Part of #536 : tests for opening swatch libraries from every menu

Window > Swatch Libraries (in a window short enough that the Window menu scrolls), the Mac menu bar's item, the Swatches panel's Swatch Libraries Menu button, every built-in library and a library with no document open all open and show the library panel. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 00:32:17 +07:00
819 changed files with 8598 additions and 176467 deletions
@@ -1,37 +0,0 @@
-name: Affinity 3 corpus
-
-on:
-  push:
-    branches: [main]
-    paths: ["crates/**", "xtask/**", "Cargo.toml", "Cargo.lock", ".github/workflows/affinity-corpus.yml"]
-  pull_request:
-    paths: ["crates/**", "xtask/**", "Cargo.toml", "Cargo.lock", ".github/workflows/affinity-corpus.yml"]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: affinity-corpus-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  affinity3:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    env:
-      AFFINITY_CORPUS_REQUIRED: "1"
-      CARGO_PROFILE_DEV_DEBUG: "0"
-      CARGO_PROFILE_TEST_DEBUG: "0"
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
-        with:
-          toolchain: "1.95"
-      - name: Fetch pinned and checksum-verified corpus
-        run: cargo xtask corpus --affinity
-      - name: Parse every file and freeze actual Affinity 3 feature retention
-        run: cargo test -p vectorcraft-affinity --all-features -- --nocapture
-      - name: Check every artboard, native save, SVG, PDF and PSD exports
-        run: cargo test -p vectorcraft-engine --test affinity_artboards --test affinity_text --test affinity_corpus -- --nocapture
@@ -29,16 +29,16 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 300
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v4
      # The optional craft-fonts build input (Japanese fonts), so the tests that need it run here
      # rather than skip. Pinned; bump deliberately (craftrules standards/fonts.md).
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
          path: craft-fonts
      - name: Build and test in a FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
        with:
          release: "14.3"
          usesh: true
@@ -67,16 +67,16 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 150
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
+      - uses: actions/checkout@v4
+      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
      # Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
          path: craft-fonts
      - name: Package in a FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
        with:
          release: "14.3"
          usesh: true
@@ -97,7 +97,7 @@ jobs:
            for want in '/bin/vectorcraft$' '/bin/vectorcraft-cli$' '/share/applications/.*\.desktop$' '/share/icons/hicolor/' '/share/doc/vectorcraft/NOTICE$' '/share/doc/vectorcraft/OFL-.*\.txt$'; do
              grep -Eq "$want" /var/tmp/contents.txt || { echo "missing from the package: $want"; exit 1; }
            done
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v4
        with:
          name: freebsd-package
          path: dist/release/*
@@ -23,7 +23,7 @@ jobs:
    env:
      ACTIONLINT_VERSION: 1.7.12
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v4
      - name: Install tools
        run: |
          sudo apt-get update
@@ -46,7 +46,7 @@ jobs:
          }
      - name: XML, desktop entry, AppStream, Flatpak manifest
        run: |
-          xmllint --noout packaging/windows/vectorcraft.wxs packaging/windows/vectorcraft.en-us.wxl packaging/macos/*.plist* packaging/linux/*.xml*
+          xmllint --noout packaging/windows/vectorcraft.wxs packaging/macos/*.plist* packaging/linux/*.xml*
          # Windows Installer needs Icon ids ending in .ico or .exe, or shortcuts show a blank icon.
          if grep -oE '<Icon Id="[^"]*"' packaging/windows/vectorcraft.wxs | grep -vE '\.(ico|exe)"$'; then
            echo "::error::Icon Id must end in .ico or .exe"; exit 1
@@ -1,35 +0,0 @@
-name: Desktop printing
-on:
-  pull_request:
-    paths:
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "apps/vectorcraft/Cargo.toml"
-      - "apps/vectorcraft/src/printing.rs"
-      - "apps/vectorcraft/src/printing/**"
-      - "crates/ui-egui/src/print.rs"
-      - "crates/ui-egui/src/tests_printps.rs"
-      - ".github/workflows/print.yml"
-  workflow_dispatch:
-permissions:
-  contents: read
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
-jobs:
-  windows:
-    runs-on: windows-2022
-    timeout-minutes: 90
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master
-        with:
-          toolchain: stable
-          components: clippy
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          key: desktop-print
-      - run: cargo clippy --locked -p vectorcraft --all-targets -- -D warnings
-      - run: cargo test --locked -p vectorcraft
-      - name: Check pending submission and queue refusal feedback
-        run: cargo test --locked -p vectorcraft-ui-egui tests_printps
@@ -43,7 +43,7 @@ jobs:
      date: ${{ steps.v.outputs.date }}
      prerelease: ${{ steps.v.outputs.prerelease }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v4
      - id: v
        name: Resolve version
        run: |
@@ -71,18 +71,18 @@ jobs:
      VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
+      - uses: actions/checkout@v4
+      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
+      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin, x86_64-apple-darwin
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@v2
        with:
          key: release-macos-universal
      - name: Apply version override
@@ -102,7 +102,7 @@ jobs:
          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
          CRAFT_FONTS_REQUIRED: "1"
        run: packaging/macos/package.sh --arch universal
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v4
        with:
          name: release-macos
          path: dist/release/*
@@ -130,18 +130,18 @@ jobs:
      VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
+      - uses: actions/checkout@v4
+      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
+      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@v2
        with:
          key: release-windows-${{ matrix.arch }}
      - name: Apply version override
@@ -150,9 +150,7 @@ jobs:
        run: cargo xtask version set "$VECTORCRAFT_VERSION"
      - name: Install WiX
        shell: pwsh
-        run: |
-          dotnet tool install --global wix --version 5.0.2
-          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
+        run: dotnet tool install --global wix --version 5.0.2
      - name: Build, sign, package
        shell: pwsh
        env:
@@ -167,7 +165,7 @@ jobs:
          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
          CRAFT_FONTS_REQUIRED: "1"
        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v4
        with:
          name: release-windows-${{ matrix.arch }}
          path: dist/release/*
@@ -191,13 +189,13 @@ jobs:
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
      NFPM_VERSION: 2.47.0
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
+      - uses: actions/checkout@v4
+      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
          path: craft-fonts
      - name: Install build and packaging tools
        run: |
@@ -208,8 +206,8 @@ jobs:
          curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
          sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
-      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
        with:
          key: release-linux-${{ matrix.arch }}
      - name: Apply version override
@@ -236,7 +234,7 @@ jobs:
              | grep -F "gh-releases-zsync|${GITHUB_REPOSITORY%%/*}|${GITHUB_REPOSITORY#*/}|latest|vectorcraft-*-linux-${{ matrix.arch }}.AppImage.zsync"
            test -s "$appimage.zsync"
          done
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v4
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist/release/*
@@ -259,8 +257,8 @@ jobs:
      VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist/linux
@@ -274,7 +272,7 @@ jobs:
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
      - name: Build the Flatpak bundle
        run: packaging/linux/flatpak-bundle.sh "dist/linux/vectorcraft-$VECTORCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v4
        with:
          name: release-flatpak-${{ matrix.arch }}
          path: dist/release/*.flatpak
@@ -292,22 +290,22 @@ jobs:
      VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
+      - uses: actions/checkout@v4
+      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
      # Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
+      - uses: dtolnay/rust-toolchain@stable
        if: inputs.version != ''
      - name: Apply version override
        if: inputs.version != ''
        run: cargo xtask version set "$VECTORCRAFT_VERSION"
      - name: Build and package in a FreeBSD VM
        # v1.5.9, pinned by commit.
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
        with:
          release: "14.3"
          usesh: true
@@ -328,7 +326,7 @@ jobs:
            bash packaging/freebsd/package.sh
            tar -tzf dist/release/vectorcraft-*-freebsd-x86_64.tar.gz \
              | grep -E '/bin/vectorcraft$|/bin/vectorcraft-cli$|/share/applications/ai\.storyteller\.vectorcraft\.desktop$'
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v4
        with:
          name: release-freebsd
          path: dist/release/*
@@ -344,18 +342,18 @@ jobs:
      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
      TRUNK_VERSION: 0.21.14
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
+      - uses: actions/checkout@v4
+      # Japanese UI/document fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
+      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@v2
        with:
          key: release-web
      - name: Install trunk
@@ -371,97 +369,17 @@ jobs:
          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
          CRAFT_FONTS_REQUIRED: "1"
        run: packaging/web/package.sh
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v4
        with:
          name: release-web
          path: dist/release/*
          if-no-files-found: error

-  linux-riscv64:
-    name: Linux riscv64
-    needs: version
-    # Cross-compiled on x86_64 (no hosted RISC-V runners) against the runner's own Ubuntu release
-    # from ports.ubuntu.com, so the binaries need that release's glibc (24.04: 2.39). 22.04's
-    # riscv64 ports lag its amd64 updates, which breaks the multiarch install. tar.gz only; the
-    # CLI is smoke-tested under QEMU (package.sh runs `vectorcraft-cli --version` through $EMULATOR).
-    runs-on: ubuntu-24.04
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    env:
-      VECTORCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      VECTORCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR on the build
-      # step). Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
-        with:
-          targets: riscv64gc-unknown-linux-gnu
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          key: release-linux-riscv64
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo xtask version set "$VECTORCRAFT_VERSION"
-      - name: Install cross-compilation dependencies
-        run: |
-          . /etc/os-release
-          sudo dpkg --add-architecture riscv64
-          # Pin the existing (archive.ubuntu.com) sources to amd64; riscv64 comes from ports.
-          if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
-            sudo sed -i '/^Types: deb/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
-          fi
-          if [ -f /etc/apt/sources.list ]; then
-            sudo sed -i 's/^deb /deb [arch=amd64] /g' /etc/apt/sources.list
-            sudo sed -i 's/^deb-src /deb-src [arch=amd64] /g' /etc/apt/sources.list
-          fi
-          for suite in "$VERSION_CODENAME" "$VERSION_CODENAME-updates" "$VERSION_CODENAME-security"; do
-            echo "deb [arch=riscv64] http://ports.ubuntu.com/ubuntu-ports $suite main universe restricted multiverse"
-          done | sudo tee /etc/apt/sources.list.d/riscv64.list
-          sudo apt-get update
-          # The riscv64 variants of the linux job's -dev packages.
-          sudo apt-get install -y --no-install-recommends \
-            gcc-riscv64-linux-gnu binutils-riscv64-linux-gnu libc6-dev-riscv64-cross libc6-dev:riscv64 qemu-user \
-            libxkbcommon-dev:riscv64 libwayland-dev:riscv64 libx11-dev:riscv64 libxrandr-dev:riscv64 \
-            libxi-dev:riscv64 libgl1-mesa-dev:riscv64 \
-            desktop-file-utils appstream
-      - name: Build and package (tar.gz)
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-          CARGO_TARGET_RISCV64GC_UNKNOWN_LINUX_GNU_LINKER: riscv64-linux-gnu-gcc
-          CC_riscv64gc_unknown_linux_gnu: riscv64-linux-gnu-gcc
-          CXX_riscv64gc_unknown_linux_gnu: riscv64-linux-gnu-g++
-          AR_riscv64gc_unknown_linux_gnu: riscv64-linux-gnu-ar
-          PKG_CONFIG_SYSROOT_DIR: /
-          PKG_CONFIG_PATH: /usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
-          PKG_CONFIG_ALLOW_CROSS: "1"
-          CROSS_ARCH: riscv64
-          CROSS_TARGET: riscv64gc-unknown-linux-gnu
-          CROSS_COMPILE: riscv64-linux-gnu-
-          EMULATOR: qemu-riscv64
-          QEMU_LD_PREFIX: /usr/riscv64-linux-gnu
-        run: packaging/linux/package.sh --formats tar
-      - name: Check the package
-        run: |
-          tar -tzf dist/release/vectorcraft-*-linux-riscv64.tar.gz \
-            | grep -E '/bin/vectorcraft$|/bin/vectorcraft-cli$|/share/applications/ai\.storyteller\.vectorcraft\.desktop$'
-          file target/riscv64gc-unknown-linux-gnu/release/vectorcraft | grep -F 'RISC-V'
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: release-linux-riscv64
-          path: dist/release/*.tar.gz
-          if-no-files-found: error
-
  release:
    name: Draft GitHub Release
    # Needs the signed jobs, so a branch dry run (where the environment refuses them) never
    # drafts a release.
-    needs: [version, macos, windows, linux, linux-riscv64, flatpak, freebsd, web]
+    needs: [version, macos, windows, linux, flatpak, freebsd, web]
    runs-on: ubuntu-latest
    environment: release
    permissions:
@@ -472,7 +390,7 @@ jobs:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GH_REPO: ${{ github.repository }}
    steps:
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/download-artifact@v4
        with:
          pattern: release-*
          path: artifacts
@@ -36,24 +36,22 @@ jobs:
    runs-on: windows-latest
    timeout-minutes: 90
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
        with:
          targets: aarch64-pc-windows-msvc
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          key: windows-arm64-package
      - name: Install WiX
        shell: pwsh
-        run: |
-          dotnet tool install --global wix --version 5.0.2
-          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
+        run: dotnet tool install --global wix --version 5.0.2
      - name: Build and package (unsigned)
        shell: pwsh
        env:
          DIST: ${{ github.workspace }}\dist\arm64
        run: ./packaging/windows/package.ps1 -Arch arm64
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v4
        with:
          name: vectorcraft-windows-arm64
          path: dist/arm64/*
@@ -66,7 +64,7 @@ jobs:
    runs-on: windows-11-arm
    timeout-minutes: 30
    steps:
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/download-artifact@v4
        with:
          name: vectorcraft-windows-arm64
          path: dist
@@ -1,22 +1,11 @@
 # Experimental, unsupported Windows 7 SP1 x64 portable build (docs/windows7.md). It runs by hand and
-# weekly and for changes to the compatibility path; the weekly run shows when a dependency update starts
+# weekly, so ordinary PRs never wait on it, and the weekly run shows when a dependency update starts
 # importing a post-Windows-7 API. packaging/windows/windows7.ps1 does the work: it is the only build
 # that uses the patched vendor/windows-link. A modern Windows runner proves compilation and host
 # smoke tests only: run the checklist in docs/windows7.md on actual Windows 7 before claiming support.
 name: Windows 7 x64 compatibility

 on:
-  pull_request:
-    paths:
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "apps/vectorcraft/Cargo.toml"
-      - "apps/vectorcraft/src/printing.rs"
-      - "apps/vectorcraft/src/printing/**"
-      - "crates/ui-egui/src/print.rs"
-      - "crates/ui-egui/src/tests_printps.rs"
-      - "packaging/windows/windows7.ps1"
-      - ".github/workflows/windows7.yml"
  schedule:
    - cron: "23 5 * * 1" # weekly
  workflow_dispatch:
@@ -33,11 +22,11 @@ jobs:
    runs-on: windows-2022
    timeout-minutes: 90
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
        with:
          arch: x64
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master
+      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # master
        with:
          toolchain: nightly-2026-10-01
          components: rust-src
@@ -47,7 +36,7 @@ jobs:
      - name: Build, check and test the portable package
        shell: pwsh
        run: ./packaging/windows/windows7.ps1 -Test
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: vectorcraft-windows7-x64-portable
          path: dist/release/vectorcraft-windows7-x64-portable.zip
@@ -5,7 +5,7 @@ VectorCraft is a clean-room, open-source, Rust-native vector illustration app ta
 Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format": "drawcraft"` headers still open (`vectorcraft_format::LEGACY_EXTENSION`), and preferences migrate from the old config folder. Keep those paths working; use the new name everywhere else.

 ## Start every session here
-1. Read [`ROADMAP.md`](ROADMAP.md) (stage, numbers by dimension, what's next) and the ranked work list in [`docs/gaps.md`](docs/gaps.md). Unless the user gives you a task, pick work from that list.
+1. Read the [honest assessment in `ROADMAP.md`](ROADMAP.md#honest-assessment-2026-10-05): where we stand by dimension, **where we're lacking** (the prioritized gap list) and **where we're going**. Unless the user gives you a task, pick work from that list.
 2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: public documentation only (see Clean-room below); `plan/illustrator/*.md` holds notes from it.
 3. Follow the autonomous operation protocol (`plan/execution-plan.md` §7): orient → plan → implement + test → verify → record → commit. Don't stop to ask unless §7 lists the decision as the user's.

@@ -56,15 +56,10 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 - Shell gotcha: `mv`/`cp` are aliased interactive here — use `/bin/mv -f` / `/bin/cp -f`.
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; write manifests atomically. Each target dir grows to ~30 GB: delete yours when you finish (a full disk fails links with `errno=28`).

-## Roadmap and progress docs
-The progress docs follow craftrules' [`standards/progress-docs.md`](https://github.com/storytold/craftrules/blob/main/standards/progress-docs.md):
- [`ROADMAP.md`](ROADMAP.md): stage, headline numbers, dimensions, features, languages, upcoming, progress log.
- [`docs/target-app-parity.md`](docs/target-app-parity.md): the authoritative parity assessment (area table, methodology, calibration, evidence of what ships).
- [`docs/gaps.md`](docs/gaps.md): every known shortfall, ranked; the work list. [`docs/roadmap.md`](docs/roadmap.md): milestones and current focus.
- Checklists: [`ui-parity.md`](docs/ui-parity.md), [`file-format-parity.md`](docs/file-format-parity.md), [`hardware-parity.md`](docs/hardware-parity.md), [`localization-parity.md`](docs/localization-parity.md), [`effects-parity.md`](docs/effects-parity.md), [`type-parity.md`](docs/type-parity.md); [`architecture.md`](docs/architecture.md).
-
-When a task lands, update in the same PR: the area row in `docs/target-app-parity.md` (score, missing items, hours) and its evidence list, the gap entry in `docs/gaps.md` if it closed or shrank, the checklist it belongs to, the milestone row in `docs/roadmap.md`, and the ROADMAP's tables and progress log when a headline number moves. Update each touched doc's status line and revision history.
- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low; mark each number measured or estimated.
+## Roadmap
+`ROADMAP.md` (committed) is the shared picture of where VectorCraft stands. It holds status, the honest assessment (by dimension, the gap list, the direction), milestones, the parity table and time-to-parity estimates.
+- When a task lands, update it in the same PR: the milestone row, the parity-table row (score, missing items, hours), "Shipped so far", and the gap list if the gap closed or shrank.
+- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low.
 - Keep the README's Status section in step with the ROADMAP headline.

 ## Contributor credits (About window)
@@ -83,7 +83,6 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/icons/copy.svg` | Lucide Icons and Contributors | https://lucide.dev (lucide-static v1.49.0; header kept in file) | ISC (`assets/icons/LICENSE-lucide.txt`) |  |
 | `assets/icons/dc-actions.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-al-bottom.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
-| `assets/icons/dc-al-center.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-al-hcenter.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-al-left.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-al-right.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
@@ -99,7 +98,6 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/icons/dc-arc.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-arrow-down.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-arrow-extend.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
-| `assets/icons/dc-arrow-fill.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 | The Selection and Direct Selection arrows' fill, painted black or white under their outline |
 | `assets/icons/dc-arrow-tip.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-arrow-up.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-artboard-options.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
@@ -5,7 +5,7 @@ VectorCraft is a clean-room, open-source, Rust-native vector illustration app ta
 Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format": "drawcraft"` headers still open (`vectorcraft_format::LEGACY_EXTENSION`), and preferences migrate from the old config folder. Keep those paths working; use the new name everywhere else.

 ## Start every session here
-1. Read [`ROADMAP.md`](ROADMAP.md) (stage, numbers by dimension, what's next) and the ranked work list in [`docs/gaps.md`](docs/gaps.md). Unless the user gives you a task, pick work from that list.
+1. Read the [honest assessment in `ROADMAP.md`](ROADMAP.md#honest-assessment-2026-10-05): where we stand by dimension, **where we're lacking** (the prioritized gap list) and **where we're going**. Unless the user gives you a task, pick work from that list.
 2. Read `plan/STATUS.md` (local session notes, may lag the ROADMAP), then the task in `plan/execution-plan.md` §3 and the relevant `plan/architecture.md` section. Behaviour reference: public documentation only (see Clean-room below); `plan/illustrator/*.md` holds notes from it.
 3. Follow the autonomous operation protocol (`plan/execution-plan.md` §7): orient → plan → implement + test → verify → record → commit. Don't stop to ask unless §7 lists the decision as the user's.

@@ -56,13 +56,8 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
 - Shell gotcha: `mv`/`cp` are aliased interactive here — use `/bin/mv -f` / `/bin/cp -f`.
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; write manifests atomically. Each target dir grows to ~30 GB: delete yours when you finish (a full disk fails links with `errno=28`).

-## Roadmap and progress docs
-The progress docs follow craftrules' [`standards/progress-docs.md`](https://github.com/storytold/craftrules/blob/main/standards/progress-docs.md):
- [`ROADMAP.md`](ROADMAP.md): stage, headline numbers, dimensions, features, languages, upcoming, progress log.
- [`docs/target-app-parity.md`](docs/target-app-parity.md): the authoritative parity assessment (area table, methodology, calibration, evidence of what ships).
- [`docs/gaps.md`](docs/gaps.md): every known shortfall, ranked; the work list. [`docs/roadmap.md`](docs/roadmap.md): milestones and current focus.
- Checklists: [`ui-parity.md`](docs/ui-parity.md), [`file-format-parity.md`](docs/file-format-parity.md), [`hardware-parity.md`](docs/hardware-parity.md), [`localization-parity.md`](docs/localization-parity.md), [`effects-parity.md`](docs/effects-parity.md), [`type-parity.md`](docs/type-parity.md); [`architecture.md`](docs/architecture.md).
-
-When a task lands, update in the same PR: the area row in `docs/target-app-parity.md` (score, missing items, hours) and its evidence list, the gap entry in `docs/gaps.md` if it closed or shrank, the checklist it belongs to, the milestone row in `docs/roadmap.md`, and the ROADMAP's tables and progress log when a headline number moves. Update each touched doc's status line and revision history.
- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low; mark each number measured or estimated.
+## Roadmap
+`ROADMAP.md` (committed) is the shared picture of where VectorCraft stands. It holds status, the honest assessment (by dimension, the gap list, the direction), milestones, the parity table and time-to-parity estimates.
+- When a task lands, update it in the same PR: the milestone row, the parity-table row (score, missing items, hours), "Shipped so far", and the gap list if the gap closed or shrank.
+- Grade by behaviour against the public documentation (`plan/illustrator/` notes), not by whether a menu item exists. Scores are self-assessed, so err low.
 - Keep the README's Status section in step with the ROADMAP headline.
@@ -200,12 +200,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "anyhow"
-version = "1.0.104"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
-
 [[package]]
 name = "arboard"
 version = "3.6.1"
@@ -719,16 +713,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"

-[[package]]
-name = "colored"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "117725a109d387c937a1533ce01b450cbde6b88abceea8473c4d7a85853cda3c"
-dependencies = [
- "lazy_static",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "combine"
 version = "4.6.8"
@@ -806,23 +790,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "craft-print"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=d991bf6792f8ade99c51358bf3c1d902c8cd96b5#d991bf6792f8ade99c51358bf3c1d902c8cd96b5"
-dependencies = [
- "tempfile",
-]
-
-[[package]]
-name = "craft-ui"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=5c874d51eeb3de70e735c8ce87a59a7dedd47675#5c874d51eeb3de70e735c8ce87a59a7dedd47675"
-dependencies = [
- "egui",
- "serde",
-]
-
 [[package]]
 name = "crc32fast"
 version = "1.5.2"
@@ -894,19 +861,6 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be1e0bca6c3637f992fc1cc7cbc52a78c1ef6db076dbf1059c4323d6a2048376"

-[[package]]
-name = "dify"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ce0fb972943b4e88cd03b8f92953df0c71bb05e0bde8e5b684895d808013cc"
-dependencies = [
- "anyhow",
- "colored",
- "getopts",
- "image",
- "rayon",
-]
-
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -1112,27 +1066,6 @@ dependencies = [
 "winit",
 ]

-[[package]]
-name = "egui_kittest"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb3f3effb2726fee23449293e67acbf6cc6ce35525b1722bd5743bb348114d5"
-dependencies = [
- "dify",
- "eframe",
- "egui",
- "egui-wgpu",
- "image",
- "kittest",
- "log",
- "open",
- "pollster 1.0.1",
- "serde",
- "tempfile",
- "toml",
- "wgpu",
-]
-
 [[package]]
 name = "either"
 version = "1.18.0"
@@ -1505,15 +1438,6 @@ dependencies = [
 "windows-link",
 ]

-[[package]]
-name = "getopts"
-version = "0.2.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
-dependencies = [
- "unicode-width",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.3.4"
@@ -1868,32 +1792,11 @@ checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
 "displaydoc",
 "litemap",
- "serde",
 "tinystr",
 "writeable",
 "zerovec",
 ]

-[[package]]
-name = "icu_locale_fallback"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
-dependencies = [
- "icu_locale_core",
- "icu_locale_fallback_data",
- "icu_provider",
- "potential_utf",
- "tinystr",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_fallback_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
-
 [[package]]
 name = "icu_normalizer"
 version = "2.3.0"
@@ -1943,8 +1846,6 @@ checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
 "displaydoc",
 "icu_locale_core",
- "serde",
- "stable_deref_trait",
 "writeable",
 "yoke",
 "zerofrom",
@@ -1952,29 +1853,6 @@ dependencies = [
 "zerovec",
 ]

-[[package]]
-name = "icu_segmenter"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82d07aafccd67af15d02512a6adf5896fbc5ed00f2e99b471d2efa14016db3db"
-dependencies = [
- "core_maths",
- "icu_collections",
- "icu_locale_fallback",
- "icu_provider",
- "icu_segmenter_data",
- "potential_utf",
- "smallvec",
- "utf8_iter",
- "zerovec",
-]
-
-[[package]]
-name = "icu_segmenter_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae293c039020f9ec10710af98d29ce6aa2051486638b49c9a6409f3b4a9e98ad"
-
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -2062,25 +1940,6 @@ dependencies = [
 "generic-array",
 ]

-[[package]]
-name = "is-docker"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "928bae27f42bc99b60d9ac7334e3a21d10ad8f1835a4e12ec3ec0464765ed1b3"
-dependencies = [
- "once_cell",
-]
-
-[[package]]
-name = "is-wsl"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "173609498df190136aa7dea1a91db051746d339e18476eed5ca40521f02d7aa5"
-dependencies = [
- "is-docker",
- "once_cell",
-]
-
 [[package]]
 name = "itertools"
 version = "0.15.0"
@@ -2208,16 +2067,6 @@ version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"

-[[package]]
-name = "kittest"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ceaa75eb0036a32b6b9833962eb18137449e9817e2e586006471925b727fd5"
-dependencies = [
- "accesskit",
- "accesskit_consumer 0.35.0",
-]
-
 [[package]]
 name = "krilla"
 version = "0.8.2"
@@ -2270,12 +2119,6 @@ dependencies = [
 "smallvec",
 ]

-[[package]]
-name = "lazy_static"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
-
 [[package]]
 name = "leb128fmt"
 version = "0.1.0"
@@ -2324,9 +2167,9 @@ checksum = "d4a5ff6bcca6c4867b1c4fd4ef63e4db7436ef363e0ad7531d1558856bae64f4"

 [[package]]
 name = "linesweeper"
-version = "0.5.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a25df1b0c5432893f41bba817150e323703ee5f6d974f3a6808ac7fd7f046d18"
+checksum = "9c19728333c060c6569a53c9a0e56c4be0df52cb4e6e07a8fbe16084cecce769"
 dependencies = [
 "arrayvec",
 "kurbo 0.13.1",
@@ -2710,15 +2553,6 @@ dependencies = [
 "objc2-foundation 0.2.2",
 ]

-[[package]]
-name = "objc2-core-text"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
-dependencies = [
- "objc2-core-foundation",
-]
-
 [[package]]
 name = "objc2-encode"
 version = "4.1.0"
@@ -2897,16 +2731,6 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"

-[[package]]
-name = "open"
-version = "5.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa576c76302b7b808eecc68061e67336c47833ef9d22caa74dda10fa9675eebc"
-dependencies = [
- "is-wsl",
- "libc",
-]
-
 [[package]]
 name = "orbclient"
 version = "0.3.55"
@@ -3206,8 +3030,6 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
- "serde_core",
- "writeable",
 "zerovec",
 ]

@@ -3638,15 +3460,6 @@ dependencies = [
 "unicode-script",
 ]

-[[package]]
-name = "ruzstd"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a252f5e20f038fe7b4ea53e073e65398d652c864cc162fc77c56c2f13717b888"
-dependencies = [
- "twox-hash",
-]
-
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -4189,7 +4002,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
 "displaydoc",
- "serde_core",
 "zerovec",
 ]

@@ -4311,12 +4123,6 @@ dependencies = [
 "core_maths",
 ]

-[[package]]
-name = "twox-hash"
-version = "2.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
-
 [[package]]
 name = "type-map"
 version = "0.5.1"
@@ -4490,12 +4296,11 @@ dependencies = [

 [[package]]
 name = "vectorcraft"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "arboard",
 "block2 0.6.2",
 "clipboard-win",
- "craft-print",
 "eframe",
 "egui",
 "image",
@@ -4503,39 +4308,19 @@ dependencies = [
 "muda",
 "objc2 0.6.4",
 "objc2-app-kit 0.3.2",
- "objc2-core-foundation",
- "objc2-core-text",
 "objc2-foundation 0.3.2",
- "pollster 1.0.1",
- "raw-window-handle",
 "rfd",
 "serde_json",
 "vectorcraft-engine",
- "vectorcraft-text",
 "vectorcraft-ui-egui",
- "wayland-client",
- "wayland-protocols",
 "webbrowser",
- "windows",
 "winit",
 "winresource",
- "winsafe",
-]
-
-[[package]]
-name = "vectorcraft-affinity"
-version = "0.10.0"
-dependencies = [
- "crc32fast",
- "flate2",
- "image",
- "proptest",
- "ruzstd",
 ]

 [[package]]
 name = "vectorcraft-brush"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "kurbo 0.13.1",
 "serde",
@@ -4547,7 +4332,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-cad"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "image",
 "kurbo 0.13.1",
@@ -4563,11 +4348,8 @@ dependencies = [

 [[package]]
 name = "vectorcraft-cli"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
- "log",
- "objc2-core-foundation",
- "objc2-core-text",
 "serde_json",
 "vectorcraft-color",
 "vectorcraft-doc",
@@ -4578,14 +4360,11 @@ dependencies = [
 "vectorcraft-render",
 "vectorcraft-svg",
 "vectorcraft-testkit",
- "vectorcraft-text",
- "windows",
- "winsafe",
 ]

 [[package]]
 name = "vectorcraft-color"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "kurbo 0.13.1",
 "moxcms",
@@ -4597,7 +4376,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-doc"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "image",
 "jpeg-encoder",
@@ -4614,7 +4393,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-effects"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "kurbo 0.13.1",
 "serde_json",
@@ -4624,24 +4403,20 @@ dependencies = [
 "vectorcraft-pathops",
 "vectorcraft-plugins",
 "vectorcraft-text",
- "vectorcraft-three-d",
 ]

 [[package]]
 name = "vectorcraft-engine"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
- "crc32fast",
 "flate2",
 "image",
 "kurbo 0.13.1",
 "log",
 "proptest",
- "ruzstd",
 "serde",
 "serde_json",
 "thiserror 2.0.21",
- "vectorcraft-affinity",
 "vectorcraft-brush",
 "vectorcraft-cad",
 "vectorcraft-color",
@@ -4664,20 +4439,17 @@ dependencies = [

 [[package]]
 name = "vectorcraft-eps"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "flate2",
 "image",
 "kurbo 0.13.1",
- "ruzstd",
- "serde_json",
 "vectorcraft-brush",
 "vectorcraft-color",
 "vectorcraft-doc",
 "vectorcraft-effects",
 "vectorcraft-geom",
 "vectorcraft-metafile",
- "vectorcraft-pdf",
 "vectorcraft-render",
 "vectorcraft-testkit",
 "vectorcraft-text",
@@ -4685,7 +4457,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-format"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "flate2",
 "proptest",
@@ -4699,7 +4471,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-geom"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "kurbo 0.13.1",
 "proptest",
@@ -4711,7 +4483,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-mcp"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "image",
 "log",
@@ -4730,7 +4502,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-metafile"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "image",
 "kurbo 0.13.1",
@@ -4744,7 +4516,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-pathops"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "kurbo 0.13.1",
 "linesweeper",
@@ -4756,7 +4528,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-pdf"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "aes",
 "flate2",
@@ -4785,7 +4557,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-plugins"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "serde",
 "serde_json",
@@ -4799,7 +4571,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-render"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "flate2",
 "gif",
@@ -4824,7 +4596,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-svg"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "flate2",
 "image",
@@ -4848,7 +4620,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-testkit"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "image",
 "kurbo 0.13.1",
@@ -4865,10 +4637,9 @@ dependencies = [

 [[package]]
 name = "vectorcraft-text"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "harfrust 0.13.3",
- "icu_segmenter",
 "kurbo 0.13.1",
 "log",
 "skrifa 0.47.0",
@@ -4876,24 +4647,15 @@ dependencies = [
 "unicode-bidi",
 "unicode-general-category",
 "unicode-script",
- "unicode-segmentation",
 "vectorcraft-doc",
 "vectorcraft-geom",
 "windows-registry",
 "write-fonts",
 ]

-[[package]]
-name = "vectorcraft-three-d"
-version = "0.10.0"
-dependencies = [
- "vectorcraft-geom",
- "vectorcraft-pathops",
-]
-
 [[package]]
 name = "vectorcraft-tools"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "image",
 "kurbo 0.13.1",
@@ -4908,7 +4670,7 @@ dependencies = [

 [[package]]
 name = "vectorcraft-trace"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "image",
 "kurbo 0.13.1",
@@ -4921,18 +4683,15 @@ dependencies = [

 [[package]]
 name = "vectorcraft-ui-egui"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
- "craft-ui",
 "egui",
 "egui_extras",
- "egui_kittest",
 "image",
 "log",
 "serde",
 "serde_json",
 "toml",
- "vectorcraft-brush",
 "vectorcraft-cad",
 "vectorcraft-color",
 "vectorcraft-doc",
@@ -4947,14 +4706,13 @@ dependencies = [
 "vectorcraft-svg",
 "vectorcraft-testkit",
 "vectorcraft-text",
- "vectorcraft-three-d",
 "vectorcraft-tools",
 "wat",
 ]

 [[package]]
 name = "vectorcraft-web"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "eframe",
 "egui",
@@ -4963,7 +4721,6 @@ dependencies = [
 "rfd",
 "vectorcraft-engine",
 "vectorcraft-format",
- "vectorcraft-text",
 "vectorcraft-ui-egui",
 "wasm-bindgen",
 "wasm-bindgen-futures",
@@ -5938,12 +5695,6 @@ dependencies = [
 "version_check",
 ]

-[[package]]
-name = "winsafe"
-version = "0.0.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ef0ffc427f045c0cc9ebffd6f4f91153dcd2a1547b5c3c29ee3f541e16e95c6"
-
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
@@ -6064,7 +5815,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.10.0"
+version = "0.6.0"
 dependencies = [
 "serde_json",
 ]
@@ -6248,7 +5999,6 @@ dependencies = [
 "displaydoc",
 "yoke",
 "zerofrom",
- "zerovec",
 ]

 [[package]]
@@ -6257,7 +6007,6 @@ version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
- "serde",
 "yoke",
 "zerofrom",
 "zerovec-derive",
@@ -4,15 +4,13 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/vectorcraft", "apps/vectorcraft-cli", "xtask"]

 [workspace.package]
-version = "0.10.0"
+version = "0.6.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
 repository = "https://github.com/storytold/vectorcraft"

 [workspace.dependencies]
-craft-print = { git = "https://github.com/storytold/craft-libs", rev = "d991bf6792f8ade99c51358bf3c1d902c8cd96b5" }
-craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
 # internal
 vectorcraft-geom = { path = "crates/geom" }
 vectorcraft-color = { path = "crates/color" }
@@ -22,7 +20,6 @@ vectorcraft-brush = { path = "crates/brush" }
 vectorcraft-trace = { path = "crates/trace" }
 vectorcraft-text = { path = "crates/text" }
 vectorcraft-effects = { path = "crates/effects" }
-vectorcraft-three-d = { path = "crates/three-d" }
 vectorcraft-render = { path = "crates/render" }
 vectorcraft-svg = { path = "crates/svg" }
 vectorcraft-pdf = { path = "crates/pdf" }
@@ -36,7 +33,6 @@ vectorcraft-cad = { path = "crates/cad" }
 vectorcraft-eps = { path = "crates/eps" }
 vectorcraft-metafile = { path = "crates/metafile" }
 vectorcraft-plugins = { path = "crates/plugins" }
-vectorcraft-affinity = { path = "crates/affinity" }

 # foundation
 kurbo = { version = "0.13", features = ["serde"] }
@@ -46,7 +42,6 @@ serde = { version = "1", features = ["derive", "rc"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
 proptest = "1"
-crc32fast = "1.5"
 # tests: a TCP port bound without listening (connections to it are refused)
 socket2 = "0.6"
 # Sandboxed WebAssembly plug-ins: a pure-Rust interpreter (MIT OR Apache-2.0) that builds for wasm32
@@ -57,16 +52,14 @@ wasmi = { version = "2.0.0", default-features = false, features = ["std", "valid
 wat = "1.228"

 # rendering / formats
-vello_cpu = { version = "0.2", features = ["f32_pipeline"] }
+vello_cpu = "0.2"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
 usvg = "0.48"
 krilla = "0.8"
 skrifa = "0.47"
 harfrust = "0.13"
-linesweeper = "0.5"
+linesweeper = "0.4"
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
-# Zstandard decoder (pure Rust, builds for wasm32 too): the editing copy an EPS carries of its art.
-ruzstd = { version = "0.9", default-features = false, features = ["std"] }
 jpeg-encoder = { version = "0.6", default-features = false, features = ["std"] }
 gif = { version = "0.14", default-features = false, features = ["std", "raii_no_panic"] }
 # CMYK image samples (vectorcraft-doc's cmyk module): the image crate's own TIFF and JPEG
@@ -148,9 +148,6 @@ exposes to agents, and exported by VectorCraft's own renderer. The source files
 ## Quick start

 ```sh
-git clone https://github.com/storytold/vectorcraft
-cd vectorcraft
-
 cargo run --release -p vectorcraft                          # desktop app
 cargo run --release -p vectorcraft -- examples/dusk-poster.vectorcraft
 cargo run --release -p vectorcraft -- --control 7979        # + JSON control channel
@@ -172,14 +169,8 @@ Graphics Processor** and restart. If a graphics processor can't show the window,
 next one. To pick one when starting the app, set `WGPU_POWER_PREF=high` (or `low`), or `WGPU_ADAPTER_NAME` to part of
 its name, such as `WGPU_ADAPTER_NAME=nvidia` (see [`docs/development.md`](docs/development.md#desktop-graphics-processor)).

-On native Wayland, winit 0.30 does not deliver dropped files. To open an SVG, use File › Open;
-to place artwork in the current document, copy and paste the file in a file manager. For file
-drag-and-drop, set **Preferences › Performance › Linux Display Server** to **X11 (XWayland)** and restart, or start
-the app with `WAYLAND_DISPLAY= vectorcraft`: the window then opens through XWayland, where drops work
-(see [`docs/development.md`](docs/development.md#linux-wayland-and-x11)).
-
 On Linux under KDE Plasma 6.3 or later with Wayland, a drawing tablet's pen moves the cursor but VectorCraft doesn't
-respond to it yet (#491). Open the window through XWayland instead, with the same preference or `WAYLAND_DISPLAY= vectorcraft` (see
+respond to it yet (#491). Start the app under XWayland instead: `WAYLAND_DISPLAY= vectorcraft` (see
 [`docs/development.md`](docs/development.md#linux-wayland-and-x11)).

 ### Use it from Claude Code and other agents
@@ -190,55 +181,36 @@ Register the MCP server with Claude Code:
 claude mcp add vectorcraft -- /path/to/vectorcraft-cli mcp
 ```

-To keep an agent to one project's files, give it folders to read and write (the same flags as PhotoCraft):
-
-```sh
-claude mcp add vectorcraft -- /path/to/vectorcraft-cli mcp --automation-read-root /work/project --automation-write-root /work/project
-```
-
 The details are in [`docs/mcp.md`](docs/mcp.md) and [`docs/control-protocol.md`](docs/control-protocol.md).

 For the experimental, unsupported 64-bit Windows 7 build, see [Windows 7 instructions](docs/windows7.md).

 ## Status

-VectorCraft is under active development. [**ROADMAP.md**](ROADMAP.md) has the stage, the numbers by dimension
-and what's next; [`docs/target-app-parity.md`](docs/target-app-parity.md) the full parity assessment and
-[`docs/gaps.md`](docs/gaps.md) the ranked list of what's missing.
+VectorCraft is under active development. [**ROADMAP.md**](ROADMAP.md) covers what ships today, the
+milestones, and honest time-to-parity estimates.

-**Where we are (2026-10-10): alpha.** About 88% of Illustrator 2026's menu items, tools, effects and formats exist
-(92.5% of menu items do something), feature depth is ~75%, and we estimate ~65% "ready for real work" for a mainstream illustrator (~62% against
-all of Illustrator): everyday
-vector illustration is close to usable: drawing and path tools,
+**Where we are (2026-10-07):** roughly 69–75% of Illustrator's features exist and work, and about 40–55% of
+"a power user can't tell the difference". Everyday vector illustration is close to usable: drawing and path tools,
 Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
-files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats, PSD out and PSD/PSB in as their merged image, Print, Package).
-Affinity documents (`.af` from Affinity 3, `.afdesign`, `.afpub` and, by their content, `.afphoto` from Affinity 1 and 2) open
-and place natively: layers, groups, artboards and pages, curves and shapes, fills, gradients and strokes, clipping
-and masks, text and images, with what didn't come in (effects, adjustments, brushes, master pages…) listed in the
-import warning; a file whose native data can't be read opens as its embedded preview, saying why. VectorCraft
-doesn't write Affinity files. Current `.af` validation includes 33 pinned files, native save/reload
-and every-board SVG/PDF/PSD export, with fixes for Affinity 3 artboards, source-backed JPEGs and text runs.
-[Scope and limits](crates/affinity/README.md); [source audit and remaining gaps](docs/affinity-validation.md).
-The interface
-speaks English, German, Japanese, Korean, Vietnamese, Traditional and Simplified Chinese, Spanish, French, Hungarian, Italian, Polish, Russian and Ukrainian (and Czech and Brazilian Portuguese in the menus);
-[localization-parity.md](docs/localization-parity.md) has the details.
-The scores are self-assessed from our code against Illustrator's public documentation;
-[target-app-parity.md](docs/target-app-parity.md#how-this-was-measured-2026-10-10) explains how far to trust them.
+files (SVG, PDF and PDF-compatible `.ai` with PDF/X, EPS, DXF, EMF/WMF, raster formats and PSD, Print, Package). The interface
+speaks English, Japanese, Traditional and Simplified Chinese, Spanish and Italian (and Czech and Brazilian Portuguese in the menus).
+The scores are
+self-assessed, so the [honest assessment](ROADMAP.md#honest-assessment-2026-10-05) explains how far to trust them.

 **What's missing:**
- reliable exchange of Illustrator's own `.ai` files (layer structure in real files; Illustrator's editing data isn't written);
- an interaction-fidelity pass covering every tool's modifiers and small behaviours;
- 3D and Materials beyond the initial live Revolve (Extrude & Bevel, Inflate, Rotate, materials);
- about half of the Photoshop-style raster effects (28 of 57 still missing; Film Grain is available under Artistic) and the Effect Gallery;
+- 3D and Materials;
+- the Photoshop-style raster effects (Effect Gallery);
 - CJK composition for vertical type (vertical type itself has initial support, with a Japanese interface);
- scripting, and the rest of Variables (image and graph kinds, dataset import);
- generative AI features.
+- Variables and scripting;
+- an interaction-fidelity pass covering every tool's modifiers and small behaviours;
+- packaging for Windows and Linux.

-**Where we're going:** next is the interaction-fidelity pass, `.ai` files from real users and start-up stability,
-alongside the raster-effects package; then type, the Illustrator 2026 additions and 3D. The ranked list is in
-[`docs/gaps.md`](docs/gaps.md).
+**Where we're going:** next is the interaction-fidelity pass alongside the raster-effects package, then 3D and
+advanced type, then hardening and packaging for 1.0. The prioritized list is in
+[Where we're lacking](ROADMAP.md#where-were-lacking-in-priority-order).

-**Workspace:** `crates/{geom, color, doc, pathops, text, effects, three-d, trace, brush, render, svg, pdf, eps, cad, metafile, format, tools, engine, ui-egui, mcp, testkit}`
+**Workspace:** `crates/{geom, color, doc, pathops, text, effects, trace, brush, render, svg, pdf, eps, cad, metafile, format, tools, engine, ui-egui, mcp, testkit}`
 and `apps/{vectorcraft, vectorcraft-cli, vectorcraft-web}`. The egui frontend is its own crate, so
 the UI can be swapped without touching the engine.

@@ -1,164 +1,253 @@
 # VectorCraft Roadmap

- UI.5: Shared docking adds tab reordering, docking into other groups, dock splits and resizable floating panel groups. Panel positions and return locations persist with workspaces; the native icon rail and Tools panel remain available.
+VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adobe Illustrator workflow. It runs on macOS, Windows, Linux and the web (WASM), and agents can drive it fully over a JSON control channel and MCP.

- UI.4: Dock and floating-panel headers use shared accessible tabs with bounded overflow. Widget-state theme application uses `craft-ui`; all four palettes, font stacks and preferences remain app-owned.
+This file tracks **how far we are and what's left**. Time estimates are wall-clock hours of continuous Claude Opus 5.5 agent work (including builds and the CI gate), given both for **one agent** and for **4–6 parallel agents** on disjoint crates. They are counted from the remaining work (see [Parity estimate](#parity-estimate)), calibrated against measured throughput, and updated as work lands.

-**Stage: alpha** · next: beta, ~13 points (ready for real work ~62% → ~75%, and reliable `.ai` exchange) and ~170–270 h away
+_Last updated: 2026-10-08 (after M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457), the Properties panel's Fill and Stroke matching the Control bar's, Illustrator's Window menu panel keys (Shift+F7 for Align…) and Alt-wheel zoom whatever the wheel preference (Discord feedback), the point/area type widget (Discord feedback), groups in legacy Illustrator .ai files (Discord feedback), a rotating desktop log file (#465), image controls in the Control bar and Properties panel: Image Trace with its presets, Mask, Crop Image, Embed/Unembed, and an Image Trace object's preset, Expand and Release (Discord feedback), the Pen working as the Anchor Point tool with Alt held over a selected path's handles and anchors, and anchor buttons that convert, connect and cut paths at the selected anchors (Discord feedback), Japanese hanging punctuation (burasagari, #463), Escape leaving Presentation Mode with no screen mode saved across restarts, documents dropped on the desktop app opening as tabs of their own and a note that an `.ai` file's art off its artboards isn't in the part read (#472), Add/Delete Anchor Point tool icons drawn from the Pen tool's (#479), EPS import running more of PostScript Level 3 (patterns, Type 3 fonts, mesh shadings, masked images, VM and resource probes), and a preview that stands in saying why (Discord feedback, #466, #469, #474), chords with modifiers recorded in Edit › Keyboard Shortcuts (#487), Type Object Selection by Path Only (#394), Anti-aliased Artwork (#394), Show Pixel Grid (#394), pen and touch taps pressed and lifted within one frame clicking where they tapped and the Linux/Wayland pen-tablet workaround (#491), bounding-box resizes landing on the other objects' anchors and centres with labels, and the Rotate, Scale, Shear and Reflect tools snapping their drags (#482), Shift-drag marquees that toggle the objects or anchors they reach and a Lasso whose Alt subtraction keeps the rest of the selection (#483), the mouse wheel stepping the focused numeric field, the dialogs' and preferences' drag values made such fields (#485), Show The Home Screen When No Documents Are Open (#394), Numbers Without Units Are Points (#394), Auto-Collapse Iconic Panels (#394), the Contextual Task Bar moved by its handle and its More Options menu pinning and resetting its position, a designed macOS DMG window (#493), panels, panel groups and the Tools panel undocking into flLine truncated

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (community PRs and fixes of late 2026-10-12: type that does not fit its frame is reported, #1471; Tabs panel drags, #1458; template layers in Outline view, #1486; dialog slider rails, #1483; Direct Selection anchor precedence, #1508; print-size images, #1517; French catalog complete again, #1511; headline numbers unchanged; Image Trace colour and photo presets, measured in `docs/image-trace-quality.md`, headline numbers unchanged; community PRs and fixes of 2026-10-12: Split Into Grid options, #1462; Transform Objects and Reflect across an angle, #1448 and #1460; Pathfinder on a group, #1450; unknown parameter keys refused, #1442; grayscale TIFFs with alpha, #1466 in part; many-object edits, #1429 in part; headline numbers unchanged; Image Trace places edges to a fraction of a pixel, measured in `docs/image-trace-quality.md`, headline numbers unchanged; Transform dialogs preview and the transform tools act on direct-selected anchors, #1412 and #1408; `.ai` compound path paint, #1410, overprint, #1388, and text-only PDF parts, #1387; community PRs: strokes wider than their shape, corner drags without the bounding box, pasted pictures, compound paths in `document.inspect`, MCP guide; headline numbers unchanged; community PRs: `.ai` editing-data follow-ups (gradient stops, type of objects with an appearance, short area-type frames), PDF bleed with editing data, dialog keyboard focus, art flush with an artboard, font rescan, symbol instance redraw, `--control` port check; headline numbers unchanged; Rectangular Grid and Polar Grid tool options, #1377 in part; `.ai` files with placed (linked) pictures open from their editing data, #1264; community PRs: `.ai` and PDF bleed and editing-data import, gradient shapes imported as paths, ruler origin, Align To, Live Corners corner selection; headline numbers unchanged; G2: Film Grain added; Photoshop effects 29/57; 28 filters remain; community PRs: graph designs, Graph Data worksheet and Graph Type options; Align both centres; Pen endpoint fixes; earlier: Effect › Brush Strokes landed: Photoshop-style filters 28 of 57, raster effects 40% → 48%; `.ai` gradients, meshes and artboard names from the editing data; headline numbers unchanged; `.ai` art styles and clipping fills from the editing data; headline numbers unchanged; `editingData: "always"`; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
+## Where we are

-VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adobe Illustrator workflow. It runs
-on macOS, Windows, Linux, FreeBSD and the web (WASM), and agents can drive all of it over MCP, the CLI and a JSON
-control channel. This page is the summary; the evidence is in [`docs/target-app-parity.md`](docs/target-app-parity.md)
-and the work list in [`docs/gaps.md`](docs/gaps.md).
-
-**Why alpha:** the core workflows exist end to end (drawing and path editing, Pathfinder, paint and appearance,
-type, SVG/PDF/EPS, print, export) and feature depth is ~75%, but a professional can't yet switch: Illustrator's
-own `.ai` files open with a wrong layer structure in real cases and can't be saved back with Illustrator's
-editing data, the interaction details have never been checked side by side, and some machines fail to start the
-app. Beta needs those closed (the beta list in [gaps.md](docs/gaps.md)). It passes the core-workflow
-gate: all six core workflows (path drawing and editing, paint and style, type, layers/artboards/export, print
-production, file exchange) work end to end on macOS with save and reopen, and only the last is partial, without
-blocking it ([Alpha gate](docs/roadmap.md#alpha-gate)).
-
-## Headline numbers
-
-| | Value | Kind |
-|---|---|---|
-| **Feature breadth** (Illustrator's menu items, tools, effects, formats exist) | **~88%** | measured in part: menu items 348/375 wired (92.8%), tools 89/92, Illustrator effects 44/50, Photoshop effects 29/57, 3D 4/4 (initial types, no materials) |
-| **Feature depth** (weighted by use, scored by behaviour) | **~75%** | estimated |
-| **To beta** | **~170–270 h** one agent · ~50–80 h with 4–6 agents | estimated |
-| **To full parity** | **~360–590 h** one agent · ~95–165 h with 4–6 agents | estimated |
-
-**Readiness by audience** (all estimated; method in [target-app-parity.md](docs/target-app-parity.md#ready-for-real-work)):
-
-| Audience | Ready % | Opus 5.5 agent hours to ~95% (one agent) | With 4–6 agents | Work that dominates |
-|---|---:|---:|---:|---|
-| **Full Illustrator** (ready for real work; decides the stage) | **~62%** (57–67%) | **~340–560 h** | ~95–160 h | the mainstream work below, plus 3D (50–85 h), raster effects (23–39 h), advanced type (20–28 h), generative AI (30–60 h), localization (55–90 h) and ecosystem |
-| **Mainstream illustrator** | **~65%** (60–70%) | **~230–380 h** | ~65–110 h | the interaction-fidelity pass (60–90 h), hardening and QA (30–50 h), stability (20–35 h), performance budgets (15–25 h), `.ai` exchange (10–20 h), the remaining depth of the everyday areas |
-| **Essentials user** | **~75%** (70–80%) | **~60–105 h** | ~25–45 h | launch and stability on Windows (20–35 h), in-app help and onboarding (8–15 h), basic QA (10–15 h), Shape Builder regions (4–8 h), UI polish |
-
-Hours are Opus 5.5 agent wall-clock hours, calibrated from this repo's merged-PR timestamps (e.g. 0.7–1.2 h per
-Photoshop-style filter, ~0.8 h per medium feature); see [calibration](docs/target-app-parity.md#calibration).
-The installed Illustrator was **not** inspected: the clean-room rule in [`AGENTS.md`](AGENTS.md) forbids it, so
-everything is measured from our code against Illustrator's public documentation.
-
-## By dimension
-
-| Dimension | % | One agent (h) | Doc |
-|---|---:|---:|---|
-| Features (depth) | 75% | 220–360 | [target-app-parity.md](docs/target-app-parity.md) |
-| UI/UX fidelity | 55% | 70–110 | [ui-parity.md](docs/ui-parity.md) |
-| File formats | 75% | 15–30 | [file-format-parity.md](docs/file-format-parity.md) |
-| Hardware (GPU, pen, touch, displays) | 35% | 25–45 | [hardware-parity.md](docs/hardware-parity.md) |
-| Localization (12 key languages) | 71% (measured) | 55–90 | [localization-parity.md](docs/localization-parity.md) |
-| Performance | ~60% | 15–25 | [gaps.md › G15](docs/gaps.md#g15-performance-budgets-and-a-gpu-renderer) |
-| Stability | ~60% | 30–50 | [gaps.md › G10](docs/gaps.md#g10-launch-and-stability-on-real-machines) |
-| Platforms | 80% | 15–25 | [gaps.md › G8](docs/gaps.md#g8-hardening-at-scale) |
-| Ecosystem and plug-ins | 15% | 30–60 | [gaps.md › G17](docs/gaps.md#g17-ecosystem-third-party-plug-ins) |
-| AI features (generative) | 0% | 30–60 + owner decision | [gaps.md › G18](docs/gaps.md#g18-generative-ai-features) |
-| Agent automation | beyond Illustrator | — | [mcp.md](docs/mcp.md) |
-
-The dimension hours overlap (feature rows hold some UI, format and AI work), so they don't add up to the total.
-
-## Features
-
-| Area | % | One agent (h) |
-|---|---:|---:|
-| Selection, transform & align | 85% | 4–6 |
-| Drawing tools | 85% | 8–13 |
-| Path operations, Pathfinder, Shape Builder, Live Paint | 80% | 4–8 |
-| Colour, swatches, gradients, patterns, mesh, recolor | 92% | 4–7 |
-| Strokes, brushes, width profiles | 88% | 8–15 |
-| Appearance, transparency, graphic styles, masks | 97% | 1–2 |
-| Live vector effects | 85% | 6–10 |
-| Raster effects (Effect Gallery) — [effects-parity.md](docs/effects-parity.md) | 49% | 23–39 |
-| 3D and Materials | ~25% | 30–55 |
-| Type core — [type-parity.md](docs/type-parity.md) | 80% | 14–19 |
-| Type advanced (CJK, spelling, Touch Type) | 50% | 20–28 |
-| Symbols, blends, envelopes, Repeat, perspective | 85% | 6–10 |
-| Image Trace, graphs, image tools | 75% | 5–8 |
-| Layers, artboards, document setup | 78% | 5–8 |
-| View & navigation | 70% | 9–14 |
-| Guides, grids, smart guides, snapping | 80% | 4–7 |
-| File formats — [file-format-parity.md](docs/file-format-parity.md) | 75% | 10–20 |
-| Export for Screens, Asset Export, slices | 85% | 2–4 |
-| Print, colour management, separations | 80% | 2–4 |
-| Automation (Actions, Variables, scripting) | 60% | 8–14 |
-| UI chrome (panels, Properties, preferences) | 80% | 13–20 |
-| Libraries, Links, Package | 82% | 2–3 |
-| Generative AI | 0% | 30–60 |
-
-Weights, evidence and the missing items per area: [target-app-parity.md](docs/target-app-parity.md#feature-areas).
-
-## Languages
-
-| Language | Code | Status | Translated |
-|---|---|---|---:|
-| English | `en` | full | 100% |
-| Simplified Chinese | `zh-hans` | partial (messages in English) | 85% |
-| Spanish | `es` | full | 100% |
-| Hindi | `hi` | none | 0% |
-| Arabic | `ar` | none (no right-to-left interface) | 0% |
-| French | `fr` | full | 100% |
-| Portuguese (Brazil) | `pt-br` | partial | 68% |
-| Indonesian | `id` | none | 0% |
-| Japanese | `ja` | full | 100% |
-| German | `de` | full | 98% |
-| Korean | `ko` | full | 100% |
-| Vietnamese | `vi` | full | 100% |
-
-Also shipped: Traditional Chinese (partial, 80%), Hungarian, Italian, Russian and Ukrainian (full), Czech (catalog complete; render-site gaps reduced; native review pending).
-No catalog has had a native speaker's review. Details: [localization-parity.md](docs/localization-parity.md).
-
-## Upcoming
-
-Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gaps.md).
-
-1. **Interaction-fidelity pass** (G1), tool by tool from [ui-parity.md](docs/ui-parity.md): 60–90 h.
-2. **`.ai` files from real users** (G9): layer structure, guides, speed: 10–20 h.
-3. **Launch and stability on real machines** (G10): 20–35 h.
-4. **Core-tool correctness** (G11: Shape Builder regions, Asset Export borders): 8–15 h.
-5. **Raster effects** (G2) alongside: 28 filters and the Effect Gallery, 23–39 h.
-6. **Then:** type core and advanced type (G4), the Illustrator 2026 additions (G13), 3D (G3).
-
-## Progress log
-
-| Date | What landed |
+| Dimension | Status |
 |---|---|
-| 2026-10-13 | Image Trace's colour presets trace flat art with its own colours however many are asked for (noise no longer shatters it: 16 Colors 70 → 4 paths on the harness's flat art; no slivers of in-between colour along anti-aliased edges), and the photo presets trace a photo into smooth tones without specks or hairlines (High Fidelity Photo 3,653 → 121 paths, colour error 2.30 → 1.75; 16 megapixels traced where 4 were refused) ([`docs/image-trace-quality.md`](docs/image-trace-quality.md)). |
-| 2026-10-13 | Image Trace traces anti-aliased and blurred images to a fraction of a pixel in Black and White, Grayscale and Color, with corners put back, straight edges as lines and round outlines as circles; a harness measures every preset before and after ([`docs/image-trace-quality.md`](docs/image-trace-quality.md)): outlines 0.31 → 0.09 px off on average (Default), 0.27 → 0.06 (Black and White Logo). |
-| 2026-10-13 | Effect › 3D and Materials: Inflate takes Twist, Taper and Cap (Hollow leaves the back open), as the 3D docs list for every type. |
-| 2026-10-12 | Effect › 3D and Materials: Extrude & Bevel (depth, twist, taper, solid or hollow caps, five bevel shapes with repeat, spacing, inside and both sides), Inflate (volume, both sides) and Rotate, with Position presets and the rotation and light gizmos; live, exported as vector faces, expandable (#1407). |
-| 2026-10-12 | `convert --editing-data` (`editingData: "always"`) opens a `.ai` from its editing data even where its page, which can be older, draws differently, with a note. |
-| 2026-10-12 | `.ai` import reads an object's art style (a fill and a stroke, variable widths too, with an Outer Glow or Drop Shadow) as its own appearance, paints a clipping path's own fill under what it clips and keeps a group's transparency as its PDF part draws them. |
-| 2026-10-12 | `.ai` import reads gradients with their matrix (radials and skew too), focal point and stop order, gradient meshes and the artboards' names from the editing data. |
-| 2026-10-12 | The Rectangular Grid and Polar Grid tools take their options: a click opens the size, the divider counts with a skew slider each, Use Outside Rectangle As Frame (rectangular) or Create Compound Path From Ellipses (polar) and Fill Grid; the choices stay with the tool, so dragging draws with them, and scripts and agents pass them to `shape.rectangularGrid` and `shape.polarGrid` (#1377, in part). |
-| 2026-10-12 | A `.ai` file with placed (linked) pictures opens from its editing data, with its guides, sublayers and hidden objects: each picture is a linked image in its place, showing the low-resolution preview the file keeps until its file is found or relinked (#1264). Scores unchanged. |
-| 2026-10-12 | Desktop printing adopts the shared `craft-print` spooler with exact physical sheet sizes. Windows 7 retains its WMI/viewer transport and excludes the shared backend; compatibility CI checks the dependency tree and PE imports. Scores unchanged. |
-| 2026-10-12 | Graphs: Object › Graph › Design… and Marker… (designs with a preview, New Design, Rename, Delete Design, Paste Design, Select Unused, and markers drawn with a design or None) (#1092); Graph Data opens as a worksheet with Import Data…, column width and decimals (#1138), and takes Transpose, Switch x/y, `|` line breaks in labels and the pie Legend, Position and Sort options (#1115); Graph Type adds Add Drop Shadow and Add Legend Across Top (#1119), widths past 100%, First Row and First Column in Front, and Draw Filled Lines (#1136); graphs keep their label formatting when drawn again (#1137). Align: a Horizontal & Vertical Align Center button (#1073); Align to Key Object makes the topmost selected object the key (#1221), and the palette's key entry reads Cancel Key Object (#1224). Pen: the nearest end wins over snapping, Alt on the last anchor edits it, and Enter, Escape or a tool switch finish a handle preview as one undo step (#821). Direct Selection: a click on an anchor of an already selected path selects that anchor alone (#1237). Make Compound Path keeps the backmost object's paint, and a selected member reads and changes the compound's fill rule (#1225). Shape Builder and Live Paint no longer turn a line's loose end past a crossing into a piece that runs out and back (#1230). Art moved or duplicated with an artboard follows Transform Pattern Tiles (#1219). A click with the Rectangular Grid tool opens its options dialog (#1169). Commands that change nothing (Lock, Hide, Transform Each, Rearrange Artboards and others) add no undo step (#1233). Saving with missing placed files keeps their relink data, and .ai export honours the chosen artboards (#718). SVG export keeps Unicode data-attribute names, and SVG Options refuses an invalid artboard range (#989). CMYK colours given in percent with a component under 1 keep their scale (#1249). Colour Image Trace keeps close dark tones apart (#1247). macOS: the Save sheet has a Format menu (#1235). The Hand and Zoom tools show drawn cursors on every platform (#1238). Czech: the remaining strings are translated, and Pathfinder's Add reads "Sjednotit" (#1226). MCP: a lost reply reports that the edit may have happened instead of replaying it (#1246); `select.key` checks its id and agents can read the key object (#1222). Tests: the command sweeps and import fuzz tests fail on a panic caught by the engine's guard (#1218), and the envelope export test ignores PDF dates and file IDs (#1220). Effect › Artistic › Film Grain (Grain, Highlight Area, Intensity; Photoshop-style filters 29/57) (#1282), and Craquelure, Mosaic Tiles and Stained Glass redraw 25–30% faster with identical pixels (#1265). Direct Selection: clicking a segment selects only that segment, and Delete removes just it (#1300); Shift-click deselects one anchor of a path selected whole (#1263). Pen + Alt converts anchors of paths inside a selected group or compound path (#1306). The Curvature tool shows circular point markers without direction handles (#1284). Snap to Point: pressing near an anchor drags by that anchor, with Smart Guides on or off (#1313). Transform Again repeats the options of the transform it repeats (#1303). Aligning anchors that are already aligned adds no undo step (#1276), and type commands that change nothing record none either (#1316). Simplify keeps the path selected with its new anchors, and its dialog previews and shows the anchor count (#1305). Adding a stroke colour to an unpainted zero-width stroke gives it a visible 1 pt width (#1256). The Eyedropper samples locked objects, template layers and art outside isolation mode (#1260), and shows a pipette cursor (#1288). Fonts named by their full name resolve to the right face (#1267), and Proportional Metrics brings the matching kerning (`apkn`, `vkrn`, `vapk`) (#1291). Artboards: Escape leaves Artboard editing (#1296), Document Setup's Edit Artboards switches to the Artboard tool (#1294), and the Artboard tool starts on the active artboard (#1309). New and imported documents use the Gridline every and Subdivisions preferences (#1314). Send to Current Layer refuses a hidden or locked current layer (#1301), and layer row commands check explicit ids (#1255). Links: Find in Folder… finds missing linked files in a folder and its subfolders and can copy them into the document's folder (#1287). Image Trace traces images over 64 megapixels scaled down instead of refusing them (#1315). DXF export marks closed curves as closed SPLINE entities (#1320). EPS import: closepath respects the path size limit (#1311). The interface is available in Hungarian (#1302), and more Czech labels are translated (#1259). Linux RPMs declare shared-library capabilities (#1290). CI pins every third-party action to a verified commit (#1321). Select menu commands skip hidden and locked art and stay inside the isolated group in isolation mode (#1325). Fill, stroke, gradient and Appearance panel commands that change nothing add no undLine truncated
-| 2026-10-11 | Effect › Brush Strokes: Accented Edges, Angled Strokes, Crosshatch, Dark Strokes, Ink Outlines, Spatter, Sprayed Strokes, Sumi-e (G2). Command parameters from agents and files checked before anything changes (paint, place, cuts, dashes, crop, asset ids, anchors, paths, distort; #984–#999); command dialogs keep whole numbers whole, so Create Object Mosaic takes the tiles typed (#1000); stepper arrows take Shift (×10) and Ctrl/Cmd (÷10) like the arrow keys (#991). Exports and Rasterize supersample Art Optimized edges, so shapes meeting edge to edge leave no seam (#983). Character and paragraph styles take leading, kerning, mojikumi and the other attributes left out at their defaults (#1001). Drawing, typing and pasting with no layer shown and unlocked is refused instead of adding art to a hidden or locked layer (#1002). MCP `add_text` gives type on or in a path the colour asked for (#1003). MCP `screenshot` of a connected app renders the artboard asked for (#1004). `vectorcraft-cli run` ends quietly when its reader closes early (#1005). Select › All on Active Artboard selects on the artboard made active, not always the first (#1006). Reverse Gradient keeps off-centre midpoints, mirrored (#1007). A polar grid with no radial dividers draws none (#1008). Use Precise Cursors also covers the Pen's join pointer (#1009). SVGs with one absolute and one unitless root side import at their size, unstretched (#1010). DXF US survey inches, yards and miles open at their size and name (#1011). A file placed into a document with no other links follows its first change even while the app sits idle (#1031). PDF import keeps the style a font name says when the file doesn't embed the font (#1023). Shift selects ruler guides and art together, and Delete removes both (#1022). Open filled paths are hit by their fill on every side, the rotate cursor bows around the corner it is at, the flip icons match their flips, the Color Picker previews on the selection, and Properties › Transform reaches Scale Corners and Scale Strokes & Effects (#1036). Offset Path and the other booleans finish on outlines where the sweep used to loop until memory ran out (linesweeper 0.5, #1028). Floating panel groups stack into sets that move together, collapse to their tabs and dock as extra dock columns that scroll (#1020). Ruler guides live on layers: listed in the Layers panel, shown, hidden, locked, duplicated, merged and deleted with their layer, and moved between layers (#1021). A `.ai` whose editing data uses global process colours (`Xk`/`XK`) or pattern fills keeps its sublayers: the colours come in as global swatches at their tint, the patterns as pattern swatches (#1025). A `.ai` in PostScript form opens through its layers, read from the program itself, also when it names the prolog defining its operators without including it, as Rhino and other CAD apps write it (#1027). A fill or stroke chosen while the Type tool has characters selected colours just those characters (#1063). Scaled type shows its scaled font size, leading, baseline shift and horizontal scale in the Character panel, and a size typed there is the size you get (#1034). Character panel menu › Proportional Metrics sets Japanese and Chinese full-width glyphs on the font's proportional widths in horizontal type (#966). Align, Distribute, Move, Arrange, Lock, Hide, Ungroup and other Object commands that would change nothing no longer record an undo step or mark the document changed (#1060). Spot colours defined in Lab open with their Lab values from `.ai` and PDF files, instead of as wrong RGB colours or their CMYK equivalents (#1032). Build scripts leave a generated source they wouldn't change untouched, so the next build doesn't compile most of the workspace again where file times lose their sub-second part (#1051). A fill colour recolours the gradient mesh point last clicked with the Mesh tool or Direct Selection, and a Mesh tool click on a mesh's point selects that mesh (#1052). The All Tools drawer stays two tools wide instead of filling a wide window (#1054). Text Wrap's Make, Release and Options refuse a list of object ids with a malformed or unknown id instead of skipping it (#1055). A freeform gradient line with a malformed point index is refused instead of being shortened to the indices that are valid (#1056). The Corners dialog (`ui.corners`) refuses a malformed object id or a listed anchor that isn't a corner instead of editing the selection or the other corners (#1057). New View refuses a centre that isn't exactly [x, y] and a rotation that isn't a number, instead of trimming the one and saving the other as 0° (#1058). The command sweeps try junk scale, spacing and artboard values too, which they had skipped since before those bugs were fixed (#1059). EPS and PostScript `arc` and `arcn` with huge angles no longer hang the import, and an arc whose angles are whole turns apart is empty, as the PostScript reference defines it (#1062). Align and DisLine truncated
-| 2026-10-10 | Initial live Revolve (Effect › 3D and Materials, #846, #605), in its own `three-d` crate. Progress docs re-measured and restructured to the craftrules standard (this page, `docs/target-app-parity.md`, `gaps.md`, `ui-parity.md`, the format, hardware, localization, effects and type checklists). Same day: v0.8.0; Effect › Distort, Pixelate and Texture filters (13); German interface; Variables (data merge); Graph Type value axes and tick marks; restart when the first frame never reaches the screen (#964) |
-| 2026-10-09 | Radial Blur, Smart Blur, Unsharp Mask (gap 2 begins); 340 commits, the busiest day |
-| 2026-10-08 | v0.5.0–v0.7.0; community contributions: Pen and shape-tool modifiers, Layers, Artboards, Japanese composition, Hebrew/Arabic type, interface languages, saved selections |
-| 2026-10-07 | v0.4.0; issue fixes; Layers panel rework |
-| 2026-10-06 | M8 transform and distort fidelity pass (M8.1–M8.20) |
-| 2026-10-05 | M4 files done (M4.14–M4.98); M3 paint and appearance done (92 tasks over two days) |
-| 2026-10-02 | First weighted parity estimate (22 areas); look and feel measured against public screenshots |
-| 2026-10-01 | Renamed from DrawCraft to VectorCraft |
-| 2026-09-30 | Repository history begins |
+| Infrastructure (engine, command registry, history, render, formats, MCP, web, packaging, tests) | **~90%** |
+| Look & feel vs Illustrator 2026 default workspace (measured) | **~75–80%** |
+| Feature surface vs full Illustrator (weighted, see below) | **~75%** on the rubric · **69–75%** honest range (self-graded, see [Honest assessment](#honest-assessment-2026-10-05)) |
+| Parity including interaction fidelity and hardening ("a power user can't tell the difference, but faster") | **~40–55%** |
+| Time to **feature parity** (every menu item, tool, panel, effect and dialog functional) | **~210–330 h** one agent · **~55–95 h** with 4–6 agents |
+| Time to **full parity** (feature parity + interaction-fidelity pass + hardening) | **~320–500 h** one agent · **~80–145 h** with 4–6 agents |

-The full pre-standard record of what landed is kept in [docs/roadmap.md](docs/roadmap.md#progress-log-before-the-progress-docs-standard).
+## Honest assessment (2026-10-05)

-## Revision history
+**In one line:** about two-thirds to three-quarters of Illustrator's features exist and work, and for everyday
+vector illustration (drawing, paths, paint and appearance, SVG/PDF/print) VectorCraft is close to usable. Measured
+against "a power user can't tell the difference", it is closer to 40–55%. What stands between here and "anyone can
+switch" is a handful of large subsystems plus a fidelity pass, not a long tail of small fixes.

-| Date | Change | Summary |
+**How much to trust the numbers:** area scores are graded by the agents that built the features, from behaviour docs
+(`plan/illustrator/`) and tests, not by side-by-side use of Illustrator. Treat them as upper bounds. Look & feel is
+the only dimension measured against the reference app. Performance budgets haven't been re-run on an idle machine
+since 2026-10-01.
+
+### By dimension
+
+| Dimension | Estimate | Evidence and what's missing |
 |---|---|---|
-| 2026-10-10 | minor | Method aligned with the standard, no new evidence: full ready for real work is the additive weighted sum, ~62%; hours per audience; beta ~13 points away |
-| 2026-10-10 | minor | Added the essentials-user readiness score (~75%) |
-| 2026-10-10 | minor | Ready for real work re-examined against the issue tracker and user feedback: 50% → 55% (full), 65% mainstream added; see target-app-parity.md |
-| 2026-10-10 | minor | Applied the core-workflow gate (docs/roadmap.md › Alpha gate): passes, stage stays alpha |
-| 2026-10-10 | major | Re-measured against Illustrator 2026 (30.x) from code counts, 71 open issues and public docs; stage set to alpha; moved the parity estimate, honest assessment and "Shipped so far" to `docs/target-app-parity.md`, the gap list to `docs/gaps.md`, milestones to `docs/roadmap.md`, the `.ai` scope to `docs/file-format-parity.md` |
-| 2026-10-05 | major | Honest assessment by dimension and the prioritized gap list |
-| 2026-10-02 | major | First 22-area weighted parity estimate |
+| **Breadth:** menus, tools and panels exist | ~90% | 13 menu items still stubbed; every tool implemented except Touch Type; 51 panel modules |
+| **Depth:** each feature behaves like Illustrator | ~69–75% | Strong: paint, appearance and colour (M3), Pathfinder and booleans, selection, drawing, files (M4). Weak: advanced type (~45%), brushes and symbols (in progress), raster effects (~20%) |
+| **Large missing subsystems** | 0–20% | 3D & Materials (0%), Photoshop-style raster effects and the Effect Gallery (~1 of ~56 filters), SVG Filters, CJK composition (vertical type with kinsoku, tate-chu-yoko and the font's vertical metrics; ruby, mojikumi and proportional vertical metrics open), Variables (data merge), scripting |
+| **Interaction fidelity:** modifiers, cursors, small behaviours | ~30–40% | The dedicated pass hasn't started, and there has been no side-by-side session with Illustrator yet. A power user notices this first |
+| **Look & feel** | ~75–80% | Measured against Illustrator 2026 screenshots (2026-10-02); the panels added since haven't been re-measured |
+| **File interop** | ~85% | SVG/SVGZ, PDF and PDF-compatible `.ai`, EPS, DXF, EMF/WMF, raster formats, PSD export, Place and Links, Package, Print, clipboard flavours. Native `.ai` private data is out of scope by design; DWG has no open spec |
+| **Bundled content:** brush, symbol, style and swatch libraries | ~30% | Ours are original and generated in code, and far fewer than Illustrator ships; brush and symbol libraries are still missing |
+| **Performance** | unverified | Multithreaded, off-thread rendering and caches are in place. The last budget run (2026-10-01, loaded machine) measured 290 ms for a 50k-path fit against a 16 ms budget. Re-run `vectorcraft-cli perf` on an idle machine |
+| **Robustness** | good, new | ~2,840 tests, property tests, no panics in shipped code (lints, the `guard` safety net, import fuzzing), Data Recovery. Missing: a corpus of real-world files, Windows/Linux/browser QA |
+| **Platforms and 1.0 polish** | ~60% | The macOS app and the web build work, and Finder opens every readable format with the macOS app (#295, #354); on macOS the menus are in the system menu bar, laid out as a Mac app's, with the in-window menus as a fallback (`--in-window-menus`; verified on Windows and by cross-compilation, not yet by hand on a Mac); hybrid-graphics laptops render on the power-saving GPU by default on Windows and macOS (#306), and Linux on the GPU the desktop runs on, since a Wayland compositor may refuse frames from the other one; a window that fails on its GPU while starting up starts again on the next one instead of crashing (#502; the dual-GPU Wayland case is verified by unit tests and cross-compilation, not on such hardware); web drops land in the document they were dropped on (#359); desktop drops carry no pointer position (winit 0.30), so a dropped document opens as a tab of its own and a picture or text is placed in the middle of the view, while the web places anything dropped on the canvas and opens what is dropped off it, as Illustrator does (#472); a web page that loses its WebGPU device or WebGL context restarts its graphics with the same documents (#369); on Linux/Wayland the clipboard reads the compositor's own (data-control) and copied image files paste, but files can't be dropped on the window under Wayland until eframe moves to winit 0.31 (#398; the Wayland side is verified by compilation only); on Linux the Paste menu checks the system clipboard on a background thread, so a clipboard owner that never answers no longer freezes the window, while Windows and macOS keep their quick in-line check (#510; the X11 hang verified by the contributor, here by headless tests); on KDE Plasma 6.3+ under Wayland, pens and pen displays reach the app only under XWayland (`WAYLAND_DISPLAY=`) or with KWin's `KWIN_WAYLAND_EMULATE_TABLET=1`, since winit 0.30 has no Wayland tablet input (#491, not verified on hardware); Windows/Linux packaging and accessibility are pending; an experimental, unsupported Windows 7 x64 OpenGL build exists (community-contributed, not verified by maintainers) |
+| **Agent automation** | beyond Illustrator | Every command, gesture and dialog is drivable over MCP, the CLI and the control channel |
+| **Scrubby numeric fields** | beyond Illustrator | As in Photoshop, dragging a numeric field's label (`W:`, `Opacity:`, the Character panel's icons) left or right steps its value live; one undo step per drag, Escape cancels (#400) |
+
+### Where we're lacking (in priority order)
+
+Ordered by how much each gap blocks someone from switching. Sizes are one-agent hours from the parity table.
+
+1. **Interaction fidelity:** go tool by tool and panel by panel against `plan/illustrator/05-tools.md`,
+   `06-panels.md` and `09-shortcuts.md`, covering modifier keys, cursors, the Properties panel per context and
+   isolation mode. Do it side by side with Illustrator where the owner allows. 60–90 h.
+2. **Photoshop-style raster effects and the Effect Gallery:** about 55 filters (Artistic, Brush Strokes, Distort,
+   Pixelate, Sketch, Stylize, Texture, Video) on the raster pipeline that drop shadows already use, applied at
+   Document Raster Effects Settings resolution. Parallelizes well across agents. 28–42 h.
+3. **3D and Materials:** Extrude & Bevel, Revolve, Inflate and Rotate with lighting and materials, using a software
+   renderer in its own crate (layering allows it below L6), with output in SVG/PDF as rasters or projected vectors.
+   The largest single gap. 50–80 h.
+4. **Advanced type:** CJK composition for vertical type (ruby, mojikumi, proportional vertical metrics, manual
+   tate-chu-yoko), Optical Margin Alignment, the composer/hyphenation options, tab leaders, a
+   spell-check dictionary (open licence), Touch Type and Snap to Glyph. Vertical point, area and path type have
+   initial support. 35–48 h across type core and advanced.
+5. **Brushes, symbols and libraries:** brush options depth; original brush, symbol and graphic-style libraries
+   generated in code (never Adobe's); dynamic symbols; Start Global Edit; brushes driven by pen tilt, bearing and
+   barrel rotation (6D art pens, #372), which needs tablet input beyond pressure on every platform. 20–32 h.
+6. **Automation:** Variables (data merge), a scripting surface over the command registry, batch. 8–12 h.
+7. **Views and windows:** multiple windows and arrange, Consolidate All Windows, video
+   rulers. 15–25 h.
+8. **Hardening at scale:** a corpus of real-world SVG/PDF/EPS files, idle-machine perf budgets, Windows, Linux and
+   browser QA, pen tablets on Wayland and pen pressure beyond Windows (winit 0.31's tablet input, #491), accessibility, packaging. 50–80 h.
+
+### Where we're going
+
+- **Next:** start the interaction-fidelity pass (1) in parallel with the raster-effects package (2). Both are broad,
+  so they split well across agents, and they move the "can't tell the difference" number most.
+- **Then:** 3D (3) and advanced type (4), each a focused milestone with its own plan in `plan/` before coding.
+- **Alongside:** keep closing the stubbed menu items. Run `vectorcraft-cli perf` on an idle machine, and fix any
+  budget it misses before 1.0.
+- **1.0:** feature parity plus the fidelity pass, hardening (8) and packaging for all three desktop OSes and the web.
+
+**For agents:** pick work from the list above (or the milestone rows below), and write a task plan before coding.
+When a task lands, update this section, the parity table and "Shipped so far" in the same PR. Keep the scores honest:
+grade by behaviour against `plan/illustrator/`, not by whether a menu item exists.
+
+## Shipped so far
+- **Architecture:** 19+ crates with enforced layering (`cargo xtask layers`). Every action is a command (~400 engine + ~50 UI). Undo is unlimited via structural sharing. `command.batch` runs several commands as one transaction.
+- **Automation:**
+  - Actions panel (record/playback, persisted), generic parameter dialogs for every "…" command.
+  - JSON-lines control channel with real egui pointer and keyboard injection.
+  - MCP server with 25 tools (drawing, text, effects, Pathfinder, transforms, graphs, text wrap, export, screenshots, any command), attached to the running app or headless. Tool descriptions and replies agree with the engine: format lists come from its format table, `save_file` says it keeps the document's own format, `inspect_document` reports the paint type's characters show, and selection exports report the encoder's warnings.
+  - MCP protocol: five prompts (`prompts/list` / `prompts/get`: poster, icon set, recolour, trace-and-style, export set), `completion/complete` for prompt arguments and template variables read from the live catalogues (formats, effect ids, command ids, trace presets, swatch and object ids), four resource templates (`vectorcraft://object/{id}`, `//command/{id}`, `//effect/{id}`, `//swatch/{name}`) so an agent reads one thing instead of the whole document, and `logging/setLevel` with `notifications/message`. `window.panel` ids are case-insensitive (display labels work too), `vectorcraft://object/{id}` reads through `document.node {summary: true}` (the same reply bytes from one lookup instead of summarizing the whole document: a leaf read on a 2,000-object document drops from ~20 ms to ~0.06 ms), large containers slice with `document.node {depth?, childLimit?}` (truncated levels report `childCount`), `document.inspect` and the `inspect_document` tool slice the same way so a depth-0 read is the layer skeleton (~9.7 KB instead of ~2 MB on a 2,000-object document), `document.find` locates nodes by name/kind/text with ancestor paths, and the CLI sweeps the protocol surface over stdio against the compiled binary. `docs/mcp.md` has a Protocol section covering the capability table and what is deliberately absent (subscriptions, progress, cancellation, sampling, elicitation, Streamable HTTP — all of which need the transport to interleave reads).
+  - Headless CLI (`vectorcraft-cli run`, `convert`, `info`, `bench`, `perf`, `mcp`).
+  - Actions panel that records and plays back commands.
+- **UI:** Illustrator 2026 layout restyled to measured values:
+  - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs.
+  - Hint bar, contextual task bar, 19 dock panels with ≡ menus.
+  - The contextual task bar's handle drags it anywhere on the canvas (kept whole on it as the window resizes); unpinned it keeps that offset as it follows the selection, and its More Options menu hides it, pins its position across selection changes (`window.taskBar.pin`), resets it under the selection (`window.taskBar.reset`) and shows the Properties panel. As in Illustrator the position isn't kept across launches. Not done: the bar's tool-specific variants (only the selection tools show it).
+  - Tool flyouts tear off: dragging or clicking the tear-off bar on a flyout's right side (or releasing the long press over it) floats its group as a strip of tool buttons, moved by the same bar and put back in the toolbar by the × at its top (`window.floatTools`). While a group floats, the presses that would open its flyout raise the strip instead. Floating strips are kept with the preferences and in user workspaces. Not done: turning a strip vertical, docking it.
+  - Panels undock (#495): a dock tab, a panel icon or a popped-out panel's title dragged out of the dock floats that panel inside the window, and the strip right of the dock's tabs floats the whole tabbed group. A floating group moves by its title bar, a tab dragged out of it floats on its own, and dropped on another group's title bar or tabs it stacks with that group; dropped on the dock, which lights up under the pointer, its panels go back where they live (the tabbed group or the icon column), as its × and the panel menus' Float Panel / Dock Panel do (`window.panel.float`, `window.panel.dock`). The Tools panel floats by its title bar and docks again on the window's left edge. Floating panels and the Tools panel's position are kept with the preferences and in user workspaces, and clamped into a smaller window. Not done: panels in separate OS windows, docking a panel into a dock group it doesn't belong to, reordering tabs by dragging, collapsing a floating group to icons, resizing floating panels.
+  - The dock's double arrow collapses Properties, Layers and Libraries to icons at the top of the icon column, popping out like the other icon panels, and expands them again (`window.collapseDock`, kept with the preferences and in saved workspaces). The icon column's own arrow (expanding the icon panels into a full column) is not done.
+  - Localised UI: menus (in-window and native), panels, dialogs, toolbar and Preferences read from per-language catalogs (`crates/ui-egui/src/i18n`, see `docs/development.md`); Traditional Chinese (Taiwan), Simplified Chinese (mainland), Japanese, Spanish and Italian ship complete, and Czech and Brazilian Portuguese cover every menu label (and more), with system-locale detection on macOS, Windows, Linux and the web (the browser's languages, or `?lang=`), a VectorCraft ▸ Language menu and a Language preference. Names are never translated (fonts and their styles, layers, artboards, saved presets, user libraries, custom workspaces, recent files, plug-ins).
+  - Native macOS menu bar, vector tool cursors, a ⌘K command palette, middle-button panning with any tool.
+  - The macOS menu bar is built from the in-window menus (one model, `native_menu`) and laid out as a Mac app's: the VectorCraft menu holds About, Settings ▸ (each Preferences page, General… ⌘K), Language ▸, Appearance ▸ (UI brightness), Services, Hide VectorCraft ⌃⌘H (⌘H stays Hide Edges), Hide Others, Show All and Quit; Window gains Minimize ⌃⌘M, Zoom and Bring All to Front, and Help the system's search field. Its key equivalents go back to egui as key presses, so user shortcuts, focused text fields and the Type tool's input method behave as in the window, and nothing fires twice; enabled, check marks and labels update in place. `--in-window-menus` or `VECTORCRAFT_IN_WINDOW_MENUS=1` keeps the menus in the window; `ui.inspect` reports `nativeMenuBar`.
+  - macOS: Finder opens every format File › Open reads with VectorCraft (double-click, Open With, a drop on the Dock icon, `open -a`), at launch or while it runs; the release and `cargo xtask bundle` apps share one `Info.plist` that declares those document types, owning only VectorCraft's own formats. The DMG opens on a designed Finder window, VectorCraft.app beside the `Applications` link over a background with the app icon (#493).
+  - A canvas context menu: right-click selects the object under the pointer and lists what applies to the selection (Undo/Redo, clipboard, group, isolation, join, Remove Anchor Points when anchors are selected, masks, compound paths, guides, Transform, Arrange, Select, Export Selection), or the view commands on empty canvas.
+  - Save / Don't Save / Cancel before closing or quitting with unsaved documents (tabs, Close, Close All, Quit, window close).
+  - Four brightness themes, persistent preferences.
+  - Preferences that act (#394, in part): Show Tool Tips, Double Click To Isolate, Zoom with Mouse Wheel (the wheel zooms about the pointer, Shift-wheel scrolls up and down, Cmd/Ctrl-wheel sideways; Alt/Option-wheel and a trackpad pinch zoom about the pointer either way), Use Precise Cursors; Selection & Anchor Display › Tolerance (objects, anchors and handles), Object Selection by Path Only, Command Click to Select Objects Behind (cycling down the stack), Zoom to Selection, anchor Size, Highlight anchors on mouse over; Type › Number of Recent Fonts (up to 15); Guides & Grid › guide and grid Color and Style (lines or dots) and Grids In Back. Then Snap to Point (its distance, for moves, drawn points and reference points), Move Locked and Hidden Artwork with Artboard, Enable Rubber Band for the Pen and Curvature tools, Handles style, Show handles when multiple anchors are selected, Hide Corner Widget for angles greater than; General › Transform Pattern Tiles (the transforms' and dialogs' Transform Patterns) and Select Same Tint %; Type › Size/Leading, Tracking and Baseline Shift increments (`type.step`, Cmd+Shift+. and Cmd+Shift+, for the size, the Type tool's Alt+arrows), Enable Missing Glyph Protection and Fill New Type Objects With Placeholder Text. Then Smart Guides › Color, Alignment Guides, Anchor/Path Labels, Measurement Labels, Transform Tools, Object Highlighting (with Smart Guides on) and Snapping Tolerance (4 px by default, for every smart guide snap). Then Type › Type Object Selection by Path Only (type is picked on the baseline of any of its lines, area type's frame or the path of type on a path, no longer anywhere in its bounds; the Type tools and the Eyedropper still take a click among the characters). Then General › Anti-aliased Artwork (off, the canvas draws the art with hard edges). Then Guides & Grid › Show Pixel Grid (Above 600% Zoom), a line at every document pixel over the art in Pixel Preview, turning with a rotated view as the document grid now does too. Then General › Show The Home Screen When No Documents Are Open (off, closing the last document leaves an empty window; the Home button still opens the screen). Then Units › Numbers Without Units Are Points (on by default: a number typed with no unit into a field in picas is read in points, a typed unit still wins; dimmed unless a unit is Picas). Then User Interface › Auto-Collapse Iconic Panels (off by default: on, a click away from a panel popped out of the icon column puts it away). They reach agents too (`prefs.set`, then `pointer_gesture` or `press_key`; `ui.wheel` on the control channel). About 32 stored options still do nothing yet (the rest of #394: Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, Construction and Spacing Guides, performance, devices…).
+  - Dialogs move by dragging their heading (the band down from the top edge, as a title bar), stay on screen and keep where they were moved for the session; the form dialogs' choices are dropdowns (Offset Path's Joins, Average's and Shear's and Reflect's axis), and Offset Path lists Offset, Joins, Miter Limit and previews (#423).
+  - Dialogs open with their first field focused and its value selected: type a value and press Enter (Move, Rotate, Scale…). Number fields in panels, the Control bar and dialogs (preferences too) step with Up/Down, or with the mouse wheel over the focused field (#485: a notch a step; the panel under it then stays put, and an unfocused field leaves the wheel to scrolling) (Shift: ten, Ctrl/Cmd: a tenth of their unit), applied at once.
+  - Scrubby labels (#400, beyond Illustrator, as in Photoshop): dragging a numeric field's label left or right (the ↔ cursor shows over it) steps the value one unit every 2 points (Shift: ten, Ctrl/Cmd: a tenth; counts stay whole), in the field's unit and within its limits, applied live as the art follows; the whole drag is one undo step and Escape puts the value back. A click on the label focuses the field; the text box itself never scrubs, and a field with no label doesn't. Text labels before a field (Transform, Properties, Control bar, Stroke, Transparency, form rows in dialogs) and the Character and Paragraph panels' icons act as labels. Preferences › General › Scrub Numeric Fields by Dragging (on by default) turns it off.
+  - Tab shows and hides the panels (in the Type tool it types a tab) without moving the keyboard focus onto a field, so the next shortcut or letter still works; in dialogs and panel fields it moves between fields.
+  - Cmd/Ctrl+A follows the keyboard: in a panel, dialog or search field it selects the field's text, while the Type tool edits it selects all of that text (also `select.all` over MCP), and only otherwise every object. On macOS the menu bar's Select All, Cut, Copy and Paste (keys or clicks) act on a focused field too. Not yet: Select All across threaded frames (one frame's text is selected).
+  - On Windows and Linux the app bar is the window's title bar (its own minimize, maximize and close buttons, drag to move, edges to resize), with the dragon app icon as the brand mark; dialogs and menus size to their content. As on a native menu bar, once one menu is open, moving the pointer onto another title opens that one.
+- **Tools:**
+  - **Selection:** Selection, Direct/Group Selection, Magic Wand, Lasso. A Shift-drag marquee toggles what it reaches: objects with the Selection tool, anchors with Direct and Group Selection (#483); the Lasso adds with Shift and subtracts with Alt. Dragging a path segment with Direct Selection bends it when it's curved (its anchors stay) and moves its two anchors when it's straight, one undo step; the fill, Shift or Alt still pick the whole path (Alt-drag copies it).
+  - **Saved selections:** Select ▸ Save Selection… asks for a name and keeps the selection in the document (saved with the file, undoable, up to 25); each one is listed at the bottom of the Select menu and a click selects its objects again; Edit Selection… lists them to rename or delete, applied together on OK. A file's saved selections are capped and checked against its objects when it opens. Not yet: Update Selection and the Layers panel's saved-selection menu.
+  - **Drawing:** Pen, Curvature, anchor tools, Pencil, Paintbrush, Blob Brush, Smooth, Path Eraser, Join. Direction handles dragged with Direct Selection or the Anchor Point tool snap to smart guides, and Shift keeps them at 45° steps from their anchor.
+  - **Shapes:** all shape tools (including Flare) and the line, arc, spiral and grid tools. Space held while dragging out a shape, line, arc, spiral or grid moves it at its current size. While a grid is dragged out, Up/Down change its rows (concentric dividers) and Left/Right its columns (radial dividers).
+  - **Cutting:** Eraser, Scissors, Knife, Mirror & Cut, Line Cut and Rectangle Cut (real geometry, compound paths keep their holes).
+  - **Transform:** Rotate, Reflect, Scale, Shear (click or Alt-click snaps the reference point to anchors and centres; Alt-click opens the tool's dialog, and a drag with Alt down at the release, from the press or pressed mid-drag, transforms a copy), Reshape, Free Transform (free and perspective distort and shear, switched by the keys held during a handle drag).
+  - **Live Corners:** drag a live rectangle's corner widgets (Selection or Direct Selection) to round all corners, with a radius readout; with Direct Selection, select corner anchors to show and round just those corners (#381). Each corner keeps its own radius and kind (Round, Inverted Round, Chamfer): Alt-click a widget to cycle the kind, double-click it for the Corners dialog, and the Properties and Transform radius fields set the selected corners (`object.setLiveShape {corners, radius, kind}`). Corners stay circular when the rectangle is scaled unevenly or along its own sides when rotated (the radius keeps its size, or scales by the mean scale with Scale Corners on); only a shear distorts them. On a rectangle that isn't square every corner is the same circle: a radius past half the shorter side stops there for all of them, the widgets sit on the corners as drawn and turn the edited corners red at that limit, CSS export writes the drawn radii, and rectangles saved stretched by older versions get circular corners when their corners are next set (#442).
+  - **Pen:** Alt pressed in the middle of dragging out an anchor splits its handles and keeps the curve already shaped into it (only the outgoing handle follows the pointer); Space held while dragging out an anchor moves it, handles and all. A press on the first anchor of the path being drawn closes it whatever the drag then does: the drag shapes the closing curve (symmetric handles, Alt breaks them) and the release closes the path wherever it ends (#501). Clicking the last anchor of the path being drawn retracts its outgoing handle (convert cursor), and dragging from it pulls out a new one on its own. Auto Add/Delete: over a selected path, a click on a segment adds an anchor and a click on an anchor deletes it (add and delete cursors); Shift held, or Preferences › General › Disable Auto Add/Delete, starts a new path instead. Alt held over a handle end or an anchor of a selected path (the one being drawn too) works as the Anchor Point tool, with its convert cursor: dragging a handle moves it alone, clicking a smooth anchor makes it a corner, dragging an anchor pulls out new symmetric handles, dragging a segment reshapes it; drawing then goes on. Cmd (Ctrl) held drags with the selection tool chosen last, Direct Selection until one is (handles, anchors and segments of the path being drawn or another), and the Pen then goes on drawing its path while that stays selected; the pointer shows that tool's while Cmd is held. The same holds for agents (`pointer_gesture` with `mods.cmd`), as the borrowing now lives in the engine (#494).
+  - **Path editing (#494):** the handles shown are the handles that drag: Direct Selection drags those of a path selected as a whole (as the Pen leaves it), the Anchor Point tool and Pen+Alt no longer grab handles that Show handles when multiple anchors are selected hides, a handle shorter than the tolerance leaves its anchor to be picked, and the anchor tools pick within Selection & Anchor Display › Tolerance. A dragged segment keeps a smooth anchor at either end smooth. With Direct Selection, the Pen, the Curvature and the anchor tools, a path selected as a whole shows all its anchors selected, and the Control bar and the Properties panel offer Convert (corner, smooth) for them too; Remove and Cut wait for anchors direct-selected (#504). A handle drag gathers its snap targets once per drag (it took 21 ms per pointer move on a 20,000-path document, now 1 ms; `vectorcraft-cli perf` measures handle and segment drags on a 5,000-anchor path).
+  - **Graphs:** Column, Stacked Column, Bar, Stacked Bar, Line, Area, Scatter, Pie and Radar graph tools with Graph Data and Graph Type.
+  - **Other:** Eyedropper, Gradient annotator, Artboard (Alt-drag duplicates an artboard, and its art with Move/Copy Artwork with Artboard on; Copy, Cut and Paste take the artboard with its art, Paste right of the last artboard, Paste in Place where it was, into this or another document, #446), Measure, Type, Hand, Zoom, Rotate View.
+  - **Editing type:** double-clicking type with a selection tool switches to the Type tool with the caret where it was clicked.
+  - **Temporary tools:** Cmd with any other tool drags with the selection tool used last (Selection, Direct Selection or Group Selection). Held Space pans and Cmd+Space zooms (Cmd+Alt+Space out) whatever the tool.
+  - **Panel drag and drop:** art dragged off the canvas onto the Symbols panel becomes a symbol, onto the Swatches panel a pattern swatch and onto the Brushes panel an Art brush; a symbol dragged onto the canvas places an instance where it is dropped, and a brush dragged onto a path is applied to it.
+  - **Tool double-clicks:** double-clicking a tool's button opens its options: Hand fits the artboard in the window, Zoom shows 100 %, Rotate, Scale, Reflect and Shear open their Object › Transform dialogs, the Selection, Direct Selection and Group Selection tools the Move dialog (Enter opens these seven tools' dialogs too), Gradient, Eyedropper, Blend and the Liquify tools their panels or options, and the Pencil, Paintbrush, Smooth, Blob Brush and Eraser tools their Tool Options (Fidelity, fill, the tolerances, the brush size).
+- **Layers panel:** every layer, sublayer, group and object is a clickable row at any depth: a click highlights it and makes its layer current (new art goes there), Shift-click a range, Ctrl/Cmd-click toggles. Sublayers are no longer treated as objects: clicks, marquees, Select All and the Select menu take the art inside them, and each sublayer selects in its own colour. Selection squares on rows with selected art (click selects a row's art, Shift adds or removes; dragging the square moves the selection to another row, Alt copies), the eye and lock on every row with drag-down-the-column (one undo step), Ctrl/Cmd-click an eye for per-layer Outline, Alt-click an eye or lock to hide or lock the other layers (again: show or unlock them all), triangles with Alt to open or close everything inside, drag and drop rows above, below or into layers and groups with a drop line (Alt copies) and a dimmed copy of the row under the pointer (dropped on the trash rows are deleted, on New Layer duplicated, as in Illustrator), inline rename, Delete key on highlighted rows. Buttons and the full panel menu: New Layer/Sublayer (Alt: options, Ctrl: on top), Duplicate, Delete, Options for Selection, clipping mask, isolation, Locate Object, Merge Selected, Flatten Artwork, Collect in New Layer, Release to Layers (Sequence and Build), Reverse Order, Template, Hide/Outline/Lock Others and Show/Preview/Unlock All, Paste Remembers Layers, Panel Options (row size, thumbnails per kind, Show Layers Only). Layer Options: name, colour (presets, each with a chip of its colour, or custom), Template, Lock, Show, Print, Preview (outline drawing and clicking) and Dim Images to %. Every operation is a command (`layer.move`, `layer.highlight`, `layer.merge`…) with validation against cycles and invalid nesting.
+- **Drawing aids:** Smart Guides and snapping (moving, with the Selection, Group Selection or Direct Selection tool, and resizing by the bounding-box handles with the Selection or Free Transform tool, Shift and Alt too: the dragged corner or side lands on the other objects' anchors and centres ("anchor", "center") or lines up with their edges and centres (a line and "align"); the Rotate, Scale, Shear and Reflect tools drag from the anchor they grab and snap the pointer the same way, so a corner dragged onto another object's anchor scales exactly onto it, #482; anchors dragged with Direct Selection: the one pressed on lands on other anchors, its own path's that stay put among them, on path segments or in line with them, the others following, Shift keeps 45° steps, and with Smart Guides off Snap to Point pulls it onto anchors; the Artboard tool snaps artboards, and their bleed, to other artboards, bleeds and art, the grid or whole pixels while moving, copying and resizing them, and the Transform panel shows and edits the active artboard's X/Y/W/H), guides dragged out of the rulers (#451: they snap as moved guides do, Shift to the ruler's ticks; with the Artboard tool they are artboard guides, which run across their artboard only and move, copy and delete with it, `guide.add {artboard}`) that the Selection, Direct Selection and Group Selection tools then pick and drag (#414: the selected guides highlight and move together, Alt copies them, Shift snaps the dragged one to the ticks, otherwise it snaps to pixels, the grid or the edges, centres (so the sides' midpoints) and anchors of the art and the artboards, or with Smart Guides off Snap to Point pulls it onto anchors; the arrow keys nudge them, Delete deletes them, dragging one back onto its ruler deletes it, Lock Guides and Hide Guides leave them alone; `guide.list`, `guide.select`, `guide.move` and `guide.remove` reach agents), and Draw Normal / Behind / Inside modes.
+- **Views:** the status bar's artboard navigator (first, previous, next, last; `view.goToArtboard`) goes to an artboard and fits it, and Fit Artboard in Window and Actual Size show the navigator's artboard. The Artboards panel highlights that active artboard: clicking a row makes it active (the Artboard tool's too, while it is chosen) as does clicking an artboard with the Artboard tool, double-clicking its number also fits it in the window and double-clicking its name renames it. Duplicate Artboards, or a row dragged onto New Artboard, copies the artboard with its art (#446). Escape leaves Presentation Mode, F from it goes back to Normal Screen Mode, and the screen mode isn't saved with the preferences: the app always starts in Normal Screen Mode with its menus and panels (#472).
+- **Geometry and effects:**
+  - Pathfinder (10 exact curve booleans), Offset, Outline Stroke, Simplify, Clean Up, Split Into Grid, Divide Objects Below. Object › Path › Remove Anchor Points (`path.removeAnchors`) removes the direct-selected anchors without opening their paths (the Delete key still deletes them with their segments): the neighbours keep their handle directions and their facing handles are refitted so one cubic follows the two old segments, and straight sides stay straight. The Delete Anchor Point tool uses the same refit. The Control bar, the contextual task bar, the Properties quick actions and the canvas context menu offer it when anchors are selected. With anchors selected, the Control bar and the Properties panel also convert them to corner or smooth (`path.convertAnchors`), connect end points (Join) and cut the path at them (`path.cutAtAnchors`, also on the task bar and the context menu): a closed path opens there and an open one becomes one path per piece, each cut leaving one of its two coincident anchors selected so a drag pulls the path apart.
+  - Live effects with previewing dialogs: Distort & Transform, Path, Convert to Shape, 15 Warp styles, Round Corners, Scribble, Effect → Pathfinder (all 10 operations, live on groups; several loose objects are grouped first, in one undo step), Color Adjustments (Brightness/Contrast, Curves, Levels, Hue/Saturation, Shift to Color, Temperature/Tint, on vectors, live type and embedded images), and raster drop shadow, glows and feather. SVG and PDF export keep live effects (geometry baked; SVG raster effects as filters).
+- **Type:** Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), Area Type Options (rows/columns/inset/first baseline), threaded text across any closed shapes, Fit Headline. Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`). Point type still scales. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. Variation axis sliders are not done. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458).
+- **Interface languages, vertical type:** VectorCraft ▸ Language (or Preferences ▸ User Interface) picks Automatic (the system locale) or a registered language, persisted as `interfaceLanguage`. Translations come from per-language catalogs (`i18n/*.tsv`): Traditional and Simplified Chinese, Japanese, Spanish (neutral international Spanish, for every `es-*` locale) and Italian (every `it-*` locale) cover the whole interface, Czech and Brazilian Portuguese every menu label, Brazilian Portuguese the shell's `tl!` literals too (tested); Spanish and Italian also translate status-bar and error messages as they are shown (`@msg` templates, every message literal tested; the messages themselves stay English for agents); untranslated text stays English. Japanese and Chinese glyphs come from the craft-fonts build input (release builds) or the installed fonts, Czech, Spanish and Italian ones from the bundled UI fonts. The web app follows the browser's languages (or `?lang=`). The Basic toolbar's Type button holds Vertical Type in its flyout. Vertical Type, Vertical Area Type and Vertical Type on a Path create vertical text (columns right to left, upright CJK glyphs and marks with `vert` alternates, Latin and longer numbers on their side, two- and three-digit numbers set as tate-chu-yoko in one em of the column (kept whole when justified), upright glyphs centred on the column (tracked or justified too), point type's anchor on the first column's centre line); kinsoku (the strict set) applies to horizontal and vertical Japanese, and justified Japanese lines spread their room between characters (not inside Latin words); Paragraph panel › Mojikumi Set (shown with Preferences › Type › Show East Asian Options, `text.setFormat {mojikumi}`): None or Line-end Punctuation Half Width (new type's default, as in Illustrator; older documents and imported text keep None) shares one half-em space between consecutive punctuation, sets a closing mark ending a line half width and an opening bracket starting a wrapped line flush with its start, and puts a quarter em between Japanese and Latin letters or digits; Paragraph panel menu › Top-to-Top / Bottom-to-Bottom Leading measures leading from em box top to top (area type's first line touches the frame) or from baseline to baseline; Paragraph panel menu › Burasagari None / Regular / Force (`text.setFormat {burasagari: "none"|"standard"|"forced"}`) hangs an East Asian comma or full stop (、。，．､｡) ending an area type line outside it, Regular (new type's default) when it doesn't fit and Force always (the rest of the line then fills the measure; closing brackets and Latin punctuation don't hang); Character panel menu › Character Alignment (with the East Asian options; `text.setFormat` or `text.setRangeStyle {charAlign}`) lines characters smaller than the largest on their line up on the Roman baseline or the em box top/right, centre or bottom/left (ICF top and bottom not yet); Type ▸ Type Orientation switches existing text; caret, selection, hit testing and arrow keys follow the writing direction. Vertical text exports to PDF as real text and to SVG as outlines.
+- **Transparency:** opacity masks (clip/invert/disable/link), exported as SVG `<mask>` and PDF soft masks.
+- **Advanced art:** live Blends (steps/distance/smooth colour, editable spine, anchor-targeted Blend tool, faithful interpolation, knockout), Envelope Distort (warp/mesh/top object, Reset, full Envelope Options, mesh handles, Edit Contents; type, images, symbols, gradients, patterns and appearance distorted everywhere), Liquify tools with options and pen pressure, Puppet Warp with rotating pins, Perspective Grid with presets, movable planes and projected type (choosing a perspective tool shows the grid; Hide Grid hides it with the tool still chosen), Gradient Mesh, Shape Builder (stroke-only open paths and lines cut the regions they cross and enclose regions of their own; filled open paths count as closed; erase mode while Alt/Option is held: a minus pointer, red highlights of what will go, a click or drag deletes the regions touched, the pieces of open lines and the edges (outline pieces between the points where paths meet, opening their paths there) it passes over, one undo step, `shapeBuilder.merge {erase}` and `shapeBuilder.regions` edges over MCP), Live Paint (every path an edge, open lines included), Image Trace (12 presets; with an image selected the Control bar and the Properties panel show Image Trace, whose arrow traces with any preset, Mask (`object.maskImage`: a clipping path on the image's outline, selected so its handles crop), Crop Image and Embed or Unembed in place of Fill and Stroke; with an Image Trace object selected, its Preset (choosing another traces again), the Image Trace panel and Expand, plus Release in Properties; the View modes are not done), pattern swatches with pattern editing mode, live Repeat (radial/grid/mirror).
+- **Paint and appearance (M3):**
+  - **Swatches:** names follow the colour model and are unique; Swatch Options (process/spot, Global, Gray/RGB/HSB/CMYK/Web, live preview); editing a global or spot swatch recolours every linked fill, stroke and text run in one undo step; multi-select and delete with confirmation; New Swatch and New Color Group dialogs (a group from the selected artwork's colours); swatches in colour groups convert, separate and count like any other. The Swatches panel selects ranges and whole groups, has a find field, and drags swatches to reorder, regroup or paint art; Add Used Colors, Select All Unused, Merge, Ungroup and Sort by Kind; a CMYK document keeps applied colours in CMYK. Swatch libraries: nine generated colour libraries and five gradient libraries in a library panel, saved and loaded as `.vcswatches`, `.gpl` or CSS. Tints of global and spot colours ("Name 40%") stay linked and separate as a percentage of their plate. Spot colours can be defined in Lab (Spot Colors options). A built-in [Registration] swatch prints on every plate.
+  - **Colour:** a Color Picker (colour field, H/S/B/R/G/B channel slider, HSB/RGB/Lab/CMYK fields, hex, web-only snapping, out-of-gamut correction); the Color panel follows each colour's own model and Alt-click paints the other proxy; proxies look through groups and show "?" for mixed paint; Invert, Complement, Apply Last Color (`,`) and Apply Last Gradient (`.`) keep the colour model; every paint command feeds the recent colours. The Color Guide has 21 harmony rules, Steps and Variation options and Limit to Library. Adjust Color Balance (its Global mode shifts tints) and Saturate preview live; Edit Colors and Recolor also reach meshes, images and patterns. Recolor Artwork has colour reduction, five recolour methods, presets, Limit to Library, a colour-wheel Edit tab and Edit Color Group; a local Color Themes panel saves five-colour themes. Fill/Stroke chips open swatch and mixer popovers (the Properties panel has the Control bar's Fill and Stroke chips, Stroke link and weight spinner, with nothing selected too), panels have Illustrator's Window menu keys (Align Shift+F7, Transform Shift+F8, Pathfinder Cmd+Shift+F9, Layers F7, Character Cmd+T…; every panel can be given one in Edit › Keyboard Shortcuts), and Eyedropper Options pick up and apply chosen attributes (Alt and Shift+Alt, image pixels). Fills and strokes can overprint (Attributes panel, Overprint Black options), and CMYK documents blend in inks on screen, in PDF and when flattening. Document Color Mode converts the art, symbols, pattern tiles and swatches through the colour settings: Gray stays Gray, RGB greys separate into four-colour greys and a rich black as Illustrator does, or go on the black plate only with `grays: "black"` (also for `document.open {colorMode}`).
+  - **Gradients:** lossless, validated gradient params; gradients follow rotate, reflect, shear, non-uniform scale and distortions; the Gradient tool edits the fill or stroke of the active proxy, type included; an interactive on-canvas annotator (move, length/angle, rotate, add/move/delete/duplicate stops, midpoints, a stop popover, Delete and arrow keys). The Gradient panel has the Fill/Stroke proxy, a gradient-swatch dropdown with Save to Swatches, midpoint locations, Alt-drag to copy or swap stops, swatch drops on the ramp and a stop eyedropper; copied appearances and graphic styles place gradients on each target's own bounds; gradient handles snap and honour Constrain Angle. Gradient stops stay linked to global and spot swatches. Freeform gradients (points and lines) are edited on the canvas; radial gradients have an extent ellipse, an aspect handle and an off-centre focal point (SVG `fx`/`fy`, PDF two-point radials). A stroke's gradient runs within, along or across it. Object ▸ Expand turns gradients into N objects or a gradient mesh.
+  - **Strokes:** one stroke-geometry module shared by the canvas, SVG, PDF and Outline Stroke; dotted lines (zero-length dashes draw dots or squares); arrowheads with hollow outlines, tip-on-end or extend-past-end alignment and one opacity for line and head. SVG and PDF export arrowheads, width profiles, brushes and aligned strokes exactly as the canvas draws them; Outline Stroke and the live Outline Stroke effect outline every stroke item as drawn (dashes, heads, profiles, alignment); dashes can be fitted to corners and path ends; width profiles carry through dashes, and their corners take the join. The Stroke panel edits type's character strokes, follows the stroke units (its weight presets are round values in that unit: `0.25 mm`, `0.0625 in`, `1 px`, #426; fields show four decimals in mm, cm and inches, three in points), shows mixed values blank and opens from the Control bar. A width profile library, thirty more arrowheads, and Width Point Edit with multi-select and discontinuous points. Visual bounds and clicks cover the whole painted stroke. Scale Strokes & Effects, Scale Corners and Use Preview Bounds work everywhere, and new art inherits stroke options, a graphic style or the whole last appearance.
+  - **Appearance:** the Appearance panel's selected row drives every paint, stroke, gradient and transparency edit (`item` on the commands); effects apply to one fill or stroke; per-item Opacity popups, whose blend-mode list and opacity slider stay open inside them (#430; the Control bar's Stroke popover too); Mixed Appearances, Layers target dots and basic-appearance rules. Effects can be reordered, moved between items and copied by dragging; Show All Hidden Attributes; clicking an effect edits it in place; the object thumbnail drags onto art; effects render on type, images, symbols, blends, envelopes, meshes and repeats, and per-item raster effects export. Groups, layers and type have their own fills, strokes and effects (Contents and Characters rows); the Layers panel's target circles target layers, groups and objects; Expand Appearance turns fills, strokes, effects and brushes into objects.
+  - **Masks and clipping:** opacity-mask controls work while the mask is being edited; transparency commands take ids and work without a selection; clipping sets clip by compound paths, even-odd paths, text and groups on screen and in raster export, matching SVG/PDF. Alt-click shows only the mask; SVG masks keep Clip and Invert; the transparency grid is per-document state; a clipping path's own fill and stroke paint behind and over the clipped art; layers can be clipping masks.
+  - **Transparency:** three-state Knockout Group (on, neutral, off), Opacity & Mask Define Knockout Shape, Page Isolated Blending and Page Knockout Group, on screen and in SVG/PDF. Blend modes match the standard formulas on screen, in SVG and in PDF, and non-isolated groups blend with the art below. Flatten Transparency with presets, a dialog and a Flattener Preview panel.
+  - **Graphic styles:** styles keep opacity and blend mode, capture groups and type, apply on top with Alt, and link to the objects using them; Redefine, Break Link, Graphic Style Options, Select All Unused, Sort by Name, and Select > Same Graphic Style / Appearance Attribute. The panel has list and thumbnail views with rendered previews, merge, reorder and drag and drop, plus a Control bar Style picker; six generated style libraries save and load as `.vcstyles`.
+  - **Neutral wording:** labels, MCP tool text, docs and packaging use neutral names, and `cargo xtask brands` (part of `cargo xtask ci`) fails on vendor names.
+- **Colour, type and file workflows:** Recolor Artwork (dialog with harmonies), Edit Colors, Find & Replace, Change Case, Smart Punctuation, Guides, Lock/Hide Above, Transform Each, Rasterize.
+- **Fonts:** a font is found by any of its names (family and style in every language of its name table, legacy family/style pairs, PostScript name), so documents from other apps open with the font they name; Find Font and `text.fonts` say for each font whether it was found exactly, by another name, substituted or missing, and how many glyphs are missing. PDF and `.ai` import brings Japanese text back as live type: CID fonts without a ToUnicode map read through the standard CMaps, vertical columns (WMode 1) as vertical type, letter spacing as tracking; a glyph is live type only when the installed font (in the closest style of its family) draws the same glyph, and text in a font that isn't installed comes in as live type shown in the fallback font until the font is installed (exports that draw it — PDF, EPS, EMF/WMF, raster, SVG outlines or embedded fonts — warn that they wrote the fallback font; `textAs: outlines` keeps the PDF's embedded glyphs).
+- **Files (M4):**
+  - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash (browser tabs hold their copies with Web Locks too, so a background tab's copies are never taken for a crash's, and a tab repairs copies another removed when it resumes: #367), background save and export. The desktop app writes its warnings and errors (graphics adapter, a lost graphics device, panics the guard recovered from) to standard error and to `logs/vectorcraft.log` next to the preferences, the two previous runs kept and each file capped at 16 MiB, so a launch without a terminal still leaves something to attach to a bug report (#465).
+  - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; a type object's stroke written as each glyph's outline stroked back on the type, so it stays one editable object; lines wrapped in a frame (each wrapped line ending in a space, one left edge, leading and font) back as one area type object, left aligned or justified with its paragraph spacing, where laying it out breaks the lines where the file does; glyphs set apart by gaps wider than a space (a barcode's digit groups) keeping their places; layers stacked as the pages mark them even when one first paints on a later page, art ending a layer's marked content or a clip closing in a later layer kept in its own layer, and layers with no art kept empty: #508; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320).
+  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole).
+  - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398); on Linux the Paste menu checks the clipboard off the UI thread, so an X11 owner that never answers can't freeze the window (#510); screenshots and other copied pictures paste as embedded images at the view centre everywhere, the web included (#457).
+- **Performance:** 20k shapes + 1k texts render in 27 ms per full-retina frame (7.8 ms zoomed), 7× faster than the first version. The UI thread never blocks. The web build is 7.1 MB gzipped.
+- **Graphics processor:** the canvas is rasterized on the CPU and the GPU only composites it, so any GPU that can show the window will do. Preferences › Performance › Graphics Processor (`gpuPreference`) is Automatic by default: the power-saving GPU on Windows and macOS (the integrated one on hybrid-graphics laptops, where presenting from the discrete GPU made the window flicker, #306), and the GPU the desktop runs on under Linux, where KWin on an NVIDIA GPU refused frames from a Ryzen's integrated GPU and 0.5.0 crashed at startup (#502). Power Saving and High Performance pick a kind of GPU; `WGPU_POWER_PREF`, `WGPU_ADAPTER_NAME` and `WGPU_BACKEND` override them. The app picks among the adapters that can present to the window (native backends before OpenGL, hardware before software), and if the window fails on one while starting up it starts again without it instead of crashing; Help › About, `ui.inspect` and the log name the adapter in use. When the browser drops the page's WebGPU device or WebGL context, the web build writes recovery copies, starts again on new graphics with the same app and uploads its textures again; if it can't, it removes the stale canvas and says to reload, which offers the copies back. The desktop app writes the copies and says to restart (#369). On Windows and Linux the tools' cursors are OS cursors (bitmaps rasterized once per display scale), which the system moves itself: painted into the window, they trailed the pointer by the frames waiting to be shown, and the window now queues one frame instead of two (#444). macOS and the web still paint them (macOS sizes cursor bitmaps in points, eframe has no bitmap cursors on the web). Pens and touch drive the tools as the mouse does, and a tap pressed and lifted within one frame clicks where it tapped (#491); pen pressure reaches the Liquify tools' Use Pressure Pen on Windows, while winit 0.30 reports none on macOS or Linux and egui none on the web. On Linux, see `docs/development.md` for pens under Wayland.
+- **Tests and robustness:** ~2,840 automated tests: model-based property tests, a junk-parameter sweep over every command, import fuzzing (SVG, PDF, libraries), golden renders, and MCP end-to-end tests over stdio. Shipped code never panics (workspace lints and a rollback safety net; see `docs/development.md`).
+
+## Milestones and estimates
+
+| # | Milestone | Status | Est. remaining, one agent (h) |
+|---|---|---|---|
+| M0 | Skeleton + vertical slice | ✅ done | — |
+| M1 | Selection, transform, layers, MCP | ✅ mostly done (transform reference point snaps to anchors/centres; rotated objects keep a rotated bounding box and their angle; Free Transform, Scale and Reflect along a rotated box pending) | 4–6 |
+| M2 | Drawing tools + smart guides | ✅ mostly done (Flare, Reshape, Live Corners widget dragging and per-corner radii and kinds landed; Shaper, the remaining Pen modifier nuances) | 15–20 |
+| M3 | Paint & appearance (swatches, color, gradient, stroke, appearance, transparency, styles) | ✅ done (M3.7–M3.98): swatches, groups, libraries, tints, Lab spots and Registration; Color Picker, Color panel, Color Guide, Color Themes, Edit Colors and Recolor Artwork; gradients that follow every transform, the annotator, linked stops, freeform gradients, focal points, gradients on strokes and Expand; stroke geometry, arrowheads, dashes fitted to corners, stroke on type, width profiles and the Width tool, Scale Strokes and preview bounds; Appearance targeting, container appearance, target circles, Expand Appearance; knockout, isolation, blend accuracy, CMYK blending, overprint, Attributes, masks and clipping, Flatten Transparency; graphic styles, links and libraries. Left: freeform and mixed spot/process gradients export as stops or process colours to SVG/PDF; confirm the Scale Strokes & Effects default | 4–8 |
+| M4 | Files (native, SVG, PDF, raster, Export for Screens, clipboard interop) | ✅ done (M4.14–M4.98 on 2026-10-05): Save As/Save a Copy/Revert/templates, Data Recovery and background save, SVG import and export fidelity (units, text, symbols, filters, SVGZ, Preserve Editing, SVG Options), PDF import (colours, layers, masks, editable text, security) and export (presets, marks, bleed, ICC and output intent, raster effects, subset fonts, PDF/X-1a, X-3 and X-4, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3), Place and Links, Package, EPS and DXF in and out, EMF/WMF, TIFF/BMP/Targa/PSD/GIF/PNG-8 export, Print and print presets, slices, Save for Web, Asset Export, clipboard flavours, File Info. Left: DWG (use DXF), PSD placement as layers, overprint read back from PDF, polish | 3–6 |
+| M5 | Performance | 🟡 background render + caches + MT done; `vectorcraft-cli bench` and `vectorcraft-cli perf` (budget suite); file format v2 opens 3× faster (50k paths: 722 → 244 ms); raster effects (glows, shadows, blur, feather) no longer force the whole frame single-threaded (filtered offscreen per effect, verified equal to the single-threaded reference); effect-heavy demos need a clean-machine benchmark; dirty-region rendering, GPU backend spike pending | 15–25 |
+| M6 | Path operations (Pathfinder, Shape Builder, offset…) | ✅ mostly done (Boolean precision on almost-horizontal edges fixed and the property tests made deterministic; Shape Builder gap detection, large-offset bug open) | 3–6 |
+| M7 | Type (point/area/path, editing, styles, OpenType, threading, glyphs) | 🟡 Character/Paragraph Styles, Area Type Options (with Width/Height), type areas resized by their handles and reshaped with Direct Selection, threaded text, Fit Headline, Glyphs, OpenType panel, Find Font, installed system fonts in every font menu (fonts registered with Windows outside its font folders, the XDG and Flatpak host font folders on Linux, and fonts installed while the app runs, listed when it comes back to the front; searchable; the Character and Properties menus show each family's sample of the selected text, preview it live under the pointer or ↑/↓, filter by script and kind, list a family's styles, and star favourites; the Glyphs panel and Find Font's Replace With use the same menu without the live preview) and found by name on open/import, variable fonts' named instances as styles, CJK names in the UI, input methods (marked text in place, candidate window at the caret; Japanese IME), Text Wrap (offset, invert, both sides of an object; follows edits), Type on a Path effects and Options with draggable start/centre/end brackets (slide, flip), tab stops + Tabs panel, Hebrew/Arabic bidirectional text and Paragraph Direction done; tab leaders, spell check, vertical type pending | 45–60 |
+| M8 | Transform & distort (Puppet Warp, Liquify tools, Envelopes, Blends, Perspective Grid) | ✅ done (M8.1–M8.20 on 2026-10-06, fidelity pass): Liquify Tool Options with one shared brush, pen pressure, hold-to-apply, a safe scope and incremental strokes; tool options that last; Puppet Warp rotation, multi-select, Control bar and a rest-shape session that follows Undo; Width tool on compound paths; Envelope dialogs with preview, Reset with Warp/Mesh, full Envelope Options, type/images/symbols/appearance/gradients/patterns distorted on canvas and in every export, warps that keep their frame, Edit Contents, mesh handles and Control bar; Blend Options, anchor-targeted Blend tool, editable spine, keys picked on the canvas, faithful interpolation and knockout; Perspective Grid with Define Grid, presets, lock/snap/rulers, widgets, the 1–4 plane switch, movable planes, Perspective Selection scale/copy/perpendicular/Transform Again, and type and symbols truly projected with Edit Text. Left: Anti-Alias and Preserve Shape output, warp-envelope point editing, brush interpolation in blends, Free Transform/Scale/Reflect along a rotated box | 2–4 |
+| M9 | Live effects (+ 3D & Materials) | 🟡 2D effects done incl. Effect → Pathfinder and Color Adjustments; SVG Filters, Document Raster Effects Settings, 3D pending | 86–135 |
+| M10 | Brushes, symbols, patterns, Repeat | 🟡 pattern swatches (5 tile types, Pattern Options, editing mode, SVG `<pattern>`/PDF export) and live Repeat (radial/grid/mirror) done; brushes/symbols in progress | 23–37 |
+| M11 | Artboards & views (artboard panel/tool, Trim View, middle-button pan, print tiling and the status bar's artboard navigator done; multiple windows, presentation polish) | 🟡 | 15–25 |
+| M12 | Advanced color & art (CMYK/ICC, separations, Gradient Mesh, Live Paint, Image Trace, Graphs) | 🟡 Gradient Mesh, Live Paint, Image Trace (12 presets, 18 ms/1k² image), Recolor Artwork, colour management (ICC, soft proofing, separations preview), Graphs (all 9 tools, Graph Data/Type, regenerate in place) done; graph Design/Column/Marker designs pending | 6–10 |
+| M13 | Automation (Actions ✅ record/playback, persisted; variables, scripting, batch) | 🟡 | 18–27 |
+| M14 | 1.0 polish (preferences, shortcut editor, workspaces, accessibility, packaging for all OSes) | 🟡 Preferences, shortcut editor (chords with Shift and a punctuation key fire as typed), workspaces, a custom title bar on Windows/Linux with a Home button, content-sized dialogs and menus that scroll when longer than the window done; an experimental, unsupported Windows 7 x64 portable OpenGL build (not verified by maintainers); accessibility and broader Windows/Linux packaging/QA pending | 18–28 |
+| — | Interaction fidelity pass (every tool's modifiers, Properties panel per context, isolation, nuance) | ⬜ | 60–90 |
+| — | Hardening at scale (big-file corpus, fuzzing, cross-platform + browser QA) | 🟡 | 50–80 |
+| | **Total to full parity** (one agent; re-derived from the [Parity estimate](#parity-estimate) table) | | **~320–500** |
+
+## Parity estimate
+
+_Method (2026-10-02; M3 rows re-derived 2026-10-04, file, export, print, links and UI-chrome rows after M4 on 2026-10-05):_ Illustrator's feature surface is split into 22 areas, weighted by how much of the app (and of
+real users' work) each represents. Each area is scored by depth of behaviour, not by presence of a menu item: an area
+is 100% only when every feature in it behaves like Illustrator. Feature parity = Σ weight × score / Σ weight. Remaining
+time is counted per area from what is missing, calibrated on measured throughput: in the last session one agent landed
+about 20 medium features (Text Wrap, Graphs, Effect → Pathfinder, export baking…) in ~16 h wall clock including builds
+and CI on a heavily loaded machine — about 0.8 h per medium feature; large subsystems (3D, raster filters, vertical type)
+are counted bottom-up. The M3 rows (colour, strokes, appearance) come from a detailed 92-task M3 plan whose review
+found more missing depth than the first estimate; all 92 tasks landed on 2026-10-04 and 2026-10-05 with 6–8 agents in parallel; its packages, planned at 5–11 h each, took
+about 1–1.5 agent-hours each, so the other rows (estimated on the older scale) are likely high.
+
+| Area | Weight | Done | Missing (main items) | One agent (h) |
+|---|---:|---:|---|---:|
+| Selection, transform & align tools | 6 | 85% | Free Transform/Scale/Reflect along a rotated box, Start Global Edit, transform nuances (the rotated persistent bounding box is done) | 4–6 |
+| Drawing tools | 7 | 85% | Shaper Groups (merge/punch overlapping shapes), pencil and the remaining pen modifier nuances, the freehand Tool Options' Keep selected, Alt to the Smooth tool, Blob Brush Merge Only with Selection and brush angle/roundness, Touch Type, Live Corners on plain paths and polygons (and Relative rounding) | 10–15 |
+| Path operations, Pathfinder, Shape Builder, Live Paint | 5 | 86% | Live Paint gap options, Shape Builder gap detection, options (Tool Options dialog, clicking a stroke in merge mode) and Shift-drag marquee | 3–6 |
+| Colour, swatches, gradients, patterns, mesh, recolor | 7 | 96% | freeform and mixed spot/process gradients in SVG/PDF (exported as stops or process colours), pattern fills in Expand | 2–4 |
+| Strokes, brushes, width profiles | 5 | 88% | brush options depth, brush libraries (generated in code), brushes driven by pen tilt, bearing and barrel rotation (6D art pens) | 12–20 |
+| Appearance, transparency, graphic styles, masks | 5 | 98% | raster effect reach in preview bounds (flattener presets apply in PDF, EPS and print) | 1–2 |
+| Live vector effects | 5 | 85% | Outline Object, Pathfinder Hard/Soft Mix and Trap, SVG Filters | 6–10 |
+| Raster effects (Effect Gallery, Document Raster Effects Settings) | 4 | 20% | ~55 Photoshop-style filters (Artistic, Brush Strokes, Distort, Pixelate, Sketch, Stylize, Texture, Video) and the Effect Gallery; Document Raster Effects Settings and raster effects in PDF are done | 28–42 |
+| 3D and Materials | 4 | 0% | Extrude & Bevel, Revolve, Inflate, Rotate, lighting, materials (software renderer) | 50–80 |
+| Type core | 9 | 79% | Middle Eastern features beyond bidi layout and Paragraph Direction (Character Direction, digit types, kashidas, the Middle Eastern composers, editable bidirectional SVG text, a split caret where directions meet); composer/hyphenation options, Optical Margin Alignment, hidden characters, Transform Again after a type-area resize (it scales the type), partial selection of type-area anchors by marquee | 15–20 |
+| Type advanced | 4 | 50% | CJK composition for vertical type (ruby, mojikumi beyond Line-end Punctuation Half Width — the other sets (and their paragraph-start bracket and indent rules), kinsoku sets and the Mojikumi Settings dialog —, proportional vertical metrics, manual tate-chu-yoko, Character Alignment on the ICF top and bottom), variable font axis sliders (named instances are styles), tab leaders, spell check (open dictionary), Touch Type, Retype; vertical point/area/path type and Type Orientation have initial support | 20–28 |
+| Symbols, blends, envelopes, Repeat, perspective | 5 | 88% | symbol libraries (original), dynamic symbols, envelope Anti-Alias/Preserve Shape output and warp point editing, brush interpolation in blends (M8 fidelity pass done) | 5–8 |
+| Image Trace, graphs, image tools | 3 | 70% | graph Design/Column/Marker, Create Object Mosaic, Crop Image polish (an on-canvas crop box), Image Trace View modes (Outlines, Source Image) (Vector Halftone is done) | 6–10 |
+| Layers, artboards, document setup | 5 | 82% | Layers panel: a confirmation before deleting layers that hold art, Collect for Export, row context menus, the Layer Options dialog for several rows with mixed values, Paste Remembers Layers for sublayers, drag-scrolling a long panel while dragging rows; artboard presets/rearrange polish (Document Setup, New Document and the rest of the Layers panel are done) | 4–7 |
+| View & navigation | 3 | 70% | New View/Edit Views, multiple windows/arrange, Snap to Pixel/Glyph (print tiling is done) | 9–14 |
+| Guides, grids, smart guides, snapping, rulers | 3 | 82% | global/video rulers, smart-guide preference depth, Alt swapping a ruler guide's orientation, ruler guides selected together with art (marquee, Shift-click), ruler guides as Layers rows with their own lock and hide (#451: Lock Guides locks them all; Make Guides paths are Layers rows already) (dragging existing guides is done, #414; new guides snapping to side midpoints and artboards, and artboard guides, #451) | 3–5 |
+| File formats | 6 | 85% | DWG (no open spec: DXF instead), PSD placement as layers, EPS checked against more real files users send (Inkscape files open as vectors; other generators' constructs are tested with programs written from the PostScript Language Reference only; CID-keyed CJK type and `CCITTFaxDecode` images not read), legacy `.ai` files saved without the prolog that defines their operators (their own operator set isn't read yet), the remaining fidelity polish; EPS, DXF, EMF/WMF, TIFF, BMP, Targa, PSD export, SVGZ, PDF security, PDF/X, PDF layers and presets are done | 6–10 |
+| Export for Screens, Asset Export, slices, Save for Web | 3 | 85% | polish only (all four are done) | 2–4 |
+| Print, colour management, separations, flattener | 3 | 80% | print preview fidelity (flattener presets in PDF and print, overprint in PDF and composite print, Print dialog, presets, PostScript, marks, separations, Print Tiling, print overprint/flattener/bitmap options and printer profile are done) | 1–2 |
+| Automation | 3 | 60% | Variables (data merge), scripting surface, batch | 8–12 |
+| UI chrome (panels, contextual Properties, workspaces, prefs) | 6 | 78% | Variables, SVG Interactivity, Properties per context, Consolidate All Windows, floating panels outside the app window and docked into any group, context menus beyond the canvas (Links, Asset Export, CSS Properties, Attributes and the canvas context menu are done), about 32 Preferences options stored but not yet acted on (#394: Construction and Spacing Guides, Auto Size New Area Type, Show Font Names in English, Highlight Alternate Glyphs, performance, devices…) | 14–22 |
+| Libraries, Links, Package | 2 | 50% | a local Libraries panel (no cloud by design); Links and Package are done | 5–8 |
+| **Feature parity** | **103** | **~75%** | | **~210–330** |
+| Interaction-fidelity pass (side by side with Illustrator: every tool modifier, cursor, dialog, Properties context) | | | | 60–90 |
+| Hardening (big-file corpus, fuzzing, cross-platform and browser QA, accessibility, packaging) | | | | 50–80 |
+| **Full parity** | | **~56%** | | **~320–500** |
+
+With 4–6 agents working on disjoint crates (as the layering allows) the wall-clock time divides by roughly 3.5–4
+(integration, review and shared files such as `menus.rs` serialize some work): **~55–95 h** to feature parity,
+**~80–145 h** to full parity.
+
+_Inventories (2026-10-07):_ 13 menu items still stubbed (`todo(…)` in `crates/ui-egui/src/menus.rs`); every tool
+implemented except Touch Type; 51 panel modules; Illustrator-style live
+effects ~44/54, Photoshop-style raster effects ~1/56, 3D 0/5; ~2,840 tests; ~221k lines of Rust.
+
+_Where we already beat Illustrator:_ exact curve booleans, off-thread multithreaded rendering, undo that never runs out,
+lossless SVG/PDF export of live effects with SVG filters, a documented JSON format, the same app on the web, and every
+command, gesture and dialog drivable by agents (MCP, CLI, control channel).
+
+## Out of scope (by design or by law)
+- **Native `.ai` private data:** it's undocumented. We read the PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+- **Adobe cloud services** (Libraries sync, Adobe Fonts, Firefly/generative): these are pluggable provider APIs, not built in.
+- **Adobe's bundled assets** (swatch/brush/symbol libraries, presets, icons): ours are original.
+
+## Where we aim to be better than Illustrator
+- **Speed:** off-thread multithreaded rendering, instant startup, a responsive UI on huge files.
+- **Robustness:** exact curve booleans (no "cannot perform operation"), property-tested undo/redo and file round trips.
+- **Openness:** a documented native format, first-class SVG, and the same app in the browser.
+- **Automation:** every command, gesture, dialog and widget is drivable by agents (JSON channel + MCP), with headless batch mode.
+
+## How to update this file
+After each milestone task lands, update the status column and remaining estimates, and move items into "Shipped so far". Keep estimates honest: re-derive them from what remains, never from wishful velocity.
@@ -22,26 +22,7 @@ vectorcraft-geom = { workspace = true }
 vectorcraft-svg = { workspace = true }
 vectorcraft-mcp = { workspace = true }
 vectorcraft-render = { workspace = true }
-vectorcraft-text = { workspace = true }
 serde_json = { workspace = true }
-log = { workspace = true }
-
-# `perf` on Windows (src/perf.rs) reads how busy the processors are (GetSystemTimes) and this
-# process's working set (GetProcessMemoryInfo) through winsafe's safe wrappers over Win32 (MIT),
-# which the desktop app's src/gpu.rs also uses.
-[target.'cfg(windows)'.dependencies]
-winsafe = { version = "0.0.29", default-features = false, features = ["kernel", "psapi"] }
-
-# DirectWrite's system font collection (the desktop app's src/system_fonts.rs, shared): fonts that
-# font services such as Adobe Fonts load in place (#579). MIT OR Apache-2.0.
-[target.'cfg(all(windows, not(target_vendor = "win7")))'.dependencies]
-windows = { version = "0.62", features = ["Win32_Graphics_DirectWrite"] }
-
-# CoreText's font manager (the desktop app's src/mac_fonts.rs, shared): fonts that apps and font
-# managers register from their own folders (#579). Zlib OR Apache-2.0 OR MIT.
-[target.'cfg(target_os = "macos")'.dependencies]
-objc2-core-foundation = { version = "0.3", default-features = false, features = ["std", "CFArray", "CFString", "CFURL"] }
-objc2-core-text = { version = "0.3", default-features = false, features = ["std", "CTFontManager"] }

 [dev-dependencies]
 vectorcraft-testkit = { workspace = true }
@@ -1,20 +1,17 @@
 //! `vectorcraft-cli`: VectorCraft from the command line.
 //!
 //! ```text
-//! vectorcraft-cli mcp [--connect 127.0.0.1:7979 | --headless] [--automation-read-root DIR] [--automation-write-root DIR]
+//! vectorcraft-cli mcp [--connect 127.0.0.1:7979 | --headless]
 //! vectorcraft-cli run [--in FILE] [--cmd id [--params '{json}']]... [--export out.svg]... [--scale 2]
 //! vectorcraft-cli commands
-//! vectorcraft-cli convert IN OUT [--scale 2] [--artboard 0 | --range 1-3,5] [--outline-text] [--decimals N] [--replace-lossy] [--editing-data]
+//! vectorcraft-cli convert IN OUT [--scale 2] [--artboard 0 | --range 1-3,5] [--outline-text]
 //! vectorcraft-cli info FILE
 //! vectorcraft-cli bench FILE [--size 2880x1800] [--iters 5]
-//! vectorcraft-cli perf [--paths 50000] [--deep]
+//! vectorcraft-cli perf [--paths 50000]
 //! ```
-// Denied, not forbidden: the font listers shared with the desktop app allow it for their
-// DirectWrite (Windows) and CoreText (macOS) calls, and nothing else may.
-#![deny(unsafe_code)]
+#![forbid(unsafe_code)]

 use std::io::Write;
-use std::path::Path;
 use std::process::ExitCode;

 /// `println!` / `print!` that end the program quietly when stdout is closed
@@ -37,21 +34,9 @@ macro_rules! out {
    }};
 }

-/// The desktop app's CoreText font lister, shared: exports and MCP find the same fonts.
-#[cfg(target_os = "macos")]
-#[path = "../../vectorcraft/src/mac_fonts.rs"]
-mod mac_fonts;
 mod perf;
-/// The desktop app's settings folder, shared: exports and MCP read the same Fonts folder.
-#[path = "../../vectorcraft/src/prefs_dir.rs"]
-mod prefs_dir;
-/// The desktop app's DirectWrite font lister, shared: exports and MCP find the same fonts.
-#[cfg(all(windows, not(target_vendor = "win7")))]
-#[path = "../../vectorcraft/src/system_fonts.rs"]
-mod system_fonts;

 use serde_json::{Value, json};
-use vectorcraft_engine::file_access::{self, AutomationRoots};
 use vectorcraft_mcp::{Backend, DEFAULT_ADDR, Headless, Remote, Server};

 /// stdout went away. A reader that stopped early (a closed pipe) ends the program quietly, as
@@ -68,13 +53,9 @@ const USAGE: &str = "\
 vectorcraft-cli — VectorCraft automation

 USAGE:
-  vectorcraft-cli mcp [--connect ADDR | --headless] [--automation-read-root DIR] [--automation-write-root DIR]
+  vectorcraft-cli mcp [--connect ADDR | --headless]
      Run the MCP server on stdio. Default: connect to a running app at 127.0.0.1:7979
      (vectorcraft --control 7979), falling back to a headless in-process session.
-      --automation-read-root / --automation-write-root confine the files the agent's commands read
-      (open, place, relink, library loads…) and write (save, export, package, library saves…) to
-      DIR, links followed; a root left out grants none of its access. They imply --headless: a
-      running app enforces its own (vectorcraft --control PORT --automation-read-root DIR …).

  vectorcraft-cli run [--in FILE] [--cmd ID [--params JSON]]... [--export FILE]... [--scale N]
      Headless batch: open FILE (any readable format) or start a new document, run commands in
@@ -84,16 +65,11 @@ USAGE:
  vectorcraft-cli commands
      Print the command catalogue as JSON.

-  vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text] [--decimals N] [--replace-lossy] [--editing-data]
+  vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text]
      Open IN (any readable format) and export OUT in the format its extension picks (see Writable
      formats). --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
      unless one of them is given, EPS the bounds of the art, the other formats the first artboard.
-      Live effects are kept, and hidden layers and objects (written hidden in SVG and PSD), with
-      SVG's data-* attributes; --outline-text writes SVG text as paths, --decimals sets SVG's coordinate
-      precision (1–7, default 3). OUT may not be IN when reading
-      IN left things out (hidden text, art or layers it could not read; the notes say which) unless
-      --replace-lossy is given. --editing-data opens a .ai from its editing copy even where that
-      draws differently from its PDF part (which can be older), as long as it can be read.
+      Live effects are kept; --outline-text writes SVG text as paths.

  vectorcraft-cli info FILE
      Print a JSON summary: the import warnings (what didn't come in as it was, such as an EPS
@@ -104,11 +80,9 @@ USAGE:
      Render FILE (any readable format) fitted to WxH (default 2880x1800) and print ms per frame
      (warm), multithreaded and single-threaded.

-  vectorcraft-cli perf [--paths N] [--deep]
-      Check the performance budgets (render, pan, hit test, save/load, SVG, Pathfinder, handle
-      and segment drags) on a synthetic N-path document (default 50000). Exits non-zero if a
-      budget is exceeded, unless the report says the machine is busy. --deep also times work with
-      no budget yet and prints memory use (the working set on Windows).
+  vectorcraft-cli perf [--paths N]
+      Check the performance budgets (render, pan, hit test, save/load, SVG, Pathfinder) on a
+      synthetic N-path document (default 50000). Exits non-zero if a budget is exceeded.
 ";

 /// The usage text plus the formats `document.open` reads and `document.export` writes.
@@ -118,12 +92,6 @@ fn usage() -> String {
 }

 fn main() -> ExitCode {
-    // Before any font lookup: the fonts font services load (#579).
-    #[cfg(all(windows, not(target_vendor = "win7")))]
-    system_fonts::install();
-    #[cfg(target_os = "macos")]
-    mac_fonts::install();
-    prefs_dir::install_fonts();
    let args: Vec<String> = std::env::args().skip(1).collect();
    let r = match args.first().map(String::as_str) {
        Some("mcp") => mcp(&args[1..]),
@@ -155,42 +123,18 @@ fn main() -> ExitCode {
 fn mcp(args: &[String]) -> Result<(), String> {
    let mut connect: Option<String> = None;
    let mut headless = false;
-    let (mut read_root, mut write_root): (Option<String>, Option<String>) = (None, None);
    let mut it = args.iter();
    while let Some(a) = it.next() {
-        // The roots also come as `--flag=DIR`, as the other Craft apps take them.
-        let (flag, inline) = match a.split_once('=') {
-            Some((f, v)) if f.starts_with("--automation-") => (f, Some(v.to_string())),
-            _ => (a.as_str(), None),
-        };
-        match flag {
+        match a.as_str() {
            "--connect" => connect = Some(it.next().cloned().ok_or("--connect needs an address")?),
            "--headless" => headless = true,
-            "--automation-read-root" | "--automation-write-root" => {
-                let dir = inline.or_else(|| it.next().cloned()).ok_or_else(|| format!("{flag} needs a folder"))?;
-                let slot = if flag == "--automation-read-root" { &mut read_root } else { &mut write_root };
-                if slot.replace(dir).is_some() {
-                    return Err(format!("{flag} is given twice: it takes one folder"));
-                }
-            }
            other => return Err(format!("unknown mcp option `{other}`")),
        }
    }
    if headless && connect.is_some() {
        return Err("use either --connect or --headless".into());
    }
-    let roots = AutomationRoots::new(read_root.as_deref().map(Path::new), write_root.as_deref().map(Path::new))?;
-    if roots.is_some() && connect.is_some() {
-        return Err("--automation-read-root and --automation-write-root confine the headless server; a running app enforces its own roots:                     start it with `vectorcraft --control <port> --automation-read-root <dir> --automation-write-root <dir>`"
-            .into());
-    }
-    let backend: Box<dyn Backend> = if let Some(roots) = roots {
-        // Every thread of this process, not only the server's: nothing reaches past the roots.
-        file_access::confine_process(roots.clone());
-        let show = |root: Option<&Path>| root.map_or_else(|| "none".to_string(), |r| r.display().to_string());
-        eprintln!("vectorcraft-cli: files confined: read root {}, write root {}", show(roots.read_root()), show(roots.write_root()));
-        Box::new(Headless::with_document().with_automation_roots(Some(roots)))
-    } else if headless {
+    let backend: Box<dyn Backend> = if headless {
        Box::new(Headless::with_document())
    } else if let Some(addr) = connect {
        // Explicit address: fail loudly if the app isn't there.
@@ -219,9 +163,7 @@ fn commands() -> Result<(), String> {

 fn convert(args: &[String]) -> Result<(), String> {
    let mut files = vec![];
-    let (mut scale, mut artboard, mut range, mut outline_text, mut replace_lossy, mut editing_data) =
-        (1.0f64, None::<u64>, None::<String>, false, false, false);
-    let mut decimals = None::<u64>;
+    let (mut scale, mut artboard, mut range, mut outline_text) = (1.0f64, None::<u64>, None::<String>, false);
    let mut it = args.iter();
    while let Some(a) = it.next() {
        match a.as_str() {
@@ -229,27 +171,18 @@ fn convert(args: &[String]) -> Result<(), String> {
            "--artboard" | "-a" => artboard = Some(it.next().and_then(|v| v.parse().ok()).ok_or("--artboard needs an index")?),
            "--range" | "-r" => range = Some(it.next().cloned().ok_or("--range needs artboards such as 1-3,5")?),
            "--outline-text" => outline_text = true,
-            "--decimals" => decimals = Some(it.next().and_then(|v| v.parse::<u64>().ok()).ok_or("--decimals needs a number")?),
-            "--replace-lossy" => replace_lossy = true,
-            "--editing-data" => editing_data = true,
            f => files.push(f.to_string()),
        }
    }
    let [input, output] = <[String; 2]>::try_from(files).map_err(|_| "convert needs IN and OUT")?;
    let mut h = Headless::new();
-    if editing_data {
-        let params = json!({"path": input, "editingData": "always"});
-        h.call("engine.execute", json!({"command": "document.open", "params": params})).map_err(|e| format!("open {input}: {e}"))?;
-    } else {
-        h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?;
-    }
-    // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
-    // PSD).
-    let mut params = json!({"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
-    if let Some(decimals) = decimals {
-        params["decimals"] = json!(decimals);
-    }
-    let r = h.call("engine.execute", json!({"command": "document.export", "params": params})).map_err(|e| format!("export {output}: {e}"))?;
+    h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?;
+    let r = h
+        .call(
+            "engine.execute",
+            json!({"command": "document.export", "params": {"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text}}),
+        )
+        .map_err(|e| format!("export {output}: {e}"))?;
    outln!("{r}");
    Ok(())
 }
@@ -308,44 +241,24 @@ fn run(args: &[String]) -> Result<(), String> {

    let mut h = Headless::new();
    let mut out = std::io::stdout().lock();
-    // A reader that stopped early (a closed pipe) isn't an error, and the batch goes on: its later
-    // steps (an export…) still run, unprinted.
-    let mut closed = false;
-    let mut emit = |v: Value| {
-        if closed {
-            return Ok(());
-        }
-        match writeln!(out, "{v}") {
-            Err(e) if e.kind() == std::io::ErrorKind::BrokenPipe => {
-                closed = true;
-                Ok(())
-            }
-            r => r.map_err(|e| e.to_string()),
-        }
-    };
+    let mut emit = |v: Value| writeln!(out, "{v}").map_err(|e| e.to_string());
    if let Some(path) = &input {
        let r = h.call("app.open", json!({"path": path})).map_err(|e| format!("open {path}: {e}"))?;
        emit(json!({"step": "open", "path": path, "result": r}))?;
    } else if !matches!(steps.first(), Some(Step::Cmd(id, _)) if id == "file.new") {
        h.ensure_document();
    }
-    // Each step's result, for later steps to refer to (`"$1.id"`, see `vectorcraft_engine::steps`).
-    let mut results = vec![];
    for step in steps {
-        let r = match step {
+        match step {
            Step::Cmd(id, params) => {
-                let params = vectorcraft_engine::steps::resolve(&params, &results).map_err(|e| format!("{id}: {e}"))?;
                let r = h.call("engine.execute", json!({"command": id, "params": params})).map_err(|e| format!("{id}: {e}"))?;
                emit(json!({"step": "cmd", "command": id, "result": r}))?;
-                r
            }
            Step::Export(path) => {
                let r = h.call("app.export", json!({"path": path, "scale": scale})).map_err(|e| format!("export {path}: {e}"))?;
                emit(json!({"step": "export", "result": r}))?;
-                r
            }
-        };
-        results.push(r);
+        }
    }
    Ok(())
 }
@@ -1,8 +1,7 @@
 //! `vectorcraft-cli perf`: the performance budgets (plan §4) measured on a synthetic document.
 //!
-//! Each row is the median of several runs. Timings are wall-clock: on a busy machine (a load
-//! average above three quarters of the cores, or on Windows more than three quarters of the
-//! cores busy over a second) they are noise, and the report says so.
+//! Each row is the median of several runs. Timings are wall-clock: on a busy machine (load
+//! average above the core count) they are noise, and the report says so.

 use std::time::Instant;

@@ -62,7 +61,6 @@ fn median_ms(runs: usize, mut f: impl FnMut()) -> f64 {
 }

 /// 1-minute load average (macOS / Linux), if available.
-#[cfg(not(windows))]
 fn load_average() -> Option<f64> {
    let out = std::process::Command::new("sysctl").args(["-n", "vm.loadavg"]).output().ok().filter(|o| o.status.success());
    let text = match out {
@@ -72,27 +70,6 @@ fn load_average() -> Option<f64> {
    text.split_whitespace().map(|t| t.trim_matches(|c| c == '{' || c == '}')).find_map(|t| t.parse().ok())
 }

-/// The cores busy on average over one second (Windows), if available: the share of the
-/// processors' time that `GetSystemTimes` reports as kernel or user time but not as idle time,
-/// times `cores`. A load average also counts the threads waiting for a core.
-#[cfg(windows)]
-fn busy_cores(cores: usize) -> Option<f64> {
-    let times = || winsafe::GetSystemTimes().ok().map(|(idle, kernel, user)| [idle, kernel, user].map(u64::from));
-    let before = times()?;
-    std::thread::sleep(std::time::Duration::from_secs(1));
-    busy_share(before, times()?).map(|share| share * cores as f64)
-}
-
-/// The share of the processors' time between two `[idle, kernel, user]` readings of
-/// `GetSystemTimes` that was busy (kernel time includes idle time). It is None when no time
-/// passed, a time went back, or the idle time exceeds the kernel and user time.
-#[cfg(any(windows, test))]
-fn busy_share([idle0, kernel0, user0]: [u64; 3], [idle1, kernel1, user1]: [u64; 3]) -> Option<f64> {
-    let total = kernel1.checked_sub(kernel0)?.checked_add(user1.checked_sub(user0)?)?;
-    let busy = total.checked_sub(idle1.checked_sub(idle0)?)?;
-    (total > 0).then(|| busy as f64 / total as f64)
-}
-
 /// Milliseconds per pointer move of a Direct Selection drag of a handle, then of a segment, of a
 /// 5,000-anchor wave of smooth anchors added on top of the synthetic `n`-path document.
 fn edit_drags(n: usize) -> Result<(f64, f64), String> {
@@ -136,171 +113,18 @@ fn edit_drags(n: usize) -> Result<(f64, f64), String> {
    Ok((handle, segment))
 }

-/// Resident memory of this process in MB (`ps`), if available.
-#[cfg(not(windows))]
-fn rss_mb() -> Option<f64> {
-    let pid = std::process::id().to_string();
-    let out = std::process::Command::new("ps").args(["-o", "rss=", "-p", &pid]).output().ok().filter(|o| o.status.success())?;
-    String::from_utf8_lossy(&out.stdout).trim().parse::<f64>().ok().map(|kb| kb / 1024.0)
-}
-
-/// The working set of this process in MB (`GetProcessMemoryInfo`), if available: its pages that
-/// are in physical memory, the figure `ps` reports as resident memory elsewhere.
-#[cfg(windows)]
-fn rss_mb() -> Option<f64> {
-    let counters = winsafe::HPROCESS::GetCurrentProcess().GetProcessMemoryInfo().ok()?;
-    Some(counters.WorkingSetSize as f64 / (1024.0 * 1024.0))
-}
-
-/// `--deep`: tracked rows (no budget yet) for work the budgets above don't reach: editing a whole
-/// selection, live effects, every Pathfinder operation, typing in a long story, and memory.
-fn deep(n: usize) -> Result<(), String> {
-    let err = |e: vectorcraft_engine::EngineError| e.to_string();
-    let mut rows: Vec<(String, f64)> = vec![];
-    let mut mem: Vec<(String, f64)> = vec![];
-    let mut note = |what: &str| {
-        if let Some(m) = rss_mb() {
-            mem.push((what.to_string(), m));
-        }
-    };
-    note("start");
-    // Editing every object of an n-path document.
-    let mut s = vectorcraft_engine::Session::new();
-    s.add_document(synthetic(n)?, None);
-    note("document built");
-    rows.push((format!("select all, {n} paths"), median_ms(3, || drop(s.execute("select.all", &json!({}))))));
-    rows.push((format!("nudge the selection ({n} paths)"), median_ms(5, || drop(s.execute("object.move", &json!({"dx": 1, "dy": 0}))))));
-    rows.push((format!("undo a nudge ({n} paths)"), median_ms(5, || drop(s.execute("edit.undo", &json!({}))))));
-    rows.push((format!("redo a nudge ({n} paths)"), median_ms(5, || drop(s.execute("edit.redo", &json!({}))))));
-    // Dragging the whole selection with the Selection tool: one pointer move (the preview).
-    {
-        use vectorcraft_engine::tools::{Mods, PointerEvent, PointerKind};
-        use vectorcraft_geom::Vec2;
-        let view = vectorcraft_engine::ViewInfo { zoom: 1.0, ..Default::default() };
-        let first = s.doc().map_err(err)?.selection.objects.first().copied();
-        let at = first.and_then(|id| s.doc().ok()?.doc.node(id)?.geometric_bounds()).map(|b| b.center());
-        if let Some(down) = at {
-            let ev = |kind, dx: f64| PointerEvent { kind, pos: down + Vec2::new(dx, 0.0), mods: Mods::default(), pressure: 1.0 };
-            s.select_tool("selection", view).map_err(err)?;
-            s.pointer(&ev(PointerKind::Down, 0.0), view).map_err(err)?;
-            let mut dx = 0.0;
-            rows.push((
-                format!("drag the selection, per move ({n} paths)"),
-                median_ms(5, || {
-                    dx += 2.0;
-                    let _ = s.pointer(&ev(PointerKind::Drag, dx), view);
-                }),
-            ));
-            s.pointer(&ev(PointerKind::Up, dx), view).map_err(err)?;
-        }
-    }
-    for _ in 0..40 {
-        s.execute("object.move", &json!({"dx": 1, "dy": 0})).map_err(err)?;
-    }
-    note("after 45 whole-selection edits");
-    drop(s);
-    // Live effects on 2,000 paths: render a page whose every object has the effect.
-    let opts = RenderOptions::default();
-    for (fx, params) in [("path.offsetPath", json!({"offset": 3})), ("distort.roughen", json!({"size": 5, "relative": true}))] {
-        let mut s = vectorcraft_engine::Session::new();
-        s.add_document(synthetic(2000)?, None);
-        s.execute("select.all", &json!({})).map_err(err)?;
-        s.execute("effect.apply", &json!({"effect": fx, "params": params})).map_err(err)?;
-        let doc = s.doc().map_err(err)?.doc.clone();
-        let mut r = Renderer::new();
-        r.render(&doc, 2880, 1800, Affine::scale(1.6), &opts);
-        rows.push((format!("render, 2,000 paths with {fx} (warm)"), median_ms(5, || drop(r.render(&doc, 2880, 1800, Affine::scale(1.6), &opts)))));
-    }
-    note("after live effects");
-    // Every Pathfinder operation on 300 overlapping paths.
-    for op in ["unite", "intersect", "exclude", "minusFront", "minusBack", "divide", "trim", "merge", "crop", "outline"] {
-        let ms = median_ms(1, || {
-            let mut s = vectorcraft_engine::Session::new();
-            if let Ok(d) = synthetic(300) {
-                s.add_document(d, None);
-                let _ = s.execute("select.all", &json!({})).and_then(|_| s.execute(&format!("object.pathfinder.{op}"), &json!({})));
-            }
-        });
-        rows.push((format!("Pathfinder {op}, 300 paths"), ms));
-    }
-    note("after Pathfinder");
-    // Typing one character in the middle of a 20,000-character area-type story.
-    let mut s = vectorcraft_engine::Session::new();
-    s.add_document(Document::new(1600.0, 1200.0), None);
-    let text: String = (0..2000).map(|i| if i % 12 == 11 { "paragraph.\n" } else { "lorem ips " }).collect();
-    let id = s.execute("text.create", &json!({"x": 20, "y": 20, "text": text, "size": 10, "area": {"width": 1500, "height": 1100}})).map_err(err)?;
-    let id = id.get("id").cloned().unwrap_or(json!(0));
-    let mut at = 10_000;
-    rows.push((
-        "type one character, 20,000-character area text".into(),
-        median_ms(9, || {
-            at += 1;
-            let _ = s.execute("text.editRange", &json!({"id": id, "start": at, "end": at, "insert": "x"}));
-        }),
-    ));
-    note("after typing");
-    // Four embedded 24 MP photos drawn at fit page by three renderers, as the app's canvas, render
-    // worker and a panel each draw them.
-    {
-        let art = synthetic(3000)?;
-        let mut d = Document::new(1600.0, 1200.0);
-        let l = d.layers.first().map(|l| l.id);
-        for i in 0..4u32 {
-            let photo = Renderer::new().render(&art, 6000, 4000, Affine::scale(3.75 + f64::from(i) * 0.1), &opts).to_png()?;
-            let key = format!("photo {i}");
-            d.images.insert(key.clone(), vectorcraft_doc::ImageBlob::new("image/png", photo));
-            let xf = Affine::translate((f64::from(i % 2) * 800.0, f64::from(i / 2) * 600.0)) * Affine::scale(800.0 / 6000.0);
-            let image = vectorcraft_doc::ImageObject { key, width: 6000, height: 4000, xf, link: None, placement: Default::default() };
-            let id = d.alloc_id();
-            d.insert(l, usize::MAX, Node::new(id, vectorcraft_doc::NodeKind::Image(Box::new(image)))).map_err(|e| e.to_string())?;
-        }
-        note("4 embedded 24 MP photos");
-        let mut renderers = [Renderer::new(), Renderer::new(), Renderer::new()];
-        let ms = median_ms(1, || {
-            for r in &mut renderers {
-                r.render(&d, 2880, 1800, Affine::scale(1.6), &opts);
-            }
-        });
-        rows.push(("render 4 embedded 24 MP photos with 3 renderers (cold)".into(), ms));
-        note("after rendering the photos with 3 renderers");
-    }
-    // Output hashes, to compare builds: the SVG export and a save → open → save round trip.
-    let fnv = |b: &[u8]| b.iter().fold(0xcbf2_9ce4_8422_2325u64, |h, &x| (h ^ u64::from(x)).wrapping_mul(0x100_0000_01b3));
-    let doc = synthetic(n)?;
-    let svg = vectorcraft_svg::export(&doc, &vectorcraft_svg::ExportOptions::default());
-    let saved = vectorcraft_format::save_file(&doc);
-    let reopened = vectorcraft_format::load(&saved).map_err(|e| e.to_string())?;
-    outln!("  output hash: SVG export {:016x}, save→open→save {:016x}", fnv(svg.as_bytes()), fnv(&vectorcraft_format::save_file(&reopened)));
-    outln!("  tracked (no budget yet)");
-    for (name, ms) in &rows {
-        outln!("  {name:<52} {ms:>10.2} ms");
-    }
-    // `rss_mb` reads the working set on Windows.
-    let memory = if cfg!(windows) { "working set" } else { "memory" };
-    for (what, mb) in &mem {
-        outln!("  {:<52} {mb:>8.0} MB", format!("{memory} {what}"));
-    }
-    Ok(())
-}
-
 pub fn run(args: &[String]) -> Result<(), String> {
    let mut n = 50_000usize;
-    let mut want_deep = false;
    let mut it = args.iter();
    while let Some(a) = it.next() {
        match a.as_str() {
-            "--deep" => want_deep = true,
            "--paths" => n = it.next().and_then(|v| v.parse().ok()).ok_or("--paths needs a number")?,
            other => return Err(format!("unknown perf option `{other}`")),
        }
    }
    let cores = std::thread::available_parallelism().map_or(1, |c| c.get());
-    // The figure is the 1-minute load average, or on Windows the cores busy over one second.
-    #[cfg(not(windows))]
-    let (load, label) = (load_average(), "load average");
-    #[cfg(windows)]
-    let (load, label) = (busy_cores(cores), "cores busy");
-    outln!("VectorCraft performance budgets — {n} paths, {cores} cores, {label} {}", load.map_or("?".into(), |l| format!("{l:.1}")));
+    let load = load_average();
+    outln!("VectorCraft performance budgets — {n} paths, {cores} cores, load average {}", load.map_or("?".into(), |l| format!("{l:.1}")));
    let noisy = load.is_some_and(|l| l > cores as f64 * 0.75);
    if noisy {
        outln!("WARNING: the machine is busy; wall-clock timings below are not trustworthy.");
@@ -376,9 +200,6 @@ pub fn run(args: &[String]) -> Result<(), String> {
    if let Some(e) = failed {
        return Err(e);
    }
-    if want_deep {
-        deep(n)?;
-    }

    let mut over = 0;
    outln!("  {:<40} {:>10} {:>10}", "", "measured", "budget");
@@ -396,38 +217,3 @@ pub fn run(args: &[String]) -> Result<(), String> {
        _ => Err(format!("{over} budget(s) exceeded")),
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn busy_share_leaves_out_idle_time() {
-        // In one second four processors log 40,000,000 ticks of 100 ns of kernel and user time,
-        // 10,000,000 of them idle.
-        assert_eq!(busy_share([7, 100, 50], [10_000_007, 25_000_100, 15_000_050]), Some(0.75));
-        // There is no share when no time passed, a time went back, or the idle time exceeds the
-        // kernel and user time.
-        assert_eq!(busy_share([7, 100, 50], [7, 100, 50]), None);
-        assert_eq!(busy_share([7, 100, 50], [8, 99, 60]), None);
-        assert_eq!(busy_share([0, 0, 0], [30, 10, 10]), None);
-    }
-
-    /// On Windows `busy_cores` gives a number between 0 and the cores.
-    #[cfg(windows)]
-    #[test]
-    fn windows_reads_how_many_cores_are_busy() {
-        let cores = std::thread::available_parallelism().map_or(1, |c| c.get());
-        let busy = busy_cores(cores);
-        assert!(busy.is_some_and(|b| (0.0..=cores as f64).contains(&b)), "{busy:?} of {cores}");
-    }
-
-    /// On Windows `rss_mb` gives this process's working set: more than 0 MB and less than
-    /// 10,000 MB.
-    #[cfg(windows)]
-    #[test]
-    fn windows_reads_the_working_set() {
-        let mb = rss_mb();
-        assert!(mb.is_some_and(|mb| mb > 0.0 && mb < 10_000.0), "{mb:?}");
-    }
-}
@@ -83,89 +83,6 @@ fn mcp_headless_over_stdio() {
    assert_eq!(replies[3]["result"]["content"][0]["type"], "image");
 }

-/// `mcp --automation-read-root` / `--automation-write-root` (#832): the flags are checked before the
-/// server starts, and the process then reads and writes only inside its roots.
-#[test]
-fn mcp_automation_roots() {
-    let base = tmp("roots");
-    for d in ["in", "out", "outside"] {
-        std::fs::create_dir_all(base.join(d)).unwrap();
-    }
-    let svg = r#"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="30"><rect width="20" height="10"/></svg>"#;
-    std::fs::write(base.join("in/a.svg"), svg).unwrap();
-    std::fs::write(base.join("outside/b.svg"), svg).unwrap();
-    std::fs::write(base.join("outside/victim.png"), b"keep this file").unwrap();
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::symlink;
-        symlink(base.join("outside/b.svg"), base.join("in/escape.svg")).unwrap();
-        symlink(base.join("outside"), base.join("out/escape")).unwrap();
-        symlink(base.join("outside/victim.png"), base.join("out/victim.png")).unwrap();
-        symlink(base.join("outside/missing.png"), base.join("out/dangling.png")).unwrap();
-    }
-    let dir = |d: &str| base.join(d).to_string_lossy().into_owned();
-    let fails = |args: &[&str], why: &str| {
-        let out = Command::new(BIN).args(args).stdin(Stdio::null()).output().unwrap();
-        let err = String::from_utf8_lossy(&out.stderr);
-        assert!(!out.status.success() && err.contains(why), "{args:?}: {err}");
-    };
-    fails(&["mcp", "--automation-read-root", &dir("missing")], "cannot open the automation read root");
-    fails(&["mcp", "--automation-read-root", &dir("in"), "--automation-read-root", &dir("out")], "given twice");
-    fails(&["mcp", "--automation-write-root"], "needs a folder");
-    fails(&["mcp", "--connect", "127.0.0.1:1", &format!("--automation-write-root={}", dir("out"))], "a running app enforces its own roots");
-
-    let mut child = Command::new(BIN)
-        .args(["mcp", "--automation-read-root", &dir("in"), &format!("--automation-write-root={}", dir("out"))])
-        .stdin(Stdio::piped())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::null())
-        .spawn()
-        .unwrap();
-    let call = |id: u64, name: &str, args: Value| json!({"jsonrpc":"2.0","id":id,"method":"tools/call","params":{"name":name,"arguments":args}});
-    let file = |d: &str, f: &str| base.join(d).join(f).to_string_lossy().into_owned();
-    let mut calls = vec![
-        call(1, "open_file", json!({"path": file("in", "a.svg")})),
-        call(2, "open_file", json!({"path": file("outside", "b.svg")})),
-        call(3, "export", json!({"path": file("out", "a.png")})),
-        call(4, "export", json!({"path": file("in", "a.png")})),
-        call(5, "save_file", json!({"path": file("outside", "a.vectorcraft")})),
-        call(6, "open_file", json!({"path": file("in", "../outside/b.svg")})),
-        call(7, "export", json!({"path": file("out", "../outside/traversal.png")})),
-    ];
-    let mut expected_errors = vec![false, true, false, true, true, true, true];
-    #[cfg(unix)]
-    {
-        calls.extend([
-            call(8, "open_file", json!({"path": file("in", "escape.svg")})),
-            call(9, "export", json!({"path": file("out", "escape/escaped.png")})),
-            call(10, "export", json!({"path": file("out", "victim.png")})),
-            call(11, "export", json!({"path": file("out", "dangling.png")})),
-        ]);
-        expected_errors.extend([true; 4]);
-    }
-    // An access error is per request: the server continues and can still save inside its root.
-    calls.push(call(12, "save_file", json!({"path": file("out", "allowed.vectorcraft")})));
-    expected_errors.push(false);
-    {
-        let mut stdin = child.stdin.take().unwrap();
-        for m in calls {
-            writeln!(stdin, "{m}").unwrap();
-        }
-    }
-    let out = child.wait_with_output().unwrap();
-    assert!(out.status.success());
-    let replies: Vec<Value> = String::from_utf8(out.stdout).unwrap().lines().map(|l| serde_json::from_str(l).unwrap()).collect();
-    let errors: Vec<bool> = replies.iter().map(|r| r["result"]["isError"] == true).collect();
-    assert_eq!(errors, expected_errors, "{replies:?}");
-    assert!(replies[1]["result"]["content"][0]["text"].as_str().unwrap().contains("outside the read root"));
-    assert!(base.join("out/a.png").is_file() && !base.join("in/a.png").exists() && !base.join("outside/a.vectorcraft").exists());
-    assert!(base.join("out/allowed.vectorcraft").is_file());
-    for denied in ["traversal.png", "escaped.png", "missing.png"] {
-        assert!(!base.join("outside").join(denied).exists(), "{denied}");
-    }
-    assert_eq!(std::fs::read(base.join("outside/victim.png")).unwrap(), b"keep this file");
-}
-
 /// End-to-end protocol sweep over stdio against the compiled binary. The in-process
 /// tests drive `Server::handle_line` directly, so the binary's own wiring (argument
 /// parsing, logger install, stdout pollution, notification order) is untested: this
@@ -220,7 +137,7 @@ fn mcp_protocol_over_stdio() {
    assert!(r["result"]["completion"]["values"].as_array().is_some_and(|v| v.contains(&json!("svg"))), "{r}");

    send(&mut stdin, json!({"jsonrpc":"2.0","id":5,"method":"resources/list","params":{}}));
-    assert!(recv(&mut lines, &mut notes, 5)["result"]["resources"].as_array().is_some_and(|v| v.len() == 3));
+    assert!(recv(&mut lines, &mut notes, 5)["result"]["resources"].as_array().is_some_and(|v| v.len() == 2));
    send(&mut stdin, json!({"jsonrpc":"2.0","id":6,"method":"resources/templates/list","params":{}}));
    assert!(recv(&mut lines, &mut notes, 6)["result"]["resourceTemplates"].as_array().is_some_and(|v| v.len() >= 4));

@@ -328,21 +245,3 @@ fn closed_stdout_ends_quietly() {
    let err = String::from_utf8_lossy(&out.stderr);
    assert!(out.status.success() && !err.contains("panicked"), "{:?}: {err}", out.status);
 }
-
-/// #1005: `run` whose reader has gone (`vectorcraft-cli run … | true`) ends quietly with status 0,
-/// and its later steps still run; a failing step still fails.
-#[test]
-fn run_with_a_closed_stdout_ends_quietly_and_finishes_the_batch() {
-    let svg = tmp("closed-run.svg");
-    let _ = std::fs::remove_file(&svg);
-    let rect = r#"{"x":1,"y":1,"width":5,"height":5}"#;
-    let args = ["run", "--cmd", "document.json", "--cmd", "shape.rectangle", "--params", rect, "--export", svg.to_str().unwrap()];
-    let mut child = Command::new(BIN).args(args).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
-    drop(child.stdout.take());
-    let out = child.wait_with_output().unwrap();
-    let err = String::from_utf8_lossy(&out.stderr);
-    assert!(out.status.success() && err.is_empty(), "{:?}: {err}", out.status);
-    assert!(svg.is_file(), "the export after the closed reader still ran");
-    let out = Command::new(BIN).args(["run", "--cmd", "not-a-command"]).stdout(Stdio::null()).output().unwrap();
-    assert!(!out.status.success());
-}
@@ -83,12 +83,6 @@ fn help_lists_readable_formats() {
    assert!(out.contains("Readable formats: .vectorcraft") && out.contains(".ait") && out.contains(".webp"), "{out}");
 }

-#[test]
-fn help_lists_perf_deep() {
-    let out = ok(&["--help"]);
-    assert!(out.contains("vectorcraft-cli perf [--paths N] [--deep]") && out.contains("--deep also times"), "{out}");
-}
-
 /// `info` reports the import warnings: an EPS read only up to an error names it.
 #[test]
 fn info_reports_why_an_eps_read_partly() {
@@ -17,7 +17,6 @@ path = "src/main.rs"
 vectorcraft-engine = { workspace = true }
 vectorcraft-ui-egui = { workspace = true }
 vectorcraft-format = { workspace = true }
-vectorcraft-text = { workspace = true }
 egui = { workspace = true }
 log = { workspace = true }

@@ -28,4 +27,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage", "Navigator", "RequestInit", "Response", "AbortController", "AbortSignal"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage", "Navigator"] }
@@ -8,11 +8,3 @@ filehash = true
 [serve]
 addresses = ["127.0.0.1"]
 port = 8766
-
-# Copy the craft-fonts faces web builds fetch (crates/text/web-fonts.txt) into the site's fonts/
-# folder; a no-op without CRAFT_FONTS_DIR. Runs for `trunk serve` and `trunk build`, through cargo so
-# it needs no shell (xtask/src/web_fonts.rs).
-[[hooks]]
-stage = "post_build"
-command = "cargo"
-command_arguments = ["xtask", "web-fonts"]
@@ -1,109 +0,0 @@
-//! Craft-fonts faces served beside the wasm (`fonts/<sha16>/…`, copied by
-//! `cargo xtask web-fonts`) instead of embedded: [`load_startup_fonts`] fetches the `startup`
-//! ones before the app starts, [`spawn_background_fonts`] the rest once it runs. The browser checks
-//! each file against its SHA-256 (Subresource Integrity). A face that fails is logged and skipped:
-//! the app runs without it. With `WEB_FONTS` empty (built without craft-fonts) both do nothing.
-
-use std::cell::Cell;
-use std::rc::Rc;
-
-use vectorcraft_text::{FontDb, WEB_FONTS, WebFont};
-use wasm_bindgen::JsCast as _;
-use wasm_bindgen::closure::Closure;
-use wasm_bindgen_futures::JsFuture;
-
-/// Per startup face: the page shows its loading text meanwhile.
-const STARTUP_TIMEOUT_MS: i32 = 20_000;
-/// Per background face.
-const BACKGROUND_TIMEOUT_MS: i32 = 120_000;
-/// Background fetches at once, leaving the connection to the app's own requests.
-const BACKGROUND_PARALLEL: usize = 4;
-
-thread_local! {
-    /// The background fetch runs once per page, though a graphics restart creates the app again.
-    static BACKGROUND_STARTED: Cell<bool> = const { Cell::new(false) };
-}
-
-/// Fetch and register the `startup` faces (one after the other). Returns how many loaded.
-pub async fn load_startup_fonts() -> usize {
-    let mut loaded = 0;
-    for f in WEB_FONTS.iter().filter(|f| f.startup) {
-        if load(f, STARTUP_TIMEOUT_MS).await {
-            loaded += 1;
-        }
-    }
-    loaded
-}
-
-/// Fetch and register the `background` faces, [`BACKGROUND_PARALLEL`] at a time, asking `ctx` for
-/// a frame after each so the font menus and the canvas pick it up. Only the first call does
-/// anything.
-pub fn spawn_background_fonts(ctx: egui::Context) {
-    if BACKGROUND_STARTED.with(|s| s.replace(true)) {
-        return;
-    }
-    let queue: Rc<Vec<&'static WebFont>> = Rc::new(WEB_FONTS.iter().filter(|f| !f.startup).collect());
-    let next = Rc::new(Cell::new(0usize));
-    for _ in 0..BACKGROUND_PARALLEL.min(queue.len()) {
-        let (queue, next, ctx) = (queue.clone(), next.clone(), ctx.clone());
-        wasm_bindgen_futures::spawn_local(async move {
-            loop {
-                let i = next.get();
-                next.set(i + 1);
-                let Some(f) = queue.get(i) else { break };
-                if load(f, BACKGROUND_TIMEOUT_MS).await {
-                    ctx.request_repaint();
-                }
-            }
-        });
-    }
-}
-
-/// Fetch one face and add it to the font database. False (and a console warning) on failure.
-async fn load(f: &WebFont, timeout_ms: i32) -> bool {
-    let bytes = match fetch(f.url, f.integrity, timeout_ms).await {
-        Ok(bytes) => bytes,
-        Err(e) => {
-            log::warn!("web font {} {}: {e}", f.family, f.style);
-            return false;
-        }
-    };
-    if FontDb::global().add_font(bytes) == 0 {
-        log::warn!("web font {} {}: not a font, or already loaded", f.family, f.style);
-        return false;
-    }
-    true
-}
-
-/// GET `url` (relative to the page) with Subresource Integrity `integrity`, aborted after
-/// `timeout_ms`.
-async fn fetch(url: &str, integrity: &str, timeout_ms: i32) -> Result<Vec<u8>, String> {
-    let window = web_sys::window().ok_or("no window")?;
-    let abort = web_sys::AbortController::new().map_err(js)?;
-    let init = web_sys::RequestInit::new();
-    init.set_method("GET");
-    init.set_integrity(integrity);
-    init.set_signal(Some(&abort.signal()));
-    let on_timeout = {
-        let abort = abort.clone();
-        Closure::<dyn FnMut()>::new(move || abort.abort())
-    };
-    let timer = window.set_timeout_with_callback_and_timeout_and_arguments_0(on_timeout.as_ref().unchecked_ref(), timeout_ms).map_err(js)?;
-    let result = async {
-        let response: web_sys::Response = JsFuture::from(window.fetch_with_str_and_init(url, &init)).await.map_err(js)?.dyn_into().map_err(js)?;
-        if !response.ok() {
-            return Err(format!("HTTP {} for {url}", response.status()));
-        }
-        let buffer = JsFuture::from(response.array_buffer().map_err(js)?).await.map_err(js)?;
-        Ok(js_sys::Uint8Array::new(&buffer).to_vec())
-    }
-    .await;
-    window.clear_timeout_with_handle(timer);
-    // Kept alive until the timer can no longer fire.
-    drop(on_timeout);
-    result
-}
-
-fn js(e: wasm_bindgen::JsValue) -> String {
-    format!("{e:?}")
-}
@@ -14,8 +14,6 @@
 //! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?lang=es` (any
 //! language code) stands in for the browser's languages when the interface language is Automatic.

-#[cfg(target_arch = "wasm32")]
-mod fonts;
 #[cfg(target_arch = "wasm32")]
 mod locks;
 #[cfg(target_arch = "wasm32")]
@@ -6,7 +6,7 @@ use std::rc::Rc;
 use std::sync::{Arc, Mutex};

 use vectorcraft_engine::Session;
-use vectorcraft_engine::cmd::clipboard::{FILE_HEAD, Flavour, PASTE_ORDER, file_flavour, is_address};
+use vectorcraft_engine::cmd::clipboard::{FILE_HEAD, Flavour, PASTE_ORDER, file_flavour};
 use vectorcraft_engine::cmd::fileio;
 use vectorcraft_engine::cmd::recovery::{self, Hold, RecoveryStore};
 use vectorcraft_ui_egui::graphics::GraphicsLoss;
@@ -64,9 +64,6 @@ pub fn start() {
    wasm_bindgen_futures::spawn_local(async move {
        // Before the first frame, which looks for copies a crash left behind.
        let locks = WebLocks::start(RECOVERY_PREFIX).await;
-        // Fallback fonts the first frame needs (Noto Sans Arabic), fetched while the loading text
-        // shows; the rest load in the background once the app runs.
-        crate::fonts::load_startup_fonts().await;
        let host = Host {
            runner: eframe::WebRunner::new(),
            inbox: Arc::default(),
@@ -102,7 +99,6 @@ async fn run(host: Host, canvas: web_sys::HtmlCanvasElement, moving: Option<Movi
            web_options(),
            Box::new(move |cc| {
                let ctx = &cc.egui_ctx;
-                crate::fonts::spawn_background_fonts(ctx.clone());
                let loss = GraphicsLoss::default();
                watch_canvas(&page, &loss, ctx);
                if let Some(rs) = &cc.wgpu_render_state {
@@ -204,9 +200,7 @@ fn track_paste(pasted: &Rc<RefCell<Pasted>>) {
    let on_paste = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::ClipboardEvent)>::new(move |e: web_sys::ClipboardEvent| {
        let Some(data) = e.clipboard_data() else { return };
        let Some(files) = data.files().filter(|f| f.length() > 0) else { return };
-        // Text is egui's, but for the address a browser's Copy Image puts next to the picture.
-        // Blank text is not a caption. A picture pasted with it is still the picture.
-        if data.get_data("text").is_ok_and(|t| !t.trim().is_empty() && !is_address(&t)) {
+        if data.get_data("text").is_ok_and(|t| !t.is_empty()) {
            return;
        }
        e.prevent_default();
@@ -309,8 +303,7 @@ fn notice(lines: &[&str]) {
 }

 /// Wraps the app to read dropped files asynchronously (browsers can't read them synchronously)
-/// and feed them through the inboxes: placed where they were dropped on the canvas, else opened
-/// (libraries, presets and plug-ins open wherever they are dropped).
+/// and feed them through the inboxes: placed where they were dropped on the canvas, else opened.
 /// When the graphics are lost it hands the app to a new runner on a new canvas.
 struct WebShell {
    /// `None` once handed on.
@@ -403,10 +396,7 @@ fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context, locks: Op
            let inbox = picked.clone();
            let ctx = place_ctx.clone();
            wasm_bindgen_futures::spawn_local(async move {
-                let dialog =
-                    fileio::place_filters().fold(rfd::AsyncFileDialog::new().set_title(vectorcraft_ui_egui::i18n::t("Place")), |d, (name, exts)| {
-                        d.add_filter(vectorcraft_ui_egui::i18n::tr_ctx(vectorcraft_ui_egui::i18n::current(), "file-filter", name), exts)
-                    });
+                let dialog = fileio::place_filters().fold(rfd::AsyncFileDialog::new().set_title("Place"), |d, (name, exts)| d.add_filter(name, exts));
                let Some(files) = dialog.pick_files().await else {
                    return;
                };
@@ -423,9 +413,7 @@ fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context, locks: Op
            let inbox = open_inbox.clone();
            let ctx = ctx.clone();
            wasm_bindgen_futures::spawn_local(async move {
-                let dialog = fileio::open_filters().fold(rfd::AsyncFileDialog::new(), |d, (name, exts)| {
-                    d.add_filter(vectorcraft_ui_egui::i18n::tr_ctx(vectorcraft_ui_egui::i18n::current(), "file-filter", name), exts)
-                });
+                let dialog = fileio::open_filters().fold(rfd::AsyncFileDialog::new(), |d, (name, exts)| d.add_filter(name, exts));
                let Some(file) = dialog.pick_file().await else {
                    return;
                };
@@ -11,7 +11,7 @@ workspace = true

 [features]
 default = ["wgpu", "accessibility"]
-wgpu = ["eframe/wgpu", "dep:winsafe"]
+wgpu = ["eframe/wgpu"]
 accessibility = ["eframe/accesskit"]
 # Build with --no-default-features --features windows7 and the win7 Rust target.
 windows7 = ["eframe/glow"]
@@ -19,7 +19,6 @@ windows7 = ["eframe/glow"]
 [dependencies]
 vectorcraft-engine = { workspace = true }
 vectorcraft-ui-egui = { workspace = true }
-vectorcraft-text = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wayland", "x11"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
@@ -34,48 +33,18 @@ webbrowser = { workspace = true }
 # The window's monitors, size and position (the same winit eframe runs on).
 winit = { version = "0.30", default-features = false }

-# The win7 target retains the viewer fallback; craft-print's WinRT PDF renderer needs newer Windows.
-[target.'cfg(all(not(target_arch = "wasm32"), not(target_vendor = "win7")))'.dependencies]
-craft-print = { workspace = true }
-
 [target.'cfg(windows)'.dependencies]
 clipboard-win = { workspace = true }
-# Which GPU drives which display (EnumDisplayDevices, src/gpu.rs), so the window is drawn on the
-# GPU that shows it: drawing on a GPU without a monitor reset the display driver. Safe wrappers over
-# Win32 (MIT); the `user` feature is User32.dll only. Only the wgpu renderer chooses an adapter.
-winsafe = { version = "0.0.29", default-features = false, features = ["user"], optional = true }
-
-# DirectWrite's system font collection (src/system_fonts.rs): fonts that font services such as
-# Adobe Fonts load in place (#579). MIT OR Apache-2.0, already in the build through accesskit.
-[target.'cfg(all(windows, not(target_vendor = "win7")))'.dependencies]
-windows = { version = "0.62", features = ["Win32_Graphics_DirectWrite"] }

 [target.'cfg(target_os = "macos")'.dependencies]
 # The macOS menu bar (src/mac_menu.rs): Tauri's menu crate, AppKit menus behind a safe API (no GTK
 # with default features off). Pinned exactly: review the diff before bumping.
 muda = { version = "=0.21.1", default-features = false }
 objc2 = "0.6"
-objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSButton", "NSControl", "NSMenu", "NSEvent", "NSPasteboard", "NSPopUpButton", "NSResponder", "NSSavePanel", "NSTextField", "NSTextInputContext", "NSView", "NSWindow"] }
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSEvent", "NSPasteboard", "NSResponder", "NSTextInputContext"] }
 # Files opened from Finder and the Dock (src/open_documents.rs) and pasted bitmaps (src/clipboard.rs); both already come with winit, muda and rfd.
-objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSData", "NSGeometry", "NSNotification", "NSOperation", "NSString", "NSURL"] }
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSData", "NSNotification", "NSOperation", "NSString", "NSURL"] }
 block2 = "0.6"
-# The window's AppKit view, to centre its buttons on the app bar (src/mac_window.rs). MIT OR
-# Apache-2.0 OR Zlib, already in the build through eframe and winit.
-raw-window-handle = "0.6"
-# CoreText's font manager (src/mac_fonts.rs): fonts that apps and font managers register from their
-# own folders (#579). Zlib OR Apache-2.0 OR MIT; objc2-core-foundation already comes with
-# objc2-foundation.
-objc2-core-foundation = { version = "0.3", default-features = false, features = ["std", "CFArray", "CFString", "CFURL"] }
-objc2-core-text = { version = "0.3", default-features = false, features = ["std", "CTFontManager"] }
-# Waits for the answer of a file dialog shown as a sheet (src/main.rs, #867). MIT OR Apache-2.0,
-# already in the build through eframe.
-pollster = "1"
-
-[target.'cfg(target_os = "linux")'.dependencies]
-# Asks the Wayland compositor which GPU it draws with (linux-dmabuf feedback, src/compositor_gpu.rs),
-# so Automatic draws on that one. Both are already in the build through winit.
-wayland-client = "0.31"
-wayland-protocols = { version = "0.32", features = ["client"] }

 [build-dependencies]
 # Icon + VERSIONINFO for vectorcraft.exe; build.rs only uses it when targeting Windows.
@@ -1,185 +0,0 @@
-//! Parse the control port and automation roots before starting any desktop services. A malformed
-//! flag must not silently remove a root and leave the control channel unconfined, or leave the app
-//! running without the control channel that was asked for.
-
-use std::ffi::OsString;
-use std::path::PathBuf;
-
-pub struct AutomationArgs {
-    pub read_root: Option<PathBuf>,
-    pub write_root: Option<PathBuf>,
-    read_given: bool,
-    write_given: bool,
-}
-
-impl AutomationArgs {
-    pub fn new(read_root: Option<PathBuf>, write_root: Option<PathBuf>) -> Self {
-        Self { read_root, write_root, read_given: false, write_given: false }
-    }
-
-    /// Returns whether this argument is a root flag. CLI values override environment defaults
-    /// once; a second occurrence is an error, including when the two spellings are mixed.
-    pub fn consume(&mut self, arg: &str, args: &mut impl Iterator<Item = String>) -> Result<bool, String> {
-        let (flag, inline) = arg.split_once('=').map_or((arg, None), |(flag, value)| (flag, Some(value)));
-        let (root, given) = match flag {
-            "--automation-read-root" => (&mut self.read_root, &mut self.read_given),
-            "--automation-write-root" => (&mut self.write_root, &mut self.write_given),
-            _ => return Ok(false),
-        };
-        if *given {
-            return Err(format!("{flag} given twice"));
-        }
-        let value = match inline {
-            Some(value) => value.to_owned(),
-            None => {
-                let value = args.next().ok_or_else(|| format!("{flag} needs a folder"))?;
-                if value.starts_with('-') {
-                    return Err(format!("{flag} needs a folder; use {flag}=<dir> for a folder starting with '-'"));
-                }
-                value
-            }
-        };
-        if value.is_empty() {
-            return Err(format!("{flag} needs a non-empty folder"));
-        }
-        *root = Some(value.into());
-        *given = true;
-        Ok(true)
-    }
-}
-
-/// `--control <port>` or `--control=<port>`, given at most once.
-#[derive(Default)]
-pub struct ControlArg {
-    pub port: Option<u16>,
-}
-
-impl ControlArg {
-    /// Returns whether this argument is `--control`. The next argument is its port whatever it
-    /// is, so `--control --automation-read-root` reports the flag rather than reading it as a root.
-    pub fn consume(&mut self, arg: &str, args: &mut impl Iterator<Item = String>) -> Result<bool, String> {
-        let value = match arg.strip_prefix("--control") {
-            Some("") => args.next(),
-            Some(rest) => match rest.strip_prefix('=') {
-                Some(value) => Some(value.to_owned()),
-                None => return Ok(false),
-            },
-            None => return Ok(false),
-        };
-        if self.port.is_some() {
-            return Err("--control given twice".into());
-        }
-        self.port = Some(port("--control", value.as_deref())?);
-        Ok(true)
-    }
-}
-
-/// `VECTORCRAFT_CONTROL_PORT`, for when `--control` isn't given: unset or empty is no control
-/// channel, anything else must be a port.
-pub fn env_control_port(value: Option<OsString>) -> Result<Option<u16>, String> {
-    match value {
-        Some(v) if !v.is_empty() => port("VECTORCRAFT_CONTROL_PORT", Some(&v.to_string_lossy())).map(Some),
-        _ => Ok(None),
-    }
-}
-
-/// A port from 1 to 65535 (the server would listen on 0's random port without saying which).
-fn port(name: &str, value: Option<&str>) -> Result<u16, String> {
-    let need = format!("{name} needs a port number from 1 to 65535");
-    match value {
-        None => Err(need),
-        Some(v) => v.parse().ok().filter(|&p| p != 0).ok_or(format!("{need}, not `{v}`")),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn roots_override_environment_once_and_leave_other_arguments() {
-        let mut roots = AutomationArgs::new(Some("environment".into()), None);
-        let mut args = ["a folder".to_owned(), "drawing.svg".to_owned()].into_iter();
-        assert!(roots.consume("--automation-read-root", &mut args).unwrap());
-        assert!(roots.consume("--automation-write-root=out", &mut args).unwrap());
-        assert!(!roots.consume("--in-window-menus", &mut args).unwrap());
-        assert_eq!(roots.read_root, Some("a folder".into()));
-        assert_eq!(roots.write_root, Some("out".into()));
-        assert_eq!(args.next().as_deref(), Some("drawing.svg"));
-        assert!(roots.consume("--automation-read-root=other", &mut args).is_err());
-        assert_eq!(roots.read_root, Some("a folder".into()));
-    }
-
-    #[test]
-    fn invalid_operands_preserve_environment_roots() {
-        for flag in ["--automation-read-root", "--automation-write-root"] {
-            for operand in [None, Some(""), Some("--version"), Some("--control"), Some("-folder")] {
-                let mut roots = AutomationArgs::new(Some("read".into()), Some("write".into()));
-                let mut args = operand.map(str::to_owned).into_iter();
-                assert!(roots.consume(flag, &mut args).is_err(), "{flag} {operand:?}");
-                assert_eq!(roots.read_root, Some("read".into()));
-                assert_eq!(roots.write_root, Some("write".into()));
-            }
-            let mut roots = AutomationArgs::new(None, None);
-            assert!(roots.consume(&format!("{flag}="), &mut std::iter::empty()).is_err());
-        }
-    }
-
-    #[test]
-    fn explicit_dash_folder_and_relative_dash_folder_are_valid() {
-        let mut roots = AutomationArgs::new(None, None);
-        assert!(roots.consume("--automation-read-root=-folder", &mut std::iter::empty()).unwrap());
-        assert!(roots.consume("--automation-write-root", &mut ["./-folder".to_owned()].into_iter()).unwrap());
-        assert_eq!(roots.read_root, Some("-folder".into()));
-        assert_eq!(roots.write_root, Some("./-folder".into()));
-    }
-
-    fn control(args: &[&str]) -> Result<Option<u16>, String> {
-        let mut control = ControlArg::default();
-        let mut args = args.iter().map(|a| a.to_string());
-        while let Some(a) = args.next() {
-            assert!(control.consume(&a, &mut args)?, "{a}");
-        }
-        Ok(control.port)
-    }
-
-    #[test]
-    fn control_needs_a_port_from_1_to_65535() {
-        let need = "--control needs a port number from 1 to 65535";
-        assert_eq!(control(&["--control"]), Err(need.into()));
-        assert_eq!(control(&["--control", "--automation-read-root"]), Err(format!("{need}, not `--automation-read-root`")));
-        for bad in ["abc", "0", "70000", "-1", ""] {
-            assert_eq!(control(&["--control", bad]), Err(format!("{need}, not `{bad}`")));
-            assert_eq!(control(&[&format!("--control={bad}")]), Err(format!("{need}, not `{bad}`")));
-        }
-        assert_eq!(control(&["--control", "7979"]), Ok(Some(7979)));
-        assert_eq!(control(&["--control=65535"]), Ok(Some(65535)));
-        assert_eq!(control(&["--control", "7979", "--control=7980"]), Err("--control given twice".into()));
-    }
-
-    #[test]
-    fn other_arguments_are_not_control() {
-        let mut control = ControlArg::default();
-        let mut args = ["7979".to_owned()].into_iter();
-        for other in ["--controls", "--control-port", "drawing.svg", "--in-window-menus"] {
-            assert!(!control.consume(other, &mut args).unwrap(), "{other}");
-        }
-        assert_eq!(args.next().as_deref(), Some("7979"));
-        assert_eq!(control.port, None);
-    }
-
-    #[test]
-    fn control_port_variable_is_a_port_or_unset() {
-        assert_eq!(env_control_port(None), Ok(None));
-        assert_eq!(env_control_port(Some("".into())), Ok(None));
-        assert_eq!(env_control_port(Some("7979".into())), Ok(Some(7979)));
-        let need = "VECTORCRAFT_CONTROL_PORT needs a port number from 1 to 65535";
-        assert_eq!(env_control_port(Some("abc".into())), Err(format!("{need}, not `abc`")));
-        assert_eq!(env_control_port(Some("0".into())), Err(format!("{need}, not `0`")));
-        #[cfg(unix)]
-        {
-            use std::os::unix::ffi::OsStringExt;
-            assert_eq!(env_control_port(Some(OsString::from_vec(vec![0x39, 0xff]))), Err(format!("{need}, not `9\u{fffd}`")));
-        }
-    }
-}
@@ -2,21 +2,20 @@
 //! (`Services::system_clipboard`).
 //!
 //! - Windows: text, SVG, PDF, PNG and an opaque bitmap (for apps that don't read PNG) in one go;
-//!   Paste reads each of them and EPS, a bitmap as PNG, else as the device-independent bitmap that
+//!   Paste reads each of them, a bitmap as PNG, else as the device-independent bitmap that
 //!   screenshots and most apps copy (`CF_DIBV5`, `CF_DIB`; the system makes them of a `CF_BITMAP`).
 //! - macOS and Linux: one format at a time, the text (a type-only copy's text or the SVG markup),
-//!   else the PNG as a bitmap; Paste reads text and bitmaps, and on macOS the pasteboard's SVG, PDF
-//!   and EPS as vector art (#1499) and its PNG or TIFF as they are, as screenshots copy them (on
-//!   Linux arboard reads no other formats). On Wayland, arboard's data-control
+//!   else the PNG as a bitmap; Paste reads text and bitmaps (on macOS the pasteboard's PNG or TIFF
+//!   as they are, as screenshots copy them). On Wayland, arboard's data-control
 //!   backend reads the compositor's clipboard (X11 through XWayland only sees what X11 apps
 //!   copied), falling back to X11 where the compositor lacks the protocol.
-//! - Everywhere: files copied in a file manager paste as the first one that is art (SVG, PDF, EPS,
-//!   a metafile or a bitmap), before the clipboard's other formats (the files' paths as text).
+//! - Everywhere: files copied in a file manager paste as the first one that is art (SVG, PDF, a
+//!   metafile or a bitmap), before the clipboard's other formats (the files' paths as text).

 use std::io::{Cursor, Read};
 use std::path::PathBuf;

-use vectorcraft_engine::cmd::clipboard::{BITMAP, EPS, FILE_HEAD, Flavour, PDF, PNG, SVG, TEXT, file_flavour};
+use vectorcraft_engine::cmd::clipboard::{BITMAP, FILE_HEAD, Flavour, PNG, TEXT, file_flavour};
 use vectorcraft_ui_egui::SystemClipboard;

 /// This platform's system clipboard.
@@ -28,34 +27,6 @@ pub fn system_clipboard() -> Box<dyn SystemClipboard> {
    cb
 }

-/// The registered Windows clipboard formats a flavour is written under (and read from, first held
-/// first).
-#[cfg_attr(not(windows), allow(dead_code))]
-fn windows_formats(mime: &str) -> &'static [&'static str] {
-    match mime {
-        SVG => &["image/svg+xml"],
-        PDF => &["Portable Document Format", "application/pdf"],
-        EPS => &["Encapsulated PostScript", "application/postscript"],
-        PNG => &["PNG"],
-        _ => &[],
-    }
-}
-
-/// The macOS pasteboard types Paste reads for `mime` (`image/*`: any bitmap), best first, each with
-/// the MIME type of its data. They are the system's uniform type identifiers (the values of
-/// `NSPasteboardTypePDF`, `NSPasteboardTypePNG` and `NSPasteboardTypeTIFF` among them) and the
-/// older name some apps still give PDF. Text is read through arboard.
-#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
-fn pasteboard_types(mime: &str) -> &'static [(&'static str, &'static str)] {
-    match mime {
-        SVG => &[("public.svg-image", SVG)],
-        PDF => &[("com.adobe.pdf", PDF), ("Apple PDF pasteboard type", PDF)], // brand-ok: the system's type identifier
-        EPS => &[("com.adobe.encapsulated-postscript", EPS)],                 // brand-ok: the system's type identifier
-        BITMAP => &[("public.png", PNG), ("public.tiff", "image/tiff")],
-        _ => &[],
-    }
-}
-
 /// The text flavour among `flavours`.
 fn text_of(flavours: &[Flavour]) -> Option<String> {
    flavours.iter().find(|f| f.mime == TEXT).map(|f| String::from_utf8_lossy(&f.data).into_owned())
@@ -156,15 +127,27 @@ mod win {
    use std::num::NonZeroU32;

    use clipboard_win::{formats, options::NoClear, raw};
+    use vectorcraft_engine::cmd::clipboard::{PDF, SVG};

    use super::*;

+    /// The registered clipboard formats a flavour is written under (and read from, first held
+    /// first).
+    fn names(mime: &str) -> &'static [&'static str] {
+        match mime {
+            SVG => &["image/svg+xml"],
+            PDF => &["Portable Document Format", "application/pdf"],
+            PNG => &["PNG"],
+            _ => &[],
+        }
+    }
+
    /// The device-independent bitmaps, the one that carries alpha first. Each is there whenever the
    /// other or a `CF_BITMAP` is: the system converts between them.
    const DIBS: [u32; 2] = [formats::CF_DIBV5, formats::CF_DIB];

    fn formats_of(mime: &str) -> impl Iterator<Item = u32> {
-        windows_formats(mime).iter().filter_map(|n| raw::register_format(n)).map(NonZeroU32::get)
+        names(mime).iter().filter_map(|n| raw::register_format(n)).map(NonZeroU32::get)
    }

    fn err(e: impl std::fmt::Display) -> String {
@@ -367,30 +350,27 @@ mod portable {
            if let Some(f) = cb.get().file_list().ok().and_then(|paths| copied_file(paths, mimes)) {
                return Some(f);
            }
-            mimes.iter().find_map(|m| {
-                #[cfg(target_os = "macos")]
-                if let Some(f) = super::mac::read(m) {
-                    return Some(f);
-                }
-                match *m {
-                    TEXT => cb.get_text().ok().filter(|t| !t.is_empty()).map(|t| Flavour { mime: TEXT, data: t.into_bytes() }),
-                    BITMAP => {
-                        let img = cb.get_image().ok()?;
-                        let rgba =
-                            image::RgbaImage::from_raw(u32::try_from(img.width).ok()?, u32::try_from(img.height).ok()?, img.bytes.into_owned())?;
-                        png_flavour(&rgba)
+            mimes.iter().find_map(|m| match *m {
+                TEXT => cb.get_text().ok().filter(|t| !t.is_empty()).map(|t| Flavour { mime: TEXT, data: t.into_bytes() }),
+                BITMAP => {
+                    #[cfg(target_os = "macos")]
+                    if let Some(f) = super::mac::bitmap() {
+                        return Some(f);
                    }
-                    _ => None,
+                    let img = cb.get_image().ok()?;
+                    let rgba = image::RgbaImage::from_raw(u32::try_from(img.width).ok()?, u32::try_from(img.height).ok()?, img.bytes.into_owned())?;
+                    png_flavour(&rgba)
                }
+                _ => None,
            })
        }

-        /// Text, and on macOS vector art or a bitmap (by the pasteboard's types). Linux has no
-        /// cheap way to ask for a bitmap (reading one costs as much as pasting it): the paste keys
-        /// take it, the menu item waits for text.
+        /// Text, and on macOS a bitmap (by the pasteboard's types). Linux has no cheap way to ask
+        /// for a bitmap (reading one costs as much as pasting it): the paste keys take it, the
+        /// menu item waits for text.
        fn has(&mut self, mimes: &[&'static str]) -> bool {
            #[cfg(target_os = "macos")]
-            if super::mac::has(mimes) {
+            if mimes.contains(&BITMAP) && super::mac::has_bitmap() {
                return true;
            }
            mimes.contains(&TEXT) && self.cb().is_ok_and(|cb| cb.get_text().is_ok_and(|t| !t.is_empty()))
@@ -398,8 +378,7 @@ mod portable {
    }
 }

-/// The macOS pasteboard's vector art and bitmaps as they are (arboard reads text, and of the
-/// pictures TIFF only, decoded).
+/// The macOS pasteboard's bitmaps as they are (arboard reads TIFF only, and decodes it).
 #[cfg(target_os = "macos")]
 mod mac {
    use objc2::rc::autoreleasepool;
@@ -408,20 +387,24 @@ mod mac {

    use super::*;

-    /// Does the pasteboard hold one of `mimes` ([`pasteboard_types`])? Asks for its types only.
-    pub fn has(mimes: &[&'static str]) -> bool {
+    /// The bitmap types Paste reads, best first (the values of `NSPasteboardTypePNG` and
+    /// `NSPasteboardTypeTIFF`), with their MIME types.
+    const TYPES: [(&str, &str); 2] = [("public.png", PNG), ("public.tiff", "image/tiff")];
+
+    /// Does the pasteboard hold a bitmap? Asks for its types only.
+    pub fn has_bitmap() -> bool {
        autoreleasepool(|_| {
-            let types: Vec<_> = mimes.iter().flat_map(|m| pasteboard_types(m)).map(|(t, _)| NSString::from_str(t)).collect();
+            let types = TYPES.map(|(t, _)| NSString::from_str(t));
            let types: Vec<&NSString> = types.iter().map(|t| &**t).collect();
-            !types.is_empty() && NSPasteboard::generalPasteboard().availableTypeFromArray(&NSArray::from_slice(&types)).is_some()
+            NSPasteboard::generalPasteboard().availableTypeFromArray(&NSArray::from_slice(&types)).is_some()
        })
    }

-    /// The pasteboard's data for `mime`, the first of its types held ([`pasteboard_types`]).
-    pub fn read(mime: &str) -> Option<Flavour> {
+    /// The pasteboard's bitmap, PNG before TIFF.
+    pub fn bitmap() -> Option<Flavour> {
        autoreleasepool(|_| {
            let pasteboard = NSPasteboard::generalPasteboard();
-            pasteboard_types(mime).iter().find_map(|&(t, mime)| {
+            TYPES.into_iter().find_map(|(t, mime)| {
                let data = pasteboard.dataForType(&NSString::from_str(t))?.to_vec();
                (!data.is_empty()).then_some(Flavour { mime, data })
            })
@@ -431,7 +414,7 @@ mod mac {

 #[cfg(test)]
 mod tests {
-    use vectorcraft_engine::cmd::clipboard::{EMF, PASTE_ORDER};
+    use vectorcraft_engine::cmd::clipboard::{PASTE_ORDER, SVG};

    use super::*;

@@ -465,36 +448,6 @@ mod tests {
        assert!(copied_file(vec![], &PASTE_ORDER).is_none());
    }

-    /// What another app copied as vector art is asked for under the names the platforms give it,
-    /// and read as the flavour the paste imports (#1499).
-    #[test]
-    fn vector_art_is_read_under_each_platforms_names() {
-        let mac = |m| pasteboard_types(m).iter().map(|t| t.0).collect::<Vec<_>>();
-        assert_eq!(mac(PDF), ["com.adobe.pdf", "Apple PDF pasteboard type"]);
-        assert_eq!(mac(EPS), ["com.adobe.encapsulated-postscript"]);
-        assert_eq!(mac(SVG), ["public.svg-image"]);
-        assert_eq!(pasteboard_types(BITMAP), [("public.png", PNG), ("public.tiff", "image/tiff")]);
-        assert!(windows_formats(EPS).contains(&"Encapsulated PostScript") && windows_formats(PDF).contains(&"Portable Document Format"));
-        for asked in PASTE_ORDER {
-            // Each type's data is the flavour asked for (a bitmap its own type): what
-            // `clipboard.import*` then reads. Text and metafiles come another way.
-            assert!(pasteboard_types(asked).iter().all(|(_, mime)| *mime == asked || asked == BITMAP), "{asked}");
-            assert_eq!(pasteboard_types(asked).is_empty(), [TEXT, EMF].contains(&asked), "{asked}");
-        }
-        // Vector art before text, text before bitmaps.
-        let at = |m| PASTE_ORDER.iter().position(|x| *x == m).unwrap();
-        assert!(at(PDF) < at(EPS) && at(EPS) < at(TEXT) && at(TEXT) < at(BITMAP));
-    }
-
-    /// An .eps file copied in a file manager pastes as EPS.
-    #[test]
-    fn a_copied_eps_file_pastes() {
-        let eps = dir("eps").join("equation.eps");
-        std::fs::write(&eps, "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 10 10\n0 0 10 10 rectfill\n").unwrap();
-        assert_eq!(copied_file(vec![eps.clone()], &PASTE_ORDER).map(|f| f.mime), Some(EPS));
-        assert!(copied_file(vec![eps], &[BITMAP, TEXT]).is_none());
-    }
-
    #[test]
    fn a_crlf_left_by_the_uri_list_is_ignored() {
        let red = dir("crlf").join("red.png");
@@ -1,178 +0,0 @@
-//! The GPU the Wayland compositor draws with ([`crate::gpu`] ranks it first under Automatic).
-//!
-//! A window drawn on another GPU reaches the compositor as that GPU's buffers, and the compositor
-//! may not show them: it can refuse them and end the window's connection (#502), or take them and
-//! show nothing, with no error on either side, so neither the restart on a failed adapter nor
-//! the first-frame watch notices. The second happened on a hybrid laptop whose Hyprland runs on
-//! the NVIDIA GPU (`AQ_DRM_DEVICES`) while the built-in panel hangs off the Intel one: the panel
-//! rule picked Intel and the window stayed empty. Which GPU drives a display is a guess at the
-//! compositor's GPU; the compositor states it, as the `main_device` of its linux-dmabuf feedback
-//! (protocol version 4): the device it imports client buffers on.
-
-#[cfg(target_os = "linux")]
-use wayland_client::globals::{GlobalListContents, registry_queue_init};
-#[cfg(target_os = "linux")]
-use wayland_client::protocol::wl_registry::{self, WlRegistry};
-#[cfg(target_os = "linux")]
-use wayland_client::{Connection, Dispatch, QueueHandle};
-#[cfg(target_os = "linux")]
-use wayland_protocols::wp::linux_dmabuf::zv1::client::zwp_linux_dmabuf_feedback_v1::{self, ZwpLinuxDmabufFeedbackV1};
-#[cfg(target_os = "linux")]
-use wayland_protocols::wp::linux_dmabuf::zv1::client::zwp_linux_dmabuf_v1::{self, ZwpLinuxDmabufV1};
-
-/// PCI `(vendor, device)` ids of the GPU the Wayland compositor draws with. `None` outside a
-/// Wayland session, when the compositor doesn't say (linux-dmabuf older than version 4), when its
-/// device isn't a PCI GPU, and on other systems.
-#[cfg(target_os = "linux")]
-pub(crate) fn compositor_gpu() -> Option<(u32, u32)> {
-    let device = match main_device() {
-        Ok(device) => device,
-        Err(why) => {
-            log::debug!("the compositor's GPU is unknown: {why}");
-            return None;
-        }
-    };
-    let pci = pci_ids(std::path::Path::new("/sys/dev/char"), device);
-    match pci {
-        Some((vendor, id)) => log::info!("the compositor draws with {vendor:04x}:{id:04x}"),
-        None => log::debug!("the compositor's device {:?} has no PCI ids", major_minor(device)),
-    }
-    pci
-}
-
-#[cfg(not(target_os = "linux"))]
-pub(crate) fn compositor_gpu() -> Option<(u32, u32)> {
-    None
-}
-
-/// The `main_device` of the compositor's default linux-dmabuf feedback, asked on a connection of
-/// its own that is closed again before the window opens.
-#[cfg(target_os = "linux")]
-fn main_device() -> Result<u64, String> {
-    let conn = Connection::connect_to_env().map_err(|e| format!("no Wayland compositor: {e}"))?;
-    let (globals, mut queue) = registry_queue_init::<Feedback>(&conn).map_err(|e| e.to_string())?;
-    let qh = queue.handle();
-    // Version 4 brought the feedback; older compositors only list formats.
-    let dmabuf: ZwpLinuxDmabufV1 = globals.bind(&qh, 4..=4, ()).map_err(|e| format!("linux-dmabuf version 4: {e}"))?;
-    let _feedback = dmabuf.get_default_feedback(&qh, ());
-    let mut state = Feedback::default();
-    // The compositor sends the whole feedback, ending with `done`, in reply; the bound only keeps
-    // a compositor that never ends it from holding up the start.
-    for _ in 0..4 {
-        if state.done {
-            break;
-        }
-        queue.roundtrip(&mut state).map_err(|e| e.to_string())?;
-    }
-    // Dropping the connection releases the objects.
-    let device = state.main_device.ok_or("the compositor named no main device")?;
-    // A `dev_t`, in this machine's byte order.
-    let device: [u8; 8] = device.try_into().map_err(|d: Vec<u8>| format!("a {}-byte device number", d.len()))?;
-    Ok(u64::from_ne_bytes(device))
-}
-
-/// What [`main_device`] collects from the feedback events.
-#[cfg(target_os = "linux")]
-#[derive(Default)]
-struct Feedback {
-    main_device: Option<Vec<u8>>,
-    done: bool,
-}
-
-#[cfg(target_os = "linux")]
-impl Dispatch<WlRegistry, GlobalListContents> for Feedback {
-    fn event(_: &mut Self, _: &WlRegistry, _: wl_registry::Event, _: &GlobalListContents, _: &Connection, _: &QueueHandle<Self>) {}
-}
-
-#[cfg(target_os = "linux")]
-impl Dispatch<ZwpLinuxDmabufV1, ()> for Feedback {
-    // Version 4 sends no format or modifier events: the feedback replaces them.
-    fn event(_: &mut Self, _: &ZwpLinuxDmabufV1, _: zwp_linux_dmabuf_v1::Event, _: &(), _: &Connection, _: &QueueHandle<Self>) {}
-}
-
-#[cfg(target_os = "linux")]
-impl Dispatch<ZwpLinuxDmabufFeedbackV1, ()> for Feedback {
-    fn event(
-        state: &mut Self,
-        _: &ZwpLinuxDmabufFeedbackV1,
-        event: zwp_linux_dmabuf_feedback_v1::Event,
-        _: &(),
-        _: &Connection,
-        _: &QueueHandle<Self>,
-    ) {
-        match event {
-            zwp_linux_dmabuf_feedback_v1::Event::MainDevice { device } => state.main_device = Some(device),
-            zwp_linux_dmabuf_feedback_v1::Event::Done => state.done = true,
-            _ => {}
-        }
-    }
-}
-
-/// The major and minor numbers of a Linux `dev_t`, as glibc's and musl's `major()` and `minor()`
-/// split it.
-#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
-fn major_minor(device: u64) -> (u64, u64) {
-    let major = ((device & 0x0000_0000_000f_ff00) >> 8) | ((device & 0xffff_f000_0000_0000) >> 32);
-    let minor = (device & 0x0000_0000_0000_00ff) | ((device & 0x0000_0fff_fff0_0000) >> 12);
-    (major, minor)
-}
-
-/// The PCI ids of the GPU behind DRM device `device` (its `cardN` or `renderDN` node), from
-/// `<sys_dev_char>/MAJOR:MINOR/device/{vendor,device}`.
-#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
-fn pci_ids(sys_dev_char: &std::path::Path, device: u64) -> Option<(u32, u32)> {
-    let read_hex = |p: std::path::PathBuf| -> Option<u32> {
-        let s = std::fs::read_to_string(p).ok()?;
-        u32::from_str_radix(s.trim().trim_start_matches("0x"), 16).ok()
-    };
-    let (major, minor) = major_minor(device);
-    let gpu = sys_dev_char.join(format!("{major}:{minor}")).join("device");
-    Some((read_hex(gpu.join("vendor"))?, read_hex(gpu.join("device"))?))
-}
-
-#[cfg(test)]
-mod tests {
-    /// glibc's `makedev()`.
-    fn makedev(major: u64, minor: u64) -> u64 {
-        ((major & 0x0000_0fff) << 8) | ((major & 0xffff_f000) << 32) | (minor & 0x0000_00ff) | ((minor & 0xffff_ff00) << 12)
-    }
-
-    #[test]
-    fn device_numbers_split_into_major_and_minor() {
-        // DRM nodes: card1 is 226:1, renderD128 is 226:128.
-        assert_eq!(super::major_minor(0xe201), (226, 1));
-        assert_eq!(super::major_minor(0xe280), (226, 128));
-        for (major, minor) in [(0, 0), (226, 129), (511, 1_048_575), (0xfff, 0xff), (0x1000, 0x100), (0xffff_ffff, 0xffff_ffff)] {
-            assert_eq!(super::major_minor(makedev(major, minor)), (major, minor));
-        }
-    }
-
-    #[cfg(target_os = "linux")]
-    #[test]
-    fn the_gpu_behind_a_device_number_comes_from_sysfs() -> std::io::Result<()> {
-        let dir = std::env::temp_dir().join(format!("vectorcraft-dev-char-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        // /sys/dev/char/226:128 links to the render node, whose `device` is the PCI GPU.
-        std::fs::create_dir_all(dir.join("226:128/device"))?;
-        std::fs::write(dir.join("226:128/device/vendor"), "0x10de\n")?;
-        std::fs::write(dir.join("226:128/device/device"), "0x25ac\n")?;
-        // A device that isn't a PCI GPU (a virtual one) has no ids.
-        std::fs::create_dir_all(dir.join("226:0/device"))?;
-        let render = super::pci_ids(&dir, makedev(226, 128));
-        let virtual_gpu = super::pci_ids(&dir, makedev(226, 0));
-        let missing = super::pci_ids(&dir, makedev(226, 1));
-        std::fs::remove_dir_all(&dir)?;
-        assert_eq!(render, Some((0x10de, 0x25ac)));
-        assert_eq!(virtual_gpu, None);
-        assert_eq!(missing, None);
-        Ok(())
-    }
-
-    #[test]
-    fn the_compositor_names_a_pci_gpu_or_nothing() {
-        // Whatever this session has: no compositor (CI), one that doesn't say, or a PCI GPU.
-        if let Some((vendor, _)) = super::compositor_gpu() {
-            assert_ne!(vendor, 0);
-        }
-    }
-}
@@ -4,25 +4,9 @@
 //! The canvas is rasterized on the CPU; the GPU only composites it and draws the UI, so any
 //! adapter that can present to the window will do. [`adapter_order`] ranks the adapters: those that
 //! can't present to the window's surface never, then the one `WGPU_ADAPTER_NAME` names, hardware
-//! before software, the native backends (Vulkan, Metal, DX12) before OpenGL, the GPU the Wayland
-//! compositor draws with ([`crate::compositor_gpu`]), the GPU that drives a display and the one
-//! that drives the primary display ([`display_gpus`]), the power preference
-//! ([`power_preference`]) among the rest, and a GPU's DX12 adapter before its Vulkan one (#545).
-//! eframe is handed [`selector`], which takes the first of that order.
-//!
-//! A GPU without a monitor is the wrong one even when it can present: on a desktop whose monitors
-//! all hang off the discrete GPU, power saving picked the Ryzen's integrated GPU, Windows had to
-//! present every frame across adapters, and the integrated GPU's driver reset under that, which
-//! lost the graphics device, or took the desktop's compositor and every monitor down for minutes
-//! (pdfcraft#378). So, when Preferences say Automatic, the GPU that drives the display the user
-//! looks at comes first, and the power preference only orders the rest. Windows says which adapter
-//! drives which display (`EnumDisplayDevices`), Linux through sysfs; elsewhere, or when nothing
-//! matches, the order is the power preference's as before. Power Saving and High Performance,
-//! chosen by the user, order by kind as they always did.
-//!
-//! Under Wayland, the compositor's own GPU comes before the displays: the compositor says which
-//! GPU it draws with, and frames from another one may never reach the screen, with no error, even
-//! from the GPU behind the built-in panel when the compositor runs on the discrete one.
+//! before software, the native backends (Vulkan, Metal, DX12) before OpenGL, and the power
+//! preference ([`power_preference`]) among the rest. eframe is handed [`selector`], which takes
+//! the first of that order.
 //!
 //! An adapter can report that it presents to the window and still fail once it does: on a hybrid
 //! Linux desktop under Wayland, the compositor runs on one GPU and may refuse the frame buffers
@@ -31,23 +15,15 @@
 //! the graphics fail while the window is starting up, [`finish`] starts the app again without
 //! that adapter, as the next one in the order would be tried. Each restart leaves out one more
 //! adapter, so it ends when none is left.
-//!
-//! An adapter can also hang instead of failing: on a hybrid laptop with High Performance chosen,
-//! the discrete GPU never put the window's first frame on the screen, with no error and no panic,
-//! and the app stayed in the background without a window (#964). [`watch_first_frame`] gives the
-//! first frame [`FIRST_FRAME_TIMEOUT`] once the app is created and, when it doesn't come, starts
-//! the app again without that adapter in the same way.

 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, OnceLock};
-use std::time::{Duration, Instant};

 use eframe::egui_wgpu::NativeAdapterSelectorMethod;
-use eframe::wgpu::{self, Backend, Backends, DeviceType, PowerPreference};
+use eframe::wgpu::{self, Backend, DeviceType, PowerPreference};

-/// The adapters a restart leaves out, those the window failed on, as comma-separated [`key`]s
-/// (`Vulkan:1002:164e`, `Metal:Intel Iris Pro Graphics`). Set by the app itself when it starts
-/// again.
+/// The adapters a restart leaves out, those the window failed on, as comma-separated
+/// `backend:vendor:device` keys (`Vulkan:1002:164e`). Set by the app itself when it starts again.
 pub const SKIP_ENV: &str = "VECTORCRAFT_GPU_SKIP";

 /// wgpu's variable for choosing an adapter by (part of) its name, any case.
@@ -60,12 +36,7 @@ const HELP: &str =
 /// Frames the UI ran before the failure, below which it was still starting up. The failure in
 /// #502 came on the first or second frame; later, the adapter has proved itself, and a lost
 /// window is something else (such as the compositor restarting).
-pub const STARTUP_FRAMES: u64 = 10;
-
-/// How long the window's first frame may take to reach the screen, from the app's creation,
-/// before its adapter counts as hanging ([`watch_first_frame`]). The first frame draws the whole
-/// interface and compiles its shaders, a second at most on a slow machine.
-pub const FIRST_FRAME_TIMEOUT: Duration = Duration::from_secs(20);
+const STARTUP_FRAMES: u64 = 10;

 /// The preference used when Preferences say Automatic. Windows and macOS show frames from any GPU
 /// (the integrated one avoids the flicker of #306). Elsewhere, the system's own order: Mesa's
@@ -86,51 +57,14 @@ pub fn power_preference(pref: Option<&str>, env: Option<PowerPreference>) -> Pow
    }
 }

-/// Whether the adapter is the app's to choose: neither `WGPU_POWER_PREF` nor Preferences name a
-/// kind of GPU (the arguments of [`power_preference`]). Then the GPU that drives the display comes
-/// first ([`display_gpus`]); a user's own choice is kept as it is.
-pub fn automatic(pref: Option<&str>, env: Option<PowerPreference>) -> bool {
-    env.is_none() && !matches!(pref, Some("highPerformance" | "lowPower"))
-}
-
-/// The GPUs to rank first: those that drive a display, when the choice is [`automatic`].
-pub fn preferred_displays(pref: Option<&str>, env: Option<PowerPreference>) -> Vec<DisplayGpu> {
-    if automatic(pref, env) { display_gpus() } else { Vec::new() }
-}
-
-/// The GPU to rank first: the one the Wayland compositor draws with, when the choice is
-/// [`automatic`].
-pub fn preferred_compositor(pref: Option<&str>, env: Option<PowerPreference>) -> Option<(u32, u32)> {
-    if automatic(pref, env) { crate::compositor_gpu::compositor_gpu() } else { None }
-}
-
-/// The graphics backends the window starts with: on Windows Direct3D 12, falling back to OpenGL,
-/// unless `WGPU_BACKEND` names others (`env_set`; `default` then holds them). Creating a Vulkan
-/// instance loads every installed Vulkan driver into the process, and a faulty one (Intel's
-/// `igvk64.dll`, #806) crashed the app before its window appeared. DX12 is Windows' own backend,
-/// as in PdfCraft. Elsewhere, `default`.
-pub fn backends(default: Backends, env_set: bool) -> Backends {
-    if cfg!(windows) && !env_set { Backends::DX12 | Backends::GL } else { default }
-}
-
-/// The largest texture side to ask the device for, which bounds the window's surface: the
-/// adapter's own limit when it is above eframe's `default` (8192 px), so a window larger than
-/// that keeps its surface (#1459). Never below `default`, which is what was asked for before.
-pub fn surface_limit(default: u32, adapter: u32) -> u32 {
-    default.max(adapter)
-}
-
 /// One adapter, as [`adapter_order`] sees it.
 #[derive(Clone, Debug)]
 pub struct Candidate {
-    /// Identifies the adapter across a restart ([`key`]).
+    /// Identifies the adapter across a restart: `backend:vendor:device` ([`key`]).
    pub key: String,
    pub name: String,
    pub backend: Backend,
    pub device_type: DeviceType,
-    /// PCI vendor and device ids, to match a [`DisplayGpu`]; zero where the backend reports none
-    /// (Metal, and OpenGL's device id).
-    pub pci: (u32, u32),
    /// Reports that it can present to the window's surface.
    pub presents: bool,
 }
@@ -139,189 +73,31 @@ impl Candidate {
    fn new(adapter: &wgpu::Adapter, surface: Option<&wgpu::Surface<'_>>) -> Self {
        let info = adapter.get_info();
        Self {
-            key: key(info.backend, info.vendor, info.device, &info.name),
+            key: key(info.backend, info.vendor, info.device),
            presents: surface.is_none_or(|s| adapter.is_surface_supported(s)),
            name: info.name,
            backend: info.backend,
            device_type: info.device_type,
-            pci: (info.vendor, info.device),
        }
    }
-
-    /// Whether it is the GPU the compositor draws with (`compositor`, by PCI ids).
-    fn composites(&self, compositor: Option<(u32, u32)>) -> bool {
-        compositor == Some(self.pci)
-    }
-
-    /// Whether it drives one of `displays`, and whether that is the primary one.
-    fn drives(&self, displays: &[DisplayGpu]) -> (bool, bool) {
-        let shown = displays.iter().find(|g| g.pci == self.pci);
-        (shown.is_some(), shown.is_some_and(|g| g.primary))
-    }
-}
-
-/// A GPU with a monitor attached, as the system reports it ([`display_gpus`]).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct DisplayGpu {
-    /// PCI `(vendor, device)` ids, as wgpu's `AdapterInfo` reports them.
-    pub pci: (u32, u32),
-    /// Drives the display the user most likely looks at: on Windows the primary display, on Linux
-    /// a built-in panel (`eDP`, `LVDS` or `DSI`).
-    pub primary: bool,
-}
-
-impl std::fmt::Display for DisplayGpu {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{:04x}:{:04x}{}", self.pci.0, self.pci.1, if self.primary { " (primary)" } else { "" })
-    }
-}
-
-/// The GPUs that drive a display, each once. Windows enumerates its display devices
-/// (`EnumDisplayDevices`: those attached to the desktop, and the primary one); Linux reads the
-/// connected connectors in `/sys/class/drm`. macOS and the rest report nothing, so the power
-/// preference decides as before; so does a system whose GPUs report no PCI ids.
-pub fn display_gpus() -> Vec<DisplayGpu> {
-    #[cfg(windows)]
-    {
-        windows_display_gpus()
-    }
-    #[cfg(target_os = "linux")]
-    {
-        linux_display_gpus(std::path::Path::new("/sys/class/drm"))
-    }
-    #[cfg(not(any(windows, target_os = "linux")))]
-    {
-        Vec::new()
-    }
-}
-
-/// Record that the GPU `pci` drives a display, merging it with its other displays.
-#[cfg(any(windows, target_os = "linux", test))]
-fn add_display_gpu(gpus: &mut Vec<DisplayGpu>, pci: (u32, u32), primary: bool) {
-    match gpus.iter_mut().find(|g| g.pci == pci) {
-        Some(gpu) => gpu.primary |= primary,
-        None => gpus.push(DisplayGpu { pci, primary }),
-    }
-}
-
-/// Windows' display devices: one per GPU output; those `ATTACHED_TO_DESKTOP` show a monitor, one
-/// of them the `PRIMARY_DEVICE`. The registry doesn't tell a user which adapter drives a display,
-/// and WMI reports a resolution for a GPU without a monitor, so this is the way.
-#[cfg(windows)]
-fn windows_display_gpus() -> Vec<DisplayGpu> {
-    use winsafe::co::DISPLAY_DEVICE as Flags;
-    let mut gpus = Vec::new();
-    // A machine has a handful of display devices; the cap only bounds a runaway enumeration.
-    for device in winsafe::EnumDisplayDevices(None, None).take(256) {
-        let device = match device {
-            Ok(d) => d,
-            // The enumeration ends with "no more items" or, from a driver, with any other error.
-            Err(e) => {
-                log::debug!("display devices: {e}");
-                break;
-            }
-        };
-        if !device.StateFlags.has(Flags::ATTACHED_TO_DESKTOP) {
-            continue;
-        }
-        // Remote Desktop and other non-PCI devices (`ROOT\BasicDisplay\0000`) are left out.
-        let Some(pci) = pci_ids(&device.DeviceID()) else { continue };
-        add_display_gpu(&mut gpus, pci, device.StateFlags.has(Flags::PRIMARY_DEVICE));
-    }
-    gpus
-}
-
-/// The PCI `(vendor, device)` of a Windows device id such as
-/// `PCI\VEN_10DE&DEV_2204&SUBSYS_40421458&REV_A1`, any case; `None` for anything else.
-#[cfg(any(windows, test))]
-fn pci_ids(device_id: &str) -> Option<(u32, u32)> {
-    let field = |key: &str| {
-        device_id.split(['\\', '&']).find_map(|part| {
-            let (name, hex) = part.split_at_checked(key.len())?;
-            if name.eq_ignore_ascii_case(key) { u32::from_str_radix(hex, 16).ok() } else { None }
-        })
-    };
-    Some((field("VEN_")?, field("DEV_")?))
-}
-
-/// Linux: every connector `cardN-CONNECTOR` under `drm` whose `status` is `connected`, with the
-/// PCI ids of its card (`cardN/device/{vendor,device}`). A built-in panel is the primary display.
-#[cfg(any(target_os = "linux", test))]
-fn linux_display_gpus(drm: &std::path::Path) -> Vec<DisplayGpu> {
-    let read_hex = |p: std::path::PathBuf| -> Option<u32> {
-        let s = std::fs::read_to_string(p).ok()?;
-        u32::from_str_radix(s.trim().trim_start_matches("0x"), 16).ok()
-    };
-    let mut gpus = Vec::new();
-    let Ok(entries) = std::fs::read_dir(drm) else { return gpus };
-    // A machine has a handful of connectors; the cap only bounds a pathological sysfs.
-    for entry in entries.flatten().take(256) {
-        let name = entry.file_name();
-        let Some((card, connector)) = name.to_str().and_then(|n| n.split_once('-')) else { continue };
-        let connected = std::fs::read_to_string(entry.path().join("status")).is_ok_and(|s| s.trim() == "connected");
-        if !connected {
-            continue;
-        }
-        let device = drm.join(card).join("device");
-        let (Some(v), Some(d)) = (read_hex(device.join("vendor")), read_hex(device.join("device"))) else { continue };
-        add_display_gpu(&mut gpus, (v, d), is_internal_panel(connector));
-    }
-    gpus
-}
-
-/// A laptop's built-in panel: an embedded DisplayPort, LVDS or DSI connector.
-#[cfg(any(target_os = "linux", test))]
-fn is_internal_panel(connector: &str) -> bool {
-    ["eDP", "LVDS", "DSI"].iter().any(|kind| connector.starts_with(kind))
 }

 /// `backend:vendor:device`, e.g. `Vulkan:1002:164e` (PCI ids, as `MESA_VK_DEVICE_SELECT` takes them).
-/// Metal reports no ids (`0000:0000` for every GPU), so an adapter without them is `backend:name`
-/// (`Metal:Intel Iris Pro Graphics`): otherwise leaving out the one that failed would leave out
-/// every GPU of a dual-GPU Mac (#651). Commas, which separate [`SKIP_ENV`]'s keys, become spaces.
-fn key(backend: Backend, vendor: u32, device: u32, name: &str) -> String {
-    if vendor == 0 && device == 0 {
-        format!("{backend:?}:{}", name.replace(',', " ").trim())
-    } else {
-        format!("{backend:?}:{vendor:04x}:{device:04x}")
-    }
+fn key(backend: Backend, vendor: u32, device: u32) -> String {
+    format!("{backend:?}:{vendor:04x}:{device:04x}")
 }

 /// The order to try `candidates` in (their indices): only those that present to the window and
 /// aren't in `skip`; the one whose name contains `named` (any case) first; hardware before
-/// software; native backends before OpenGL; the GPU the compositor draws with (`compositor`); the
-/// GPUs that drive one of `displays`, the primary display's first; then by `power`; then DX12
-/// before Vulkan, keeping the system's order among equals (all of it for
-/// [`PowerPreference::None`]). Windows lists each GPU under both, and Intel's
-/// Vulkan driver made the whole window flicker black where DX12 and OpenGL didn't (#545);
-/// elsewhere there is no DX12 adapter, so the order is unchanged.
-///
-/// With no `displays`, or none a candidate's PCI ids match (OpenGL reports no device id, Metal no
-/// ids at all), the order is the power preference's alone, as it was.
-pub fn adapter_order(
-    candidates: &[Candidate],
-    power: PowerPreference,
-    displays: &[DisplayGpu],
-    compositor: Option<(u32, u32)>,
-    named: Option<&str>,
-    skip: &[String],
-) -> Vec<usize> {
+/// software; native backends before OpenGL; then by `power`, keeping the system's order among
+/// equals (all of it for [`PowerPreference::None`]).
+pub fn adapter_order(candidates: &[Candidate], power: PowerPreference, named: Option<&str>, skip: &[String]) -> Vec<usize> {
    let named = named.map(str::to_lowercase).filter(|n| !n.is_empty());
    let mut order: Vec<(usize, &Candidate)> = candidates.iter().enumerate().filter(|(_, c)| c.presents && !skip.contains(&c.key)).collect();
    // Stable, so equals keep the system's order.
    order.sort_by_key(|(_, c)| {
        let unnamed = named.as_ref().is_some_and(|n| !c.name.to_lowercase().contains(n));
-        let (drives_display, drives_primary) = c.drives(displays);
-        (
-            unnamed,
-            c.device_type == DeviceType::Cpu,
-            c.backend == Backend::Gl,
-            !c.composites(compositor),
-            !drives_display,
-            !drives_primary,
-            power_rank(c.device_type, power),
-            c.backend == Backend::Vulkan,
-        )
+        (unnamed, c.device_type == DeviceType::Cpu, c.backend == Backend::Gl, power_rank(c.device_type, power))
    });
    order.into_iter().map(|(i, _)| i).collect()
 }
@@ -355,8 +131,6 @@ pub struct Startup {
    adapter: OnceLock<String>,
    /// The UI's context, which counts the frames run.
    ui: OnceLock<egui::Context>,
-    /// When the app was created, the files named at the start opened: the first frame is due.
-    ready: OnceLock<Instant>,
 }

 impl Startup {
@@ -365,102 +139,23 @@ impl Startup {
        // Set once; the window is created once.
        let _ = self.ui.set(ctx.clone());
    }
-
-    /// The app is ready to draw its first frame.
-    pub fn ready(&self) {
-        // Set once, like `created`.
-        let _ = self.ready.set(Instant::now());
-    }
 }

-/// What [`watch_first_frame`] makes of the window's start.
-#[derive(Debug, PartialEq, Eq)]
-enum FirstFrame {
-    /// Not due yet.
-    Wait,
-    /// On the screen (the second frame began, so the first was presented), or the window was
-    /// minimized at the start: nothing to watch.
-    Shown,
-    /// Overdue.
-    Hung,
-}
-
-/// The window's start after `frames` frames run, `since` its first frame was due.
-fn first_frame(frames: u64, since: Duration, minimized: bool) -> FirstFrame {
-    if frames >= 2 || minimized {
-        FirstFrame::Shown
-    } else if since >= FIRST_FRAME_TIMEOUT {
-        FirstFrame::Hung
-    } else {
-        FirstFrame::Wait
-    }
-}
-
-/// Watch the window's first frame from another thread: when it hasn't reached the screen
-/// [`FIRST_FRAME_TIMEOUT`] after the app was created ([`Startup::ready`]), start the app again
-/// without the adapter, as [`finish`] does for one that failed, and end this process, whose UI
-/// thread is stuck in the graphics driver.
-pub fn watch_first_frame(startup: Arc<Startup>) {
-    let watch = move || loop {
-        std::thread::sleep(Duration::from_millis(250));
-        let Some(due) = startup.ready.get() else { continue };
-        let ui = startup.ui.get();
-        let frames = ui.map_or(0, egui::Context::cumulative_frame_nr);
-        let minimized = ui.and_then(|c| c.input(|i| i.viewport().minimized)).unwrap_or(false);
-        match first_frame(frames, due.elapsed(), minimized) {
-            FirstFrame::Wait => continue,
-            FirstFrame::Shown => return,
-            FirstFrame::Hung => {}
-        }
-        let mut skip = skipped();
-        let Some(failed) = restart_without(true, frames, startup.adapter.get().map(String::as_str), &skip) else { return };
-        log::error!(
-            "the window's first frame didn't reach the screen in {}s on graphics adapter {failed}: starting again without it",
-            FIRST_FRAME_TIMEOUT.as_secs()
-        );
-        skip.push(failed.to_string());
-        match restart(&skip.join(",")) {
-            Ok(()) => std::process::exit(0),
-            Err(e) => {
-                log::error!("starting again failed: {e}");
-                return;
-            }
-        }
-    };
-    if let Err(e) = std::thread::Builder::new().name("first frame".into()).spawn(watch) {
-        log::warn!("no watch on the window's first frame: {e}");
-    }
-}
-
-/// eframe's adapter choice: the first of [`adapter_order`] for `power`, the GPU the `compositor`
-/// draws with, the GPUs that drive a `displays`, `WGPU_ADAPTER_NAME` and the adapters a restart
-/// left out. Every adapter, the displays and the choice are logged: which GPU draws is the first
-/// question in every black-window report.
-pub fn selector(
-    power: PowerPreference,
-    displays: Vec<DisplayGpu>,
-    compositor: Option<(u32, u32)>,
-    startup: Arc<Startup>,
-) -> NativeAdapterSelectorMethod {
+/// eframe's adapter choice: the first of [`adapter_order`] for `power`, `WGPU_ADAPTER_NAME` and the
+/// adapters a restart left out. Every adapter and the choice are logged, for bug reports.
+pub fn selector(power: PowerPreference, startup: Arc<Startup>) -> NativeAdapterSelectorMethod {
    let named = std::env::var(NAME_ENV).ok();
    let skip = skipped();
    Arc::new(move |adapters, surface| {
        let candidates: Vec<Candidate> = adapters.iter().map(|a| Candidate::new(a, surface)).collect();
-        let order = adapter_order(&candidates, power, &displays, compositor, named.as_deref(), &skip);
+        let order = adapter_order(&candidates, power, named.as_deref(), &skip);
        let listed: Vec<String> = candidates
            .iter()
            .map(|c| {
-                let (drives_display, drives_primary) = c.drives(&displays);
                let note = if !c.presents {
                    ", can't show the window"
                } else if skip.contains(&c.key) {
                    ", failed before"
-                } else if c.composites(compositor) {
-                    ", the compositor draws with it"
-                } else if drives_primary {
-                    ", drives the primary display"
-                } else if drives_display {
-                    ", drives a display"
                } else {
                    ""
                };
@@ -472,14 +167,6 @@ pub fn selector(
        let Some((adapter, chosen)) = first else {
            return Err(format!("no graphics adapter can show the window (power preference {power:?}, {} adapters)", adapters.len()));
        };
-        let why = match chosen.drives(&displays) {
-            _ if chosen.composites(compositor) => "the compositor draws with it".to_string(),
-            (_, true) => "it drives the primary display".to_string(),
-            (true, false) => "it drives a display".to_string(),
-            (false, false) if displays.is_empty() => format!("power preference {power:?}"),
-            (false, false) => format!("no adapter matches a display GPU, so power preference {power:?}"),
-        };
-        log::info!("drawing on {} ({:?}, {:?}): {why}", chosen.name.trim(), chosen.backend, chosen.device_type);
        // Set once; eframe picks the adapter once.
        let _ = startup.adapter.set(chosen.key.clone());
        Ok(adapter.clone())
@@ -551,262 +238,13 @@ mod tests {
    use super::*;

    fn gpu(name: &str, backend: Backend, device_type: DeviceType) -> Candidate {
-        Candidate { key: format!("{backend:?}:{name}"), name: name.into(), backend, device_type, pci: (0, 0), presents: true }
-    }
-
-    /// #1459: a 9048 px wide window (two display scales' ratio past 8192) fits an adapter that
-    /// takes 16384 px textures; an adapter with less than eframe asks for changes nothing.
-    #[test]
-    fn the_surface_may_be_as_large_as_the_adapter_allows() {
-        assert_eq!(surface_limit(8192, 16384), 16384);
-        assert_eq!(surface_limit(8192, 4096), 8192);
+        Candidate { key: format!("{backend:?}:{name}"), name: name.into(), backend, device_type, presents: true }
    }

    fn names(c: &[Candidate], order: &[usize]) -> Vec<String> {
        order.iter().map(|&i| c[i].name.clone()).collect()
    }

-    const NVIDIA_3090: (u32, u32) = (0x10de, 0x2204);
-    const AMD_IGPU: (u32, u32) = (0x1002, 0x164e);
-    const INTEL_IGPU: (u32, u32) = (0x8086, 0xa780);
-    const WARP: (u32, u32) = (0x1414, 0x008c);
-
-    fn pci_gpu(name: &str, backend: Backend, device_type: DeviceType, pci: (u32, u32)) -> Candidate {
-        Candidate { key: key(backend, pci.0, pci.1, name), name: name.into(), backend, device_type, pci, presents: true }
-    }
-
-    fn monitor(pci: (u32, u32)) -> DisplayGpu {
-        DisplayGpu { pci, primary: false }
-    }
-
-    fn primary(pci: (u32, u32)) -> DisplayGpu {
-        DisplayGpu { pci, primary: true }
-    }
-
-    /// The desktop of pdfcraft#378 as wgpu lists it on Windows: a Ryzen's integrated GPU without a
-    /// monitor and an RTX 3090 driving both monitors, each under Vulkan and DX12, then WARP and
-    /// OpenGL (which reports no device id).
-    fn ryzen_desktop() -> Vec<Candidate> {
-        vec![
-            pci_gpu("NVIDIA GeForce RTX 3090", Backend::Vulkan, DeviceType::DiscreteGpu, NVIDIA_3090),
-            pci_gpu("AMD Radeon(TM) Graphics", Backend::Vulkan, DeviceType::IntegratedGpu, AMD_IGPU),
-            pci_gpu("NVIDIA GeForce RTX 3090", Backend::Dx12, DeviceType::DiscreteGpu, NVIDIA_3090),
-            pci_gpu("AMD Radeon(TM) Graphics", Backend::Dx12, DeviceType::IntegratedGpu, AMD_IGPU),
-            pci_gpu("Microsoft Basic Render Driver", Backend::Dx12, DeviceType::Cpu, WARP),
-            pci_gpu("NVIDIA GeForce RTX 3090/PCIe/SSE2", Backend::Gl, DeviceType::Other, (NVIDIA_3090.0, 0)),
-        ]
-    }
-
-    /// pdfcraft#378: power saving picked the integrated GPU, whose driver reset when Windows had to
-    /// present its frames on the monitors of the NVIDIA card. The GPU that drives the displays now
-    /// comes first, through DX12 (#545); the integrated GPU stays the fallback a restart reaches.
-    #[test]
-    fn a_desktop_draws_on_the_gpu_that_drives_its_monitors() {
-        let c = ryzen_desktop();
-        for displays in [vec![primary(NVIDIA_3090)], vec![monitor(NVIDIA_3090)]] {
-            assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, None, None, &[]), [2, 0, 3, 1, 5, 4], "{displays:?}");
-            assert_eq!(adapter_order(&c, PowerPreference::None, &displays, None, None, &[]), [2, 0, 3, 1, 5, 4], "{displays:?}");
-        }
-        // Without the display information the order is power saving's, as before.
-        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[], None, None, &[]), [3, 1, 2, 0, 5, 4]);
-        // After the NVIDIA adapters failed, the integrated GPU is next.
-        let skip = vec![c[2].key.clone(), c[0].key.clone()];
-        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[primary(NVIDIA_3090)], None, None, &skip), [3, 1, 5, 4]);
-    }
-
-    /// A hybrid laptop: the panel (primary) on the integrated GPU, an external monitor on the
-    /// discrete one. Power saving and the display agree, in either enumeration order.
-    #[test]
-    fn a_hybrid_laptop_draws_on_the_integrated_gpu_that_drives_its_panel() {
-        let c = ryzen_desktop();
-        for displays in [vec![primary(AMD_IGPU), monitor(NVIDIA_3090)], vec![monitor(NVIDIA_3090), primary(AMD_IGPU)], vec![primary(AMD_IGPU)]] {
-            assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, None, None, &[]), [3, 1, 2, 0, 5, 4], "{displays:?}");
-        }
-        // Linux names no primary unless there is a built-in panel: a monitor on each GPU keeps the
-        // system's order among them (Mesa puts the compositor's GPU first), and a GPU without one
-        // comes after both.
-        let linux = vec![
-            pci_gpu("AMD Radeon Graphics (RADV RAPHAEL_MENDOCINO)", Backend::Vulkan, DeviceType::IntegratedGpu, AMD_IGPU),
-            pci_gpu("NVIDIA GeForce RTX 3090", Backend::Vulkan, DeviceType::DiscreteGpu, NVIDIA_3090),
-            pci_gpu("Intel(R) Arc(TM) A380", Backend::Vulkan, DeviceType::DiscreteGpu, INTEL_IGPU),
-            pci_gpu("llvmpipe (LLVM 20.1.8, 256 bits)", Backend::Vulkan, DeviceType::Cpu, (0x10005, 0)),
-        ];
-        let both = [monitor(AMD_IGPU), monitor(NVIDIA_3090)];
-        assert_eq!(adapter_order(&linux, PowerPreference::None, &both, None, None, &[]), [0, 1, 2, 3]);
-        assert_eq!(adapter_order(&linux, PowerPreference::None, &[monitor(INTEL_IGPU)], None, None, &[]), [2, 0, 1, 3]);
-        assert_eq!(adapter_order(&linux, PowerPreference::None, &[monitor(NVIDIA_3090), primary(AMD_IGPU)], None, None, &[]), [0, 1, 2, 3]);
-    }
-
-    /// A hybrid laptop whose Wayland compositor runs on the discrete GPU (Hyprland with
-    /// `AQ_DRM_DEVICES` naming it first), as Vulkan lists it there: the integrated GPU drives the
-    /// built-in panel, yet the compositor shows nothing it draws, and reports no error. The GPU the
-    /// compositor draws with comes first; without it, the panel's, as before.
-    #[test]
-    fn the_gpu_the_compositor_draws_with_comes_before_the_panels() {
-        const RTX_3050: (u32, u32) = (0x10de, 0x25ac);
-        const INTEL_RPL: (u32, u32) = (0x8086, 0xa7a8);
-        let mut c = vec![
-            pci_gpu("NVIDIA GeForce RTX 3050 6GB Laptop GPU", Backend::Vulkan, DeviceType::DiscreteGpu, RTX_3050),
-            pci_gpu("Intel(R) Graphics (RPL-P)", Backend::Vulkan, DeviceType::IntegratedGpu, INTEL_RPL),
-            pci_gpu("NVIDIA GeForce RTX 3050 6GB Laptop GPU/PCIe/SSE2", Backend::Gl, DeviceType::Other, (RTX_3050.0, 0)),
-        ];
-        c[2].presents = false;
-        let panel = [primary(INTEL_RPL)];
-        assert_eq!(adapter_order(&c, PowerPreference::None, &panel, Some(RTX_3050), None, &[]), [0, 1]);
-        assert_eq!(adapter_order(&c, PowerPreference::None, &panel, None, None, &[]), [1, 0]);
-        // The usual hybrid laptop, with the compositor on the integrated GPU: the panel's GPU.
-        assert_eq!(adapter_order(&c, PowerPreference::None, &[primary(INTEL_RPL), monitor(RTX_3050)], Some(INTEL_RPL), None, &[]), [1, 0]);
-        // `WGPU_ADAPTER_NAME` still comes first, and a restart after a failure still moves on.
-        assert_eq!(adapter_order(&c, PowerPreference::None, &panel, Some(RTX_3050), Some("intel"), &[]), [1, 0]);
-        assert_eq!(adapter_order(&c, PowerPreference::None, &panel, Some(RTX_3050), None, &[c[0].key.clone()]), [1]);
-        // A compositor GPU no adapter matches (a virtual one) leaves the displays in charge.
-        assert_eq!(adapter_order(&c, PowerPreference::None, &panel, Some((0x1af4, 0x1050)), None, &[]), [1, 0]);
-    }
-
-    /// A Windows desktop with a monitor on each GPU: the window opens on the primary display, so
-    /// its GPU draws, whichever kind it is.
-    #[test]
-    fn the_primary_display_decides_between_gpus_that_both_drive_a_monitor() {
-        let c = ryzen_desktop();
-        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[monitor(AMD_IGPU), primary(NVIDIA_3090)], None, None, &[]), [2, 0, 3, 1, 5, 4]);
-        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[primary(AMD_IGPU), monitor(NVIDIA_3090)], None, None, &[]), [3, 1, 2, 0, 5, 4]);
-        // The displays only matter among adapters that can show the window; a GPU driving no
-        // display still loses to one that does.
-        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[monitor(AMD_IGPU), monitor(INTEL_IGPU)], None, None, &[]), [3, 1, 2, 0, 5, 4]);
-    }
-
-    /// Display GPUs none of the adapters match (another driver's ids, OpenGL's missing device id,
-    /// Metal's zeros) change nothing: power saving's order, the old behaviour.
-    #[test]
-    fn displays_no_adapter_matches_leave_the_power_preference_in_charge() {
-        let c = ryzen_desktop();
-        let low = adapter_order(&c, PowerPreference::LowPower, &[], None, None, &[]);
-        for displays in [vec![monitor(INTEL_IGPU)], vec![primary((0x8086, 0x1234)), monitor((0x8086, 0x5678))], vec![primary((0, 0))]] {
-            assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, None, None, &[]), low, "{displays:?}");
-        }
-        assert_eq!(
-            names(&c, &adapter_order(&c, PowerPreference::HighPerformance, &[monitor(INTEL_IGPU)], None, None, &[]))[0],
-            "NVIDIA GeForce RTX 3090"
-        );
-        // The #502 machine's adapters report no ids in these tests: the primary display never matches.
-        let c = issue_502();
-        assert_eq!(
-            adapter_order(&c, PowerPreference::None, &[primary(NVIDIA_3090)], None, None, &[]),
-            adapter_order(&c, PowerPreference::None, &[], None, None, &[])
-        );
-        assert!(adapter_order(&[], PowerPreference::LowPower, &[primary(NVIDIA_3090)], None, None, &[]).is_empty());
-    }
-
-    /// `WGPU_ADAPTER_NAME` and "can't present" still come before the displays.
-    #[test]
-    fn a_named_adapter_comes_before_the_one_driving_the_display() {
-        let mut c = ryzen_desktop();
-        let displays = [primary(NVIDIA_3090)];
-        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, None, Some("radeon"), &[]), [3, 1, 2, 0, 5, 4]);
-        c[2].presents = false;
-        c[0].presents = false;
-        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &displays, None, None, &[]), [3, 1, 5, 4]);
-    }
-
-    /// A user's own choice (Preferences or `WGPU_POWER_PREF`) is kept as it is; only Automatic
-    /// looks at the displays.
-    #[test]
-    fn only_automatic_considers_which_gpu_drives_the_display() {
-        assert!(automatic(None, None));
-        assert!(automatic(Some("automatic"), None));
-        assert!(automatic(Some("powerSaving"), None));
-        assert!(!automatic(Some("lowPower"), None));
-        assert!(!automatic(Some("highPerformance"), None));
-        assert!(!automatic(None, Some(PowerPreference::None)));
-        assert!(!automatic(Some("automatic"), Some(PowerPreference::LowPower)));
-        assert!(preferred_displays(Some("lowPower"), None).is_empty());
-        assert!(preferred_displays(None, Some(PowerPreference::HighPerformance)).is_empty());
-        // Automatic reports whatever this machine has (nothing on macOS, in CI, or under Remote Desktop).
-        assert_eq!(preferred_displays(None, None), display_gpus());
-        assert_eq!(preferred_compositor(Some("lowPower"), None), None);
-        assert_eq!(preferred_compositor(None, Some(PowerPreference::HighPerformance)), None);
-        assert_eq!(preferred_compositor(None, None), crate::compositor_gpu::compositor_gpu());
-    }
-
-    #[test]
-    fn pci_ids_come_from_windows_device_ids() {
-        assert_eq!(pci_ids("PCI\\VEN_10DE&DEV_2204&SUBSYS_40421458&REV_A1"), Some(NVIDIA_3090));
-        assert_eq!(pci_ids("PCI\\VEN_1002&DEV_164E&SUBSYS_88771043&REV_C1"), Some(AMD_IGPU));
-        assert_eq!(pci_ids("pci\\ven_1002&dev_164e"), Some(AMD_IGPU));
-        // Remote Desktop and other non-PCI display devices, and malformed ids.
-        assert_eq!(pci_ids("ROOT\\BasicDisplay\\0000"), None);
-        assert_eq!(pci_ids("PCI\\VEN_10DE&SUBSYS_40421458"), None);
-        assert_eq!(pci_ids("PCI\\VEN_10DE&DEV_ZZZZ"), None);
-        assert_eq!(pci_ids("VEN_&DEV_"), None);
-        assert_eq!(pci_ids(""), None);
-    }
-
-    /// Whatever this machine has: every GPU listed is a PCI device, at most one drives the primary
-    /// display, and none is listed twice. (A headless CI runner may list none.)
-    #[cfg(windows)]
-    #[test]
-    fn windows_lists_each_gpu_with_a_monitor_once() {
-        let gpus = windows_display_gpus();
-        assert!(gpus.iter().filter(|g| g.primary).count() <= 1, "{gpus:?}");
-        for (i, g) in gpus.iter().enumerate() {
-            assert_ne!(g.pci.0, 0, "{gpus:?}");
-            assert!(!gpus[..i].iter().any(|h| h.pci == g.pci), "{gpus:?}");
-        }
-    }
-
-    #[test]
-    fn internal_panels_are_edp_lvds_and_dsi_connectors() {
-        for name in ["eDP-1", "LVDS-1", "DSI-1"] {
-            assert!(is_internal_panel(name), "{name}");
-        }
-        for name in ["DP-3", "HDMI-A-1", "DVI-D-1", "VGA-1", "Writeback-1", ""] {
-            assert!(!is_internal_panel(name), "{name}");
-        }
-    }
-
-    /// A sysfs like a hybrid laptop's with an external monitor: the panel and a disconnected port
-    /// on the integrated GPU (card0), the monitor on the discrete one (card1), and a card without
-    /// PCI ids. Each GPU is listed once, the one with the panel as primary.
-    #[test]
-    fn linux_display_gpus_come_from_the_connected_connectors() -> std::io::Result<()> {
-        let dir = std::env::temp_dir().join(format!("vectorcraft-drm-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        let card = |name: &str, (vendor, device): (u32, u32)| -> std::io::Result<()> {
-            std::fs::create_dir_all(dir.join(name).join("device"))?;
-            std::fs::write(dir.join(name).join("device/vendor"), format!("{vendor:#06x}\n"))?;
-            std::fs::write(dir.join(name).join("device/device"), format!("{device:#06x}\n"))
-        };
-        let connector = |name: &str, status: &str| -> std::io::Result<()> {
-            std::fs::create_dir_all(dir.join(name))?;
-            std::fs::write(dir.join(name).join("status"), format!("{status}\n"))
-        };
-        card("card0", AMD_IGPU)?;
-        card("card1", NVIDIA_3090)?;
-        std::fs::create_dir_all(dir.join("card2"))?;
-        connector("card0-eDP-1", "connected")?;
-        connector("card0-HDMI-A-1", "disconnected")?;
-        connector("card1-DP-1", "connected")?;
-        connector("card1-DP-2", "connected")?;
-        connector("card2-Virtual-1", "connected")?;
-        std::fs::write(dir.join("renderD128"), "")?;
-        let mut gpus = linux_display_gpus(&dir);
-        gpus.sort_by_key(|g| g.pci);
-        assert_eq!(gpus, [primary(AMD_IGPU), monitor(NVIDIA_3090)]);
-        assert!(linux_display_gpus(&dir.join("no such dir")).is_empty());
-        std::fs::remove_dir_all(&dir)
-    }
-
-    #[test]
-    fn display_gpus_are_logged_as_pci_ids() {
-        assert_eq!(primary(NVIDIA_3090).to_string(), "10de:2204 (primary)");
-        assert_eq!(monitor(AMD_IGPU).to_string(), "1002:164e");
-        let mut gpus = vec![];
-        add_display_gpu(&mut gpus, NVIDIA_3090, false);
-        add_display_gpu(&mut gpus, NVIDIA_3090, true);
-        add_display_gpu(&mut gpus, AMD_IGPU, false);
-        assert_eq!(gpus, [primary(NVIDIA_3090), monitor(AMD_IGPU)]);
-    }
-
    /// The machine of #502 as Vulkan lists it with Mesa's device-select layer: the GPU KDE's
    /// compositor runs on (NVIDIA) first, then the Ryzen's integrated GPU, Mesa's software
    /// renderer, and OpenGL.
@@ -822,7 +260,7 @@ mod tests {
    #[test]
    fn automatic_keeps_the_systems_order_on_linux_and_saves_power_elsewhere() {
        let c = issue_502();
-        let order = adapter_order(&c, power_preference(None, None), &[], None, None, &[]);
+        let order = adapter_order(&c, power_preference(None, None), None, &[]);
        let first = &c[order[0]].name;
        if cfg!(any(windows, target_os = "macos")) {
            assert_eq!(first, "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)");
@@ -835,7 +273,7 @@ mod tests {
    #[test]
    fn each_preference_orders_the_adapters_then_falls_back_to_opengl_and_software() {
        let c = issue_502();
-        let order = |power| names(&c, &adapter_order(&c, power, &[], None, None, &[]));
+        let order = |power| names(&c, &adapter_order(&c, power, None, &[]));
        assert_eq!(
            order(PowerPreference::None),
            [
@@ -867,52 +305,12 @@ mod tests {

    /// A restart leaves out the adapter the window failed on, so Power Saving on the machine of
    /// #502 ends up on the NVIDIA GPU, and once every adapter failed there is nothing to try.
-    /// A dual-GPU Mac reports both GPUs under Metal with no PCI ids (#651): their keys still
-    /// differ, so when the integrated GPU fails, the restart renders on the discrete one.
-    #[test]
-    fn gpus_without_pci_ids_are_told_apart_by_name() {
-        let mac = |name: &str, device_type| Candidate {
-            key: key(Backend::Metal, 0, 0, name),
-            name: name.into(),
-            backend: Backend::Metal,
-            device_type,
-            pci: (0, 0),
-            presents: true,
-        };
-        let c = vec![mac("NVIDIA GeForce GT 750M", DeviceType::DiscreteGpu), mac("Intel Iris Pro Graphics", DeviceType::IntegratedGpu)];
-        assert_eq!((c[0].key.as_str(), c[1].key.as_str()), ("Metal:NVIDIA GeForce GT 750M", "Metal:Intel Iris Pro Graphics"));
-        let first = adapter_order(&c, PowerPreference::LowPower, &[], None, None, &[]);
-        assert_eq!(names(&c, &first)[0], "Intel Iris Pro Graphics");
-        let skip = parse_skip(&c[first[0]].key);
-        assert_eq!(names(&c, &adapter_order(&c, PowerPreference::LowPower, &[], None, None, &skip)), ["NVIDIA GeForce GT 750M"]);
-        // A comma in a name can't split the list.
-        assert_eq!(parse_skip(&key(Backend::Gl, 0, 0, "Mesa, llvmpipe")), ["Gl:Mesa  llvmpipe"]);
-    }
-
-    #[test]
-    fn a_first_frame_that_never_reaches_the_screen_hangs_its_adapter() {
-        let s = Duration::from_secs;
-        // The second frame began: the first was presented.
-        assert_eq!(first_frame(2, s(60), false), FirstFrame::Shown);
-        // Still drawing (or presenting) the first frame: waited for, then given up on (#964).
-        for frames in [0, 1] {
-            assert_eq!(first_frame(frames, s(3), false), FirstFrame::Wait);
-            assert_eq!(first_frame(frames, FIRST_FRAME_TIMEOUT, false), FirstFrame::Hung);
-        }
-        // A window minimized at the start may not draw again until restored.
-        assert_eq!(first_frame(1, s(60), true), FirstFrame::Shown);
-        // A hung adapter is left out once, like one that failed.
-        let skip = vec!["Dx12:10de:28a0".to_string()];
-        assert_eq!(restart_without(true, 1, Some("Dx12:10de:28a0"), &skip), None);
-        assert_eq!(restart_without(true, 1, Some("Dx12:8086:a7a8"), &skip), Some("Dx12:8086:a7a8"));
-    }
-
    #[test]
    fn a_restart_tries_the_next_adapter() {
        let c = issue_502();
        let mut skip = vec![];
        let mut tried = vec![];
-        while let Some(&i) = adapter_order(&c, PowerPreference::LowPower, &[], None, None, &skip).first() {
+        while let Some(&i) = adapter_order(&c, PowerPreference::LowPower, None, &skip).first() {
            tried.push(c[i].name.clone());
            skip.push(c[i].key.clone());
        }
@@ -933,40 +331,37 @@ mod tests {
        c[0].presents = false;
        c[3].presents = false;
        for power in [PowerPreference::None, PowerPreference::LowPower, PowerPreference::HighPerformance] {
-            let order = adapter_order(&c, power, &[], None, None, &[]);
+            let order = adapter_order(&c, power, None, &[]);
            assert!(!order.contains(&0) && !order.contains(&3), "{power:?}: {order:?}");
            assert_eq!(order.len(), 2);
        }
        for p in &mut c {
            p.presents = false;
        }
-        assert!(adapter_order(&c, PowerPreference::None, &[], None, None, &[]).is_empty());
-        assert!(adapter_order(&[], PowerPreference::HighPerformance, &[], None, None, &[]).is_empty());
+        assert!(adapter_order(&c, PowerPreference::None, None, &[]).is_empty());
+        assert!(adapter_order(&[], PowerPreference::HighPerformance, None, &[]).is_empty());
    }

    #[test]
    fn wgpu_adapter_name_picks_an_adapter_first_and_the_rest_stay_as_fallbacks() {
        let c = issue_502();
-        let order = adapter_order(&c, PowerPreference::HighPerformance, &[], None, Some("radv"), &[]);
+        let order = adapter_order(&c, PowerPreference::HighPerformance, Some("radv"), &[]);
        assert_eq!(c[order[0]].name, "AMD Ryzen 9 7900X (RADV RAPHAEL_MENDOCINO)");
        assert_eq!(order.len(), 4);
        // Any case; every match comes before the rest, natively first.
-        let order = adapter_order(&c, PowerPreference::LowPower, &[], None, Some("GeForce"), &[]);
+        let order = adapter_order(&c, PowerPreference::LowPower, Some("GeForce"), &[]);
        assert_eq!(names(&c, &order[..2]), ["NVIDIA GeForce RTX 5070", "NVIDIA GeForce RTX 5070/PCIe/SSE2"]);
        // An empty name or one nothing matches changes nothing.
        for named in ["", "no such gpu"] {
-            assert_eq!(
-                adapter_order(&c, PowerPreference::LowPower, &[], None, Some(named), &[]),
-                adapter_order(&c, PowerPreference::LowPower, &[], None, None, &[])
-            );
+            assert_eq!(adapter_order(&c, PowerPreference::LowPower, Some(named), &[]), adapter_order(&c, PowerPreference::LowPower, None, &[]));
        }
        // A named adapter that failed is left out like any other.
        let skip = vec![c[1].key.clone()];
-        assert_eq!(adapter_order(&c, PowerPreference::None, &[], None, Some("radv"), &skip)[0], 0);
+        assert_eq!(adapter_order(&c, PowerPreference::None, Some("radv"), &skip)[0], 0);
    }

    /// A Windows machine lists every GPU twice (Vulkan and DX12): power saving still takes the
-    /// integrated GPU first, as wgpu's own choice did (#306), each GPU through DX12 first (#545).
+    /// integrated GPU first, as wgpu's own choice did (#306).
    #[test]
    fn hybrid_laptop_on_windows_renders_on_the_integrated_gpu_with_power_saving() {
        let c = vec![
@@ -976,38 +371,9 @@ mod tests {
            gpu("Intel(R) Iris(R) Xe Graphics", Backend::Dx12, DeviceType::IntegratedGpu),
            gpu("Microsoft Basic Render Driver", Backend::Dx12, DeviceType::Cpu),
        ];
-        let order = adapter_order(&c, PowerPreference::LowPower, &[], None, None, &[]);
-        assert_eq!(order, [3, 1, 2, 0, 4]);
-        assert_eq!(adapter_order(&c, PowerPreference::HighPerformance, &[], None, None, &[]), [2, 0, 3, 1, 4]);
-    }
-
-    /// The machine of #545: one Intel GPU, whose Vulkan driver made the window flicker black.
-    /// DX12 comes first whatever the preference; Vulkan stays a fallback, and `WGPU_ADAPTER_NAME`
-    /// or a restart leaving DX12 out still reach it.
-    #[test]
-    fn a_windows_gpu_renders_through_dx12_before_vulkan() {
-        let c = vec![
-            gpu("Intel(R) Graphics", Backend::Vulkan, DeviceType::IntegratedGpu),
-            gpu("Intel(R) Graphics", Backend::Dx12, DeviceType::IntegratedGpu),
-            gpu("Microsoft Basic Render Driver", Backend::Dx12, DeviceType::Cpu),
-            gpu("Intel(R) Graphics", Backend::Gl, DeviceType::Other),
-        ];
-        for power in [PowerPreference::LowPower, PowerPreference::HighPerformance, PowerPreference::None] {
-            assert_eq!(adapter_order(&c, power, &[], None, None, &[]), [1, 0, 3, 2], "{power:?}");
-        }
-        assert_eq!(adapter_order(&c, PowerPreference::LowPower, &[], None, None, &[c[1].key.clone()]), [0, 3, 2], "DX12 failed: Vulkan next");
-    }
-
-    #[test]
-    fn windows_never_loads_vulkan_drivers_unless_asked() {
-        let all = Backends::all();
-        let start = backends(all, false);
-        if cfg!(windows) {
-            assert_eq!(start, Backends::DX12 | Backends::GL, "#806");
-        } else {
-            assert_eq!(start, all);
-        }
-        assert_eq!(backends(Backends::VULKAN, true), Backends::VULKAN, "WGPU_BACKEND=vulkan still picks it");
+        let order = adapter_order(&c, PowerPreference::LowPower, None, &[]);
+        assert_eq!(order, [1, 3, 0, 2, 4]);
+        assert_eq!(adapter_order(&c, PowerPreference::HighPerformance, None, &[]), [0, 2, 1, 3, 4]);
    }

    #[test]
@@ -1048,8 +414,8 @@ mod tests {
    fn skipped_adapters_parse_from_a_comma_separated_list() {
        assert_eq!(parse_skip("Vulkan:1002:164e, Gl:10de:2f04,,"), ["Vulkan:1002:164e", "Gl:10de:2f04"]);
        assert!(parse_skip("").is_empty());
-        assert_eq!(key(Backend::Vulkan, 0x1002, 0x164e, "AMD Radeon"), "Vulkan:1002:164e");
-        assert_eq!(key(Backend::Gl, 0x10de, 0x2f04, "NVIDIA"), "Gl:10de:2f04");
+        assert_eq!(key(Backend::Vulkan, 0x1002, 0x164e), "Vulkan:1002:164e");
+        assert_eq!(key(Backend::Gl, 0x10de, 0x2f04), "Gl:10de:2f04");
    }

    #[test]
@@ -1,84 +0,0 @@
-//! macOS: the font files CoreText's font manager lists, scanned with the font folders
-//! (`vectorcraft_text::set_platform_font_files`). The desktop app and `vectorcraft-cli` (exports,
-//! MCP) both install it; the CLI shares this file.
-//!
-//! Apps and font managers can register fonts with the font manager from files in any folder,
-//! outside the font folders
-//! (<https://developer.apple.com/documentation/coretext/ctfontmanagerregisterfontsforurl(_:_:_:)>).
-//! The font manager's list of available fonts holds them
-//! (<https://developer.apple.com/documentation/coretext/ctfontmanagercopyavailablefonturls()>), so
-//! VectorCraft lists them as it does on Windows (`system_fonts.rs`), reading the files in place
-//! (#579).
-//!
-//! CoreText is a C API with no safe binding, hence the scoped `unsafe_code` allowance.
-#![allow(unsafe_code)]
-
-use std::collections::BTreeSet;
-
-use objc2_core_foundation::{CFType, CFURL};
-use objc2_core_text::CTFontManagerCopyAvailableFontURLs;
-
-/// The most fonts read from the list (a system has a few thousand faces).
-const MAX_FONTS: usize = 1 << 16;
-
-/// Have the font scans read the font files CoreText lists.
-pub fn install() {
-    vectorcraft_text::set_platform_font_files(font_files);
-}
-
-/// The files of the fonts available to the app as CoreText lists them now (fonts registered since
-/// the last call included).
-fn font_files() -> Vec<String> {
-    // SAFETY: a CoreText call without arguments; it returns a new array.
-    let list = unsafe { CTFontManagerCopyAvailableFontURLs() };
-    // SAFETY: the array holds CF objects (CFURLs, as CoreText documents); each one is checked to be
-    // a CFURL before it is read.
-    let fonts = unsafe { list.cast_unchecked::<CFType>() };
-    // Faces of one file (a collection's) name it once.
-    let files: BTreeSet<String> = fonts
-        .iter()
-        .take(MAX_FONTS)
-        .filter_map(|f| f.downcast::<CFURL>().ok())
-        // Only file URLs, as in `open_documents.rs` (#433).
-        .filter(|u| u.scheme().is_some_and(|s| s.to_string().eq_ignore_ascii_case("file")))
-        .filter_map(|u| u.to_file_path()?.into_os_string().into_string().ok())
-        .collect();
-    files.into_iter().collect()
-}
-
-#[cfg(test)]
-mod tests {
-    use objc2_core_foundation::CFURL;
-    use objc2_core_text::{CTFontManagerRegisterFontsForURL, CTFontManagerScope, CTFontManagerUnregisterFontsForURL};
-
-    /// CoreText lists the installed fonts, by their files' full paths.
-    #[test]
-    fn coretext_lists_the_installed_font_files() {
-        let files = super::font_files();
-        assert!(files.iter().all(|f| std::path::Path::new(f).is_absolute()), "{:?}", files.first());
-        assert!(files.iter().any(|f| f.starts_with("/System/Library/Fonts/")), "{} files, {:?}", files.len(), files.first());
-    }
-
-    /// A font registered with CoreText from another folder, as apps and font managers register
-    /// fonts, is listed while it is registered.
-    #[test]
-    fn fonts_registered_from_other_folders_are_listed() {
-        let dir = std::env::temp_dir().join(format!("vectorcraft-mac-fonts-{}", std::process::id()));
-        std::fs::create_dir_all(&dir).unwrap();
-        // A space in the name: the URL's escapes are decoded. The bundled serif isn't a font macOS
-        // installs.
-        let file = dir.join("Registered Font.ttf");
-        std::fs::copy(concat!(env!("CARGO_MANIFEST_DIR"), "/../../assets/fonts/SourceSerif4-Regular.ttf"), &file).unwrap();
-        let want = std::fs::canonicalize(&file).unwrap();
-        let listed = || super::font_files().iter().any(|f| f.ends_with("/Registered Font.ttf") && std::fs::canonicalize(f).is_ok_and(|p| p == want));
-        assert!(!listed());
-        let url = CFURL::from_file_path(&file).unwrap();
-        // SAFETY: a file URL, a scope constant and no error out-parameter.
-        assert!(unsafe { CTFontManagerRegisterFontsForURL(&url, CTFontManagerScope::Process, std::ptr::null_mut()) });
-        let registered = listed();
-        // SAFETY: as above.
-        unsafe { CTFontManagerUnregisterFontsForURL(&url, CTFontManagerScope::Process, std::ptr::null_mut()) };
-        std::fs::remove_dir_all(&dir).unwrap();
-        assert!(registered);
-    }
-}
@@ -12,83 +12,16 @@
 //! - Hide and Hide Others are items of ours calling `NSApplication`: AppKit's own always take ⌘H
 //!   (View › Hide Edges) and ⌥⌘H.

-use std::sync::Once;
-use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::mpsc::{Receiver, channel};

-use block2::RcBlock;
-
 use egui::{Key, KeyboardShortcut};
 use muda::accelerator::{Accelerator, Code, Modifiers};
 use muda::{CheckMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
 use objc2::MainThreadMarker;
-use objc2_app_kit::{NSApplication, NSEventModifierFlags, NSEventType, NSMenuDidBeginTrackingNotification, NSMenuDidEndTrackingNotification};
-use objc2_foundation::{NSNotification, NSNotificationCenter};
+use objc2_app_kit::{NSApplication, NSEventModifierFlags, NSEventType};
 use vectorcraft_ui_egui::VectorcraftApp;
 use vectorcraft_ui_egui::native_menu::{self, Backend, Event, MenuBar, MenuRole, Node, Standard};

-// AppKit can deliver window input while its system menu is still tracking (especially with
-// asynchronous menu presentation). Keep the native tracking state separate from egui popups.
-static TRACKING: AtomicBool = AtomicBool::new(false);
-
-fn observe_tracking(ctx: &egui::Context) {
-    static INSTALL: Once = Once::new();
-    INSTALL.call_once(|| {
-        // SAFETY: AppKit initializes these immutable notification-name constants.
-        #[allow(unsafe_code)]
-        let notifications = unsafe { [(NSMenuDidBeginTrackingNotification, true), (NSMenuDidEndTrackingNotification, false)] };
-        for (name, tracking) in notifications {
-            let repaint = ctx.clone();
-            let block = RcBlock::new(move |_: std::ptr::NonNull<NSNotification>| {
-                TRACKING.store(tracking, Ordering::Relaxed);
-                // Apply any deferred menu updates as soon as the tracking session ends.
-                if !tracking {
-                    repaint.request_repaint();
-                }
-            });
-            // SAFETY: these are AppKit's notification names. The notification center retains
-            // the observer and block for the application's lifetime; callbacks update an atomic and request repaint.
-            #[allow(unsafe_code)]
-            unsafe {
-                NSNotificationCenter::defaultCenter().addObserverForName_object_queue_usingBlock(Some(name), None, None, &block);
-            }
-        }
-    });
-}
-
-fn cancel_tracking() {
-    if let Some(mtm) = MainThreadMarker::new()
-        && let Some(menu) = NSApplication::sharedApplication(mtm).mainMenu()
-    {
-        menu.cancelTracking();
-    }
-    TRACKING.store(false, Ordering::Relaxed);
-}
-
-/// A dismissing click belongs to the menu, so the canvas and panel controls must not see it.
-fn dismiss_input(raw: &mut egui::RawInput, tracking: bool) -> bool {
-    if !raw
-        .events
-        .iter()
-        .any(|e| matches!(e, egui::Event::PointerButton { pressed: true, .. } | egui::Event::Key { key: egui::Key::Escape, pressed: true, .. }))
-    {
-        return false;
-    }
-    if tracking {
-        raw.events.retain(|e| !matches!(e, egui::Event::PointerButton { .. } | egui::Event::Key { key: egui::Key::Escape, .. }));
-    }
-    true
-}
-
-/// Inspect real window input before native key equivalents and control events are added.
-pub fn raw_input_hook(raw: &mut egui::RawInput) {
-    // Asynchronous menu presentation may leave a displayed menu after its tracking notification.
-    // Still cancel it, but consume the dismissing input only during a reported tracking session.
-    if dismiss_input(raw, TRACKING.load(Ordering::Relaxed)) {
-        cancel_tracking();
-    }
-}
-
 enum Handle {
    Plain(MenuItem),
    Check(CheckMenuItem),
@@ -115,13 +48,10 @@ pub struct MacMenu {
    entries: Vec<Entry>,
    rx: Receiver<Chosen>,
    structure: u64,
-    /// Latest menu state to apply after AppKit finishes tracking; item ids stay stable meanwhile.
-    pending: Option<MenuBar>,
 }

 impl MacMenu {
    fn new(ctx: &egui::Context) -> MacMenu {
-        observe_tracking(ctx);
        let (tx, rx) = channel();
        let repaint = ctx.clone();
        MenuEvent::set_event_handler(Some(move |e: MenuEvent| {
@@ -137,7 +67,7 @@ impl MacMenu {
            // Wake egui, so the item runs now rather than on the next mouse move.
            repaint.request_repaint();
        }));
-        MacMenu { menu: None, entries: Vec::new(), rx, structure: 0, pending: None }
+        MacMenu { menu: None, entries: Vec::new(), rx, structure: 0 }
    }

    /// Build the menus of `bar` and make them the app's, in place of the ones before.
@@ -216,13 +146,6 @@ fn append(sub: &Submenu, nodes: &[Node], entries: &mut Vec<Entry>) -> muda::Resu

 impl Backend for MacMenu {
    fn sync(&mut self, bar: &MenuBar) {
-        // Replacing or mutating an NSMenu during tracking can strand its displayed menu. Keep
-        // the latest state: the shared model considers this sync complete and may not resend it.
-        if TRACKING.load(Ordering::Relaxed) {
-            self.pending = Some(bar.clone());
-            return;
-        }
-        self.pending = None;
        let items = bar.items();
        if self.menu.is_none() || native_menu::structure_key(bar) != self.structure || items.len() != self.entries.len() {
            if let Err(e) = self.build(bar) {
@@ -260,7 +183,6 @@ impl Backend for MacMenu {
    fn drain(&mut self) -> Vec<Event> {
        let mut out = Vec::new();
        while let Ok(chosen) = self.rx.try_recv() {
-            cancel_tracking();
            // Ids that aren't ours are AppKit's own items (Services, Zoom…), already handled.
            let Some(e) = chosen.id.strip_prefix("vc").and_then(|n| n.parse::<usize>().ok()).and_then(|i| self.entries.get(i)) else { continue };
            if let Some(command @ (native_menu::HIDE | native_menu::HIDE_OTHERS)) = e.item.command {
@@ -285,12 +207,6 @@ impl Backend for MacMenu {
                None => Event::Click(e.item.clone()),
            });
        }
-        // Drain against the old item ids before a deferred structure change replaces them.
-        if !TRACKING.load(Ordering::Relaxed)
-            && let Some(bar) = self.pending.take()
-        {
-            self.sync(&bar);
-        }
        out
    }
 }
@@ -448,40 +364,4 @@ mod tests {
        assert_ne!(parse("Cmd+M"), parse("Ctrl+Cmd+M"));
        assert!(parse("Cmd+M").is_some());
    }
-
-    fn press() -> egui::Event {
-        egui::Event::PointerButton {
-            pos: egui::pos2(300.0, 200.0),
-            button: egui::PointerButton::Primary,
-            pressed: true,
-            modifiers: Default::default(),
-        }
-    }
-
-    #[test]
-    fn outside_press_dismisses_without_starting_a_canvas_gesture() {
-        let moved = egui::Event::PointerMoved(egui::pos2(300.0, 200.0));
-        let mut raw = egui::RawInput { events: vec![moved.clone(), press()], ..Default::default() };
-        assert!(dismiss_input(&mut raw, true));
-        assert_eq!(raw.events, [moved]);
-        assert!(!dismiss_input(&mut raw, true));
-        raw.events.push(press());
-        assert!(dismiss_input(&mut raw, false));
-        assert_eq!(raw.events.len(), 2, "ordinary canvas presses still reach egui");
-    }
-
-    #[test]
-    fn escape_dismisses_without_reaching_the_active_tool() {
-        let escape = |pressed| egui::Event::Key { key: egui::Key::Escape, physical_key: None, pressed, repeat: false, modifiers: Default::default() };
-        let mut raw = egui::RawInput { events: vec![escape(true), escape(false)], ..Default::default() };
-        assert!(dismiss_input(&mut raw, true));
-        assert!(raw.events.is_empty());
-    }
-
-    #[test]
-    fn moving_the_pointer_does_not_dismiss_a_tracking_menu() {
-        let mut raw = egui::RawInput { events: vec![egui::Event::PointerMoved(egui::pos2(300.0, 200.0))], ..Default::default() };
-        assert!(!dismiss_input(&mut raw, true));
-        assert_eq!(raw.events.len(), 1);
-    }
 }
@@ -1,137 +0,0 @@
-//! Format menu on macOS save sheets (#866). rfd's Cocoa backend combines the extensions of
-//! every filter but doesn't show their names. The accessory uses the same filters and updates
-//! the filename, whose extension already determines the format in the save command.
-//!
-//! AppKit owns the accessory until the sheet closes; its target is the accessory itself. The
-//! panel reference is weak, so closing the sheet releases both without a retain cycle.
-//! Native view handles and Objective-C subclassing require the scoped unsafe allowance.
-#![allow(unsafe_code)]
-
-use std::path::Path;
-
-use objc2::rc::{Retained, Weak};
-use objc2::{DefinedClass, MainThreadMarker, MainThreadOnly, define_class, msg_send, sel};
-use objc2_app_kit::{NSPopUpButton, NSSavePanel, NSTextField, NSView};
-use objc2_foundation::{NSObjectProtocol, NSPoint, NSRect, NSSize, NSString};
-use raw_window_handle::{HasWindowHandle, RawWindowHandle};
-use vectorcraft_ui_egui::{FilePick, i18n};
-
-type Filter = (&'static str, &'static [&'static str]);
-
-struct Ivars {
-    panel: Weak<NSSavePanel>,
-    filters: Vec<Filter>,
-}
-
-define_class!(
-    // SAFETY: NSView has no extra subclassing requirements; the subclass implements no Drop.
-    #[unsafe(super = NSView)]
-    #[thread_kind = MainThreadOnly]
-    #[ivars = Ivars]
-    #[name = "VectorcraftSaveFormatAccessory"]
-    struct FormatAccessory;
-
-    // SAFETY: NSObjectProtocol has no additional requirements.
-    unsafe impl NSObjectProtocol for FormatAccessory {}
-
-    impl FormatAccessory {
-        // SAFETY: AppKit's target/action sends the popup as the single object argument.
-        #[unsafe(method(chooseFormat:))]
-        fn choose_format(&self, sender: &NSPopUpButton) {
-            let Some(panel) = self.ivars().panel.load() else { return };
-            let Some(index) = usize::try_from(sender.indexOfSelectedItem()).ok() else { return };
-            let Some((_, extensions)) = self.ivars().filters.get(index) else { return };
-            let Some(extension) = extensions.first() else { return };
-            let name = panel.nameFieldStringValue().to_string();
-            let new = filename(&name, extension, &self.ivars().filters);
-            panel.setNameFieldStringValue(&NSString::from_str(&new));
-        }
-    }
-);
-
-/// The suggested file's type, or the request's default (the first filter).
-fn initial_format(name: &str, filters: &[Filter]) -> usize {
-    let extension = Path::new(name).extension().and_then(|e| e.to_str());
-    filters.iter().position(|(_, extensions)| extension.is_some_and(|e| extensions.iter().any(|x| e.eq_ignore_ascii_case(x)))).unwrap_or(0)
-}
-
-/// Replace a known format suffix; keep other dots (e.g. a version number) as part of the name.
-fn filename(name: &str, extension: &str, filters: &[Filter]) -> String {
-    if name.is_empty() {
-        return name.to_owned();
-    }
-    let path = Path::new(name);
-    if path
-        .extension()
-        .and_then(|e| e.to_str())
-        .is_some_and(|e| filters.iter().any(|(_, extensions)| extensions.iter().any(|x| e.eq_ignore_ascii_case(x))))
-    {
-        path.with_extension(extension).to_string_lossy().into_owned()
-    } else {
-        format!("{name}.{extension}")
-    }
-}
-
-/// Add a Format menu to the save sheet rfd just began on `window`. Open panels and requests
-/// without several named file types are left to rfd.
-pub fn attach(window: &winit::window::Window, pick: &FilePick) {
-    let Some(mtm) = MainThreadMarker::new() else { return };
-    let filters: Vec<_> = pick.filters.iter().copied().filter(|(_, extensions)| !extensions.is_empty() && !extensions.contains(&"*")).collect();
-    if filters.len() < 2 {
-        return;
-    }
-    let Ok(handle) = window.window_handle() else { return };
-    let RawWindowHandle::AppKit(handle) = handle.as_raw() else { return };
-    // SAFETY: winit keeps its content view alive while this window reference is in use.
-    let view = unsafe { handle.ns_view.cast::<NSView>().as_ref() };
-    let Some(sheet) = view.window().and_then(|w| w.attachedSheet()) else { return };
-    let Some(panel) = sheet.downcast_ref::<NSSavePanel>() else { return };
-    let selected = initial_format(&pick.name, &filters);
-    let this = FormatAccessory::alloc(mtm).set_ivars(Ivars { panel: Weak::new(panel), filters });
-    // SAFETY: NSView's designated initializer is called once on the allocated subclass.
-    let accessory: Retained<FormatAccessory> = unsafe { msg_send![super(this), initWithFrame: NSRect::new(NSPoint::ZERO, NSSize::new(360.0, 38.0))] };
-    let label = NSTextField::labelWithString(&NSString::from_str(i18n::t("Format:")), mtm);
-    label.setFrame(NSRect::new(NSPoint::new(0.0, 10.0), NSSize::new(80.0, 20.0)));
-    let popup =
-        NSPopUpButton::initWithFrame_pullsDown(NSPopUpButton::alloc(mtm), NSRect::new(NSPoint::new(82.0, 6.0), NSSize::new(278.0, 28.0)), false);
-    for (name, _) in &accessory.ivars().filters {
-        popup.addItemWithTitle(&NSString::from_str(i18n::t(name)));
-    }
-    // The filter list comes from the built-in format registry, small enough for NSInteger.
-    if let Ok(index) = isize::try_from(selected) {
-        popup.selectItemAtIndex(index);
-    }
-    // SAFETY: the accessory owns the popup and AppKit keeps the accessory while the sheet is
-    // open. The selector above has exactly the target/action signature expected by NSControl.
-    unsafe {
-        popup.setTarget(Some(&accessory));
-        popup.setAction(Some(sel!(chooseFormat:)));
-        accessory.addSubview(&label);
-        accessory.addSubview(&popup);
-    }
-    panel.setExtensionHidden(false);
-    panel.setAccessoryView(Some(&accessory));
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const FILTERS: &[Filter] = &[("VectorCraft", &["vectorcraft", "drawcraft"]), ("SVG", &["svg"]), ("PDF", &["pdf"])];
-
-    #[test]
-    fn current_suffix_selects_the_format_and_an_unknown_one_uses_the_default() {
-        for (name, index) in [("Untitled-1", 0), ("旧形式.drawcraft", 0), ("a b.SVG", 1), ("art.pdf", 2), ("version.2", 0)] {
-            assert_eq!(initial_format(name, FILTERS), index);
-        }
-    }
-
-    #[test]
-    fn changing_format_keeps_the_name_and_avoids_duplicate_extensions() {
-        for (name, expected) in
-            [("図面 1.vectorcraft", "図面 1.svg"), ("a.PDF", "a.svg"), ("art", "art.svg"), ("art.v2", "art.v2.svg"), ("art.svg", "art.svg"), ("", "")]
-        {
-            assert_eq!(filename(name, "svg", FILTERS), expected);
-        }
-    }
-}
@@ -1,74 +0,0 @@
-//! macOS: the window buttons (close, minimize, zoom) centred on the app bar (#968).
-//!
-//! AppKit puts the buttons in a standard title bar, shorter than the app bar they sit over, so they
-//! rode high on it. [`center_buttons`] moves them to the middle of the bar, inset from its left as
-//! far as from its top, and makes the title bar as tall as the app bar so they stay clickable.
-//! AppKit lays its title bar out again when the window resizes or leaves full screen, so this runs
-//! every frame and moves the buttons only when they are out of place.
-//!
-//! Reaching the title bar's views from the window's content view has no safe API, hence the scoped
-//! `unsafe_code` allowance.
-#![allow(unsafe_code)]
-
-use objc2::runtime::AnyObject;
-use objc2_app_kit::{NSView, NSWindowButton, NSWindowStyleMask};
-use objc2_foundation::NSPoint;
-use raw_window_handle::{HasWindowHandle, RawWindowHandle};
-
-/// The room the app bar keeps at its left for the buttons in AppKit's own place, before they are
-/// centred (and in full screen, where AppKit shows them elsewhere): their width and a gap.
-pub const DEFAULT_INSET: f32 = 78.0;
-
-/// Differences below this (in points) leave a frame as it is, so a frame in place isn't set again.
-const SLACK: f64 = 0.25;
-
-/// Centre the window's buttons on an app bar `bar` egui points tall, at the window's `zoom` factor
-/// (native points per egui point). Returns the room the app bar keeps clear at its left for them,
-/// in egui points, or `None` when they aren't over the bar (full screen) or can't be found.
-pub fn center_buttons(frame: &eframe::Frame, zoom: f32, bar: f32) -> Option<f32> {
-    let RawWindowHandle::AppKit(handle) = frame.window_handle().ok()?.as_raw() else {
-        return None;
-    };
-    // SAFETY: the handle's view is the window's content view, which AppKit keeps alive while the
-    // window is open, and eframe hands out the handle only while it is.
-    let view = unsafe { handle.ns_view.cast::<NSView>().as_ref() };
-    let window = view.window()?;
-    if window.styleMask().contains(NSWindowStyleMask::FullScreen) {
-        return None;
-    }
-    let close = window.standardWindowButton(NSWindowButton::CloseButton)?;
-    let minimize = window.standardWindowButton(NSWindowButton::MiniaturizeButton)?;
-    let zoom_button = window.standardWindowButton(NSWindowButton::ZoomButton)?;
-    // The buttons sit in the title bar view, inside the title bar container that sets its height.
-    // SAFETY: both views belong to the window, alive while it is; used right away.
-    let container = unsafe { close.superview().and_then(|titlebar| titlebar.superview()) }?;
-    // Another layout (a later macOS) is left as AppKit made it.
-    if AnyObject::class(&container).name() != c"NSTitlebarContainerView" {
-        return None;
-    }
-    let size = close.frame().size;
-    let gap = minimize.frame().origin.x - (close.frame().origin.x + size.width);
-    let height = f64::from(bar * zoom);
-    let margin = (height - size.height) / 2.0;
-    if !(margin.is_finite() && margin > 0.0 && gap.is_finite() && gap >= 0.0 && zoom > 0.0) {
-        return None;
-    }
-    let mut bounds = container.frame();
-    let top = window.frame().size.height - height;
-    if (bounds.size.height - height).abs() > SLACK || (bounds.origin.y - top).abs() > SLACK {
-        bounds.size.height = height;
-        bounds.origin.y = top;
-        container.setFrame(bounds);
-    }
-    let mut x = margin;
-    for button in [close, minimize, zoom_button] {
-        let at = NSPoint::new(x, (height - button.frame().size.height) / 2.0);
-        let now = button.frame().origin;
-        if (now.x - at.x).abs() > SLACK || (now.y - at.y).abs() > SLACK {
-            button.setFrameOrigin(at);
-        }
-        x += size.width + gap;
-    }
-    // The last button's right edge (`x` steps one gap past it) and the margin again after it.
-    Some(((x - gap + margin) / f64::from(zoom)) as f32)
-}
@@ -1,18 +1,13 @@
 //! VectorCraft desktop app.
 //!
-//! Usage: `vectorcraft [--control <port> [--automation-read-root <dir>] [--automation-write-root <dir>]]
-//! [--in-window-menus] [files…]`
+//! Usage: `vectorcraft [--control <port>] [--in-window-menus] [files…]`
 //!
 //! `--in-window-menus` (or `VECTORCRAFT_IN_WINDOW_MENUS=1`) keeps the menus inside the window on
 //! macOS instead of the macOS menu bar (`mac_menu`).
 //!
-//! `--control <port>` (or `VECTORCRAFT_CONTROL_PORT`; a port from 1 to 65535, or the app doesn't
-//! start) starts a localhost JSON-lines control server:
+//! `--control <port>` (or `VECTORCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server:
 //! `{"id":1,"method":"ui.inspect","params":{}}` → `{"id":1,"ok":true,"result":…}`.
-//! See `vectorcraft_ui_egui::control` for the methods. `--automation-read-root` and
-//! `--automation-write-root` (or `VECTORCRAFT_AUTOMATION_READ_ROOT` / `_WRITE_ROOT`) confine the
-//! files its requests read and write (`vectorcraft_engine::file_access`); the person at the
-//! keyboard isn't confined.
+//! See `vectorcraft_ui_egui::control` for the methods.
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]

 #[cfg(all(feature = "windows7", any(feature = "wgpu", feature = "accessibility")))]
@@ -22,36 +17,21 @@ compile_error!("windows7 requires --target x86_64-win7-windows-msvc; the ordinar
 #[cfg(all(target_vendor = "win7", not(feature = "windows7")))]
 compile_error!("the win7 target requires --no-default-features --features windows7");

-mod automation_args;
 mod clipboard;
-#[cfg(feature = "wgpu")]
-mod compositor_gpu;
 mod control_server;
 #[cfg(feature = "wgpu")]
 mod gpu;
 mod logging;
 #[cfg(target_os = "macos")]
-mod mac_fonts;
-#[cfg(target_os = "macos")]
 mod mac_menu;
 #[cfg(target_os = "macos")]
-mod mac_save_format;
-#[cfg(target_os = "macos")]
-mod mac_window;
-#[cfg(target_os = "macos")]
 mod open_documents;
-mod prefs_dir;
 mod printing;
-#[cfg(all(windows, not(target_vendor = "win7")))]
-mod system_fonts;
 mod window;
-mod xwayland;

 use vectorcraft_engine::Session;
 use vectorcraft_engine::cmd::fileio;
-use vectorcraft_engine::file_access::{self, AutomationRoots};
 use vectorcraft_ui_egui::graphics::GraphicsLoss;
-use vectorcraft_ui_egui::picks::PickRequest;
 use vectorcraft_ui_egui::{ClipboardProbeFactory, FilePick, Services, VectorcraftApp};

 struct App {
@@ -60,53 +40,10 @@ struct App {
    graphics_loss: GraphicsLoss,
    /// The graphics device was lost and the unsaved changes are kept for Data Recovery.
    graphics_lost: bool,
-    /// Frames the UI has run (see [`end_before_teardown`]).
-    frames: u64,
 }

 impl eframe::App for App {
-    // Each frame runs unconfined: it is the person at the keyboard's. The app confines what the
-    // control channel asks for, and the frames carrying input it injected, to the automation roots
-    // (`VectorcraftApp::with_automation_roots`), which are in force elsewhere in the process.
-    fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
-        file_access::unconfined(|| self.logic_frame(ctx, frame));
-    }
-    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        #[cfg(target_os = "macos")]
-        if self.app.services.native_menu.is_some() {
-            mac_menu::raw_input_hook(raw);
-        }
-        file_access::unconfined(|| self.app.raw_input_hook(raw));
-    }
-    #[cfg_attr(not(target_os = "macos"), allow(unused_variables))]
-    fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
-        #[cfg(target_os = "macos")]
-        {
-            let bar = vectorcraft_ui_egui::chrome::APP_BAR_HEIGHT;
-            let inset = mac_window::center_buttons(frame, ui.ctx().zoom_factor(), bar);
-            self.app.titlebar_inset = inset.unwrap_or(mac_window::DEFAULT_INSET);
-        }
-        file_access::unconfined(|| self.app.ui(ui));
-        // Not while a file dialog's sheet has the keyboard: its name field's composition would go.
-        #[cfg(target_os = "macos")]
-        if !self.app.file_dialog_open() && self.app.take_ime_discard() {
-            discard_marked_text();
-        }
-    }
-    #[cfg(not(feature = "windows7"))]
-    fn on_exit(&mut self) {
-        file_access::unconfined(|| save_prefs(&self.app));
-        end_before_teardown(self.frames);
-    }
-    #[cfg(feature = "windows7")]
-    fn on_exit(&mut self, _gl: Option<&eframe::glow::Context>) {
-        file_access::unconfined(|| save_prefs(&self.app));
-    }
-}
-
-impl App {
-    fn logic_frame(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        self.frames = ctx.cumulative_frame_nr();
+    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
        if let Some(why) = self.graphics_loss.take() {
            // eframe can't give a window a new device: the user saves and starts again.
            self.graphics_lost = self.app.graphics_lost(&why);
@@ -122,46 +59,41 @@ impl App {
            vectorcraft_ui_egui::background::wait_all(&mut self.app);
            return;
        }
-        // Files from the Finder and the Dock wait while a file dialog is open: what asked for it runs
-        // again on its document when it answers.
        #[cfg(target_os = "macos")]
-        if !self.app.file_dialog_open() {
-            // Files from the Finder and the Dock wait while a file dialog is open: what asked for it runs
-            // again on its document when it answers.
-            if !self.app.file_dialog_open() {
-                open_files(&mut self.app, open_documents::take());
-            }
-        }
+        open_files(&mut self.app, open_documents::take());
        self.app.logic(ctx);
        window::track(ctx, &mut self.app.ui.window);
        if self.app.ui.status == "quit" {
            ctx.send_viewport_cmd(egui::ViewportCommand::Close);
        }
    }
-}
-
-/// On macOS with accessibility, end the process once the app has saved what it keeps on quitting,
-/// before eframe tears the window down (#661). AccessKit then gives the window's content view back
-/// its own class, which AppKit's Touch Bar support was observing it under, and AppKit aborts the
-/// app as it quits on Macs with a Touch Bar. Nothing after the window is needed on a normal quit.
-/// Not while the window is still starting up (`frames` below [`gpu::STARTUP_FRAMES`]): a graphics
-/// failure then starts the app again on another adapter (#651).
-#[allow(unused_variables)]
-fn end_before_teardown(frames: u64) {
-    #[cfg(all(target_os = "macos", feature = "accessibility", feature = "wgpu"))]
-    if frames >= gpu::STARTUP_FRAMES {
-        log::info!("quitting");
-        log::logger().flush();
-        std::process::exit(0);
+    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
+        self.app.raw_input_hook(raw);
+    }
+    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+        self.app.ui(ui);
+        #[cfg(target_os = "macos")]
+        if self.app.take_ime_discard() {
+            discard_marked_text();
+        }
+    }
+    #[cfg(not(feature = "windows7"))]
+    fn on_exit(&mut self) {
+        save_prefs(&self.app);
+    }
+    #[cfg(feature = "windows7")]
+    fn on_exit(&mut self, _gl: Option<&eframe::glow::Context>) {
+        save_prefs(&self.app);
    }
 }

 /// Open files handed to the app (command line, macOS Finder and Dock) as documents. A file that
-/// can't be opened is reported to the user and on stderr; the others still open.
+/// can't be opened is reported in the status bar and on stderr; the others still open.
 fn open_files(app: &mut VectorcraftApp, files: Vec<String>) {
    for f in files {
-        if let Err(e) = vectorcraft_ui_egui::io::open_reporting(app, &f) {
+        if let Err(e) = vectorcraft_ui_egui::io::open_path(app, &f) {
            eprintln!("vectorcraft: {f}: {e}");
+            app.status(format!("Couldn't open {}: {e}", fileio::file_name(&f)));
        }
    }
 }
@@ -180,13 +112,27 @@ fn discard_marked_text() {
 /// Where UI preferences live: ~/Library/Application Support/VectorCraft (macOS),
 /// %APPDATA%\VectorCraft (Windows), $XDG_CONFIG_HOME or ~/.config/vectorcraft (Linux).
 fn prefs_path() -> Option<std::path::PathBuf> {
-    prefs_dir::prefs_path_for("VectorCraft", "vectorcraft")
+    prefs_path_for("VectorCraft", "vectorcraft")
 }

 /// The same place under the project's former name (DrawCraft): read once if there are no
 /// VectorCraft preferences yet, so settings survive the rename.
 fn legacy_prefs_path() -> Option<std::path::PathBuf> {
-    prefs_dir::prefs_path_for("DrawCraft", "drawcraft")
+    prefs_path_for("DrawCraft", "drawcraft")
+}
+
+fn prefs_path_for(name: &str, lower: &str) -> Option<std::path::PathBuf> {
+    let base = if cfg!(target_os = "macos") {
+        std::env::var_os("HOME").map(|h| std::path::PathBuf::from(h).join("Library/Application Support").join(name))
+    } else if cfg!(windows) {
+        std::env::var_os("APPDATA").map(|a| std::path::PathBuf::from(a).join(name))
+    } else {
+        std::env::var_os("XDG_CONFIG_HOME")
+            .map(std::path::PathBuf::from)
+            .or_else(|| std::env::var_os("HOME").map(|h| std::path::PathBuf::from(h).join(".config")))
+            .map(|c| c.join(lower))
+    };
+    base.map(|b| b.join("ui.json"))
 }

 /// Where the log files live: `logs` in the preferences folder (see `logging`).
@@ -205,42 +151,7 @@ fn read_prefs() -> Option<vectorcraft_ui_egui::UiState> {
        return None;
    }
    let bytes = prefs_path().and_then(|p| std::fs::read(p).ok()).or_else(|| legacy_prefs_path().and_then(|p| std::fs::read(p).ok()))?;
-    decode_saved_prefs(&bytes)
-}
-
-/// Recover only optional persisted docking metadata. Runtime UiState and command decoding
-/// remains strict, and an unreadable workspace layout cannot discard unrelated preferences.
-fn decode_saved_prefs(bytes: &[u8]) -> Option<vectorcraft_ui_egui::UiState> {
-    use serde_json::{Map, Value, json};
-
-    fn recover(object: &mut Map<String, Value>, hidden_key: &str) {
-        if let Some(layout) = object.get("docking")
-            && serde_json::from_value::<vectorcraft_ui_egui::UiState>(json!({"docking": layout})).is_err()
-        {
-            object.remove("docking");
-        }
-        if let Some(hidden) = object.get_mut(hidden_key) {
-            if let Value::Object(entries) = hidden {
-                entries.retain(|panel, location| {
-                    serde_json::from_value::<vectorcraft_ui_egui::UiState>(json!({"docking_hidden": {panel: location}})).is_ok()
-                });
-            } else {
-                object.remove(hidden_key);
-            }
-        }
-    }
-
-    let mut value: Value = serde_json::from_slice(bytes).ok()?;
-    let object = value.as_object_mut()?;
-    recover(object, "docking_hidden");
-    if let Some(Value::Array(workspaces)) = object.get_mut("custom_workspaces") {
-        for workspace in workspaces {
-            if let Some(object) = workspace.as_object_mut() {
-                recover(object, "dockingHidden");
-            }
-        }
-    }
-    serde_json::from_value(value).ok()
+    serde_json::from_slice(&bytes).ok()
 }

 fn load_prefs(app: &mut VectorcraftApp, saved: Option<vectorcraft_ui_egui::UiState>) {
@@ -268,107 +179,14 @@ fn save_prefs(app: &VectorcraftApp) {
    }
 }

-/// The window file dialogs belong to.
-type Parent = Option<std::sync::Arc<winit::window::Window>>;
-
-/// What rfd's blocking and asynchronous file dialogs are both set up with.
-trait DialogSettings: Sized {
-    fn parent(self, window: &winit::window::Window) -> Self;
-    fn title(self, title: &str) -> Self;
-    fn filter(self, name: &str, exts: &[&str]) -> Self;
-    fn folder(self, folder: &str) -> Self;
-    fn file_name(self, name: &str) -> Self;
-}
-
-macro_rules! dialog_settings {
-    ($($dialog:ty),*) => {$(
-        impl DialogSettings for $dialog {
-            fn parent(self, window: &winit::window::Window) -> Self {
-                self.set_parent(window)
-            }
-            fn title(self, title: &str) -> Self {
-                self.set_title(title)
-            }
-            fn filter(self, name: &str, exts: &[&str]) -> Self {
-                self.add_filter(name, exts)
-            }
-            fn folder(self, folder: &str) -> Self {
-                self.set_directory(folder)
-            }
-            fn file_name(self, name: &str) -> Self {
-                self.set_file_name(name)
-            }
-        }
-    )*};
-}
-
-dialog_settings!(rfd::FileDialog, rfd::AsyncFileDialog);
-
-/// `d` set up for `request`: its title, file types, folder and suggested name.
-fn dialog_for<D: DialogSettings>(d: D, request: &PickRequest) -> D {
-    let pick = match request {
-        PickRequest::Open(pick) | PickRequest::Save(pick) => pick,
-        PickRequest::OpenMany => {
-            return fileio::place_filters().fold(d.title(vectorcraft_ui_egui::i18n::t("Place")), |d, (name, exts)| {
-                d.filter(vectorcraft_ui_egui::i18n::tr_ctx(vectorcraft_ui_egui::i18n::current(), "file-filter", name), exts)
-            });
-        }
-        PickRequest::Folder => return d,
-    };
-    let d = pick
-        .filters
-        .iter()
-        .fold(d, |d, (name, exts)| d.filter(vectorcraft_ui_egui::i18n::tr_ctx(vectorcraft_ui_egui::i18n::current(), "file-filter", name), exts));
+/// A native file dialog showing `pick`'s file types, folder and suggested name.
+fn file_dialog(pick: &FilePick) -> rfd::FileDialog {
+    let d = pick.filters.iter().fold(rfd::FileDialog::new(), |d, (name, exts)| d.add_filter(*name, exts));
    let d = match &pick.folder {
-        Some(folder) => d.folder(folder),
+        Some(folder) => d.set_directory(folder),
        None => d,
    };
-    if pick.name.is_empty() { d } else { d.file_name(&pick.name) }
-}
-
-/// A native file dialog for `request` over `parent` (on Linux the portal then shows it over the
-/// window and keeps it in front).
-#[cfg(not(target_os = "macos"))]
-fn file_dialog(request: &PickRequest, parent: &Parent) -> rfd::FileDialog {
-    match parent {
-        Some(w) => dialog_for(rfd::FileDialog::new().parent(w), request),
-        None => dialog_for(rfd::FileDialog::new(), request),
-    }
-}
-
-/// Before `request`'s dialog shows: a save dialog's folder (the Templates folder) may not exist yet.
-fn make_folder(request: &PickRequest) {
-    if let PickRequest::Save(FilePick { folder: Some(folder), .. }) = request {
-        let _ = std::fs::create_dir_all(folder);
-    }
-}
-
-/// Show `dialog` for `request` (on the calling thread, until it closes) → the paths picked.
-#[cfg(not(target_os = "macos"))]
-fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest) -> Vec<String> {
-    make_folder(request);
-    let paths = match request {
-        PickRequest::Open(_) => dialog.pick_file().into_iter().collect(),
-        PickRequest::OpenMany => dialog.pick_files().unwrap_or_default(),
-        PickRequest::Save(_) => dialog.save_file().into_iter().collect(),
-        PickRequest::Folder => dialog.pick_folder().into_iter().collect(),
-    };
-    paths.into_iter().map(|p| p.to_string_lossy().to_string()).collect()
-}
-
-/// Show the dialog for `request` over `parent` now → the paths picked.
-#[cfg(not(target_os = "macos"))]
-fn pick_now(request: PickRequest, parent: &Parent) -> Vec<String> {
-    show_dialog(file_dialog(&request, parent), &request)
-}
-
-/// macOS shows no dialog in line: its modal loop would run inside winit's event handler, and an
-/// event winit held back meanwhile aborts the app (#867). Dialogs are sheets there ([`start_pick`]);
-/// one asked for any other way (a bug: outside a command, a dialog's OK or a button) picks nothing.
-#[cfg(target_os = "macos")]
-fn pick_now(request: PickRequest, _parent: &Parent) -> Vec<String> {
-    log::error!("no file dialog shown for {request:?}: macOS shows them as sheets, from commands, dialogs' OK and buttons only");
-    Vec::new()
+    if pick.name.is_empty() { d } else { d.set_file_name(&pick.name) }
 }

 /// File → Show in Folder: select `path` in Finder / Explorer, or open its folder elsewhere.
@@ -406,106 +224,29 @@ fn write_file(path: &str, bytes: &[u8]) -> Result<(), String> {
    fileio::write_atomic(std::path::Path::new(path), bytes).map_err(|e| e.to_string())
 }

-/// Linux: show the dialog for `request` over `parent` on a thread of its own, answering on the
-/// receiver. Shown on the UI thread, nothing would answer the compositor meanwhile, which then
-/// offers to kill the window as not responding (#592).
-#[cfg(not(target_os = "macos"))]
-fn start_pick(request: PickRequest, parent: &Parent, ui: &egui::Context) -> Option<std::sync::mpsc::Receiver<Vec<String>>> {
-    let dialog = file_dialog(&request, parent);
-    let (tx, rx) = std::sync::mpsc::channel();
-    let ui = ui.clone();
-    std::thread::Builder::new()
-        .name("file-dialog".into())
-        .spawn(move || {
-            // The app gone meanwhile has no use for the answer.
-            let _ = tx.send(show_dialog(dialog, &request));
-            ui.request_repaint();
-        })
-        .ok()?;
-    Some(rx)
-}
-
-/// The paths a dialog shown as a sheet picks, once it closes.
-#[cfg(target_os = "macos")]
-type SheetAnswer = std::pin::Pin<Box<dyn std::future::Future<Output = Vec<String>> + Send>>;
-
-/// macOS: show the dialog for `request` as a sheet on `parent`'s window, answering on the receiver
-/// (#867). Shown in line, the panel ran AppKit's modal event loop inside winit's event handler: an
-/// event winit had held back meanwhile (one came as a resize of the panel ended) then re-entered
-/// the handler, and winit's panic there, inside an AppKit callback, aborted the app. The sheet
-/// returns at once and the window keeps running; a thread of its own waits for the answer.
-#[cfg(target_os = "macos")]
-fn start_pick(request: PickRequest, parent: &Parent, ui: &egui::Context) -> Option<std::sync::mpsc::Receiver<Vec<String>>> {
-    use winit::raw_window_handle::HasWindowHandle as _;
-    // rfd runs the panel modally after all unless it has the running app's window to hold the
-    // sheet (and from another thread it can't reach the window): no dialog then (`pick_now`).
-    let mtm = objc2::MainThreadMarker::new();
-    let running = mtm.is_some_and(|mtm| objc2_app_kit::NSApplication::sharedApplication(mtm).isRunning());
-    let Some(window) = parent.as_ref().filter(|w| running && w.window_handle().is_ok()) else {
-        log::error!("no window to show the file dialog on (main thread: {}, running: {running})", mtm.is_some());
-        return None;
-    };
-    // The thread first, so the answer of a sheet once shown always has somewhere to go.
-    let (sheet_tx, sheet_rx) = std::sync::mpsc::channel::<SheetAnswer>();
-    let (tx, rx) = std::sync::mpsc::channel();
-    let ui = ui.clone();
-    std::thread::Builder::new()
-        .name("file-dialog".into())
-        .spawn(move || {
-            if let Ok(answer) = sheet_rx.recv() {
-                // The app gone meanwhile has no use for the answer.
-                let _ = tx.send(pollster::block_on(answer));
-                ui.request_repaint();
-            }
-        })
-        .ok()?;
-    make_folder(&request);
-    // rfd builds the panel and begins the sheet here, on the main thread (as it must).
-    let dialog = dialog_for(rfd::AsyncFileDialog::new().parent(window), &request);
-    let path = |f: &rfd::FileHandle| f.path().to_string_lossy().to_string();
-    let answer: SheetAnswer = match request {
-        PickRequest::Open(_) => {
-            let picked = dialog.pick_file();
-            Box::pin(async move { picked.await.iter().map(path).collect() })
-        }
-        PickRequest::OpenMany => {
-            let picked = dialog.pick_files();
-            Box::pin(async move { picked.await.unwrap_or_default().iter().map(path).collect() })
-        }
-        PickRequest::Save(pick) => {
-            let picked = dialog.save_file();
-            mac_save_format::attach(window, &pick);
-            Box::pin(async move { picked.await.iter().map(path).collect() })
-        }
-        PickRequest::Folder => {
-            let picked = dialog.pick_folder();
-            Box::pin(async move { picked.await.iter().map(path).collect() })
-        }
-    };
-    // The thread can't be gone: it waits for this. If it were, its receiver answers as cancelled.
-    let _ = sheet_tx.send(answer);
-    Some(rx)
-}
-
-/// The host's services; `ui` is woken when a file dialog answers.
-fn services(parent: Parent, ui: egui::Context) -> Services {
-    let (p1, p2, p3, p4, p5) = (parent.clone(), parent.clone(), parent.clone(), parent.clone(), parent);
+fn services() -> Services {
    Services {
-        pick_open: Some(Box::new(move |pick: &FilePick| pick_now(PickRequest::Open(pick.clone()), &p1).into_iter().next())),
-        pick_open_multi: Some(Box::new(move || pick_now(PickRequest::OpenMany, &p2))),
-        pick_save: Some(Box::new(move |pick: &FilePick| pick_now(PickRequest::Save(pick.clone()), &p3).into_iter().next())),
-        // Linux shows dialogs on a thread of their own (#592), macOS as sheets (#867); Windows
-        // dialogs run the window's events while they are open.
-        start_pick: cfg!(unix).then(|| Box::new(move |request: PickRequest| start_pick(request, &p5, &ui)) as vectorcraft_ui_egui::picks::StartPick),
-        dialogs_are_sheets: cfg!(target_os = "macos"),
+        pick_open: Some(Box::new(|pick: &FilePick| file_dialog(pick).pick_file().map(|p| p.to_string_lossy().to_string()))),
+        pick_open_multi: Some(Box::new(|| {
+            fileio::place_filters()
+                .fold(rfd::FileDialog::new().set_title("Place"), |d, (name, exts)| d.add_filter(name, exts))
+                .pick_files()
+                .unwrap_or_default()
+                .into_iter()
+                .map(|p| p.to_string_lossy().to_string())
+                .collect()
+        })),
+        pick_save: Some(Box::new(|pick: &FilePick| {
+            // The Templates folder may not exist yet.
+            if let Some(folder) = &pick.folder {
+                let _ = std::fs::create_dir_all(folder);
+            }
+            file_dialog(pick).save_file().map(|p| p.to_string_lossy().to_string())
+        })),
        read: Some(Box::new(|p: &str| std::fs::read(p).map_err(|e| e.to_string()))),
        write: Some(Box::new(write_file)),
        // Background Save and Export write from a worker thread.
        write_shared: Some(std::sync::Arc::new(write_file)),
-        // Native saves stream into the file as they are encoded.
-        stream_shared: Some(std::sync::Arc::new(|p: &str, fill: &mut dyn FnMut(&mut dyn std::io::Write) -> std::io::Result<()>| {
-            fileio::write_file_with(p, fill).map_err(|e| e.to_string())
-        })),
        // Every format Copy offers and Paste reads (menu-bar Paste never sees egui's Paste event).
        system_clipboard: Some(clipboard::system_clipboard()),
        // Linux checks whether Paste has something to take on a background thread: an X11 clipboard
@@ -519,7 +260,7 @@ fn services(parent: Parent, ui: egui::Context) -> Services {
        reveal: Some(Box::new(reveal)),
        // Links panel: Edit Original; Package: Show Package. Relink to Folder and Package pick folders.
        open_file: Some(Box::new(open_file)),
-        pick_folder: Some(Box::new(move || pick_now(PickRequest::Folder, &p4).into_iter().next())),
+        pick_folder: Some(Box::new(|| rfd::FileDialog::new().pick_folder().map(|p| p.to_string_lossy().to_string()))),
        // File → Print: the system's printers and print queue.
        print: Some(Box::new(printing::SystemPrint)),
        ..Default::default()
@@ -555,18 +296,6 @@ fn app_icon() -> egui::IconData {
    eframe::icon_data::from_png_bytes(png).unwrap_or_default()
 }

-/// Windows shows a window's big icon (`ICON_BIG`) in the taskbar and Alt+Tab; eframe sets only the
-/// small one (the title bar's), so the taskbar showed a generic icon. Set the big one too.
-#[cfg(windows)]
-fn set_taskbar_icon(w: &winit::window::Window) {
-    use winit::platform::windows::WindowExtWindows as _;
-    let icon = app_icon();
-    // An icon that can't be made leaves the generic one: nothing else depends on it.
-    if let Ok(i) = winit::window::Icon::from_rgba(icon.rgba, icon.width, icon.height) {
-        w.set_taskbar_icon(Some(i));
-    }
-}
-
 /// "name (backend, kind)" of the adapter the window renders with, for Help › About and bug reports.
 #[cfg(feature = "wgpu")]
 fn adapter_summary(info: &eframe::wgpu::AdapterInfo) -> String {
@@ -577,52 +306,17 @@ fn adapter_summary(info: &eframe::wgpu::AdapterInfo) -> String {
 /// macOS keeps its traffic lights over the integrated title strip.
 const CUSTOM_TITLEBAR: bool = !cfg!(target_os = "macos");

-/// Whether this start draws its own title bar: Windows and Linux do, unless Preferences ›
-/// User Interface › System Title Bar asks for the system's. Read from the saved preferences
-/// before the window opens; a missing or unreadable value keeps the default.
-fn custom_titlebar(saved: Option<&vectorcraft_ui_egui::UiState>) -> bool {
-    CUSTOM_TITLEBAR && !saved.map(|ui| ui.engine_prefs.get("systemTitleBar").and_then(serde_json::Value::as_bool).unwrap_or(false)).unwrap_or(false)
-}
-
-fn native_options(custom_titlebar: bool) -> eframe::NativeOptions {
-    eframe::NativeOptions {
-        viewport: egui::ViewportBuilder::default()
-            .with_title("VectorCraft")
-            .with_inner_size(window::DEFAULT_SIZE)
-            .with_min_inner_size(window::MIN_SIZE)
-            .with_drag_and_drop(true)
-            .with_decorations(!custom_titlebar)
-            .with_fullsize_content_view(true)
-            .with_titlebar_shown(false)
-            .with_title_shown(false)
-            .with_icon(app_icon())
-            .with_app_id("ai.storyteller.vectorcraft"),
-        #[cfg(feature = "windows7")]
-        renderer: eframe::Renderer::Glow,
-        ..Default::default()
-    }
-}
-
 fn main() -> std::process::ExitCode {
-    // Validate roots before logging, font scans, preferences or the window: a missing value
-    // must not clear an environment root and start the control channel without confinement.
-    let mut control = automation_args::ControlArg::default();
-    let root_env = |name: &str| std::env::var_os(name).filter(|v| !v.is_empty()).map(std::path::PathBuf::from);
-    let mut roots_args =
-        automation_args::AutomationArgs::new(root_env("VECTORCRAFT_AUTOMATION_READ_ROOT"), root_env("VECTORCRAFT_AUTOMATION_WRITE_ROOT"));
+    // First, so every start-up warning is recorded (`logging`).
+    let logger = logging::install();
+    vectorcraft_ui_egui::i18n::detect_system_lang_in_background();
+    let mut control_port: Option<u16> = std::env::var("VECTORCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
    let mut files = Vec::new();
    let mut in_window_menus = std::env::var_os("VECTORCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
    let mut args = std::env::args().skip(1);
    while let Some(a) = args.next() {
-        match roots_args.consume(&a, &mut args).and_then(|root| if root { Ok(true) } else { control.consume(&a, &mut args) }) {
-            Ok(true) => continue,
-            Ok(false) => {}
-            Err(e) => {
-                eprintln!("vectorcraft: {e}");
-                return std::process::ExitCode::FAILURE;
-            }
-        }
        match a.as_str() {
+            "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
            "--in-window-menus" => in_window_menus = true,
            "--version" => {
                println!("vectorcraft {}", env!("CARGO_PKG_VERSION"));
@@ -631,28 +325,6 @@ fn main() -> std::process::ExitCode {
            _ => files.push(a),
        }
    }
-    let automation_args::AutomationArgs { read_root, write_root, .. } = roots_args;
-    // After the arguments: `--control` and `--version` win over a bad environment value.
-    let control_port = match control.port {
-        Some(port) => Some(port),
-        None => match automation_args::env_control_port(std::env::var_os("VECTORCRAFT_CONTROL_PORT")) {
-            Ok(port) => port,
-            Err(e) => {
-                eprintln!("vectorcraft: {e}");
-                return std::process::ExitCode::FAILURE;
-            }
-        },
-    };
-    // Before desktop services, so every start-up warning is recorded (`logging`).
-    let logger = logging::install();
-    vectorcraft_ui_egui::i18n::detect_system_lang_in_background();
-    // Before the first font scan (the app's start): the fonts font services load (#579).
-    #[cfg(all(windows, not(target_vendor = "win7")))]
-    system_fonts::install();
-    #[cfg(target_os = "macos")]
-    mac_fonts::install();
-    // VectorCraft's own Fonts folder, which text.addFontFiles copies fonts into.
-    prefs_dir::install_fonts();
    // The log file lives in the settings directory, next to the preferences; opened after the
    // arguments, so `--version` leaves no file behind. Records logged until now are written to it
    // first. Runs without preferences (agents' test runs) log to standard error only, so they
@@ -667,70 +339,29 @@ fn main() -> std::process::ExitCode {
            None => logger.no_file(),
        }
    }
-    // The roots confine the control channel: a bad one keeps the app from starting rather than
-    // leaving agents unconfined. Without a control port there is nothing to confine.
-    let roots = if control_port.is_none() {
-        if read_root.is_some() || write_root.is_some() {
-            log::warn!("--automation-read-root and --automation-write-root confine the control channel: ignored without --control");
-        }
-        None
-    } else {
-        match AutomationRoots::new(read_root.as_deref(), write_root.as_deref()) {
-            Ok(roots) => roots,
-            Err(e) => {
-                log::error!("{e}");
-                eprintln!("vectorcraft: {e}");
-                return std::process::ExitCode::FAILURE;
-            }
-        }
-    };
    let saved = read_prefs();
    let saved_window = saved.as_ref().and_then(|ui| ui.window);
    #[cfg(feature = "wgpu")]
    let gpu_pref = saved.as_ref().and_then(|ui| ui.engine_prefs.get("gpuPreference")).and_then(serde_json::Value::as_str);
    #[cfg(feature = "wgpu")]
-    let power_env = eframe::wgpu::PowerPreference::from_env();
-    #[cfg(feature = "wgpu")]
-    let power = gpu::power_preference(gpu_pref, power_env);
-    // Automatic draws on the GPU that drives the (primary) display: a GPU without a monitor reset
-    // its driver and took every monitor down (pdfcraft#378). Logged first: the first question in
-    // every black-window report.
-    #[cfg(feature = "wgpu")]
-    let displays = gpu::preferred_displays(gpu_pref, power_env);
-    // Under Wayland, the GPU the compositor draws with comes even before those (src/compositor_gpu.rs).
-    #[cfg(feature = "wgpu")]
-    let compositor = gpu::preferred_compositor(gpu_pref, power_env);
-    #[cfg(feature = "wgpu")]
-    let chosen_gpu = !gpu::automatic(gpu_pref, power_env);
-    #[cfg(feature = "wgpu")]
-    if !chosen_gpu {
-        let listed: Vec<String> = displays.iter().map(ToString::to_string).collect();
-        log::info!("display GPUs (PCI vendor:device): {}", if listed.is_empty() { "unknown".to_string() } else { listed.join(", ") });
-    } else {
-        log::info!("graphics processor chosen by the user ({power:?}): which GPU drives the display isn't considered");
-    }
+    let power = gpu::power_preference(gpu_pref, eframe::wgpu::PowerPreference::from_env());
    #[cfg(feature = "wgpu")]
    let startup = std::sync::Arc::new(gpu::Startup::default());
-    let custom_titlebar = custom_titlebar(saved.as_ref());
-    let options = native_options(custom_titlebar);
-    // winit picks Wayland whenever `WAYLAND_DISPLAY` is set; Preferences › Performance › Linux
-    // Display Server › X11 opens the window through XWayland instead, where file drops work (#1151).
-    #[cfg(target_os = "linux")]
-    let options = {
-        let mut options = options;
-        let pref = saved.as_ref().and_then(|ui| ui.engine_prefs.get("linuxDisplayServer")).and_then(serde_json::Value::as_str);
-        if xwayland::wanted(pref, |name| std::env::var_os(name)) {
-            if xwayland::x11_libraries_found() {
-                log::info!("opening the window through XWayland (Preferences › Performance › Linux Display Server)");
-                use winit::platform::x11::EventLoopBuilderExtX11 as _;
-                options.event_loop_builder = Some(Box::new(|builder| {
-                    builder.with_x11();
-                }));
-            } else {
-                log::warn!("Linux Display Server is X11, but the X11 libraries aren't all installed: opening the window on Wayland");
-            }
-        }
-        options
+    let options = eframe::NativeOptions {
+        viewport: egui::ViewportBuilder::default()
+            .with_title("VectorCraft")
+            .with_inner_size(window::DEFAULT_SIZE)
+            .with_min_inner_size(window::MIN_SIZE)
+            .with_drag_and_drop(true)
+            .with_decorations(!CUSTOM_TITLEBAR)
+            .with_fullsize_content_view(true)
+            .with_titlebar_shown(false)
+            .with_title_shown(false)
+            .with_icon(app_icon())
+            .with_app_id("ai.storyteller.vectorcraft"),
+        #[cfg(feature = "windows7")]
+        renderer: eframe::Renderer::Glow,
+        ..Default::default()
    };
    #[cfg(feature = "wgpu")]
    let options = {
@@ -740,35 +371,12 @@ fn main() -> std::process::ExitCode {
        options.wgpu_options.surface = eframe::egui_wgpu::SurfaceConfig::LOW_LATENCY;
        // Only adapters that can show the window, in the order `gpu` gives (#306, #502).
        if let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup {
-            create.native_adapter_selector = Some(gpu::selector(power, displays, compositor, startup.clone()));
-            // Nothing draws or dispatches indirectly, so wgpu's check of indirect arguments only
-            // costs a compute shader at start-up, one some drivers can't compile (OCLP-patched
-            // Metal on an Iris Pro, #651). `WGPU_VALIDATION_INDIRECT_CALL=1` turns it back on.
-            create.instance_descriptor.flags =
-                (eframe::wgpu::InstanceFlags::from_build_config() - eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL).with_env();
-            create.instance_descriptor.backends = gpu::backends(create.instance_descriptor.backends, std::env::var_os("WGPU_BACKEND").is_some());
-            // DX12 shaders compile with FXC, part of Windows: wgpu's default loads whichever
-            // dxcompiler.dll the search path finds, and one without its dxil.dll fails every shader,
-            // losing the device before the first frame (#1194). `WGPU_DX12_COMPILER` picks another.
-            create.instance_descriptor.backend_options.dx12.shader_compiler =
-                eframe::wgpu::Dx12Compiler::from_env().unwrap_or(eframe::wgpu::Dx12Compiler::Fxc);
-            // The window's surface may be as large as the adapter allows, not eframe's fixed
-            // 8192 px: a window stretched over several monitors, or grown by a display scale
-            // change, otherwise fails to configure its surface and the app closes (#1459).
-            let device = create.device_descriptor.clone();
-            create.device_descriptor = std::sync::Arc::new(move |adapter: &eframe::wgpu::Adapter| {
-                let mut descriptor = device(adapter);
-                let limit = &mut descriptor.required_limits.max_texture_dimension_2d;
-                *limit = gpu::surface_limit(*limit, adapter.limits().max_texture_dimension_2d);
-                descriptor
-            });
+            create.native_adapter_selector = Some(gpu::selector(power, startup.clone()));
        }
        options
    };
    #[cfg(feature = "wgpu")]
    gpu::watch_panics();
-    #[cfg(feature = "wgpu")]
-    gpu::watch_first_frame(startup.clone());
    // Files opened from Finder and the Dock arrive as events, not arguments.
    #[cfg(target_os = "macos")]
    open_documents::install();
@@ -780,25 +388,17 @@ fn main() -> std::process::ExitCode {
            "VectorCraft",
            options,
            Box::new(move |cc| {
-                let mut app = VectorcraftApp::new(Session::new(), services(cc.winit_window().cloned(), cc.egui_ctx.clone()));
+                let mut app = VectorcraftApp::new(Session::new(), services());
                load_prefs(&mut app, saved);
                // Fit the window to its monitor, or put it back where it was (still hidden).
                if let Some(w) = cc.winit_window() {
                    app.ui.window = Some(window::restore(w, saved_window));
-                    #[cfg(windows)]
-                    set_taskbar_icon(w);
                }
                // User Defined swatch and graphic style libraries live next to the preferences.
                let swatches = prefs_path().and_then(|p| Some(p.parent()?.join("Swatches").to_string_lossy().to_string()));
                app.session.swatch_libraries.set_user_dir(swatches);
                let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
                app.session.style_libraries.set_user_dir(styles);
-                // So do the Libraries panel's libraries; runs without preferences (agents' test
-                // runs) keep theirs for the session only, never touching the user's.
-                if prefs_enabled() {
-                    let libraries = prefs_path().and_then(|p| Some(p.parent()?.join("Libraries").to_string_lossy().to_string()));
-                    app.session.libraries.set_dir(libraries);
-                }
                // Data Recovery copies live next to the preferences too (none for runs without
                // preferences, such as agents' test runs, unless the recoveryFolder preference is set).
                if std::env::var_os("VECTORCRAFT_NO_PREFS").is_none() {
@@ -812,15 +412,7 @@ fn main() -> std::process::ExitCode {
                    log::info!("rendering with {summary} (power preference {power:?})");
                    created.created(&cc.egui_ctx);
                    if !gpu::skipped().is_empty() {
-                        // A processor chosen in Settings can be the one that can't show the window.
-                        let hint = if chosen_gpu {
-                            " (Settings › Performance › Graphics Processor › Automatic uses the one that drives your display)"
-                        } else {
-                            ""
-                        };
-                        app.status(format!(
-                            "The graphics processor tried first couldn't show the window, so VectorCraft started again on {summary}{hint}"
-                        ));
+                        app.status(format!("The graphics processor tried first couldn't show the window, so VectorCraft started again on {summary}"));
                    }
                    app.graphics_adapter = Some(summary);
                    let (loss, ctx) = (graphics_loss.clone(), cc.egui_ctx.clone());
@@ -830,16 +422,11 @@ fn main() -> std::process::ExitCode {
                {
                    app.graphics_adapter = Some("OpenGL (Windows 7 compatibility)".into());
                }
-                app.custom_titlebar = custom_titlebar;
+                app.integrated_titlebar = cfg!(target_os = "macos");
+                app.custom_titlebar = CUSTOM_TITLEBAR;
                if let Some(port) = control_port {
                    let rx = control_server::start(port, cc.egui_ctx.clone());
-                    app = app.with_control(rx).with_automation_roots(roots.clone());
-                    if let Some(roots) = &roots {
-                        // Everywhere the app doesn't say whose work it is (worker threads), the
-                        // roots hold: unconfined is only what the person at the keyboard does.
-                        file_access::confine_process(roots.clone());
-                        log::info!("control channel confined to the automation roots: read {:?}, write {:?}", roots.read_root(), roots.write_root());
-                    }
+                    app = app.with_control(rx);
                }
                #[cfg(target_os = "macos")]
                {
@@ -851,11 +438,8 @@ fn main() -> std::process::ExitCode {
                }
                #[cfg(not(target_os = "macos"))]
                let _ = in_window_menus;
-                file_access::unconfined(|| open_files(&mut app, files));
-                // The first frame is due from now (`gpu::watch_first_frame`).
-                #[cfg(feature = "wgpu")]
-                created.ready();
-                Ok(Box::new(App { app, graphics_loss, graphics_lost: false, frames: 0 }))
+                open_files(&mut app, files);
+                Ok(Box::new(App { app, graphics_loss, graphics_lost: false }))
            }),
        )
    });
@@ -876,70 +460,6 @@ fn main() -> std::process::ExitCode {
 mod tests {
    use super::*;

-    fn ui_state_with_prefs(engine_prefs: serde_json::Value) -> vectorcraft_ui_egui::UiState {
-        vectorcraft_ui_egui::UiState { engine_prefs, ..Default::default() }
-    }
-
-    #[test]
-    fn unreadable_saved_docking_keeps_preferences_and_every_workspace() {
-        use serde_json::json;
-        let mut app = VectorcraftApp::new(vectorcraft_engine::Session::new(), Default::default());
-        app.run("window.panel.float", json!({"panel":"layers"})).unwrap();
-        app.ui.toolbar = false;
-        app.ui.engine_prefs = json!({"interfaceLanguage":"fr", "uiBrightness":"light"});
-        app.ui.custom_workspaces =
-            vec![vectorcraft_ui_egui::workspaces::capture(&app.ui, "Future"), vectorcraft_ui_egui::workspaces::capture(&app.ui, "Valid")];
-        let original = serde_json::to_value(&app.ui).unwrap();
-        let valid_location = original["docking_hidden"]["layers"].clone();
-        assert!(valid_location.is_object());
-        for invalid_layout in [json!({"root":{"FutureNode":{}},"floating":[]}), json!(false)] {
-            for invalid_hidden in [json!({"layers":{"placement":{"FuturePlacement":{}}},"swatches":valid_location}), json!(["malformed"])] {
-                let mut raw = original.clone();
-                raw["docking"] = invalid_layout.clone();
-                raw["docking_hidden"] = invalid_hidden.clone();
-                raw["custom_workspaces"][0]["docking"] = invalid_layout.clone();
-                raw["custom_workspaces"][0]["dockingHidden"] = invalid_hidden.clone();
-                assert!(serde_json::from_value::<vectorcraft_ui_egui::UiState>(raw.clone()).is_err(), "runtime serde stays strict");
-                let loaded = decode_saved_prefs(&serde_json::to_vec(&raw).unwrap()).unwrap();
-                assert_eq!(loaded.engine_prefs, app.ui.engine_prefs);
-                assert!(!loaded.toolbar);
-                assert!(loaded.docking.is_none());
-                assert!(!loaded.docking_hidden.contains_key("layers"));
-                if invalid_hidden.is_object() {
-                    assert_eq!(serde_json::to_value(loaded.docking_hidden.get("swatches")).unwrap(), valid_location);
-                } else {
-                    assert!(loaded.docking_hidden.is_empty());
-                }
-                assert_eq!(loaded.custom_workspaces.len(), 2);
-                assert_eq!(loaded.custom_workspaces[0].name, "Future");
-                assert!(loaded.custom_workspaces[0].docking.is_none());
-                assert!(!loaded.custom_workspaces[0].docking_hidden.contains_key("layers"));
-                assert_eq!(serde_json::to_value(&loaded.custom_workspaces[1]).unwrap(), original["custom_workspaces"][1]);
-            }
-        }
-        let roundtrip = decode_saved_prefs(&serde_json::to_vec(&original).unwrap()).unwrap();
-        assert_eq!(serde_json::to_value(roundtrip).unwrap(), original);
-        assert!(
-            decode_saved_prefs(&serde_json::to_vec(&json!({"toolbar":"invalid"})).unwrap()).is_none(),
-            "unrelated fields retain normal strict parsing"
-        );
-    }
-
-    #[test]
-    fn the_system_title_bar_preference_keeps_the_window_decorations() {
-        // Preferences › User Interface › System Title Bar gives the window back its system
-        // decorations on Windows and Linux; macOS always has them.
-        assert_eq!(super::custom_titlebar(None), super::CUSTOM_TITLEBAR, "no preferences: the default");
-        let off = ui_state_with_prefs(serde_json::json!({"systemTitleBar": false}));
-        assert_eq!(super::custom_titlebar(Some(&off)), super::CUSTOM_TITLEBAR);
-        let on = ui_state_with_prefs(serde_json::json!({"systemTitleBar": true}));
-        assert!(!super::custom_titlebar(Some(&on)));
-        assert_eq!(super::native_options(false).viewport.decorations, Some(true));
-        if super::CUSTOM_TITLEBAR {
-            assert_eq!(super::native_options(true).viewport.decorations, Some(false));
-        }
-    }
-
    /// The file extensions the macOS bundle declares: its document types and its own exported type.
    fn plist_extensions(plist: &str) -> Vec<&str> {
        ["<key>CFBundleTypeExtensions</key>", "<key>public.filename-extension</key>"]
@@ -951,14 +471,13 @@ mod tests {
            .collect()
    }

-    /// Finder offers the app for every file File › Open reads (#295, #354) but Photoshop documents
-    /// (`UNASSOCIATED_EXTS`), takes over no other app's files, and hands them to the app rather than
-    /// to AppKit's document machinery.
+    /// Finder offers the app for every file File › Open reads (#295, #354), takes over no other
+    /// app's files, and hands them to the app rather than to AppKit's document machinery.
    #[test]
    fn the_macos_bundle_opens_every_readable_format() {
        let plist = include_str!("../../../packaging/macos/Info.plist.in");
        let declared = plist_extensions(plist);
-        for e in fileio::OPEN_EXTS.iter().filter(|e| !fileio::UNASSOCIATED_EXTS.contains(e)) {
+        for e in fileio::OPEN_EXTS {
            assert!(declared.contains(e), "Info.plist.in doesn't declare .{e}");
        }
        for e in &declared {
@@ -78,8 +78,7 @@ fn add_open_urls_method() {

 /// Queue the files among `urls` and wake the UI. Never panics: it runs inside AppKit.
 extern "C-unwind" fn open_urls(_delegate: &AnyObject, _cmd: Sel, _app: &AnyObject, urls: &NSArray<NSURL>) {
-    // Only file URLs: macOS 27 turns an https URL's path into a file path too (#433).
-    let paths = urls.iter().filter(|u| u.isFileURL()).filter_map(|u| u.to_file_path()).map(|p| p.to_string_lossy().into_owned());
+    let paths = urls.iter().filter_map(|u| u.to_file_path()).map(|p| p.to_string_lossy().into_owned());
    PENDING.lock().unwrap_or_else(PoisonError::into_inner).extend(paths);
    if let Some(ctx) = UI.get() {
        ctx.request_repaint();
@@ -1,39 +0,0 @@
-//! Where VectorCraft keeps its settings, `ui.json`, and next to it folders of the user's own
-//! (Swatches, Graphic Styles, Fonts, Data Recovery, logs). The desktop app and `vectorcraft-cli`
-//! (which shares this file) read the same Fonts folder.
-
-use std::path::PathBuf;
-
-#[path = "profile.rs"]
-mod profile;
-
-/// The settings file `ui.json` of the app `name`: in a folder named `name` in ~/Library/Application
-/// Support (macOS) or %APPDATA% (Windows), or `lower` in $XDG_CONFIG_HOME or ~/.config (Linux and
-/// BSD).
-pub fn prefs_path_for(name: &str, lower: &str) -> Option<PathBuf> {
-    let legacy = name == "DrawCraft" || lower == "drawcraft";
-    profile::prefs_path(legacy)
-}
-
-/// Have the font scans read VectorCraft's own Fonts folder, next to the settings, which
-/// `text.addFontFiles` copies font files into. The folder is set whether or not
-/// `VECTORCRAFT_NO_PREFS` is set, as the Swatches and Graphic Styles folders are.
-pub fn install_fonts() {
-    if let Some(dir) = prefs_path_for("VectorCraft", "vectorcraft").and_then(|p| Some(p.parent()?.join("Fonts"))) {
-        vectorcraft_text::set_app_font_dir(dir);
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn the_font_scans_read_the_fonts_folder_next_to_the_settings() {
-        install_fonts();
-        let fonts = prefs_path_for("VectorCraft", "vectorcraft").and_then(|p| Some(p.parent()?.join("Fonts")));
-        assert!(fonts.is_some(), "a home folder to keep the settings in");
-        assert_eq!(vectorcraft_text::app_font_dir().map(std::path::Path::to_path_buf), fonts);
-        assert!(vectorcraft_text::system_font_dirs().contains(&fonts.unwrap_or_default()));
-    }
-}
@@ -1,54 +1,127 @@
-//! Desktop printer transport. VectorCraft composes every page and copy before submission;
-//! craft-print owns discovery and spooling. Windows 7 keeps its viewer-based transport because
-//! Windows.Data.Pdf is unavailable there.
-#[cfg(not(all(windows, any(feature = "windows7", target_vendor = "win7"))))]
+//! File → Print on the desktop ([`SystemPrint`]): the system's printers and print queue. macOS and
+//! Linux go through CUPS (`lpstat` lists the printers, `lp` queues a temporary copy of the job's
+//! PDF); Windows asks PowerShell for the printers and prints through the shell's print verb of
+//! the PDF viewer.
+
+use std::path::PathBuf;
 use std::process::Command;
+
 use vectorcraft_ui_egui::print::{PrintJob, PrintService, Printer};

-#[cfg(all(windows, any(feature = "windows7", target_vendor = "win7")))]
-mod windows7;
-#[cfg(all(windows, any(feature = "windows7", target_vendor = "win7")))]
-use windows7 as system;
-
+/// The system's printing.
 pub struct SystemPrint;
+
 impl PrintService for SystemPrint {
    fn printers(&mut self) -> Vec<Printer> {
        system::printers()
    }
+
    fn print(&mut self, job: &PrintJob) -> Result<String, String> {
-        let result = system::print(job);
+        let file = job_file(job.pdf)?;
+        let r = system::print(job, &file);
        let to = job.printer.unwrap_or("the default printer");
-        result.map(|note| format!("Sent “{}” to {to}{note}", job.title))
-    }
-    fn shared_print(&self) -> Option<vectorcraft_ui_egui::print::SharedPrintFn> {
-        Some(std::sync::Arc::new(|job| SystemPrint.print(job)))
+        r.map(|note| format!("Sent “{}” to {to}{note}", job.title))
    }
+
    fn has_setup(&self) -> bool {
        true
    }
+
    fn setup(&mut self, printer: Option<&str>) -> Result<(), String> {
        system::setup(printer)
    }
 }

-#[cfg(not(all(windows, any(feature = "windows7", target_vendor = "win7"))))]
+/// Where a job's PDF waits for the spooler: a fresh file in the temp folder. Files of jobs more
+/// than an hour old (the print verb reads them after Print returns) are removed first.
+fn job_file(pdf: &[u8]) -> Result<PathBuf, String> {
+    let dir = std::env::temp_dir().join("vectorcraft-print");
+    std::fs::create_dir_all(&dir).map_err(|e| format!("can't make {}: {e}", dir.display()))?;
+    for e in std::fs::read_dir(&dir).into_iter().flatten().flatten() {
+        let old = e.metadata().and_then(|m| m.modified()).ok().and_then(|t| t.elapsed().ok()).is_some_and(|age| age.as_secs() > 3600);
+        if old {
+            // Another job may still be reading it: leave it for next time.
+            let _ = std::fs::remove_file(e.path());
+        }
+    }
+    let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos()).unwrap_or_default();
+    let path = dir.join(format!("job-{}-{stamp}.pdf", std::process::id()));
+    std::fs::write(&path, pdf).map_err(|e| format!("can't write {}: {e}", path.display()))?;
+    Ok(path)
+}
+
+/// Run `c` → its output, or its error message.
+fn output(c: &mut Command) -> Result<String, String> {
+    let program = c.get_program().to_string_lossy().to_string();
+    let out = c.output().map_err(|e| format!("can't run {program}: {e}"))?;
+    if out.status.success() {
+        return Ok(String::from_utf8_lossy(&out.stdout).into_owned());
+    }
+    let err = String::from_utf8_lossy(&out.stderr).trim().to_string();
+    Err(if err.is_empty() { format!("{program} failed ({})", out.status) } else { err })
+}
+
+/// `lpstat -e` / `lpstat -a` → the printer names (the first word of each line).
+#[cfg(any(test, not(windows)))]
+fn lpstat_names(text: &str) -> Vec<String> {
+    let mut names: Vec<String> = vec![];
+    for name in text.lines().filter_map(|l| l.split_whitespace().next()) {
+        if !names.iter().any(|n| n == name) {
+            names.push(name.to_string());
+        }
+    }
+    names
+}
+
+/// `lpstat -d` → the default printer ("system default destination: NAME"; none: "no system
+/// default destination").
+#[cfg(any(test, not(windows)))]
+fn lpstat_default(text: &str) -> Option<String> {
+    let line = text.lines().find(|l| l.contains(':'))?;
+    let name = line.rsplit_once(':')?.1.trim();
+    (!name.is_empty()).then(|| name.to_string())
+}
+
+/// PowerShell's `<Default>\t<Name>` lines → the printers.
+#[cfg(any(test, windows))]
+fn windows_printers(text: &str) -> Vec<Printer> {
+    text.lines()
+        .filter_map(|l| l.trim_end_matches('\r').split_once('\t'))
+        .filter(|(_, name)| !name.trim().is_empty())
+        .map(|(default, name)| Printer { name: name.trim().to_string(), default: default.trim().eq_ignore_ascii_case("true") })
+        .collect()
+}
+
+/// `s` as a PowerShell single-quoted string.
+#[cfg(any(test, windows))]
+fn ps_quote(s: &str) -> String {
+    format!("'{}'", s.replace('\'', "''"))
+}
+
+#[cfg(not(windows))]
 mod system {
    use super::*;
+
    pub fn printers() -> Vec<Printer> {
-        craft_print::printers().into_iter().map(|p| Printer { name: p.name, default: p.default }).collect()
+        // `-e` lists every destination (CUPS 2); older systems answer `-a`.
+        let names = output(Command::new("lpstat").arg("-e")).or_else(|_| output(Command::new("lpstat").arg("-a"))).map(|t| lpstat_names(&t));
+        let default = output(Command::new("lpstat").arg("-d")).ok().and_then(|t| lpstat_default(&t));
+        names.unwrap_or_default().into_iter().map(|name| Printer { default: default.as_ref() == Some(&name), name }).collect()
    }
-    pub fn print(job: &PrintJob) -> Result<String, String> {
-        // Copies, layout, marks and colour management are already in the PDF. Preserve its
-        // physical sheet size and the queue's duplex default without printing copies twice.
-        let settings = craft_print::Job { printer: job.printer.map(str::to_string), title: job.title.into(), ..Default::default() };
-        craft_print::submit(job.pdf, &settings).map(|note| if note.is_empty() { note } else { format!(" ({note})") }).map_err(|e| e.to_string())
-    }
-    pub fn setup(printer: Option<&str>) -> Result<(), String> {
-        #[cfg(windows)]
-        {
-            let _ = printer;
-            Command::new("explorer").arg("ms-settings:printers").spawn().map(|_| ()).map_err(|e| e.to_string())
+
+    pub fn print(job: &PrintJob, file: &std::path::Path) -> Result<String, String> {
+        let mut c = Command::new("lp");
+        if let Some(p) = job.printer {
+            c.args(["-d", p]);
        }
+        c.args(["-t", job.title]).arg(file);
+        let r = output(&mut c);
+        // `lp` has spooled its own copy (or failed).
+        let _ = std::fs::remove_file(file);
+        r.map(|out| Some(out.trim().to_string()).filter(|o| !o.is_empty()).map(|o| format!(" ({o})")).unwrap_or_default())
+    }
+
+    pub fn setup(printer: Option<&str>) -> Result<(), String> {
        #[cfg(target_os = "macos")]
        {
            let _ = printer;
@@ -58,13 +131,92 @@ mod system {
                .map(|_| ())
                .map_err(|e| e.to_string())
        }
-        #[cfg(not(any(windows, target_os = "macos")))]
+        #[cfg(not(target_os = "macos"))]
        {
            if Command::new("system-config-printer").spawn().is_ok() {
                return Ok(());
            }
+            // CUPS' own pages.
            let url = printer.map_or_else(|| "http://localhost:631/printers/".to_string(), |p| format!("http://localhost:631/printers/{p}"));
            Command::new("xdg-open").arg(url).spawn().map(|_| ()).map_err(|e| e.to_string())
        }
    }
 }
+
+#[cfg(windows)]
+mod system {
+    use super::*;
+
+    fn powershell(script: &str) -> Command {
+        use std::os::windows::process::CommandExt as _;
+        const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+        let mut c = Command::new("powershell");
+        c.args(["-NoProfile", "-NonInteractive", "-Command", script]).creation_flags(CREATE_NO_WINDOW);
+        c
+    }
+
+    pub fn printers() -> Vec<Printer> {
+        #[cfg(feature = "windows7")]
+        let script = "Get-WmiObject Win32_Printer | ForEach-Object { \"$($_.Default)`t$($_.Name)\" }";
+        #[cfg(not(feature = "windows7"))]
+        let script = "Get-CimInstance Win32_Printer | ForEach-Object { \"$($_.Default)`t$($_.Name)\" }";
+        output(&mut powershell(script)).map(|t| windows_printers(&t)).unwrap_or_default()
+    }
+
+    pub fn print(job: &PrintJob, file: &std::path::Path) -> Result<String, String> {
+        // The PDF viewer's print verb reads the file after this returns: it stays for a while.
+        let path = ps_quote(&file.to_string_lossy());
+        let script = match job.printer {
+            Some(p) => format!(
+                "Start-Process -FilePath {path} -Verb PrintTo -ArgumentList {} -WindowStyle Hidden",
+                ps_quote(&format!("\"{}\"", p.replace('"', "")))
+            ),
+            None => format!("Start-Process -FilePath {path} -Verb Print -WindowStyle Hidden"),
+        };
+        output(&mut powershell(&script)).map(|_| String::new()).map_err(|e| format!("no app prints PDF files here ({e})"))
+    }
+
+    pub fn setup(_printer: Option<&str>) -> Result<(), String> {
+        #[cfg(feature = "windows7")]
+        let mut command = {
+            let mut command = Command::new("control.exe");
+            command.arg("printers");
+            command
+        };
+        #[cfg(not(feature = "windows7"))]
+        let mut command = {
+            let mut command = Command::new("explorer");
+            command.arg("ms-settings:printers");
+            command
+        };
+        command.spawn().map(|_| ()).map_err(|e| e.to_string())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn lpstat_lists_names_and_the_default() {
+        let names = lpstat_names("Office_Laser accepting requests since Mon 05 Oct 2026\nPhoto-Inkjet accepting requests since …\n\n");
+        assert_eq!(names, ["Office_Laser", "Photo-Inkjet"]);
+        assert_eq!(lpstat_names("Office_Laser\nOffice_Laser\n"), ["Office_Laser"]);
+        assert_eq!(lpstat_default("system default destination: Photo-Inkjet\n").as_deref(), Some("Photo-Inkjet"));
+        assert_eq!(lpstat_default("no system default destination\n"), None);
+    }
+
+    #[test]
+    fn powershell_lines_become_printers() {
+        let got = windows_printers("False\tMicrosoft Print to PDF\r\nTrue\tOffice Laser\r\n\r\nFalse\t \r\n");
+        assert_eq!(got, [Printer { name: "Microsoft Print to PDF".into(), default: false }, Printer { name: "Office Laser".into(), default: true }]);
+        assert_eq!(ps_quote("C:\\Temp\\it's.pdf"), "'C:\\Temp\\it''s.pdf'");
+    }
+
+    #[test]
+    fn job_files_hold_the_pdf() {
+        let path = job_file(b"%PDF-1.7 test").unwrap();
+        assert_eq!(std::fs::read(&path).unwrap(), b"%PDF-1.7 test");
+        let _ = std::fs::remove_file(path);
+    }
+}
@@ -1,129 +0,0 @@
-//! The legacy viewer print verb is needed on Windows 7, where Windows.Data.Pdf is absent.
-use std::path::PathBuf;
-use std::process::Command;
-use vectorcraft_ui_egui::print::{PrintJob, Printer};
-
-/// Where a job's PDF waits for the spooler: a fresh file in the temp folder. Files of jobs more
-/// than an hour old (the print verb reads them after Print returns) are removed first.
-fn job_file(pdf: &[u8]) -> Result<PathBuf, String> {
-    let dir = std::env::temp_dir().join("vectorcraft-print");
-    std::fs::create_dir_all(&dir).map_err(|e| format!("can't make {}: {e}", dir.display()))?;
-    for e in std::fs::read_dir(&dir).into_iter().flatten().flatten() {
-        let old = e.metadata().and_then(|m| m.modified()).ok().and_then(|t| t.elapsed().ok()).is_some_and(|age| age.as_secs() > 3600);
-        if old {
-            // Another job may still be reading it: leave it for next time.
-            let _ = std::fs::remove_file(e.path());
-        }
-    }
-    let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos()).unwrap_or_default();
-    let path = dir.join(format!("job-{}-{stamp}.pdf", std::process::id()));
-    // The viewer reads asynchronously, so this cannot use immediate drop cleanup. Never
-    // truncate an existing path, and remove incomplete files or refused launches immediately.
-    use std::io::Write as _;
-    let mut file =
-        std::fs::OpenOptions::new().write(true).create_new(true).open(&path).map_err(|e| format!("can't create {}: {e}", path.display()))?;
-    if let Err(e) = file.write_all(pdf).and_then(|_| file.flush()) {
-        drop(file);
-        let _ = std::fs::remove_file(&path);
-        return Err(format!("can't write {}: {e}", path.display()));
-    }
-    Ok(path)
-}
-
-/// Run `c` → its output, or its error message.
-fn output(c: &mut Command) -> Result<String, String> {
-    let program = c.get_program().to_string_lossy().to_string();
-    let out = c.output().map_err(|e| format!("can't run {program}: {e}"))?;
-    if out.status.success() {
-        return Ok(String::from_utf8_lossy(&out.stdout).into_owned());
-    }
-    let err = String::from_utf8_lossy(&out.stderr).trim().to_string();
-    Err(if err.is_empty() { format!("{program} failed ({})", out.status) } else { err })
-}
-
-/// PowerShell's `<Default>\t<Name>` lines → the printers.
-fn windows_printers(text: &str) -> Vec<Printer> {
-    text.lines()
-        .filter_map(|l| l.trim_end_matches('\r').split_once('\t'))
-        .filter(|(_, name)| !name.trim().is_empty())
-        .map(|(default, name)| Printer { name: name.trim().to_string(), default: default.trim().eq_ignore_ascii_case("true") })
-        .collect()
-}
-
-/// `s` as a PowerShell single-quoted string.
-fn ps_quote(s: &str) -> String {
-    format!("'{}'", s.replace('\'', "''"))
-}
-
-fn powershell(script: &str) -> Command {
-    use std::os::windows::process::CommandExt as _;
-    const CREATE_NO_WINDOW: u32 = 0x0800_0000;
-    let mut c = Command::new(
-        std::path::PathBuf::from(std::env::var_os("SystemRoot").unwrap_or_else(|| "C:\\Windows".into()))
-            .join("System32")
-            .join("WindowsPowerShell")
-            .join("v1.0")
-            .join("powershell.exe"),
-    );
-    c.args([
-        "-NoProfile",
-        "-NonInteractive",
-        "-Command",
-        &format!("$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false); {script}"),
-    ])
-    .creation_flags(CREATE_NO_WINDOW);
-    c
-}
-
-pub fn printers() -> Vec<Printer> {
-    let script = "Get-WmiObject Win32_Printer | ForEach-Object { \"$($_.Default)`t$($_.Name)\" }";
-    output(&mut powershell(script)).map(|t| windows_printers(&t)).unwrap_or_default()
-}
-
-fn submit(job: &PrintJob, file: &std::path::Path) -> Result<String, String> {
-    // The PDF viewer's print verb reads the file after this returns: it stays for a while.
-    let path = ps_quote(&file.to_string_lossy());
-    let script = match job.printer {
-        Some(p) => format!(
-            "Start-Process -FilePath {path} -Verb PrintTo -ArgumentList {} -WindowStyle Hidden",
-            ps_quote(&format!("\"{}\"", p.replace('"', "")))
-        ),
-        None => format!("Start-Process -FilePath {path} -Verb Print -WindowStyle Hidden"),
-    };
-    output(&mut powershell(&script)).map(|_| String::new()).map_err(|e| format!("no app prints PDF files here ({e})"))
-}
-
-pub fn setup(_printer: Option<&str>) -> Result<(), String> {
-    let mut command = {
-        let mut command = Command::new("control.exe");
-        command.arg("printers");
-        command
-    };
-    command.spawn().map(|_| ()).map_err(|e| e.to_string())
-}
-
-pub fn print(job: &PrintJob) -> Result<String, String> {
-    let file = job_file(job.pdf)?;
-    let result = submit(job, &file);
-    if result.is_err() {
-        // No viewer accepted the launch, so no asynchronous reader needs this document.
-        let _ = std::fs::remove_file(file);
-    }
-    result
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    #[test]
-    fn powershell_lines_and_quotes_are_preserved() {
-        assert_eq!(windows_printers("True\tOffice Laser\r\nFalse\t "), [Printer { name: "Office Laser".into(), default: true }]);
-        assert_eq!(ps_quote("it's.pdf"), "'it''s.pdf'");
-    }
-    #[test]
-    fn job_files_hold_the_pdf_for_the_async_viewer() {
-        let path = job_file(b"%PDF-1.7 test").unwrap();
-        assert_eq!(std::fs::read(&path).unwrap(), b"%PDF-1.7 test");
-        std::fs::remove_file(path).unwrap();
-    }
-}
@@ -1,66 +0,0 @@
-//! Native profile paths. Isolated profiles never migrate preferences from a user's old profile.
-
-use std::ffi::OsString;
-use std::path::PathBuf;
-
-pub fn prefs_path(legacy: bool) -> Option<PathBuf> {
-    prefs_path_with(std::env::consts::OS, legacy, |key| std::env::var_os(key))
-}
-
-fn prefs_path_with(os: &str, legacy: bool, env: impl Fn(&str) -> Option<OsString>) -> Option<PathBuf> {
-    if let Some(root) = env("VECTORCRAFT_CONFIG_DIR") {
-        // Never fall back to DrawCraft's real profile when the isolated file does not exist.
-        return (!legacy && !root.is_empty()).then(|| PathBuf::from(root).join("ui.json"));
-    }
-    let (name, lower) = if legacy { ("DrawCraft", "drawcraft") } else { ("VectorCraft", "vectorcraft") };
-    let base = match os {
-        "macos" => env("HOME").map(|p| PathBuf::from(p).join("Library/Application Support").join(name)),
-        "windows" => env("APPDATA").map(|p| PathBuf::from(p).join(name)),
-        _ => env("XDG_CONFIG_HOME").map(PathBuf::from).or_else(|| env("HOME").map(|p| PathBuf::from(p).join(".config"))).map(|p| p.join(lower)),
-    };
-    base.map(|p| p.join("ui.json"))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn environment(key: &str) -> Option<OsString> {
-        match key {
-            "HOME" => Some("/user".into()),
-            "APPDATA" => Some("/roaming".into()),
-            "XDG_CONFIG_HOME" => Some("/xdg-config".into()),
-            _ => None,
-        }
-    }
-
-    #[test]
-    fn isolated_profile_has_no_legacy_fallback_on_any_platform() {
-        for os in ["macos", "windows", "linux"] {
-            let env = |key: &str| {
-                if key == "VECTORCRAFT_CONFIG_DIR" { Some("/isolated".into()) } else { environment(key) }
-            };
-            assert_eq!(prefs_path_with(os, false, env), Some("/isolated/ui.json".into()));
-            assert_eq!(prefs_path_with(os, true, env), None);
-        }
-    }
-
-    #[test]
-    fn empty_override_does_not_fall_back_to_user_files() {
-        let env = |key: &str| if key == "VECTORCRAFT_CONFIG_DIR" { Some(OsString::new()) } else { environment(key) };
-        assert_eq!(prefs_path_with("macos", false, env), None);
-        assert_eq!(prefs_path_with("macos", true, env), None);
-    }
-
-    #[test]
-    fn unset_override_keeps_platform_paths_and_legacy_migration() {
-        assert_eq!(prefs_path_with("macos", false, environment), Some("/user/Library/Application Support/VectorCraft/ui.json".into()));
-        assert_eq!(prefs_path_with("macos", true, environment), Some("/user/Library/Application Support/DrawCraft/ui.json".into()));
-        assert_eq!(prefs_path_with("windows", false, environment), Some("/roaming/VectorCraft/ui.json".into()));
-        assert_eq!(prefs_path_with("linux", false, environment), Some("/xdg-config/vectorcraft/ui.json".into()));
-        assert_eq!(
-            prefs_path_with("linux", true, |key| if key == "HOME" { environment(key) } else { None }),
-            Some("/user/.config/drawcraft/ui.json".into())
-        );
-    }
-}
@@ -1,92 +0,0 @@
-//! Windows: the font files in DirectWrite's system font collection, scanned with the font folders
-//! (`vectorcraft_text::set_platform_font_files`). The desktop app and `vectorcraft-cli` (exports,
-//! MCP) both install it; the CLI shares this file.
-//!
-//! Font services such as Adobe Fonts load their fonts with GDI at run time, from files in their
-//! own folders, without installing them: the font folders and the registry don't list them. Since
-//! Windows 10 (version 1607) DirectWrite's system font collection holds them too
-//! (<https://learn.microsoft.com/windows/win32/directwrite/what-s-new-in-directwrite-for-windows-8-consumer-preview>,
-//! "Support for Adobe Typekit and other font-service clients"), so VectorCraft lists them as other
-//! apps do, reading the files in place (#579).
-//!
-//! DirectWrite is COM, which has no safe API, hence the scoped `unsafe_code` allowance.
-#![allow(unsafe_code)]
-
-use std::collections::BTreeSet;
-
-use windows::Win32::Graphics::DirectWrite::{
-    DWRITE_FACTORY_TYPE_SHARED, DWriteCreateFactory, IDWriteFactory3, IDWriteFontSet, IDWriteLocalFontFileLoader,
-};
-use windows::core::Interface;
-
-/// The most fonts read from the collection (a system has a few thousand).
-const MAX_FONTS: u32 = 1 << 16;
-/// The longest file path taken, in UTF-16 units (Windows' own limit).
-const MAX_PATH: u32 = 32_767;
-
-/// Have the font scans read the font files DirectWrite lists.
-pub fn install() {
-    vectorcraft_text::set_platform_font_files(font_files);
-}
-
-/// The local files of the fonts in DirectWrite's system font collection as it is now (fonts
-/// loaded since the last call included). None before Windows 10, or when DirectWrite fails: the
-/// font folders and the registry still list the installed fonts.
-fn font_files() -> Vec<String> {
-    match collection_files() {
-        Ok(files) => files.into_iter().collect(),
-        Err(e) => {
-            log::debug!("DirectWrite's system fonts aren't listed: {e}");
-            Vec::new()
-        }
-    }
-}
-
-fn collection_files() -> windows::core::Result<BTreeSet<String>> {
-    // SAFETY: plain DirectWrite calls on interfaces it returned, each checked for failure; the
-    // collection is asked to check for fonts loaded since the factory last looked.
-    let set = unsafe {
-        let factory: IDWriteFactory3 = DWriteCreateFactory(DWRITE_FACTORY_TYPE_SHARED)?;
-        let mut collection = None;
-        factory.GetSystemFontCollection(false, &mut collection, true)?;
-        let Some(collection) = collection else { return Ok(BTreeSet::new()) };
-        collection.GetFontSet()?
-    };
-    // SAFETY: a count of the set's fonts.
-    let count = unsafe { set.GetFontCount() }.min(MAX_FONTS);
-    // Faces of one file (a collection's, a variable font's instances) name it once.
-    Ok((0..count).filter_map(|i| local_path(&set, i)).collect())
-}
-
-/// The path of the file holding font `i` of `set`, when it is a local file (not a downloadable
-/// font, nor one in memory).
-fn local_path(set: &IDWriteFontSet, i: u32) -> Option<String> {
-    // SAFETY: `i` is below the set's count; the key DirectWrite hands back stays valid while
-    // `file` (which owns it) lives, and is passed back with its own size; the path buffer is
-    // sized from DirectWrite's answer plus the terminating NUL.
-    unsafe {
-        let file = set.GetFontFaceReference(i).ok()?.GetFontFile().ok()?;
-        let loader: IDWriteLocalFontFileLoader = file.GetLoader().ok()?.cast().ok()?;
-        let (mut key, mut size) = (std::ptr::null_mut(), 0u32);
-        file.GetReferenceKey(&mut key, &mut size).ok()?;
-        let len = loader.GetFilePathLengthFromKey(key, size).ok()?;
-        if len == 0 || len > MAX_PATH {
-            return None;
-        }
-        let mut path = vec![0u16; len as usize + 1];
-        loader.GetFilePathFromKey(key, size, &mut path).ok()?;
-        Some(String::from_utf16_lossy(path.get(..len as usize)?))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    /// DirectWrite lists the installed fonts, by their files' full paths.
-    #[test]
-    fn directwrite_lists_the_installed_font_files() {
-        let files = super::font_files();
-        assert!(files.iter().all(|f| std::path::Path::new(f).is_absolute()), "{:?}", files.first());
-        let fonts = std::path::Path::new(&std::env::var("WINDIR").unwrap()).join("Fonts").to_string_lossy().to_lowercase();
-        assert!(files.iter().any(|f| f.to_lowercase().starts_with(&fonts)), "{} files, {:?}", files.len(), files.first());
-    }
-}
@@ -1,127 +0,0 @@
-//! Linux: Preferences › Performance › Linux Display Server › X11 opens the window through XWayland
-//! on a Wayland session, where dropped files arrive (winit 0.30 has no Wayland drag and drop,
-//! #1151). Only when XWayland can run the window: an X display is set and the X11 libraries winit
-//! loads at runtime are installed. Otherwise the window opens on Wayland, so a missing library
-//! never keeps the app from starting.
-//!
-//! The library check comes from PhotoCraft's `linux_libs.rs`: no `dlopen` (that needs `unsafe`),
-//! just the dynamic linker's cache (`ldconfig -p`) and the usual library directories.
-#![cfg_attr(not(target_os = "linux"), allow(dead_code))]
-
-use std::ffi::OsString;
-use std::path::{Path, PathBuf};
-
-/// What winit 0.30 `dlopen`s for an X11 window: x11-dl opens Xlib, Xlib-xcb, Xcursor and XInput2,
-/// x11rb opens libxcb, and xkbcommon-dl opens xkbcommon and xkbcommon-x11.
-const X11_LIBS: &[&str] =
-    &["libX11.so.6", "libX11-xcb.so.1", "libxcb.so.1", "libXcursor.so.1", "libXi.so.6", "libxkbcommon.so.0", "libxkbcommon-x11.so.0"];
-
-/// Whether the saved `linuxDisplayServer` and the environment ask for XWayland: `x11` chosen, a
-/// Wayland session (winit picks Wayland whenever `WAYLAND_DISPLAY` or `WAYLAND_SOCKET` is set)
-/// and an X display to open.
-pub fn wanted(pref: Option<&str>, var: impl Fn(&str) -> Option<OsString>) -> bool {
-    let set = |name: &str| var(name).is_some_and(|v| !v.is_empty());
-    pref == Some("x11") && (set("WAYLAND_DISPLAY") || set("WAYLAND_SOCKET")) && set("DISPLAY")
-}
-
-/// Are all the libraries an X11 window needs found on this system? Libraries the check can't find
-/// count as missing.
-pub fn x11_libraries_found() -> bool {
-    let cache = read_ldconfig();
-    let dirs = search_dirs(std::env::var("LD_LIBRARY_PATH").ok().as_deref());
-    X11_LIBS
-        .iter()
-        .all(|lib| cache.as_deref().is_some_and(|out| ldconfig_has(out, lib, ldconfig_arch_tag())) || dirs.iter().any(|d| d.join(lib).exists()))
-}
-
-/// The `ldconfig -p` architecture tag for this build, when it's one we can tell apart from a
-/// 32-bit library of the same name (`libc6,x86-64` vs plain `libc6` for i386).
-fn ldconfig_arch_tag() -> Option<&'static str> {
-    if cfg!(target_arch = "x86_64") {
-        Some("x86-64")
-    } else if cfg!(target_arch = "aarch64") {
-        Some("AArch64")
-    } else {
-        None
-    }
-}
-
-/// Does `ldconfig -p` output list `soname` for our architecture? Lines look like
-/// `\tlibxkbcommon-x11.so.0 (libc6,x86-64) => /lib/x86_64-linux-gnu/libxkbcommon-x11.so.0`.
-fn ldconfig_has(output: &str, soname: &str, arch_tag: Option<&str>) -> bool {
-    output.lines().any(|line| {
-        let Some((name, rest)) = line.trim_start().split_once(' ') else { return false };
-        if name != soname {
-            return false;
-        }
-        match arch_tag {
-            None => true,
-            Some(tag) => {
-                let flags = rest.split_once('(').and_then(|(_, r)| r.split_once(')')).map_or("", |(f, _)| f);
-                flags.split(',').any(|f| f.trim() == tag)
-            }
-        }
-    })
-}
-
-/// `ldconfig -p`, from the usual locations (`/sbin` isn't on a normal user's PATH on Debian). A
-/// real listing starts with "N libs found in cache".
-fn read_ldconfig() -> Option<String> {
-    ["/sbin/ldconfig", "/usr/sbin/ldconfig", "ldconfig"].into_iter().find_map(|cmd| {
-        let out = std::process::Command::new(cmd).arg("-p").output().ok().filter(|out| out.status.success())?;
-        let text = String::from_utf8_lossy(&out.stdout).into_owned();
-        text.lines().next().is_some_and(|l| l.contains("libs found in cache")).then_some(text)
-    })
-}
-
-/// Library directories to search: `LD_LIBRARY_PATH`, then the usual system and Flatpak paths.
-fn search_dirs(ld_library_path: Option<&str>) -> Vec<PathBuf> {
-    let mut dirs: Vec<PathBuf> = ld_library_path.unwrap_or("").split(':').filter(|d| !d.is_empty()).map(PathBuf::from).collect();
-    let triplet = if cfg!(target_arch = "aarch64") {
-        "aarch64-linux-gnu"
-    } else if cfg!(target_arch = "riscv64") {
-        "riscv64-linux-gnu"
-    } else {
-        "x86_64-linux-gnu"
-    };
-    dirs.extend(["/app/lib", "/usr/local/lib", "/usr/lib64", "/lib64", "/usr/lib", "/lib"].map(PathBuf::from));
-    dirs.push(Path::new("/usr/lib").join(triplet));
-    dirs.push(Path::new("/lib").join(triplet));
-    dirs
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn env(pairs: &'static [(&'static str, &'static str)]) -> impl Fn(&str) -> Option<OsString> {
-        move |k| pairs.iter().find(|(name, _)| *name == k).map(|(_, v)| OsString::from(v))
-    }
-
-    #[test]
-    fn xwayland_only_when_chosen_on_wayland_with_an_x_display() {
-        let wayland = env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", ":0")]);
-        assert!(wanted(Some("x11"), &wayland));
-        assert!(wanted(Some("x11"), env(&[("WAYLAND_SOCKET", "3"), ("DISPLAY", ":0")])));
-        assert!(!wanted(Some("automatic"), &wayland));
-        assert!(!wanted(None, &wayland));
-        assert!(!wanted(Some("wayland"), &wayland));
-        // An X11 session already opens on X11; without an X display there is no XWayland to use.
-        assert!(!wanted(Some("x11"), env(&[("DISPLAY", ":0")])));
-        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", "")])));
-        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0")])));
-    }
-
-    #[test]
-    fn ldconfig_parsing_matches_name_and_architecture() {
-        let cache = "12 libs found in cache `/etc/ld.so.cache'\n\
-            \tlibX11.so.6 (libc6,x86-64) => /lib/x86_64-linux-gnu/libX11.so.6\n\
-            \tlibxkbcommon-x11.so.0 (libc6) => /lib/i386-linux-gnu/libxkbcommon-x11.so.0\n";
-        assert!(ldconfig_has(cache, "libX11.so.6", Some("x86-64")));
-        assert!(!ldconfig_has(cache, "libX11.so.6", Some("AArch64")));
-        // Only the 32-bit build is installed: doesn't count for a 64-bit app.
-        assert!(!ldconfig_has(cache, "libxkbcommon-x11.so.0", Some("x86-64")));
-        assert!(ldconfig_has(cache, "libxkbcommon-x11.so.0", None));
-        assert!(!ldconfig_has(cache, "libX11.so", None));
-    }
-}
@@ -1,96 +0,0 @@
-// Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use std::process::{Command, Stdio};
-use std::time::{Duration, Instant};
-
-const BIN: &str = env!("CARGO_BIN_EXE_vectorcraft");
-
-/// Invalid roots must exit before desktop initialization on every platform, including a CI
-/// machine with no display. A regression must fail rather than hang with a window open.
-fn rejects(args: &[&str], message: &str) {
-    rejects_with_env(args, &[], message);
-}
-
-fn rejects_with_env(args: &[&str], env: &[(&str, &str)], message: &str) {
-    let mut child = Command::new(BIN)
-        .args(args)
-        .env_remove("VECTORCRAFT_CONTROL_PORT")
-        .env_remove("VECTORCRAFT_AUTOMATION_READ_ROOT")
-        .env_remove("VECTORCRAFT_AUTOMATION_WRITE_ROOT")
-        .env("VECTORCRAFT_NO_PREFS", "1")
-        .envs(env.iter().copied())
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .spawn()
-        .unwrap();
-    let deadline = Instant::now() + Duration::from_secs(5);
-    let timed_out = loop {
-        if child.try_wait().unwrap().is_some() {
-            break false;
-        }
-        if Instant::now() >= deadline {
-            child.kill().unwrap();
-            break true;
-        }
-        std::thread::sleep(Duration::from_millis(10));
-    };
-    let out = child.wait_with_output().unwrap();
-    assert!(!timed_out, "{args:?}: desktop started or did not exit promptly");
-    assert!(!out.status.success(), "{args:?}");
-    assert!(out.stdout.is_empty(), "{args:?}: {:?}", out.stdout);
-    // Exact stderr excludes unrelated startup warnings or display errors that could otherwise
-    // make a malformed invocation fail for an unrelated reason.
-    assert_eq!(String::from_utf8(out.stderr).unwrap(), format!("vectorcraft: {message}\n"), "{args:?}");
-}
-
-#[test]
-fn missing_empty_or_option_operands_fail_before_startup() {
-    for flag in ["--automation-read-root", "--automation-write-root"] {
-        rejects(&["--control", "7979", flag], &format!("{flag} needs a folder"));
-        rejects(&[flag], &format!("{flag} needs a folder"));
-        rejects(&["--control", "7979", &format!("{flag}=")], &format!("{flag} needs a non-empty folder"));
-        rejects(&[flag, ""], &format!("{flag} needs a non-empty folder"));
-        for next in ["--version", "--control", "--automation-write-root", "-folder"] {
-            rejects(&[flag, next], &format!("{flag} needs a folder; use {flag}=<dir> for a folder starting with '-'"));
-        }
-    }
-}
-
-#[test]
-fn duplicate_roots_fail_for_both_spellings() {
-    for flag in ["--automation-read-root", "--automation-write-root"] {
-        rejects(&[flag, ".", &format!("{flag}=.")], &format!("{flag} given twice"));
-        rejects(&[&format!("{flag}=."), flag, "."], &format!("{flag} given twice"));
-    }
-}
-
-#[test]
-fn explicit_dash_folder_does_not_consume_version() {
-    let out = Command::new(BIN).args(["--automation-read-root=-folder", "--automation-write-root", "./-folder", "--version"]).output().unwrap();
-    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
-    assert_eq!(String::from_utf8(out.stdout).unwrap(), format!("vectorcraft {}\n", env!("CARGO_PKG_VERSION")));
-    assert!(out.stderr.is_empty());
-}
-
-/// `--control` without a port no longer starts the app without a control server, and the
-/// argument after it isn't reinterpreted (#1373).
-#[test]
-fn control_without_a_valid_port_fails_before_startup() {
-    let need = "--control needs a port number from 1 to 65535";
-    rejects(&["--control", "--automation-read-root", ".", "--automation-write-root", "."], &format!("{need}, not `--automation-read-root`"));
-    rejects(&["--control"], need);
-    rejects(&["--control", "abc"], &format!("{need}, not `abc`"));
-    rejects(&["--control=0"], &format!("{need}, not `0`"));
-    rejects(&["--control="], &format!("{need}, not ``"));
-    rejects(&["--control", "7979", "--control", "7980"], "--control given twice");
-    rejects_with_env(&[], &[("VECTORCRAFT_CONTROL_PORT", "abc")], "VECTORCRAFT_CONTROL_PORT needs a port number from 1 to 65535, not `abc`");
-}
-
-#[test]
-fn version_wins_over_a_bad_control_port_variable() {
-    let out = Command::new(BIN).arg("--version").env("VECTORCRAFT_CONTROL_PORT", "abc").output().unwrap();
-    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
-    assert_eq!(String::from_utf8(out.stdout).unwrap(), format!("vectorcraft {}\n", env!("CARGO_PKG_VERSION")));
-}
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="butt" stroke-linejoin="miter"><path d="M12 3V21M3 12H21" stroke-width="1.5" /><rect x="6.5" y="6.5" width="11" height="11" fill="currentColor" fill-opacity="1.0" stroke="none"/></svg>
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M6 3 L6 19 L10 15 L13 21 L15.5 20 L12.6 14 L18 14 Z" fill="currentColor"/></svg>
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M6 3 L6 19 L10 15 L13 21 L15.5 20 L12.6 14 L18 14 Z" fill="none"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M6 3 L6 19 L10 15 L13 21 L15.5 20 L12.6 14 L18 14 Z" fill="currentColor" stroke-width="1"/></svg>
@@ -2,49 +2,49 @@
  "schema": 1,
  "repo": "storytold/vectorcraft",
  "branch": "main",
-  "head": "866ea5878a7f6db7dd3d6b1287f9a9bb3a241c33",
-  "head_date": "2026-10-10T00:04:42Z",
-  "commits": 906,
+  "head": "fe9f3afcb7d32032e8f332b0594692a03e275b84",
+  "head_date": "2026-10-08T00:36:16Z",
+  "commits": 607,
  "unattributed_commits": 0,
  "contributors": [
    {
      "login": "echelon",
      "people_entry": true,
      "github_name": null,
-      "prs": 18,
-      "commits": 124,
-      "lines_added": 173772,
-      "lines_deleted": 40385,
+      "prs": 15,
+      "commits": 119,
+      "lines_added": 172276,
+      "lines_deleted": 40329,
      "binary_added": 37,
      "binary_deleted": 2,
      "first_commit": "2026-09-30T09:12:46Z",
-      "last_commit": "2026-10-08T14:01:10Z"
+      "last_commit": "2026-10-07T22:04:30Z"
    },
    {
      "login": "bflatastic",
      "people_entry": false,
      "github_name": null,
-      "prs": 328,
-      "commits": 561,
-      "lines_added": 253056,
-      "lines_deleted": 31036,
+      "prs": 176,
+      "commits": 394,
+      "lines_added": 212929,
+      "lines_deleted": 24160,
      "binary_added": 2,
      "binary_deleted": 0,
      "first_commit": "2026-10-02T15:22:29Z",
-      "last_commit": "2026-10-09T23:27:19Z"
+      "last_commit": "2026-10-08T00:36:16Z"
    },
    {
      "login": "storybored379",
      "people_entry": false,
      "github_name": null,
-      "prs": 8,
-      "commits": 9,
-      "lines_added": 812,
-      "lines_deleted": 77,
+      "prs": 7,
+      "commits": 7,
+      "lines_added": 456,
+      "lines_deleted": 49,
      "binary_added": 0,
      "binary_deleted": 0,
      "first_commit": "2026-10-04T06:45:57Z",
-      "last_commit": "2026-10-09T04:35:07Z"
+      "last_commit": "2026-10-04T08:14:20Z"
    },
    {
      "login": "theironchef",
@@ -102,14 +102,14 @@
      "login": "imachus",
      "people_entry": false,
      "github_name": null,
-      "prs": 21,
-      "commits": 22,
-      "lines_added": 7242,
-      "lines_deleted": 320,
+      "prs": 12,
+      "commits": 12,
+      "lines_added": 6302,
+      "lines_deleted": 212,
      "binary_added": 0,
      "binary_deleted": 0,
      "first_commit": "2026-10-06T10:06:18Z",
-      "last_commit": "2026-10-09T08:36:30Z"
+      "last_commit": "2026-10-07T22:20:10Z"
    },
    {
      "login": "petrleocompel",
@@ -128,14 +128,14 @@
      "login": "fahrim",
      "people_entry": false,
      "github_name": null,
-      "prs": 4,
-      "commits": 7,
-      "lines_added": 2134,
-      "lines_deleted": 83,
+      "prs": 3,
+      "commits": 6,
+      "lines_added": 1964,
+      "lines_deleted": 76,
      "binary_added": 0,
      "binary_deleted": 0,
      "first_commit": "2026-10-06T12:48:28Z",
-      "last_commit": "2026-10-08T01:33:25Z"
+      "last_commit": "2026-10-07T23:36:17Z"
    },
    {
      "login": "EthanSuquet",
@@ -258,14 +258,14 @@
      "login": "Haven-King",
      "people_entry": false,
      "github_name": null,
-      "prs": 9,
-      "commits": 19,
-      "lines_added": 8627,
-      "lines_deleted": 720,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 467,
+      "lines_deleted": 76,
      "binary_added": 0,
      "binary_deleted": 0,
      "first_commit": "2026-10-07T18:10:39Z",
-      "last_commit": "2026-10-09T03:25:56Z"
+      "last_commit": "2026-10-07T18:40:49Z"
    },
    {
      "login": "njmueller",
@@ -297,430 +297,14 @@
      "login": "DWAA1660",
      "people_entry": false,
      "github_name": null,
-      "prs": 3,
-      "commits": 3,
-      "lines_added": 392,
-      "lines_deleted": 44,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 76,
+      "lines_deleted": 21,
      "binary_added": 0,
      "binary_deleted": 0,
      "first_commit": "2026-10-07T23:09:37Z",
-      "last_commit": "2026-10-09T17:33:23Z"
-    },
-    {
-      "login": "raytheengineer",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 94,
-      "lines_deleted": 12,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T03:19:20Z",
-      "last_commit": "2026-10-08T03:19:20Z"
-    },
-    {
-      "login": "bobtherobot",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 5,
-      "commits": 6,
-      "lines_added": 824,
-      "lines_deleted": 93,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T03:25:09Z",
-      "last_commit": "2026-10-08T16:57:16Z"
-    },
-    {
-      "login": "devCangrejo",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 859,
-      "lines_deleted": 13,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T06:30:51Z",
-      "last_commit": "2026-10-08T06:30:51Z"
-    },
-    {
-      "login": "wstock",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 7,
-      "commits": 7,
-      "lines_added": 749,
-      "lines_deleted": 92,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T07:45:45Z",
-      "last_commit": "2026-10-08T11:46:16Z"
-    },
-    {
-      "login": "switch87",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 2,
-      "commits": 3,
-      "lines_added": 638,
-      "lines_deleted": 3,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T09:25:54Z",
-      "last_commit": "2026-10-08T09:42:11Z"
-    },
-    {
-      "login": "h-a-n-a-s-h-i",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 0,
-      "commits": 2,
-      "lines_added": 52,
-      "lines_deleted": 52,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T12:13:01Z",
-      "last_commit": "2026-10-08T14:01:57Z"
-    },
-    {
-      "login": "XusBadia",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 74,
-      "lines_deleted": 1,
-      "binary_added": 2,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T12:58:51Z",
-      "last_commit": "2026-10-08T12:58:51Z"
-    },
-    {
-      "login": "omellado-gh",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 0,
-      "commits": 1,
-      "lines_added": 335,
-      "lines_deleted": 7,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T13:05:09Z",
-      "last_commit": "2026-10-08T13:05:09Z"
-    },
-    {
-      "login": "callmeBalloch",
-      "people_entry": true,
-      "github_name": null,
-      "prs": 5,
-      "commits": 13,
-      "lines_added": 11741,
-      "lines_deleted": 698,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T14:01:08Z",
-      "last_commit": "2026-10-09T13:45:55Z"
-    },
-    {
-      "login": "jeremyfry",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 57,
-      "lines_deleted": 2,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T14:57:01Z",
-      "last_commit": "2026-10-08T14:57:01Z"
-    },
-    {
-      "login": "dbambus",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 72,
-      "lines_deleted": 11,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T15:38:18Z",
-      "last_commit": "2026-10-08T15:38:18Z"
-    },
-    {
-      "login": "mo0kid",
-      "people_entry": true,
-      "github_name": "David John Whiting",
-      "prs": 2,
-      "commits": 6,
-      "lines_added": 1973,
-      "lines_deleted": 144,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T19:50:54Z",
-      "last_commit": "2026-10-08T22:03:34Z"
-    },
-    {
-      "login": "MaksPV",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 3682,
-      "lines_deleted": 10,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T20:44:45Z",
-      "last_commit": "2026-10-08T20:44:45Z"
-    },
-    {
-      "login": "omd0",
-      "people_entry": true,
-      "github_name": "Emad Fussi",
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 291,
-      "lines_deleted": 25,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T21:34:00Z",
-      "last_commit": "2026-10-08T21:34:00Z"
-    },
-    {
-      "login": "leblanc-simon",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 4,
-      "lines_added": 3721,
-      "lines_deleted": 60,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T22:00:03Z",
-      "last_commit": "2026-10-08T23:14:11Z"
-    },
-    {
-      "login": "dotCooCoo",
-      "people_entry": true,
-      "github_name": ".CooCoo",
-      "prs": 5,
-      "commits": 6,
-      "lines_added": 1701,
-      "lines_deleted": 139,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T22:18:57Z",
-      "last_commit": "2026-10-09T15:33:59Z"
-    },
-    {
-      "login": "u9151131269-a11y",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 0,
-      "commits": 1,
-      "lines_added": 37,
-      "lines_deleted": 0,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T23:05:11Z",
-      "last_commit": "2026-10-08T23:05:11Z"
-    },
-    {
-      "login": "HEOJUNFO",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 112,
-      "lines_deleted": 17,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-08T23:49:03Z",
-      "last_commit": "2026-10-08T23:49:03Z"
-    },
-    {
-      "login": "DisasterAreaDesigns",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 4,
-      "commits": 14,
-      "lines_added": 3359,
-      "lines_deleted": 116,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T00:15:28Z",
-      "last_commit": "2026-10-09T14:43:23Z"
-    },
-    {
-      "login": "jax-spenser",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 3098,
-      "lines_deleted": 39,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T01:41:46Z",
-      "last_commit": "2026-10-09T01:41:46Z"
-    },
-    {
-      "login": "mateususa",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 18,
-      "lines_deleted": 5,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T02:19:59Z",
-      "last_commit": "2026-10-09T02:19:59Z"
-    },
-    {
-      "login": "fastmikey99",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 5,
-      "commits": 5,
-      "lines_added": 490,
-      "lines_deleted": 31,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T04:11:07Z",
-      "last_commit": "2026-10-09T04:11:08Z"
-    },
-    {
-      "login": "AutoHenry",
-      "people_entry": true,
-      "github_name": null,
-      "prs": 1,
-      "commits": 2,
-      "lines_added": 351,
-      "lines_deleted": 27,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T10:50:26Z",
-      "last_commit": "2026-10-09T10:50:26Z"
-    },
-    {
-      "login": "jmverges",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 4,
-      "commits": 4,
-      "lines_added": 382,
-      "lines_deleted": 73,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T11:17:50Z",
-      "last_commit": "2026-10-09T19:03:09Z"
-    },
-    {
-      "login": "dmatviichuk",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 2,
-      "commits": 2,
-      "lines_added": 3893,
-      "lines_deleted": 109,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T12:15:12Z",
-      "last_commit": "2026-10-09T17:51:43Z"
-    },
-    {
-      "login": "hamada147",
-      "people_entry": true,
-      "github_name": "Ahmed Moussa",
-      "prs": 1,
-      "commits": 2,
-      "lines_added": 671,
-      "lines_deleted": 62,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T13:09:34Z",
-      "last_commit": "2026-10-09T14:18:54Z"
-    },
-    {
-      "login": "haranishi",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 571,
-      "lines_deleted": 7,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T17:53:07Z",
-      "last_commit": "2026-10-09T17:53:07Z"
-    },
-    {
-      "login": "Messhias",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 3,
-      "lines_added": 268,
-      "lines_deleted": 27,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T19:00:03Z",
-      "last_commit": "2026-10-09T19:26:55Z"
-    },
-    {
-      "login": "rschuerer",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 450,
-      "lines_deleted": 35,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-09T23:08:33Z",
-      "last_commit": "2026-10-09T23:08:33Z"
-    },
-    {
-      "login": "dylanmtaylor",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 34,
-      "lines_deleted": 34,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": "2026-10-10T00:04:42Z",
-      "last_commit": "2026-10-10T00:04:42Z"
-    },
-    {
-      "login": "llduyll10",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 0,
-      "lines_added": 0,
-      "lines_deleted": 0,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": null,
-      "last_commit": null
-    },
-    {
-      "login": "visuarte",
-      "people_entry": false,
-      "github_name": null,
-      "prs": 1,
-      "commits": 0,
-      "lines_added": 0,
-      "lines_deleted": 0,
-      "binary_added": 0,
-      "binary_deleted": 0,
-      "first_commit": null,
-      "last_commit": null
+      "last_commit": "2026-10-07T23:09:37Z"
    }
  ],
  "models": [
@@ -729,72 +313,36 @@
      "company": "Anthropic",
      "model": "Claude Opus",
      "version": "5.5",
-      "commits": 787,
-      "lines_added": 439476,
-      "lines_deleted": 75146
+      "commits": 567,
+      "lines_added": 382239,
+      "lines_deleted": 67174
    },
    {
      "id": "anthropic/claude-sonnet/5.5",
      "company": "Anthropic",
      "model": "Claude Sonnet",
      "version": "5.5",
-      "commits": 22,
-      "lines_added": 7688,
-      "lines_deleted": 196
-    },
-    {
-      "id": "anthropic/claude-fable/5.1",
-      "company": "Anthropic",
-      "model": "Claude Fable",
-      "version": "5.1",
-      "commits": 9,
-      "lines_added": 8008,
-      "lines_deleted": 2754
+      "commits": 6,
+      "lines_added": 660,
+      "lines_deleted": 34
    },
    {
      "id": "anthropic/claude-opus/4.8",
      "company": "Anthropic",
      "model": "Claude Opus",
      "version": "4.8",
-      "commits": 4,
-      "lines_added": 1729,
-      "lines_deleted": 44
-    },
-    {
-      "id": "openai/codex",
-      "company": "OpenAI",
-      "model": "Codex",
-      "version": "",
      "commits": 3,
-      "lines_added": 448,
-      "lines_deleted": 120
+      "lines_added": 1672,
+      "lines_deleted": 42
    },
    {
-      "id": "anysphere/cursor",
-      "company": "Anysphere",
-      "model": "Cursor",
-      "version": "",
-      "commits": 2,
-      "lines_added": 63,
-      "lines_deleted": 25
-    },
-    {
-      "id": "anthropic/claude",
+      "id": "anthropic/claude-fable/5.1",
      "company": "Anthropic",
-      "model": "Claude",
-      "version": "",
+      "model": "Claude Fable",
+      "version": "5.1",
      "commits": 1,
-      "lines_added": 55,
-      "lines_deleted": 4
-    },
-    {
-      "id": "anthropic/claude-opus/4.7",
-      "company": "Anthropic",
-      "model": "Claude Opus",
-      "version": "4.7",
-      "commits": 1,
-      "lines_added": 94,
-      "lines_deleted": 12
+      "lines_added": 6809,
+      "lines_deleted": 2627
    }
  ]
 }
@@ -17,79 +17,11 @@
 # To remove your names, delete your entry (or set fields empty) in a PR. The next
 # contributors.py run, and the next build, drop them.

-[people.lollinoo]
-sync_github_name = true
-
 [people.echelon]
 real_name = "Brandon Thomas"
 display_name = "Brandon Thomas"
 sync_github_name = false

-[people.crqch]
-sync_github_name = true
-
-[people.mo0kid]
-sync_github_name = true
-
-[people.omd0]
-sync_github_name = true
-
-[people.dotCooCoo]
-real_name = "Robert Lee"
-sync_github_name = true
-
-[people.AutoHenry]
-real_name = "Hal Goff"
-display_name = "Hal Goff, HG Studio"
-sync_github_name = false
-
-[people.hamada147]
-real_name = "Ahmed Moussa"
-display_name = "Ahmed Moussa"
-sync_github_name = true
-
-[people.vbasky]
-real_name = "Vikram Bhaskaran"
-display_name = "Vikram Bhaskaran"
-sync_github_name = false
-
-[people.Messhias]
-real_name = "Fabio William Conceição"
-display_name = "Messhias"
-sync_github_name = false
-
-[people.KattKnight]
-display_name = "KattKnight (ayla.dsc)"
-sync_github_name = false
-
-[people.NoJuanNobody]
-real_name = "Alejandro Londono"
-display_name = "alex"
-sync_github_name = false
-
-[people.webdevtodayjason]
-display_name = "Jason Brashear"
-
-[people.Losminek]
-sync_github_name = true
-
-[people.atoslins]
-real_name = "Atos Lins"
-display_name = "Atos Lins"
-sync_github_name = false
-
-[people.sanyamsingh001]
-display_name = "sanyamsingh001"
-sync_github_name = false
-
-[people.aguo890]
-real_name = "Aaron Guo"
-display_name = "Aaron Guo"
-sync_github_name = false
-
-[people.Nael-Nathanael]
-sync_github_name = true
-
-[people.switch87]
-real_name = "Gert Pellin"
+[people.callmeBalloch]
+real_name = "Riccardo Balloch"
 sync_github_name = false
@@ -1,23 +0,0 @@
-[package]
-name = "vectorcraft-affinity"
-description = "Bounded reader for native Affinity documents: archive, object stream and document model"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
-
-[lints]
-workspace = true
-
-[features]
-# Synthetic-container builders for tests and fuzz seeds; not an Affinity exporter.
-synth = []
-
-[dependencies]
-crc32fast = { workspace = true }
-flate2 = { workspace = true }
-image = { workspace = true }
-ruzstd = "0.9"
-
-[dev-dependencies]
-proptest = { workspace = true }
@@ -1,146 +0,0 @@
-# vectorcraft-affinity
-
-An independent, bounded Rust reader for native Affinity documents: `.af` from Affinity 3 and
-`.afdesign`, `.afphoto` and `.afpub` from Affinity 1 and 2 (container versions 8 to 12). It reads
-the archive, the tagged object stream in `doc.dat` and the part of the document model listed below,
-and hands the engine a document in pixels with every transform composed. It does not write
-Affinity files.
-
-## What is imported
-
-| Affinity | VectorCraft |
-|---|---|
-| Pages, Publisher spreads (one or two pages) | artboards, spreads side by side |
-| Artboards (legacy `ABEn` or Affinity 3 `phrp`/`aprp`), with name, paint and any transform | artboards plus a clip group with the actual vector outline, background and stroke |
-| Layers (`Scop`), groups (`Grup`), pass-through or isolated | layers and sublayers, groups |
-| Curves (`PCrv`): cubic subpaths, closed flags, live corners (`CnrD`) | paths (multi-subpath curves fill even-odd) |
-| Rectangles with corner radii (relative or absolute, locked or per corner) and round or straight corners, ellipses, polygons (smooth too), stars, square stars, pies, triangles, trapezoids | paths |
-| Compound shapes (`Comp`, add and subtract) | one even-odd path |
-| A shape or curve with children clips them | clip group whose clipping path keeps its fill (behind) and stroke (over) |
-| Vector masks (`AdCh` curves and shapes) | clip group |
-| Pixel masks (`MRst`, attached or as a layer in a group) | opacity mask |
-| Solid fills: RGBA, HSLA, CMYK, grey, Lab (D50) | fill appearance (alpha as fill opacity) |
-| Linear, elliptical and radial gradients with Affinity's midpoint bias | gradients (the bias as the midpoint where the blend is half way) |
-| Strokes: weight, scale with object, dash pattern and phase, alignment, miter limit, behind the fill | stroke appearance |
-| Fill layers (`FRst`) | filled rectangles |
-| Artistic and frame text: Unicode scalar-indexed runs, stored fallback font, family/weight/style, boolean OpenType features, all caps, size, tracking, fixed leading, colour, paragraph alignment, first baseline | point type and area type |
-| Placed images (`ImgN`): the original JPEG/PNG embedded in the file | embedded images |
-| Pixel layers (`Rstr`): RGBA 8/16-bit and CMYK 8-bit tiles, cropped to their content; source-backed RGBA8 JPEG/PNG tiles with matching dimensions and zero origin | embedded PNG images |
-| Embedded documents and symbols (`EmbN`) | the picture Affinity cached of them |
-| Opacity, visibility, lock, names, the blend modes VectorCraft has | the same |
-
-Everything else is reported in the import warnings, one line per kind with a count, never
-dropped silently: layer effects, adjustment layers and live filters, brush and pressure strokes,
-transparency gradients, fill opacity, bitmap fills, master pages, conical gradients (as radial),
-special shapes (cloud, heart, cog, callouts, arrows…, imported as their bounding ellipse), corner
-types other than round or straight, stars with rounded points, several fills or strokes on one object (the
-active one is used), outlined or scaled text, text fields such as page numbers, frames with
-columns or a curved outline, paragraph indents/spacing, mixed paragraph alignments, unsupported font selectors, grey/Lab/32-bit pixels, CMYK pixels (converted to RGB without the
-document's profile) and Affinity-only blend modes (Add, Linear Light… as Normal).
-
-When the native document can't be read at all, the engine opens the embedded PNG preview instead,
-with a warning that names the reason; that preview can't be placed, used as a template or mined
-for swatches and styles. Save never writes back over the Affinity file.
-
-## Provenance and clean-room
-
-Affinity has no published file-format specification, so this reader is built only from a public
-description of the format and from public files, never from Affinity itself. This is how the sibling app PhotoCraft already treats formats that
-are only partly documented:
-its PSD reader fills the gaps in Adobe's specification from the MIT-licensed psd-tools and
-ag-psd, and its camera raw decoder recovered Nikon's compression tables by black-box analysis
-of CC0 sample files.
-
-* **No Affinity software.** Affinity was never downloaded, installed, run, scripted, screenshotted or
-  disassembled for this work, and nothing from an Affinity installation (program code, resources,
-  presets, fonts, colour profiles) was read. No file was made with Affinity for it: every sample
-  is a document its author published.
-* **A public, permissively licensed description.** The container and object-stream layout was
-  learned from [VMDevCpp/afread](https://github.com/VMDevCpp/afread) (MIT, at
-  `04b672334a43e3e37ded6b5ffc57af231d589774`, written for container versions 7–11) and re-described
-  in our own words before this Rust code was written; no code was translated. No GPL/AGPL code (such
-  as Inkscape's Affinity extension) was read.
-* **Every structure checked against public files.** afread doesn't say how its author learned the
-  format, so nothing here rests on it alone: each structure the reader relies on is confirmed by
-  the public documents. Every archive entry carries a CRC-32 that must match, and every field in
-  the object stream names its own type, so a misread layout fails loudly instead of producing
-  plausible wrong data.
-* **Meaning fitted to Affinity's own pictures.** What shapes, paints, text and pixel data mean was
-  worked out by comparing our render with the thumbnail every Affinity document embeds (Affinity's
-  render of itself), on 176 public documents saved by Affinity 1.x, 2.x and 3.0/3.1 on Windows,
-  macOS and iPad. The collection has since grown to 189 distinct documents, and the reader opens
-  all of them. Most are published under CC0, MIT, BSD, Apache-2.0 or CC BY (-SA); the others
-  (no licence stated, or GPL or non-commercial terms) were only opened locally to compare
-  pictures, never committed or redistributed. The corpus test keeps the comparison for the pinned
-  files, which are CC0, MIT or Apache-2.0 only.
-* **Nothing of Affinity's is in this repository**: no program code, assets or documents. The test
-  files are fetched at pinned commits and sha256-verified, never committed.
-* **Read-only.** Nothing is written in Affinity's format; export waits until someone can check
-  written files in Affinity itself.
-
-The reader also has an independent copy in PhotoCraft's `photocraft-affinity`.
-
-## Validation
-
-* Unit tests on synthetic containers built by the `synth` feature (stored, zlib and zstd entries,
-  checksums, budgets, cycles, hostile streams, every truncation) and property tests of random
-  mutations.
-* `cargo xtask corpus --affinity` fetches 51 public CC0/MIT/Apache-2.0 documents at pinned
-  commits, SHA-256 verified against `xtask/affinity-corpus.sha256`, with upstream license notices.
-  Of these, 33 are current `.af`: four CC0 vector illustrations and 28 original Affinity 3.2.3
-  feature probes plus one separately identified derived regression input from
-  [SethRobinson/Patchy](https://github.com/SethRobinson/Patchy). Only document data and provenance
-  notices were inspected, never that project's importer or authoring scripts.
-* `tests/real_files.rs` parses every file and freezes the modeled features of all 33 current
-  `.af` files. Native raster tests compare decoded pixels with independent embedded images;
-  text tests assert Unicode run boundaries, fallback fonts and feature retention.
-* `engine/tests/affinity_corpus.rs` requires editable native import, exact `.vectorcraft`
-  save/reload, and SVG/PDF/PSD export of every board in all 33 current files. It checks SVG/PDF
-  dimensions and reimport, and independently decodes PSD merged pixels using the published
-  specification. These are VectorCraft consistency checks, not independent Affinity PSD oracles.
-  Saved-thumbnail comparisons cover the existing 22 documents plus nine new representative
-  fixtures, checking every board; unsupported effects and text layout are not claimed visually
-  faithful. The Affinity corpus workflow requires the files, so missing fixtures cannot silently
-  pass CI. Run locally with `AFFINITY_CORPUS_REQUIRED=1` for the same strict gate.
-* Synthetic engine regressions cover nested, rotated and curved artboards, negative origins,
-  multiple spreads and resolution conversion, alongside text recovery and native save/export.
-* `engine/tests/import_fuzz.rs` mutates a synthetic native document's stream and archive and checks
-  that whatever opens also renders and exports; `fuzz/` has `cargo-fuzz` targets for the whole
-  reader (`container`) and the object stream (`stream`):
-
-  ```sh
-  cd crates/affinity
-  cargo +nightly fuzz run stream -- -max_total_time=600
-  ```
-
-The source audit, licensing decisions and remaining complex-document/font cases are recorded in
-[affinity-validation.md](../../docs/affinity-validation.md). Reopening VectorCraft's exports in
-Affinity remains an independent validation step that hasn't been done.
-
-What has not been verified: files from Affinity builds or platforms outside the public set, files
-written by other applications, rotated or skewed images against Affinity's render, mask polarity
-against a render with and without the mask, and anything listed as a warning above. The `synth`
-builders write only what this reader accepts; Affinity has never opened their output, so they are
-test fixtures, not an exporter.
-
-## Safety limits
-
-Every size is checked before it is allocated: 256 MiB per archive entry and 1 GiB per import by
-default (`Limits`), a 64 MiB zstd window, 4096 saved revisions, array lengths no longer than the
-bytes left, 16 777 216 decoded values per document stream (fields and array elements together, counted before
-anything is allocated: a value takes about 40 bytes in memory however few it took in the file; the largest of
-those 189 public documents uses 3.3 million), 384 levels of object nesting, 128 levels of layers, 500 000 layers, four million curve
-nodes per curve; compound outlines also cap recursion at 128 levels, operand visits at 100 000
-and cumulative geometry work at four million, rejecting cycles and partial results on limits.
-Pie sweeps normalize finite angles in constant time. Pixel layers are limited to 64 megapixels
-(cropped to their content first); gradients to 1024 stops. Text collection is bounded to a
-million characters per node before allocation, with a cumulative 16 MiB budget for owned font
-names, features and gradient stops. Exhaustion warns and uses default attributes for remaining
-text, preserving its characters.
-Every archive entry's CRC-32 and size must match. Malformed input returns an `Error`; the
-crate has no panics outside tests.
-
-## Privacy
-
-Affinity documents can hold the folder they were saved in, user names, original image paths and
-XMP metadata. This reader never imports those fields.
@@ -1,5 +0,0 @@
-/target
-/corpus
-/artifacts
-/coverage
-/Cargo.lock
@@ -1,29 +0,0 @@
-[package]
-name = "vectorcraft-affinity-fuzz"
-version = "0.0.0"
-edition = "2024"
-publish = false
-
-[package.metadata]
-cargo-fuzz = true
-
-[dependencies]
-libfuzzer-sys = "0.4"
-vectorcraft-affinity = { path = "..", features = ["synth"] }
-
-[[bin]]
-name = "container"
-path = "fuzz_targets/container.rs"
-test = false
-doc = false
-bench = false
-
-[[bin]]
-name = "stream"
-path = "fuzz_targets/stream.rs"
-test = false
-doc = false
-bench = false
-
-[workspace]
-members = ["."]
@@ -1,10 +0,0 @@
-#![no_main]
-
-use libfuzzer_sys::fuzz_target;
-
-// The whole native reader (archive, object stream, model) and the preview, on arbitrary bytes.
-fuzz_target!(|bytes: &[u8]| {
-    let _ = vectorcraft_affinity::container::header(bytes);
-    let _ = vectorcraft_affinity::preview(bytes);
-    let _ = vectorcraft_affinity::read(bytes, vectorcraft_affinity::Limits { max_entry: 16 << 20, max_total: 64 << 20 });
-});
@@ -1,11 +0,0 @@
-#![no_main]
-
-use libfuzzer_sys::fuzz_target;
-
-// The doc.dat object stream and the model built from it, wrapped in a stored archive entry so
-// mutations reach the tagged grammar instead of the archive's checksum.
-fuzz_target!(|stream: &[u8]| {
-    let _ = vectorcraft_affinity::stream::parse(stream);
-    let file = vectorcraft_affinity::synth::container(&[("doc.dat", stream, vectorcraft_affinity::synth::Method::Stored)], None);
-    let _ = vectorcraft_affinity::read(&file, vectorcraft_affinity::Limits { max_entry: 16 << 20, max_total: 64 << 20 });
-});
@@ -1,105 +0,0 @@
-//! Typed reads of [`Stream`] objects. Every accessor returns `None` when a field is missing or has
-//! another type, so the document mapping treats odd data as absent rather than failing.
-
-use crate::stream::{ObjId, Object, Stream, Tag, Value};
-
-impl Stream {
-    pub fn object(&self, id: ObjId) -> Option<&Object> {
-        self.objects.get(id)
-    }
-
-    pub fn field(&self, id: ObjId, tag: &[u8; 4]) -> Option<&Value> {
-        self.object(id)?.get(Tag::of(tag))
-    }
-
-    pub fn class(&self, id: ObjId) -> Option<Tag> {
-        self.object(id).map(|o| o.class)
-    }
-
-    pub fn is(&self, id: ObjId, class: &[u8; 4]) -> bool {
-        self.class(id) == Some(Tag::of(class))
-    }
-
-    /// A child object (shared, linked or inline); `None` for null or missing.
-    pub fn obj(&self, id: ObjId, tag: &[u8; 4]) -> Option<ObjId> {
-        match self.field(id, tag)? {
-            Value::Obj(o) => *o,
-            _ => None,
-        }
-    }
-
-    /// An array of objects (nulls skipped).
-    pub fn objs(&self, id: ObjId, tag: &[u8; 4]) -> Vec<ObjId> {
-        match self.field(id, tag) {
-            Some(Value::Array(a)) => a.iter().filter_map(|v| if let Value::Obj(Some(o)) = v { Some(*o) } else { None }).collect(),
-            _ => Vec::new(),
-        }
-    }
-
-    pub fn f64(&self, id: ObjId, tag: &[u8; 4]) -> Option<f64> {
-        match self.field(id, tag)? {
-            Value::Float(f) if f.is_finite() => Some(*f),
-            _ => None,
-        }
-    }
-
-    pub fn int(&self, id: ObjId, tag: &[u8; 4]) -> Option<i64> {
-        match self.field(id, tag)? {
-            Value::Int(i) => Some(*i),
-            Value::UInt(u) => i64::try_from(*u).ok(),
-            _ => None,
-        }
-    }
-
-    pub fn bool(&self, id: ObjId, tag: &[u8; 4]) -> Option<bool> {
-        match self.field(id, tag)? {
-            Value::Bool(b) => Some(*b),
-            _ => None,
-        }
-    }
-
-    pub fn str(&self, id: ObjId, tag: &[u8; 4]) -> Option<&str> {
-        match self.field(id, tag)? {
-            Value::Str(s) => Some(s),
-            _ => None,
-        }
-    }
-
-    pub fn enumeration(&self, id: ObjId, tag: &[u8; 4]) -> Option<(u16, u16)> {
-        match self.field(id, tag)? {
-            Value::Enum { id, version } => Some((*id, *version)),
-            _ => None,
-        }
-    }
-
-    /// A fixed vector of `N` finite floats (points, rectangles, transforms).
-    pub fn floats<const N: usize>(&self, id: ObjId, tag: &[u8; 4]) -> Option<[f64; N]> {
-        match self.field(id, tag)? {
-            Value::Floats(v) if v.len() == N && v.iter().all(|f| f.is_finite()) => {
-                let mut a = [0.0; N];
-                a.copy_from_slice(v);
-                Some(a)
-            }
-            _ => None,
-        }
-    }
-
-    pub fn bytes(&self, id: ObjId, tag: &[u8; 4]) -> Option<&[u8]> {
-        match self.field(id, tag)? {
-            Value::Bytes(b) | Value::Blob(b) => Some(b),
-            _ => None,
-        }
-    }
-
-    pub fn entry(&self, id: ObjId, tag: &[u8; 4]) -> Option<&str> {
-        match self.field(id, tag)? {
-            Value::Entry(s) => Some(s),
-            _ => None,
-        }
-    }
-
-    /// Untagged fields of a positional object, in order.
-    pub fn positional(&self, id: ObjId) -> impl Iterator<Item = &Value> {
-        self.object(id).into_iter().flat_map(|o| o.fields.iter().map(|(_, v)| v))
-    }
-}
@@ -1,371 +0,0 @@
-//! The Affinity archive: header, the chain of file allocation tables (one per save) and
-//! bounded, CRC-checked extraction of named entries such as `doc.dat` and raster tiles.
-
-use std::collections::{HashMap, HashSet};
-use std::io::Read;
-
-use crate::Error;
-
-pub const MAGIC: &[u8; 4] = b"\x00\xffKA";
-/// Oldest and newest container versions seen in real documents (Affinity 1.x writes 8,
-/// Affinity 3 writes 12). Version 7 is described by afread but no sample exists.
-pub const VERSIONS: std::ops::RangeInclusive<u16> = 8..=12;
-/// `Prsn` (stored byte-reversed): documents. Asset, brush and style libraries share the magic.
-const DOCUMENT_KIND: &[u8; 4] = b"nsrP";
-
-/// A save appends one table; real files have one to a few hundred.
-const MAX_TABLES: usize = 4096;
-/// zstd window ceiling: real documents use a few MiB; this stops a header from reserving gigabytes.
-const MAX_ZSTD_WINDOW: u64 = 64 << 20;
-
-/// Decompression budget for one import. Every entry declares its size, which is checked against
-/// these limits before anything is allocated, and the decoded length must match it exactly.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct Limits {
-    /// Largest single entry (`doc.dat` or one tile).
-    pub max_entry: usize,
-    /// Total bytes extracted over the whole import.
-    pub max_total: usize,
-}
-
-impl Default for Limits {
-    fn default() -> Self {
-        Self { max_entry: 256 << 20, max_total: 1 << 30 }
-    }
-}
-
-/// The container header, all integers little-endian.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct Header {
-    pub version: u16,
-    /// Seen as 0, 4 or 8 in real files; bits 0 and 1 mark container variants that are rejected.
-    pub flags: u16,
-    pub(crate) fat_offset: u64,
-    pub(crate) thumbnail_offset: u64,
-    /// Save time in Unix seconds, as written by the application.
-    pub saved: u32,
-}
-
-/// One FAT record, as of the newest table that mentions its id.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct Entry {
-    pub id: u32,
-    pub name: String,
-    offset: u64,
-    size: u64,
-    compressed: u64,
-    crc: u32,
-    compression: u8,
-}
-
-impl Entry {
-    /// Decompressed size declared by the table.
-    pub fn size(&self) -> u64 {
-        self.size
-    }
-}
-
-#[derive(Debug)]
-pub struct Archive<'a> {
-    bytes: &'a [u8],
-    pub header: Header,
-    /// Head revision of every named, non-deleted entry.
-    entries: HashMap<String, Entry>,
-    /// Number of tables (saves) in the chain.
-    pub revisions: usize,
-    extracted: usize,
-    limits: Limits,
-}
-
-pub(crate) struct Cursor<'a> {
-    bytes: &'a [u8],
-    pub(crate) pos: usize,
-}
-
-impl<'a> Cursor<'a> {
-    pub(crate) fn new(bytes: &'a [u8], pos: usize) -> Self {
-        Self { bytes, pos }
-    }
-    pub(crate) fn remaining(&self) -> usize {
-        self.bytes.len().saturating_sub(self.pos)
-    }
-    pub(crate) fn take(&mut self, n: usize) -> Result<&'a [u8], Error> {
-        let end = self.pos.checked_add(n).ok_or(Error::Malformed("length overflow"))?;
-        let s = self.bytes.get(self.pos..end).ok_or(Error::Malformed("truncated data"))?;
-        self.pos = end;
-        Ok(s)
-    }
-    pub(crate) fn array<const N: usize>(&mut self) -> Result<[u8; N], Error> {
-        let s = self.take(N)?;
-        let mut a = [0u8; N];
-        a.copy_from_slice(s);
-        Ok(a)
-    }
-    pub(crate) fn u8(&mut self) -> Result<u8, Error> {
-        Ok(self.array::<1>()?[0])
-    }
-    pub(crate) fn u16(&mut self) -> Result<u16, Error> {
-        Ok(u16::from_le_bytes(self.array()?))
-    }
-    pub(crate) fn u32(&mut self) -> Result<u32, Error> {
-        Ok(u32::from_le_bytes(self.array()?))
-    }
-    pub(crate) fn u64(&mut self) -> Result<u64, Error> {
-        Ok(u64::from_le_bytes(self.array()?))
-    }
-}
-
-fn offset(v: u64) -> Result<usize, Error> {
-    usize::try_from(v).map_err(|_| Error::Malformed("offset beyond addressable memory"))
-}
-
-/// True when `bytes` start with the Affinity container signature (documents and libraries).
-pub fn is_affinity(bytes: &[u8]) -> bool {
-    bytes.starts_with(MAGIC)
-}
-
-/// Check the signature, version and document kind.
-pub fn header(bytes: &[u8]) -> Result<Header, Error> {
-    if !is_affinity(bytes) {
-        return Err(Error::Malformed("missing container signature"));
-    }
-    let mut c = Cursor::new(bytes, 4);
-    let version = c.u16()?;
-    let flags = c.u16()?;
-    if !VERSIONS.contains(&version) {
-        return Err(Error::Unsupported("unknown container version"));
-    }
-    if flags & 3 != 0 {
-        return Err(Error::Unsupported("container variant"));
-    }
-    if c.take(4)? != DOCUMENT_KIND {
-        return Err(Error::Unsupported("this Affinity file is a library (assets, brushes or styles), not a document"));
-    }
-    if c.take(4)? != b"#Inf" {
-        return Err(Error::Malformed("missing information header"));
-    }
-    let fat_offset = c.u64()?;
-    let thumbnail_offset = c.u64()?;
-    c.take(16)?;
-    let saved = u32::try_from(c.u64()?).unwrap_or(0);
-    c.take(8)?;
-    if c.take(4)? != b"Prot" {
-        return Err(Error::Malformed("missing protocol header"));
-    }
-    Ok(Header { version, flags, fat_offset, thumbnail_offset, saved })
-}
-
-impl<'a> Archive<'a> {
-    pub fn open(bytes: &'a [u8], limits: Limits) -> Result<Self, Error> {
-        let header = header(bytes)?;
-        // Newest record per id: (table date, table index, record).
-        let mut latest: HashMap<u32, (u64, usize, Option<Entry>)> = HashMap::new();
-        let mut names: HashMap<u32, String> = HashMap::new();
-        let mut seen = HashSet::new();
-        let mut next = header.fat_offset;
-        let mut tables = 0usize;
-        while next != 0 {
-            if !seen.insert(next) {
-                return Err(Error::Malformed("allocation tables form a cycle"));
-            }
-            tables += 1;
-            if tables > MAX_TABLES {
-                return Err(Error::Limit("too many saved revisions"));
-            }
-            let mut c = Cursor::new(bytes, offset(next)?);
-            let tag = c.array::<4>()?;
-            let level = match &tag {
-                b"#FAT" => 1,
-                b"#FT2" => 2,
-                b"#FT3" => 3,
-                b"#FT4" => 4,
-                _ => return Err(Error::Malformed("missing allocation table")),
-            };
-            next = c.u64()?;
-            let date = c.u64()?;
-            c.take(24)?;
-            let files = c.u32()?;
-            c.take(8)?;
-            let dirs = c.u16()?;
-            c.take(1)?;
-            for _ in 0..files {
-                let id = c.u32()?;
-                let flag = c.u8()?;
-                let mut record = None;
-                match flag {
-                    0 | 1 => {
-                        let offset = c.u64()?;
-                        let size = c.u64()?;
-                        let compressed = c.u64()?;
-                        let crc = c.u32()?;
-                        let stored = c.u8()?;
-                        if level >= 2 {
-                            c.take(4)?;
-                        }
-                        if level >= 4 {
-                            c.take(4)?;
-                        }
-                        // Old tables number the methods; newer ones store the method byte itself.
-                        let compression = if level <= 2 {
-                            match stored {
-                                1 => 0x01,
-                                2 => 0x41,
-                                3 => 0x81,
-                                4 => 0xC1,
-                                _ => 0,
-                            }
-                        } else {
-                            stored
-                        };
-                        record = Some(Entry { id, name: String::new(), offset, size, compressed, crc, compression });
-                    }
-                    2 => {}
-                    _ => return Err(Error::Malformed("unknown allocation record")),
-                }
-                if flag == 0 {
-                    let len = usize::from(c.u16()?);
-                    let name = String::from_utf8_lossy(c.take(len)?).into_owned();
-                    names.entry(id).or_insert(name);
-                }
-                // Equal dates: the first table in the chain (the newest) wins, as in afread.
-                let replace = latest.get(&id).is_none_or(|(d, _, _)| date > *d);
-                if replace {
-                    latest.insert(id, (date, tables, record));
-                }
-            }
-            for _ in 0..dirs {
-                let len = usize::from(c.u16()?);
-                c.take(10)?;
-                c.take(len)?;
-            }
-        }
-        let mut entries = HashMap::new();
-        for (id, (_, _, record)) in latest {
-            if let (Some(mut e), Some(name)) = (record, names.get(&id)) {
-                e.name = name.clone();
-                entries.insert(e.name.clone(), e);
-            }
-        }
-        Ok(Self { bytes, header, entries, revisions: tables, extracted: 0, limits })
-    }
-
-    pub fn entry(&self, name: &str) -> Option<&Entry> {
-        self.entries.get(name)
-    }
-
-    pub fn entry_names(&self) -> impl Iterator<Item = &str> {
-        self.entries.keys().map(String::as_str)
-    }
-
-    /// Bytes extracted so far, counted against [`Limits::max_total`].
-    pub fn extracted(&self) -> usize {
-        self.extracted
-    }
-
-    /// Extract an entry by name: decompress, undo the byte predictor and verify the CRC.
-    pub fn read(&mut self, name: &str) -> Result<Vec<u8>, Error> {
-        let e = self.entries.get(name).ok_or(Error::Malformed("missing archive entry"))?.clone();
-        let size = usize::try_from(e.size).map_err(|_| Error::Limit("archive entry too large"))?;
-        if size > self.limits.max_entry {
-            return Err(Error::Limit("archive entry too large"));
-        }
-        let total = self.extracted.checked_add(size).ok_or(Error::Limit("document too large"))?;
-        if total > self.limits.max_total {
-            return Err(Error::Limit("document too large"));
-        }
-        let mut c = Cursor::new(self.bytes, offset(e.offset)?);
-        if c.take(4)? != b"#Fil" {
-            return Err(Error::Malformed("archive entry has no data block"));
-        }
-        let method = e.compression & 3;
-        let stored_len = if matches!(method, 1 | 2) { e.compressed } else { e.size };
-        let data = c.take(offset(stored_len)?)?;
-        let mut out = match method {
-            1 => inflate(data, size)?,
-            2 => unzstd(data, size)?,
-            _ => data.to_vec(),
-        };
-        if out.len() != size {
-            return Err(Error::Malformed("archive entry size mismatch"));
-        }
-        unpredict(&mut out, e.compression)?;
-        if crc32fast::hash(&out) != e.crc {
-            return Err(Error::Malformed("archive entry checksum mismatch"));
-        }
-        self.extracted = total;
-        Ok(out)
-    }
-}
-
-/// Read at most `size + 1` bytes so a stream that decodes past its declared size is caught
-/// without unbounded allocation.
-fn read_bounded(mut r: impl Read, size: usize) -> Result<Vec<u8>, Error> {
-    let mut out = Vec::with_capacity(size.min(64 << 20));
-    let cap = u64::try_from(size).unwrap_or(u64::MAX).saturating_add(1);
-    r.by_ref().take(cap).read_to_end(&mut out).map_err(|_| Error::Malformed("corrupt compressed entry"))?;
-    Ok(out)
-}
-
-fn inflate(data: &[u8], size: usize) -> Result<Vec<u8>, Error> {
-    read_bounded(flate2::read::ZlibDecoder::new(data), size)
-}
-
-fn unzstd(data: &[u8], size: usize) -> Result<Vec<u8>, Error> {
-    let mut src = data;
-    let mut out = Vec::new();
-    // Entries may hold several concatenated frames.
-    while !src.is_empty() {
-        let left = size.checked_sub(out.len()).ok_or(Error::Malformed("archive entry size mismatch"))?;
-        let decoder = ruzstd::decoding::StreamingDecoder::new_with_max_window_size(&mut src, MAX_ZSTD_WINDOW)
-            .map_err(|_| Error::Malformed("corrupt compressed entry"))?;
-        let frame = read_bounded(decoder, left)?;
-        if frame.is_empty() {
-            return Err(Error::Malformed("corrupt compressed entry"));
-        }
-        out.extend_from_slice(&frame);
-        if out.len() > size {
-            return Err(Error::Malformed("archive entry size mismatch"));
-        }
-    }
-    Ok(out)
-}
-
-/// Undo the byte predictor selected by the high bits of the compression byte.
-fn unpredict(b: &mut [u8], compression: u8) -> Result<(), Error> {
-    match (compression & 0xC0, compression & 0x20 != 0) {
-        (0x00, _) => {}
-        (0x40, _) => byte_delta(b),
-        (0x80, false) => {
-            let mut prev = 0u16;
-            for pair in b.as_chunks_mut::<2>().0.iter_mut() {
-                let v = u16::from_le_bytes([pair[0], pair[1]]).wrapping_add(prev);
-                pair.copy_from_slice(&v.to_le_bytes());
-                prev = v;
-            }
-        }
-        (0x80, true) => {
-            byte_delta(b);
-            // A 64 KiB tile of 16-bit samples is stored as all high bytes, then all low bytes.
-            if b.len() == 0x10000 {
-                let planes = b.to_vec();
-                let (hi, lo) = planes.split_at(0x8000);
-                for (i, out) in b.as_chunks_mut::<4>().0.iter_mut().enumerate() {
-                    let (Some(h), Some(l)) = (hi.get(2 * i..2 * i + 2), lo.get(2 * i..2 * i + 2)) else {
-                        return Err(Error::Malformed("tile size"));
-                    };
-                    out.copy_from_slice(&[l[0], h[0], l[1], h[1]]);
-                }
-            }
-        }
-        _ => return Err(Error::Unsupported("archive entry predictor")),
-    }
-    Ok(())
-}
-
-fn byte_delta(b: &mut [u8]) {
-    let mut prev = 0u8;
-    for v in b {
-        *v = v.wrapping_add(prev);
-        prev = *v;
-    }
-}
@@ -1,256 +0,0 @@
-//! Outlines of curves (`PCvD` node lists), parametric shapes (`Shpe` objects) and compounds, in
-//! node space.
-
-use crate::model::{Affine, Path, Point, Reader, SubPath};
-use crate::stream::{ObjId, Tag, Value};
-
-/// Nodes per curve object.
-const MAX_NODES: usize = 4_000_000;
-/// A shared-object stream is bounded, but a compound graph can expand exponentially. Count
-/// each visit and each curve record / generated contour / transformed segment across the whole
-/// outline, including repeated references. Match the document reader's nesting limit.
-const MAX_OUTLINE_DEPTH: usize = 128;
-const MAX_OUTLINE_VISITS: usize = 100_000;
-
-struct OutlineBudget {
-    active: Vec<ObjId>,
-    visits: usize,
-    work: usize,
-    failed: bool,
-}
-
-impl OutlineBudget {
-    fn fail(&mut self, r: &mut Reader, warning: &'static str) -> Option<()> {
-        if !self.failed {
-            r.warn(warning);
-        }
-        self.failed = true;
-        None
-    }
-
-    fn spend(&mut self, r: &mut Reader, work: usize) -> Option<()> {
-        if work > self.work {
-            return self.fail(r, "compound outlines exceeding the geometry work limit");
-        }
-        self.work -= work;
-        Some(())
-    }
-
-    fn path(&mut self, r: &mut Reader, path: &Path) -> Option<()> {
-        for subpath in &path.subpaths {
-            self.spend(r, 1)?;
-            self.spend(r, subpath.segments.len())?;
-        }
-        Some(())
-    }
-}
-
-/// The node-space outline of a curve, shape or compound node, and whether it fills even-odd.
-/// Instances (master-page or symbol copies) take the geometry of their master.
-pub(crate) fn outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine) -> Option<(Path, bool)> {
-    let mut budget = OutlineBudget { active: Vec::new(), visits: MAX_OUTLINE_VISITS, work: MAX_NODES, failed: false };
-    bounded_outline(r, id, class, world, &mut budget)
-}
-
-fn bounded_outline(r: &mut Reader, id: ObjId, class: Tag, world: Affine, budget: &mut OutlineBudget) -> Option<(Path, bool)> {
-    if budget.active.contains(&id) {
-        budget.fail(r, "a compound outline that contains itself")?;
-    }
-    if budget.active.len() >= MAX_OUTLINE_DEPTH {
-        budget.fail(r, "compound outlines nested deeper than 128 levels")?;
-    }
-    if budget.visits == 0 {
-        budget.fail(r, "compound outlines exceeding the operand visit limit")?;
-    }
-    budget.visits -= 1;
-    budget.active.push(id);
-    let result = outline_inner(r, id, class, world, budget);
-    // The popped value is our own stack marker, and is no longer needed.
-    let _ = budget.active.pop();
-    result
-}
-
-fn outline_inner(r: &mut Reader, id: ObjId, class: Tag, world: Affine, budget: &mut OutlineBudget) -> Option<(Path, bool)> {
-    let s = r.s;
-    match &class.0.to_be_bytes() {
-        b"PCrv" | b"TxtC" => {
-            let crvs = s.obj(id, b"Crvs").or_else(|| s.obj(id, b"MCrM").and_then(|m| s.obj(m, b"Crvs")))?;
-            let path = curves(r, crvs, budget)?;
-            budget.path(r, &path)?;
-            let multi = path.subpaths.len() > 1;
-            Some((path, multi))
-        }
-        b"Comp" => {
-            // One path of all the operands' contours in the compound's space, filled even-odd: this
-            // matches add and subtract operands in every public sample; a true union of overlapping
-            // added operands would differ.
-            let mut path = Path::default();
-            for c in s.objs(id, b"Chld") {
-                let local = s.floats::<6>(c, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
-                let class = s.class(c)?;
-                if s.enumeration(c, b"ComO").is_some_and(|(op, _)| op != 0 && op != 2) {
-                    r.warn("compound shapes that intersect or exclude (imported as add)");
-                }
-                let child_world = local.then(world);
-                if !child_world.is_finite() {
-                    budget.fail(r, "a compound operand with an invalid transform")?;
-                }
-                if let Some((mut p, _)) = bounded_outline(r, c, class, child_world, budget) {
-                    // Charge before transforming or extending. Transform the owned path in place
-                    // so nested compounds do not make an additional copy of every contour.
-                    budget.path(r, &p)?;
-                    for subpath in &mut p.subpaths {
-                        subpath.start = local.apply(subpath.start);
-                        for segment in &mut subpath.segments {
-                            *segment = segment.map(|point| local.apply(point));
-                        }
-                    }
-                    path.subpaths.extend(p.subpaths);
-                } else if budget.failed {
-                    // Never present a partial compound as complete after a cycle or budget limit.
-                    return None;
-                }
-            }
-            Some((path, true))
-        }
-        _ => {
-            let (shape, box_owner) = match s.obj(id, b"Shpe") {
-                Some(sh) => (sh, id),
-                None => {
-                    let master = s.obj(id, b"ShpM")?;
-                    (s.obj(master, b"Shpe")?, master)
-                }
-            };
-            let b = s.floats::<4>(box_owner, b"ShpB")?;
-            let path = crate::shapes::shape(r, shape, b, world)?;
-            budget.path(r, &path)?;
-            Some((path, false))
-        }
-    }
-}
-
-/// `PCvD.Data`: positional `[u8, u32 count, then per subpath: bool closed, 18-byte records]`.
-/// A record is (f64 x, f64 y, u8 kind, u8 role): role 0 is an anchor, 1 the out-handle of the
-/// anchor before it, 2 the in-handle of the anchor after it. A closed subpath repeats its first
-/// anchor at the end. `CnrD` live corners are rounded on the stored polyline.
-fn curves(r: &mut Reader, crvs: ObjId, budget: &mut OutlineBudget) -> Option<Path> {
-    let s = r.s;
-    let data = s.obj(crvs, b"Data")?;
-    let mut fields = s.positional(data);
-    fields.next()?;
-    let count = match fields.next()? {
-        Value::UInt(n) => usize::try_from(*n).ok()?,
-        _ => return None,
-    };
-    budget.spend(r, count)?;
-    let corners = s.obj(crvs, b"CnrD").and_then(|c| corner_radii(s.positional(c).collect()));
-    let mut path = Path::default();
-    let mut seen = 0usize;
-    for index in 0..count {
-        let closed = match fields.next()? {
-            Value::Bool(b) => *b,
-            _ => return None,
-        };
-        let Value::Array(records) = fields.next()? else { return None };
-        seen = seen.checked_add(records.len())?;
-        if seen > MAX_NODES {
-            budget.fail(r, "curves with more than four million nodes")?;
-        }
-        budget.spend(r, records.len())?;
-        let anchors = anchors(records)?;
-        let radii = if index == 0 { corners.as_ref() } else { None };
-        if let Some(sp) = subpath(&anchors, closed, radii) {
-            path.subpaths.push(sp);
-        }
-    }
-    if corners.is_some() && count > 1 {
-        r.warn("rounded corners on curves with several subpaths (only the first is rounded)");
-    }
-    Some(path)
-}
-
-struct Anchor {
-    p: Point,
-    inh: Option<Point>,
-    out: Option<Point>,
-    /// Index of the anchor's record (live corners refer to records).
-    record: usize,
-}
-
-fn record(v: &Value) -> Option<(Point, u8)> {
-    let Value::Bytes(b) = v else { return None };
-    if b.len() != 18 {
-        return None;
-    }
-    let x = f64::from_le_bytes(b.get(0..8)?.try_into().ok()?);
-    let y = f64::from_le_bytes(b.get(8..16)?.try_into().ok()?);
-    if !x.is_finite() || !y.is_finite() {
-        return None;
-    }
-    Some((Point { x, y }, *b.get(17)?))
-}
-
-fn anchors(records: &[Value]) -> Option<Vec<Anchor>> {
-    let mut out: Vec<Anchor> = Vec::with_capacity(records.len() / 3 + 1);
-    let mut pending_in = None;
-    for (i, v) in records.iter().enumerate() {
-        let (p, role) = record(v)?;
-        match role {
-            0 => {
-                out.push(Anchor { p, inh: pending_in.take(), out: None, record: i });
-            }
-            1 => {
-                // A leading out-handle without an anchor is edit state only.
-                if let Some(a) = out.last_mut() {
-                    a.out = Some(p);
-                }
-            }
-            2 => pending_in = Some(p),
-            _ => return None,
-        }
-    }
-    Some(out)
-}
-
-fn subpath(anchors: &[Anchor], closed: bool, radii: Option<&Vec<(usize, f64)>>) -> Option<SubPath> {
-    let first = anchors.first()?;
-    if let Some(radii) = radii.filter(|r| !r.is_empty()) {
-        let corner = |a: &Anchor| radii.iter().filter(|(rec, _)| *rec == a.record).map(|(_, r)| *r).fold(0.0, f64::max);
-        let polyline = anchors.iter().all(|a| a.inh.is_none_or(|h| h == a.p) && a.out.is_none_or(|h| h == a.p));
-        if polyline {
-            let mut pts: Vec<(Point, f64)> = anchors.iter().map(|a| (a.p, corner(a))).collect();
-            // A closed subpath repeats its first anchor; its radius may be on either copy.
-            if closed
-                && pts.len() > 1
-                && pts.first().map(|p| p.0) == pts.last().map(|p| p.0)
-                && let Some((_, r)) = pts.pop()
-                && let Some(f) = pts.first_mut()
-            {
-                f.1 = f.1.max(r);
-            }
-            return Some(crate::shapes::fillet(&pts, closed));
-        }
-    }
-    let segments = anchors
-        .windows(2)
-        .filter_map(|w| {
-            let [a, b] = w else { return None };
-            Some([a.out.unwrap_or(a.p), b.inh.unwrap_or(b.p), b.p])
-        })
-        .collect();
-    Some(SubPath { start: first.p, segments, closed })
-}
-
-/// `CnrD`: positional `[u8, i32[] record indices, f64[] radii, u8[] types]`.
-fn corner_radii(fields: Vec<&Value>) -> Option<Vec<(usize, f64)>> {
-    let (Some(Value::Array(idx)), Some(Value::Array(rad))) = (fields.get(1), fields.get(2)) else { return None };
-    Some(
-        idx.iter()
-            .zip(rad)
-            .filter_map(|(i, r)| match (i, r) {
-                (Value::Int(i), Value::Float(r)) if r.is_finite() && *r > 0.0 => Some((usize::try_from(*i).ok()?, *r)),
-                _ => None,
-            })
-            .collect(),
-    )
-}
@@ -1,51 +0,0 @@
-//! Reader for native Affinity documents (`.af`, and `.afdesign`/`.afphoto`/`.afpub` from
-//! Affinity 1 and 2): the archive container, the tagged object stream in `doc.dat`, and the
-//! subset of the document model VectorCraft imports.
-//!
-//! Layouts follow the MIT-licensed afread reference and were checked against public documents
-//! saved by Affinity 1.x to 3.x (container versions 8 to 12); see the crate README for provenance
-//! and the exact supported subset. Nothing here writes Affinity files.
-#![forbid(unsafe_code)]
-#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
-
-use std::fmt;
-
-mod access;
-pub mod container;
-mod geometry;
-pub mod model;
-pub mod paint;
-pub mod preview;
-mod raster;
-mod shapes;
-pub mod stream;
-#[cfg(any(test, feature = "synth"))]
-pub mod synth;
-mod text;
-
-pub use container::{Archive, Limits, MAGIC, is_affinity};
-pub use model::{Document, read};
-pub use preview::{MAX_PREVIEW_BYTES, MAX_PREVIEW_DIMENSION, Preview, preview};
-
-/// Why a file could not be read. Messages are short reasons; callers add advice.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Error {
-    Malformed(&'static str),
-    Unsupported(&'static str),
-    Limit(&'static str),
-}
-
-impl fmt::Display for Error {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Malformed(s) => write!(f, "damaged Affinity file: {s}"),
-            Self::Unsupported(s) => write!(f, "unsupported Affinity file: {s}"),
-            Self::Limit(s) => write!(f, "Affinity file exceeds a safety limit: {s}"),
-        }
-    }
-}
-
-impl std::error::Error for Error {}
-
-#[cfg(test)]
-mod tests;
@@ -1,618 +0,0 @@
-//! The document model VectorCraft imports: spreads, artboards, layers, groups, curves, shapes,
-//! text and images, with transforms composed into document space. Anything else is reported
-//! by [`Document::warnings`] instead of being dropped silently.
-
-use std::collections::{BTreeMap, HashSet};
-
-use crate::paint::{self, Paint, Stroke};
-use crate::stream::{ObjId, Stream, Tag};
-use crate::{Archive, Error, Limits, stream};
-
-/// Affine map `x' = a·x + c·y + e`, `y' = b·x + d·y + f` (kurbo's coefficient order).
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct Affine(pub [f64; 6]);
-
-impl Affine {
-    pub const IDENTITY: Self = Self([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]);
-
-    /// Affinity's `Xfrm`, stored row by row: (a, c, e, b, d, f).
-    pub(crate) fn from_xfrm(m: [f64; 6]) -> Self {
-        Self([m[0], m[3], m[1], m[4], m[2], m[5]])
-    }
-
-    pub fn then(self, outer: Self) -> Self {
-        let [a, b, c, d, e, f] = self.0;
-        let [oa, ob, oc, od, oe, of] = outer.0;
-        Self([oa * a + oc * b, ob * a + od * b, oa * c + oc * d, ob * c + od * d, oa * e + oc * f + oe, ob * e + od * f + of])
-    }
-
-    pub fn apply(&self, p: Point) -> Point {
-        let [a, b, c, d, e, f] = self.0;
-        Point { x: a * p.x + c * p.y + e, y: b * p.x + d * p.y + f }
-    }
-
-    /// Geometric mean of the axis scales: how much a stroke width or font size grows.
-    pub fn scale(&self) -> f64 {
-        let [a, b, c, d, ..] = self.0;
-        (a * d - b * c).abs().sqrt()
-    }
-
-    pub fn is_finite(&self) -> bool {
-        self.0.iter().all(|v| v.is_finite())
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct Point {
-    pub x: f64,
-    pub y: f64,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct Rect {
-    pub x0: f64,
-    pub y0: f64,
-    pub x1: f64,
-    pub y1: f64,
-}
-
-/// One cubic Bézier subpath, in document pixels.
-#[derive(Debug, Clone, PartialEq)]
-pub struct SubPath {
-    pub start: Point,
-    /// (control 1, control 2, end) per segment.
-    pub segments: Vec<[Point; 3]>,
-    pub closed: bool,
-}
-
-/// An outline in document pixels.
-#[derive(Debug, Clone, Default, PartialEq)]
-pub struct Path {
-    pub subpaths: Vec<SubPath>,
-}
-
-impl Path {
-    pub fn transformed(&self, m: Affine) -> Self {
-        Self {
-            subpaths: self
-                .subpaths
-                .iter()
-                .map(|s| SubPath {
-                    start: m.apply(s.start),
-                    segments: s.segments.iter().map(|seg| seg.map(|p| m.apply(p))).collect(),
-                    closed: s.closed,
-                })
-                .collect(),
-        }
-    }
-}
-
-/// Affinity's blend modes, numbered by the `Blnd` enum.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
-pub enum Blend {
-    #[default]
-    Normal,
-    PassThrough,
-    Darken,
-    DarkerColor,
-    Multiply,
-    ColorBurn,
-    Lighten,
-    LighterColor,
-    Screen,
-    ColorDodge,
-    Add,
-    Overlay,
-    SoftLight,
-    HardLight,
-    VividLight,
-    PinLight,
-    LinearLight,
-    HardMix,
-    Difference,
-    Exclusion,
-    Subtract,
-    Hue,
-    Saturation,
-    Luminosity,
-    Color,
-    Average,
-    Negation,
-    Reflect,
-    Glow,
-    Erase,
-}
-
-impl Blend {
-    /// The enum (id, version) pairs observed in a document whose layers are named after their mode.
-    fn from_enum(id: u16, version: u16) -> Option<Self> {
-        use Blend::*;
-        Some(match (id, version) {
-            (0, _) => Normal,
-            (1, 0) => Darken,
-            (2, 1) => DarkerColor,
-            (2, 0) => Multiply,
-            (3, 0) => ColorBurn,
-            (4, 0) => Lighten,
-            (6, 1) => LighterColor,
-            (5, 0) => Screen,
-            (6, 0) => ColorDodge,
-            (7, 0) => Add,
-            (8, 0) => Overlay,
-            (9, 0) => SoftLight,
-            (10, 0) => HardLight,
-            (11, 0) => VividLight,
-            (12, 0) => PinLight,
-            (15, 1) => LinearLight,
-            (13, 0) => HardMix,
-            (14, 0) => Difference,
-            (15, 0) => Exclusion,
-            (16, 0) => Subtract,
-            (17, 0) => Hue,
-            (18, 0) => Saturation,
-            (19, 0) => Luminosity,
-            (20, 0) => Color,
-            (21, 0) => Average,
-            (22, 0) => Negation,
-            (23, 0) => Reflect,
-            (24, 0) => Glow,
-            (25, 0) => Erase,
-            _ => return None,
-        })
-    }
-}
-
-/// A run of text with one set of character attributes.
-#[derive(Debug, Clone, PartialEq)]
-pub struct TextRun {
-    pub text: String,
-    /// PostScript name and family of the chosen font.
-    pub postscript: String,
-    pub family: String,
-    /// CSS weight (400 regular, 700 bold).
-    pub weight: i64,
-    pub italic: bool,
-    /// Boolean OpenType feature overrides, as tags or `-tag` for disabled features.
-    pub features: Vec<String>,
-    pub all_caps: bool,
-    /// Font size in document pixels, before the node's transform.
-    pub size: f64,
-    /// Tracking in em.
-    pub tracking: f64,
-    /// Fixed line pitch in document pixels, when the run overrides automatic leading.
-    pub leading: Option<f64>,
-    pub fill: Paint,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Align {
-    Left,
-    Center,
-    Right,
-    Justify,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Text {
-    pub runs: Vec<TextRun>,
-    pub align: Align,
-    /// Artistic text: the first baseline's anchor point in node space (start, centre or end of the
-    /// line according to `align`). Frame text: the frame box in node space.
-    pub anchor: Point,
-    pub frame: Option<Rect>,
-    /// Node space to document pixels.
-    pub transform: Affine,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub enum Pixels {
-    /// Straight-alpha RGBA, 8 bits per channel, row by row.
-    Rgba8(Vec<u8>),
-    /// The original file a placed image was made from (PNG, JPEG…), as embedded.
-    Encoded(Vec<u8>),
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Image {
-    pub width: u32,
-    pub height: u32,
-    pub pixels: Pixels,
-    /// Pixel space (0..w, 0..h) to document pixels.
-    pub transform: Affine,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub enum Kind {
-    /// Layer container (`Scop`).
-    Layer,
-    Group,
-    /// Artboard: an export rectangle and vector outline that clips its children.
-    /// `background` paints behind them, and `strokes` over them.
-    Artboard {
-        rect: Rect,
-        /// Actual clipping outline in document pixels. The artboard's export rectangle is its
-        /// bounding box, but a rotated or non-rectangular board still clips to this outline.
-        path: Path,
-        even_odd: bool,
-        background: Vec<Paint>,
-        strokes: Vec<Stroke>,
-    },
-    /// Curve, parametric shape or compound shape: an outline with its fills and strokes.
-    /// Children of a shape are clipped by its outline (painted over its fills, under its strokes).
-    Shape {
-        path: Path,
-        fills: Vec<Paint>,
-        strokes: Vec<Stroke>,
-        even_odd: bool,
-    },
-    Text(Text),
-    Image(Image),
-    /// Something this reader does not import; its children are still imported.
-    Unsupported,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Node {
-    pub class: Tag,
-    pub name: String,
-    pub visible: bool,
-    pub locked: bool,
-    pub opacity: f64,
-    pub blend: Blend,
-    pub kind: Kind,
-    /// Vector mask in document pixels: the node shows only inside it (nonzero fill).
-    pub mask: Option<Path>,
-    /// Pixel mask: grey levels (white shows the node, black hides it); outside it the node is hidden.
-    pub pixel_mask: Option<Image>,
-    /// Bottom to top.
-    pub children: Vec<Node>,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Spread {
-    /// Spread bounds in document pixels (the canvas, or the union of the artboards).
-    pub bounds: Rect,
-    /// Pages of a Publisher-style spread (one, or two facing pages), in document pixels.
-    pub pages: Vec<Rect>,
-    /// Transparent background; otherwise the page is white.
-    pub transparent: bool,
-    /// Bottom to top.
-    pub nodes: Vec<Node>,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Document {
-    /// Pixels per inch: all geometry is in document pixels at this resolution.
-    pub dpi: f64,
-    pub spreads: Vec<Spread>,
-    /// Application that last saved the file, as stored (`Affinity 3.0.2`), when present.
-    pub saved_by: Option<String>,
-    /// Content that was not imported or was approximated, one line per kind, deduplicated.
-    pub warnings: Vec<String>,
-}
-
-/// Deepest layer nesting followed; deeper content is reported, not imported.
-const MAX_TREE_DEPTH: usize = 128;
-/// Total layer nodes imported.
-const MAX_NODES: usize = 500_000;
-
-/// Read a document: archive, `doc.dat` and the model.
-pub fn read(bytes: &[u8], limits: Limits) -> Result<Document, Error> {
-    let mut archive = Archive::open(bytes, limits)?;
-    let doc = archive.read("doc.dat")?;
-    let s = stream::parse(&doc)?;
-    Reader::new(&s, &mut archive).document()
-}
-
-pub(crate) struct Reader<'s, 'a, 'b> {
-    pub(crate) s: &'s Stream,
-    pub(crate) archive: &'b mut Archive<'a>,
-    pub(crate) dpi: f64,
-    warnings: BTreeMap<String, usize>,
-    nodes: usize,
-    active: HashSet<ObjId>,
-}
-
-impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
-    fn new(s: &'s Stream, archive: &'b mut Archive<'a>) -> Self {
-        Self { s, archive, dpi: 72.0, warnings: BTreeMap::new(), nodes: 0, active: HashSet::new() }
-    }
-
-    pub(crate) fn warn(&mut self, what: impl Into<String>) {
-        *self.warnings.entry(what.into()).or_default() += 1;
-    }
-
-    fn document(mut self) -> Result<Document, Error> {
-        let s = self.s;
-        let root = s.root;
-        self.dpi = s.obj(root, b"UVCn").and_then(|u| s.f64(u, b"UPPI")).filter(|d| *d > 0.0 && *d < 100_000.0).unwrap_or(72.0);
-        let saved_by = s.obj(root, b"NVer").map(|v| {
-            let product = s.str(v, b"Prod").unwrap_or("Affinity");
-            match (s.int(v, b"Majr"), s.int(v, b"Minr"), s.int(v, b"Bild")) {
-                (Some(a), Some(b), Some(c)) => format!("{product} {a}.{b}.{c}"),
-                _ => product.to_string(),
-            }
-        });
-        let doc = s.obj(root, b"DocR").ok_or(Error::Malformed("document has no root node"))?;
-        let mut spreads = Vec::new();
-        for spread in s.objs(doc, b"Chld") {
-            if !s.is(spread, b"Sprd") {
-                self.warn("an unknown kind of page");
-                continue;
-            }
-            let pages = pages(s, spread);
-            let default_size =
-                s.floats::<2>(doc, b"DfSz").filter(|[w, h]| *w > 0.0 && *h > 0.0).map(|[w, h]| Rect { x0: 0.0, y0: 0.0, x1: w, y1: h });
-            let bounds = s.floats::<4>(spread, b"SprB").map(rect).or_else(|| pages.iter().copied().reduce(union)).or(default_size).unwrap_or(Rect {
-                x0: 0.0,
-                y0: 0.0,
-                x1: 0.0,
-                y1: 0.0,
-            });
-            let transparent = s.bool(spread, b"SprT").unwrap_or(false);
-            let (nodes, mask) = self.children(spread, Affine::IDENTITY, 0)?;
-            if mask.is_some() {
-                self.warn("mask layers directly on a page (imported without them)");
-            }
-            spreads.push(Spread { bounds, pages, transparent, nodes });
-        }
-        if spreads.is_empty() {
-            return Err(Error::Malformed("document has no pages"));
-        }
-        if !s.objs(doc, b"MpCh").is_empty() {
-            self.warn("master pages (their content is not placed on the pages that use them)");
-        }
-        let warnings = self.warnings.into_iter().map(|(w, n)| if n > 1 { format!("{w} ({n}×)") } else { w }).collect();
-        Ok(Document { dpi: self.dpi, spreads, saved_by, warnings })
-    }
-
-    /// The children of `parent`, and the pixel mask a mask layer among them puts on the parent.
-    fn children(&mut self, parent: ObjId, world: Affine, depth: usize) -> Result<(Vec<Node>, Option<Image>), Error> {
-        let s = self.s;
-        let mut out = Vec::new();
-        let mut mask = None;
-        for c in s.objs(parent, b"Chld") {
-            if s.is(c, b"MRst") {
-                // A mask layer inside a group or layer masks that container.
-                if s.bool(c, b"Visi") == Some(false) {
-                    continue;
-                }
-                let local = s.floats::<6>(c, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
-                match crate::raster::mask(self, c, local.then(world))? {
-                    Some(m) if mask.is_none() => mask = Some(m),
-                    Some(_) => self.warn("several pixel masks on one layer (only the first is used)"),
-                    None => {}
-                }
-                continue;
-            }
-            if let Some(n) = self.node(c, world, depth + 1)? {
-                out.push(n);
-            }
-        }
-        Ok((out, mask))
-    }
-
-    fn node(&mut self, id: ObjId, parent: Affine, depth: usize) -> Result<Option<Node>, Error> {
-        let s = self.s;
-        if depth > MAX_TREE_DEPTH {
-            self.warn("layers nested deeper than 128 levels");
-            return Ok(None);
-        }
-        self.nodes += 1;
-        if self.nodes > MAX_NODES {
-            return Err(Error::Limit("too many layers"));
-        }
-        // A node that contains itself (a shared object linked back into its own subtree).
-        if !self.active.insert(id) {
-            self.warn("a layer that contains itself");
-            return Ok(None);
-        }
-        let local = s.floats::<6>(id, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
-        let world = local.then(parent);
-        let class = s.class(id).unwrap_or(Tag(0));
-        let name = s.str(id, b"Desc").unwrap_or_default().to_string();
-        let visible = s.bool(id, b"Visi").unwrap_or(true);
-        let locked = s.bool(id, b"Edtb").is_some_and(|e| !e);
-        let opacity = s.f64(id, b"Opac").map_or(1.0, |o| o.clamp(0.0, 1.0));
-        let blend = match s.enumeration(id, b"Blnd") {
-            None if s.bool(id, b"PasT") != Some(false) && is_container(class) => Blend::PassThrough,
-            None => Blend::Normal,
-            Some((i, v)) => Blend::from_enum(i, v).unwrap_or_else(|| {
-                self.warn("an unknown blend mode (imported as Normal)");
-                Blend::Normal
-            }),
-        };
-        let kind = if !world.is_finite() {
-            self.warn("a layer with an invalid transform");
-            Kind::Unsupported
-        } else {
-            self.kind(id, class, world, parent)?
-        };
-        // A compound's children are its operands, already merged into its outline.
-        let (children, child_mask) = if class == Tag::of(b"Comp") { (Vec::new(), None) } else { self.children(id, world, depth)? };
-        let (mask, attached_mask) = self.attached_masks(id, world)?;
-        let pixel_mask = attached_mask.or(child_mask);
-        self.active.remove(&id);
-        if s.objs(id, b"FiEf").iter().any(|e| s.bool(*e, b"Enab") != Some(false)) {
-            self.warn("layer effects (shadows, glows, outlines, bevels…)");
-        }
-        Ok(Some(Node { class, name, visible, locked, opacity, blend, kind, mask, pixel_mask, children }))
-    }
-
-    fn kind(&mut self, id: ObjId, class: Tag, world: Affine, parent: Affine) -> Result<Kind, Error> {
-        let s = self.s;
-        Ok(match &class.0.to_be_bytes() {
-            b"Scop" => Kind::Layer,
-            b"Grup" => Kind::Group,
-            b"PCrv" | b"ShpN" | b"Comp" | b"SNEN" | b"SNRR" | b"ShRN" => {
-                // Affinity 3.2.3's two-board public fixture marks board shapes with an `aprp`
-                // property object in `phrp`, while older documents use `ABEn`. Ordinary shapes
-                // in that fixture have neither. See the pinned corpus and validation audit.
-                if s.bool(id, b"ABEn") == Some(true) || s.obj(id, b"phrp").is_some_and(|p| s.is(p, b"aprp")) {
-                    return Ok(self.artboard(id, world));
-                }
-                let Some((local, even_odd)) = crate::geometry::outline(self, id, class, world) else {
-                    self.warn(format!("a {} that could not be read", describe(class)));
-                    return Ok(Kind::Unsupported);
-                };
-                let (fills, strokes) = paint::node_paint(self, id, world);
-                Kind::Shape { path: local.transformed(world), fills, strokes, even_odd }
-            }
-            b"TxtA" | b"TxtF" | b"TxtC" => match crate::text::read(self, id, world) {
-                Some(t) => Kind::Text(t),
-                None => {
-                    self.warn("text whose story could not be read (master-page text, or an unknown layout)");
-                    Kind::Unsupported
-                }
-            },
-            b"ImgN" | b"Rstr" => match crate::raster::node_image(self, id, world)? {
-                Some(img) => Kind::Image(img),
-                None => Kind::Unsupported,
-            },
-            b"EmbN" => match crate::raster::embedded(self, id, world)? {
-                Some(img) => {
-                    self.warn("embedded documents and symbols (imported as pictures of them)");
-                    Kind::Image(img)
-                }
-                None => {
-                    self.warn("embedded documents and symbols without a cached picture");
-                    Kind::Unsupported
-                }
-            },
-            b"FRst" => {
-                // A fill layer paints its whole bitmap area; its gradient lives in page space.
-                let b = s.obj(id, b"Bitm");
-                let size = |t: &[u8; 4]| b.and_then(|b| s.int(b, t)).map(|v| v as f64).filter(|v| *v > 0.0);
-                match (size(b"BmpW"), size(b"BmpH")) {
-                    (Some(w), Some(h)) => {
-                        let local = Path { subpaths: vec![crate::shapes::rectangle(0.0, 0.0, w, h)] };
-                        let fills = paint::fills(self, id, parent, b"BFFl");
-                        Kind::Shape { path: local.transformed(world), fills, strokes: Vec::new(), even_odd: false }
-                    }
-                    _ => {
-                        self.warn("fill layers without an area");
-                        Kind::Unsupported
-                    }
-                }
-            }
-            _ => {
-                self.warn(format!("{} layers", describe(class)));
-                Kind::Unsupported
-            }
-        })
-    }
-
-    /// Vector shapes attached to a node (`AdCh`) mask it: it shows only inside their outlines;
-    /// an attached mask layer is a pixel mask. Adjustments attached the same way are reported.
-    fn attached_masks(&mut self, id: ObjId, world: Affine) -> Result<(Option<Path>, Option<Image>), Error> {
-        let s = self.s;
-        let attached = s.objs(id, b"AdCh");
-        let mut mask: Option<Path> = None;
-        let mut pixels: Option<Image> = None;
-        for a in attached {
-            let class = s.class(a).unwrap_or(Tag(0));
-            if s.bool(a, b"Visi") == Some(false) {
-                continue;
-            }
-            if class == Tag::of(b"PCrv") || class == Tag::of(b"ShpN") || class == Tag::of(b"Comp") {
-                let local = s.floats::<6>(a, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY).then(world);
-                if let Some((p, _)) = crate::geometry::outline(self, a, class, local) {
-                    mask.get_or_insert_with(Path::default).subpaths.extend(p.transformed(local).subpaths);
-                }
-            } else if class == Tag::of(b"MRst") {
-                let local = s.floats::<6>(a, b"Xfrm").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY).then(world);
-                match crate::raster::mask(self, a, local)? {
-                    Some(m) if pixels.is_none() => pixels = Some(m),
-                    Some(_) => self.warn("several pixel masks on one layer (only the first is used)"),
-                    None => {}
-                }
-            } else {
-                self.warn(format!("{} layers attached to other layers (imported without them)", describe(class)));
-            }
-        }
-        Ok((mask, pixels))
-    }
-
-    fn artboard(&mut self, id: ObjId, world: Affine) -> Kind {
-        let s = self.s;
-        let Some(b) = s.floats::<4>(id, b"ShpB").map(rect).filter(|b| b.x1 > b.x0 && b.y1 > b.y0) else {
-            self.warn("an artboard without valid bounds (its children are kept without clipping)");
-            return Kind::Unsupported;
-        };
-        let corners =
-            [Point { x: b.x0, y: b.y0 }, Point { x: b.x1, y: b.y0 }, Point { x: b.x1, y: b.y1 }, Point { x: b.x0, y: b.y1 }].map(|p| world.apply(p));
-        let [a, b2, c, d, ..] = world.0;
-        if b2.abs() > 1e-9 || c.abs() > 1e-9 || a <= 0.0 || d <= 0.0 {
-            self.warn("a rotated or flipped artboard (export bounds are its bounding box; artwork keeps its outline)");
-        }
-        let xs = corners.map(|p| p.x);
-        let ys = corners.map(|p| p.y);
-        let rect = Rect {
-            x0: xs.iter().copied().fold(f64::INFINITY, f64::min),
-            y0: ys.iter().copied().fold(f64::INFINITY, f64::min),
-            x1: xs.iter().copied().fold(f64::NEG_INFINITY, f64::max),
-            y1: ys.iter().copied().fold(f64::NEG_INFINITY, f64::max),
-        };
-        if ![rect.x0, rect.y0, rect.x1, rect.y1].iter().all(|v| v.is_finite()) || rect.x1 <= rect.x0 || rect.y1 <= rect.y0 {
-            self.warn("an artboard with an invalid transformed size (its children are kept without clipping)");
-            return Kind::Unsupported;
-        }
-        let class = s.class(id).unwrap_or(Tag::of(b"ShpN"));
-        let (path, even_odd) = crate::geometry::outline(self, id, class, world).unwrap_or_else(|| {
-            self.warn("an artboard whose outline could not be read (clipped to its rectangle)");
-            (Path { subpaths: vec![crate::shapes::rectangle(b.x0, b.y0, b.x1, b.y1)] }, false)
-        });
-        let (background, strokes) = paint::node_paint(self, id, world);
-        Kind::Artboard { rect, path: path.transformed(world), even_odd, background, strokes }
-    }
-}
-
-/// Page rectangles: `SpMd.PagR[].rctp` (Publisher 2, Affinity 3) or `SprB` split into `PagC`
-/// equal pages (Publisher 1 facing spreads).
-fn pages(s: &Stream, spread: ObjId) -> Vec<Rect> {
-    if let Some(md) = s.obj(spread, b"SpMd") {
-        let v: Vec<Rect> =
-            s.objs(md, b"PagR").into_iter().filter_map(|p| s.floats::<4>(p, b"rctp").map(rect)).filter(|r| r.x1 > r.x0 && r.y1 > r.y0).collect();
-        if !v.is_empty() {
-            return v;
-        }
-    }
-    match (s.floats::<4>(spread, b"SprB").map(rect), s.int(spread, b"PagC")) {
-        (Some(b), Some(n @ 2..=16)) => {
-            let w = (b.x1 - b.x0) / n as f64;
-            (0..n).map(|i| Rect { x0: b.x0 + w * i as f64, x1: b.x0 + w * (i + 1) as f64, ..b }).collect()
-        }
-        _ => Vec::new(),
-    }
-}
-
-pub(crate) fn union(a: Rect, b: Rect) -> Rect {
-    Rect { x0: a.x0.min(b.x0), y0: a.y0.min(b.y0), x1: a.x1.max(b.x1), y1: a.y1.max(b.y1) }
-}
-
-fn is_container(class: Tag) -> bool {
-    class == Tag::of(b"Scop") || class == Tag::of(b"Grup")
-}
-
-pub(crate) fn rect(v: [f64; 4]) -> Rect {
-    Rect { x0: v[0], y0: v[1], x1: v[2], y1: v[3] }
-}
-
-/// A readable name for a layer class in warnings.
-pub(crate) fn describe(class: Tag) -> &'static str {
-    match &class.0.to_be_bytes() {
-        b"PCrv" => "curve",
-        b"ShpN" | b"SNEN" | b"SNRR" | b"ShRN" => "shape",
-        b"Comp" => "compound",
-        b"Rstr" => "pixel",
-        b"ImgN" => "image",
-        b"EmbN" => "embedded document",
-        b"MPIN" => "master page instance",
-        b"FRst" => "fill",
-        b"MRst" => "mask",
-        b"Slic" | b"SlcP" => "slice",
-        b"3DLA" => "3D",
-        [_, _, b'R', b'A'] => "adjustment",
-        _ => "unknown",
-    }
-}
@@ -1,329 +0,0 @@
-//! Fills, strokes and colours. Two schemas exist: Affinity 1 (`BFil` fill, `PFil` stroke paint,
-//! `LSty` stroke style) and Affinity 2/3 (`BFFl`, `LIFl` and `LILn` lists with a current index).
-
-use crate::model::{Affine, Reader};
-use crate::stream::{ObjId, Value};
-
-/// A colour as stored: RGB and grey values are encoded in the document's RGB space (sRGB unless
-/// the document embeds another profile), CMYK values go through its CMYK profile. Alpha is straight.
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub enum Color {
-    Rgb {
-        r: f64,
-        g: f64,
-        b: f64,
-        a: f64,
-    },
-    Cmyk {
-        c: f64,
-        m: f64,
-        y: f64,
-        k: f64,
-        a: f64,
-    },
-    Gray {
-        v: f64,
-        a: f64,
-    },
-    /// CIE L*a*b* (D50).
-    Lab {
-        l: f64,
-        a: f64,
-        b: f64,
-        alpha: f64,
-    },
-}
-
-impl Color {
-    pub fn alpha(&self) -> f64 {
-        match self {
-            Color::Rgb { a, .. } | Color::Cmyk { a, .. } | Color::Gray { a, .. } => *a,
-            Color::Lab { alpha, .. } => *alpha,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum GradientKind {
-    Linear,
-    /// Elliptical and radial: distance from the centre in unit space.
-    Radial,
-    /// Angle around the centre.
-    Conical,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct Stop {
-    pub offset: f64,
-    pub color: Color,
-    /// Affinity's midpoint bias for the segment from this stop to the next (0.5 = even blend).
-    pub bias: f64,
-}
-
-impl Stop {
-    /// Where, between this stop (0) and the next (1), the blend reaches half way: the bias curve
-    /// fitted to Affinity's renders is `t^k` (bias ≥ 0.5) or `1-(1-t)^k`, with `k = 1 + 8·|bias-0.5|`.
-    pub fn half_point(&self) -> f64 {
-        let k = 1.0 + 8.0 * (self.bias - 0.5).abs();
-        let h = 0.5f64.powf(1.0 / k);
-        if self.bias >= 0.5 { h } else { 1.0 - h }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Gradient {
-    pub kind: GradientKind,
-    pub stops: Vec<Stop>,
-    /// Unit space to document pixels: linear runs from unit (0,0) to (1,0); radial is the unit
-    /// circle; conical starts along unit +x and turns towards unit +y.
-    pub transform: Affine,
-}
-
-#[derive(Debug, Clone, PartialEq, Default)]
-pub enum Paint {
-    #[default]
-    None,
-    Solid(Color),
-    Gradient(Gradient),
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Cap {
-    Butt,
-    Round,
-    Square,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Join {
-    Miter,
-    Round,
-    Bevel,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Align {
-    Center,
-    Inside,
-    Outside,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Stroke {
-    pub paint: Paint,
-    /// Width in document pixels.
-    pub width: f64,
-    pub cap: Cap,
-    pub join: Join,
-    pub miter_limit: f64,
-    pub align: Align,
-    /// Dash and gap lengths in document pixels, and the phase.
-    pub dash: Option<(Vec<f64>, f64)>,
-    /// Painted below the fill instead of above it.
-    pub behind: bool,
-}
-
-/// Gradient stops per gradient.
-const MAX_STOPS: usize = 1024;
-
-fn floats(v: &Value) -> Option<Vec<f64>> {
-    match v {
-        Value::Floats(f) => Some(f.clone()),
-        Value::Bytes(b) if b.len() % 4 == 0 => Some(b.as_chunks::<4>().0.iter().map(|c| f64::from(f32::from_le_bytes(*c))).collect()),
-        _ => None,
-    }
-}
-
-/// A colour object (`RGBA`, `HSLA`, `CMYK`, `GRAY`, `LABA`, `Pant`).
-pub(crate) fn color(r: &mut Reader, id: ObjId) -> Option<Color> {
-    let s = r.s;
-    let class = s.class(id)?;
-    let col = || -> Option<Vec<f64>> {
-        let v = floats(s.field(id, b"_col")?)?;
-        v.iter().all(|f| f.is_finite()).then_some(v)
-    };
-    Some(match &class.0.to_be_bytes() {
-        b"RGBA" => {
-            let v = col()?;
-            Color::Rgb { r: *v.first()?, g: *v.get(1)?, b: *v.get(2)?, a: v.get(3)?.clamp(0.0, 1.0) }
-        }
-        b"HSLA" => {
-            let v = col()?;
-            let (r2, g, b) = hsl(*v.first()?, *v.get(1)?, *v.get(2)?);
-            Color::Rgb { r: r2, g, b, a: v.get(3)?.clamp(0.0, 1.0) }
-        }
-        b"CMYK" => {
-            let v = col()?;
-            Color::Cmyk { c: *v.first()?, m: *v.get(1)?, y: *v.get(2)?, k: *v.get(3)?, a: v.get(4)?.clamp(0.0, 1.0) }
-        }
-        b"GRAY" => {
-            let v = col()?;
-            Color::Gray { v: *v.first()?, a: v.get(1)?.clamp(0.0, 1.0) }
-        }
-        b"LABA" => {
-            let b = s.bytes(id, b"_col")?;
-            let u = |i: usize| -> Option<f64> { Some(f64::from(u16::from_le_bytes([*b.get(2 * i)?, *b.get(2 * i + 1)?])) / 65535.0) };
-            Color::Lab { l: 100.0 * u(0)?, a: 255.0 * u(1)? - 128.0, b: 255.0 * u(2)? - 128.0, alpha: u(3)? }
-        }
-        b"Pant" => {
-            r.warn("spot colours (imported as their RGB equivalent)");
-            return s.obj(id, b"srgb").and_then(|c| color(r, c)).or_else(|| s.obj(id, b"base").and_then(|c| color(r, c)));
-        }
-        b"RegC" => Color::Cmyk { c: 1.0, m: 1.0, y: 1.0, k: 1.0, a: 1.0 },
-        _ => {
-            r.warn("colours in an unknown model");
-            return None;
-        }
-    })
-}
-
-fn hsl(h: f64, s: f64, l: f64) -> (f64, f64, f64) {
-    let c = (1.0 - (2.0 * l - 1.0).abs()) * s;
-    let hp = (h.rem_euclid(1.0)) * 6.0;
-    let x = c * (1.0 - (hp % 2.0 - 1.0).abs());
-    let (r, g, b) = match hp as u32 {
-        0 => (c, x, 0.0),
-        1 => (x, c, 0.0),
-        2 => (0.0, c, x),
-        3 => (0.0, x, c),
-        4 => (x, 0.0, c),
-        _ => (c, 0.0, x),
-    };
-    let m = l - c / 2.0;
-    (r + m, g + m, b + m)
-}
-
-/// A fill descriptor (`FDsc`) or, in Affinity 1 files, a bare `FilS`; `local` maps the node's
-/// space to document pixels.
-pub(crate) fn descriptor(r: &mut Reader, id: ObjId, local: Affine) -> Option<Paint> {
-    let s = r.s;
-    let (fill, unit) = if s.is(id, b"FDsc") {
-        let unit = s.floats::<6>(id, b"FDeX").map(Affine::from_xfrm).unwrap_or(Affine::IDENTITY);
-        (s.obj(id, b"FDeF")?, unit)
-    } else {
-        (id, Affine::IDENTITY)
-    };
-    match &s.class(fill)?.0.to_be_bytes() {
-        b"FilN" => Some(Paint::None),
-        b"FilS" => Some(Paint::Solid(color(r, s.obj(fill, b"Colr")?)?)),
-        b"FilG" => {
-            let kind = match s.enumeration(fill, b"Type").map(|(i, _)| i) {
-                Some(0) | None => GradientKind::Linear,
-                Some(1 | 2) => GradientKind::Radial,
-                Some(3) => GradientKind::Conical,
-                Some(_) => {
-                    r.warn("gradients of an unknown kind (imported as linear)");
-                    GradientKind::Linear
-                }
-            };
-            let grad = s.obj(fill, b"Grad")?;
-            let cols = s.objs(grad, b"Cols");
-            let posn: Vec<Vec<f64>> = match s.field(grad, b"Posn") {
-                Some(Value::Array(a)) => a.iter().filter_map(floats).collect(),
-                _ => Vec::new(),
-            };
-            let mut stops = Vec::new();
-            for (c, p) in cols.iter().zip(&posn).take(MAX_STOPS) {
-                let color = color(r, *c)?;
-                let offset = p.first().copied().filter(|v| v.is_finite()).unwrap_or(0.0).clamp(0.0, 1.0);
-                let bias = p.get(1).copied().filter(|v| v.is_finite()).unwrap_or(0.5).clamp(0.0, 1.0);
-                stops.push(Stop { offset, color, bias });
-            }
-            if stops.is_empty() {
-                return Some(Paint::None);
-            }
-            Some(Paint::Gradient(Gradient { kind, stops, transform: unit.then(local) }))
-        }
-        b"FilB" => {
-            r.warn("bitmap and pattern fills (left empty)");
-            Some(Paint::None)
-        }
-        _ => {
-            r.warn("fills of an unknown kind (left empty)");
-            Some(Paint::None)
-        }
-    }
-}
-
-fn current(r: &Reader, id: ObjId, list: &[u8; 4], index: &[u8; 4]) -> Option<ObjId> {
-    let items = r.s.objs(id, list);
-    let i = r.s.int(id, index).and_then(|i| usize::try_from(i).ok()).unwrap_or(0);
-    items.get(i).or_else(|| items.first()).copied()
-}
-
-/// The fills of `list` (artboard backgrounds use `BFFl`).
-pub(crate) fn fills(r: &mut Reader, id: ObjId, local: Affine, list: &[u8; 4]) -> Vec<crate::paint::Paint> {
-    let d = current(r, id, list, b"BFCr").or_else(|| r.s.obj(id, b"BFil"));
-    d.and_then(|d| descriptor(r, d, local)).filter(|p| *p != Paint::None).into_iter().collect()
-}
-
-/// A node's fill and stroke. `local` maps the node's space to document pixels.
-pub(crate) fn node_paint(r: &mut Reader, id: ObjId, local: Affine) -> (Vec<Paint>, Vec<Stroke>) {
-    let s = r.s;
-    let fills = fills(r, id, local, b"BFFl");
-    if r.s.objs(id, b"BFFl").len() > 1 || r.s.objs(id, b"LIFl").len() > 1 {
-        r.warn("several fills or strokes on one object (only the active one is imported)");
-    }
-    if s.f64(id, b"FOpc").is_some_and(|o| o < 0.999) {
-        r.warn("fill opacity (imported at full fill opacity)");
-    }
-    if s.obj(id, b"Trns").is_some() {
-        r.warn("transparency gradients (imported without them)");
-    }
-    let (pen, style) = if s.field(id, b"LIFl").is_some() {
-        (current(r, id, b"LIFl", b"LICr"), current(r, id, b"LILn", b"LICr"))
-    } else {
-        (s.obj(id, b"PFil"), s.obj(id, b"LSty"))
-    };
-    let behind = matches!(s.field(id, b"DrwO"), Some(Value::Array(a)) if a.first() == Some(&Value::Enum { id: 1, version: 0 }));
-    let stroke = match (pen, style) {
-        (Some(pen), Some(style)) => stroke(r, pen, style, local, behind),
-        _ => None,
-    };
-    (fills, stroke.into_iter().collect())
-}
-
-fn stroke(r: &mut Reader, pen: ObjId, ldsc: ObjId, local: Affine, behind: bool) -> Option<Stroke> {
-    let s = r.s;
-    let paint = descriptor(r, pen, local)?;
-    if paint == Paint::None {
-        return None;
-    }
-    let lsty = if s.is(ldsc, b"LDsc") { s.obj(ldsc, b"LDeL")? } else { ldsc };
-    let weight = s.f64(lsty, b"Wght").filter(|w| *w > 0.0 && *w < 1e7)?;
-    // "Scale with object": the weight follows the object's transform; otherwise it is absolute.
-    let scales = s.bool(ldsc, b"LDSc").unwrap_or(true);
-    let width = if scales { weight * local.scale() } else { weight };
-    let data = s.bytes(lsty, b"Data").unwrap_or_default();
-    let miter_limit = data.get(0..8).and_then(|b| b.try_into().ok()).map(f64::from_le_bytes).filter(|m| m.is_finite() && *m >= 1.0).unwrap_or(4.0);
-    // Cap and join bytes are only partly understood: (0, 0) is butt/miter in every clean sample;
-    // (2, 2) ends plain lines square and brush lines round; joins import round, which never
-    // looks wrong.
-    let (cap, join) = match (data.get(8).copied(), data.get(9).copied(), data.get(10).copied()) {
-        (Some(0), Some(0), _) => (Cap::Butt, Join::Miter),
-        (Some(0), Some(_), _) => (Cap::Butt, Join::Round),
-        (Some(2), Some(2), Some(3)) => (Cap::Round, Join::Round),
-        (Some(2), Some(2), _) => (Cap::Square, Join::Round),
-        _ => (Cap::Round, Join::Round),
-    };
-    let align = match s.int(ldsc, b"LDSa") {
-        Some(1) => Align::Inside,
-        Some(2) => Align::Outside,
-        _ => Align::Center,
-    };
-    let dash = match s.field(lsty, b"Patn") {
-        Some(Value::Array(a)) if data.get(10) == Some(&2) || !a.is_empty() => {
-            let mut v: Vec<f64> = a.iter().filter_map(|x| if let Value::Float(f) = x { Some(*f) } else { None }).collect();
-            while v.len() >= 2 && v.iter().rev().take(2).all(|x| *x == 0.0) {
-                v.truncate(v.len() - 2);
-            }
-            let valid = !v.is_empty() && v.iter().all(|x| x.is_finite() && *x >= 0.0) && v.iter().any(|x| *x > 0.0);
-            valid.then(|| (v.iter().map(|x| x * width).collect(), s.f64(lsty, b"Phse").unwrap_or(0.0) * width))
-        }
-        _ => None,
-    };
-    if s.obj(lsty, b"Brus").is_some() || s.obj(ldsc, b"LDeP").is_some() {
-        r.warn("brush and pressure strokes (imported as plain strokes)");
-    }
-    Some(Stroke { paint, width, cap, join, miter_limit, align, dash, behind })
-}
@@ -1,124 +0,0 @@
-//! The indexed PNG thumbnail Affinity stores next to the archive: Affinity's own render of the
-//! document, at most 512 pixels on the long side in real files, never the document itself.
-
-use crate::Error;
-use crate::container::header;
-
-pub const MAX_PREVIEW_BYTES: usize = 16 << 20;
-pub const MAX_PREVIEW_DIMENSION: u32 = 4096;
-
-/// Borrowed embedded thumbnail, at its own dimensions, never the native document dimensions.
-#[derive(Debug)]
-pub struct Preview<'a> {
-    pub png: &'a [u8],
-    pub width: u32,
-    pub height: u32,
-}
-
-fn bytes_at(bytes: &[u8], offset: usize, length: usize) -> Result<&[u8], Error> {
-    let end = offset.checked_add(length).ok_or(Error::Malformed("offset overflow"))?;
-    bytes.get(offset..end).ok_or(Error::Malformed("truncated record"))
-}
-
-fn le32(bytes: &[u8], offset: usize) -> Result<u32, Error> {
-    let b = bytes_at(bytes, offset, 4)?;
-    Ok(u32::from_le_bytes(b.try_into().map_err(|_| Error::Malformed("integer"))?))
-}
-
-fn be32(bytes: &[u8], offset: usize) -> Result<u32, Error> {
-    let b = bytes_at(bytes, offset, 4)?;
-    Ok(u32::from_be_bytes(b.try_into().map_err(|_| Error::Malformed("PNG integer"))?))
-}
-
-/// Read only the indexed `Thmb` record (identical in container versions 8 to 12), checking every PNG chunk CRC. Compressed
-/// pixels must still be validated by the consuming image decoder, with allocation limits.
-pub fn preview(bytes: &[u8]) -> Result<Preview<'_>, Error> {
-    let h = header(bytes)?;
-    if h.thumbnail_offset == 0 {
-        return Err(Error::Unsupported("no embedded preview"));
-    }
-    let offset = usize::try_from(h.thumbnail_offset).map_err(|_| Error::Malformed("thumbnail offset overflow"))?;
-    if offset < 72 {
-        return Err(Error::Malformed("thumbnail overlaps the file header"));
-    }
-    let record = bytes.get(offset..).ok_or(Error::Malformed("thumbnail offset outside file"))?;
-    if bytes_at(record, 0, 8)? != b"\xff\xff\xff\xffThmb" {
-        return Err(Error::Malformed("missing indexed thumbnail"));
-    }
-    if le32(record, 8)? != 1 || bytes_at(record, 28, 1)? != [1] {
-        return Err(Error::Unsupported("thumbnail record version or encoding"));
-    }
-    let size = usize::try_from(le32(record, 24)?).map_err(|_| Error::Limit("encoded size"))?;
-    if size > MAX_PREVIEW_BYTES {
-        return Err(Error::Limit("encoded preview exceeds 16 MiB"));
-    }
-    if le32(record, 16)? != 29 || le32(record, 20)? != 0 || u64::from(le32(record, 12)?) != size as u64 + 13 {
-        return Err(Error::Malformed("inconsistent thumbnail record lengths"));
-    }
-    let png = bytes_at(record, 29, size)?;
-    if bytes_at(png, 0, 8)? != b"\x89PNG\r\n\x1a\n" || be32(png, 8)? != 13 || bytes_at(png, 12, 4)? != b"IHDR" {
-        return Err(Error::Malformed("thumbnail is not a PNG"));
-    }
-    let width = be32(png, 16)?;
-    let height = be32(png, 20)?;
-    if width == 0 || height == 0 || width > MAX_PREVIEW_DIMENSION || height > MAX_PREVIEW_DIMENSION {
-        return Err(Error::Limit("preview dimensions must be 1..4096"));
-    }
-    // Bound work by bytes, not a file-supplied chunk count, and require exactly one complete PNG.
-    let mut pos = 8usize;
-    let (mut palette, mut image_data, mut image_data_ended) = (false, false, false);
-    loop {
-        let length = usize::try_from(be32(png, pos)?).map_err(|_| Error::Limit("PNG chunk length"))?;
-        let chunk_size = length.checked_add(12).ok_or(Error::Malformed("PNG chunk overflow"))?;
-        let chunk = bytes_at(png, pos, chunk_size)?;
-        let checksum_input = bytes_at(chunk, 4, chunk_size - 8)?;
-        if crc32fast::hash(checksum_input) != be32(chunk, chunk_size - 4)? {
-            return Err(Error::Malformed("PNG chunk checksum"));
-        }
-        let kind = bytes_at(chunk, 4, 4)?;
-        if !kind.iter().all(u8::is_ascii_alphabetic) {
-            return Err(Error::Malformed("PNG chunk type"));
-        }
-        match kind {
-            b"IHDR" if pos == 8 => {}
-            b"IHDR" => return Err(Error::Malformed("duplicate PNG header")),
-            b"PLTE" => {
-                if palette || image_data {
-                    return Err(Error::Malformed("PNG palette order"));
-                }
-                palette = true;
-            }
-            b"IDAT" => {
-                if image_data_ended {
-                    return Err(Error::Malformed("non-contiguous PNG image data"));
-                }
-                image_data = true;
-            }
-            b"IEND" if !image_data => return Err(Error::Malformed("PNG has no image data")),
-            b"IEND" => {}
-            _ if kind.first().is_some_and(u8::is_ascii_uppercase) => {
-                return Err(Error::Unsupported("unknown critical PNG chunk"));
-            }
-            _ => {}
-        }
-        if image_data && kind != b"IDAT" {
-            image_data_ended = true;
-        }
-        // Native sample previews are plain, single-frame PNGs. Pixel allocation limits do not
-        // necessarily bound aggregate compressed metadata; leave these layouts unsupported.
-        if matches!(kind, b"zTXt" | b"iTXt" | b"iCCP") {
-            return Err(Error::Unsupported("compressed PNG metadata in the preview"));
-        }
-        if matches!(kind, b"acTL" | b"fcTL" | b"fdAT") {
-            return Err(Error::Unsupported("animated PNG preview"));
-        }
-        pos = pos.checked_add(chunk_size).ok_or(Error::Malformed("PNG offset overflow"))?;
-        if kind == b"IEND" {
-            if length != 0 || pos != png.len() {
-                return Err(Error::Malformed("PNG end or trailing data"));
-            }
-            break;
-        }
-    }
-    Ok(Preview { png, width, height })
-}
@@ -1,414 +0,0 @@
-//! Pixel layers (`Rstr`) and placed images (`ImgN`). A placed image keeps its original file
-//! (`DyBm.Bckg` → archive entry `c/N`), which is imported as is; other pixels are planar tiles of
-//! 256 bytes × 256 rows per channel, each its own archive entry.
-
-use std::collections::HashMap;
-
-use crate::Error;
-use crate::model::{Affine, Image, Pixels, Reader};
-use crate::stream::{self, ObjId, Tag, Value};
-
-/// Pixels decoded per layer (the content's bounding box, not the canvas).
-const MAX_PIXELS: u64 = 64 << 20;
-const TILE: usize = 256;
-const TILE_BYTES: usize = TILE * TILE;
-
-struct CachedPixels {
-    tiles: HashMap<String, Vec<u8>>,
-    source: Option<(usize, Vec<u8>)>,
-}
-
-pub(crate) fn node_image(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
-    let s = r.s;
-    let Some(bitmap) = s.obj(id, b"Bitm") else {
-        r.warn("pixel layers without pixels");
-        return Ok(None);
-    };
-    if !s.is(bitmap, b"DyBm") {
-        r.warn("pixel layers stored in an unknown way");
-        return Ok(None);
-    }
-    let width = s.int(bitmap, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
-    let height = s.int(bitmap, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
-    if width == 0 || height == 0 {
-        return Ok(None);
-    }
-    // A placed image: the original file, byte for byte.
-    let has_tiles = s.field(bitmap, b"Sta1").is_some();
-    if let Some(name) = s.entry(bitmap, b"Bckg").filter(|n| !n.is_empty())
-        && (s.is(id, b"ImgN") || !has_tiles)
-    {
-        match original(r, name) {
-            Ok(bytes) => return Ok(Some(Image { width, height, pixels: Pixels::Encoded(bytes), transform: world })),
-            Err(Error::Limit(e)) => return Err(Error::Limit(e)),
-            Err(_) => r.warn("an embedded image file that could not be read (its cached pixels were used)"),
-        }
-    }
-    // The content's bounding box, so a mostly empty canvas-sized layer stays small.
-    let crop = s
-        .field(id, b"BitR")
-        .and_then(|v| if let Value::Ints(i) = v { Some(i.clone()) } else { None })
-        .filter(|v| v.len() == 4 && v[0] > i64::from(i32::MIN) + 1)
-        .map(|v| {
-            (
-                v[0].clamp(0, i64::from(width)) as u32,
-                v[1].clamp(0, i64::from(height)) as u32,
-                v[2].clamp(0, i64::from(width)) as u32,
-                v[3].clamp(0, i64::from(height)) as u32,
-            )
-        })
-        .unwrap_or((0, 0, width, height));
-    let source_tiles_only =
-        (1..=4).all(|c| matches!(s.field(bitmap, &tag(b"Sta", c)), Some(Value::Array(a)) if !a.is_empty() && a.iter().all(|v| *v == Value::UInt(5))));
-    if s.field(bitmap, b"Bckg").is_some() && has_tiles && !source_tiles_only && !s.is(id, b"ImgN") {
-        r.warn("edited placed images use their stored pixels");
-    }
-    decode(r, bitmap, crop, world)
-}
-
-/// A mask layer (`MRst`): one channel of coverage as grey pixels (white shows, black hides).
-pub(crate) fn mask(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
-    let s = r.s;
-    let Some(bitmap) = s.obj(id, b"Bitm") else { return Ok(None) };
-    let width = s.int(bitmap, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
-    let height = s.int(bitmap, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
-    if width == 0 || height == 0 || !matches!(s.enumeration(bitmap, b"Frmt"), Some((6 | 7, _))) {
-        r.warn("pixel masks in an unknown format (imported without them)");
-        return Ok(None);
-    }
-    decode(r, bitmap, (0, 0, width, height), world)
-}
-
-/// An embedded document or symbol instance (`EmbN`), as the picture of it Affinity caches.
-pub(crate) fn embedded(r: &mut Reader, id: ObjId, world: Affine) -> Result<Option<Image>, Error> {
-    let s = r.s;
-    let Some(cache) = s.obj(id, b"Bitm").and_then(|e| s.obj(e, b"Cach")) else { return Ok(None) };
-    let Some(bbox) = s.obj(id, b"Bitm").and_then(|e| s.floats::<4>(e, b"ChBB")) else { return Ok(None) };
-    let width = s.int(cache, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
-    let height = s.int(cache, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
-    if width == 0 || height == 0 {
-        return Ok(None);
-    }
-    let [x0, y0, x1, y1] = bbox;
-    // The instance's origin is the centre of the embedded content (checked against the
-    // thumbnails of documents with embedded documents and SVG files).
-    let (cx, cy) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0);
-    let place = Affine([(x1 - x0) / f64::from(width), 0.0, 0.0, (y1 - y0) / f64::from(height), x0 - cx, y0 - cy]).then(world);
-    decode(r, cache, (0, 0, width, height), place)
-}
-
-/// Decode the tiles of a bitmap inside `crop` (pixels), placed by `world` (bitmap pixels to document).
-fn decode(r: &mut Reader, bitmap: ObjId, crop: (u32, u32, u32, u32), world: Affine) -> Result<Option<Image>, Error> {
-    let s = r.s;
-    let (x0, y0, x1, y1) = crop;
-    if x1 <= x0 || y1 <= y0 {
-        return Ok(None);
-    }
-    let (w, h) = (x1 - x0, y1 - y0);
-    if u64::from(w) * u64::from(h) > MAX_PIXELS {
-        r.warn("pixel layers larger than 64 megapixels");
-        return Ok(None);
-    }
-    let format = s.enumeration(bitmap, b"Frmt").map(|(f, _)| f);
-    let (channels, bps) = match format {
-        Some(0) => (4, 1),
-        Some(1) => (4, 2),
-        Some(6) => (1, 1),
-        Some(7) => (1, 2),
-        Some(4) => {
-            r.warn("CMYK pixel layers (converted to RGB without the document's colour profile)");
-            (5, 1)
-        }
-        _ => {
-            r.warn("pixel layers in grey, Lab or 32-bit formats");
-            return Ok(None);
-        }
-    };
-    let mut planes = Vec::with_capacity(channels);
-    // Current .af documents can keep level-zero tiles in their embedded JPEG/PNG instead of
-    // duplicating the pixels. State 5 is checked in the public Patchy embedded-jpeg fixture.
-    // Support only the observed, same-size RGBA8 image with a zero bitmap origin; other
-    // representations still receive the existing loss warning rather than guessing a mapping.
-    let needs_source = (1..=channels).any(|c| matches!(s.field(bitmap, &tag(b"Sta", c)), Some(Value::Array(a)) if a.contains(&Value::UInt(5))));
-    let source = if needs_source && format == Some(0) && s.int(bitmap, b"LInf") == Some(0) && s.int(bitmap, b"TInf") == Some(0) {
-        if let Some(name) = s.entry(bitmap, b"Bckg") {
-            let width = s.int(bitmap, b"BmpW").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
-            let height = s.int(bitmap, b"BmpH").and_then(|v| u32::try_from(v).ok()).unwrap_or(0);
-            match original(r, name).and_then(|bytes| source_pixels(&bytes, width, height)) {
-                Ok(pixels) => Some((width as usize, pixels)),
-                Err(Error::Limit(e)) => return Err(Error::Limit(e)),
-                Err(_) => None,
-            }
-        } else {
-            None
-        }
-    } else {
-        None
-    };
-    let mut cache = CachedPixels { tiles: HashMap::new(), source };
-    for c in 1..=channels {
-        planes.push(plane(r, bitmap, c, bps, (x0, y0, w, h), &mut cache)?);
-    }
-    let n = (w as usize) * (h as usize);
-    let mut rgba = vec![0u8; n * 4];
-    let sample = |p: &Vec<u8>, i: usize| -> f64 {
-        if bps == 2 {
-            f64::from(u16::from_le_bytes([p.get(2 * i).copied().unwrap_or(0), p.get(2 * i + 1).copied().unwrap_or(0)])) / 65535.0
-        } else {
-            f64::from(p.get(i).copied().unwrap_or(0)) / 255.0
-        }
-    };
-    for (i, px) in rgba.as_chunks_mut::<4>().0.iter_mut().enumerate() {
-        let v: Vec<f64> = planes.iter().map(|p| sample(p, i)).collect();
-        let (r2, g, b, a) = if channels == 1 {
-            (v[0], v[0], v[0], 1.0)
-        } else if channels == 5 {
-            let k = 1.0 - v[3];
-            ((1.0 - v[0]) * k, (1.0 - v[1]) * k, (1.0 - v[2]) * k, v[4])
-        } else {
-            (v[0], v[1], v[2], v[3])
-        };
-        px.copy_from_slice(&[r2, g, b, a].map(|c| (c.clamp(0.0, 1.0) * 255.0).round() as u8));
-    }
-    let transform = Affine([1.0, 0.0, 0.0, 1.0, f64::from(x0), f64::from(y0)]).then(world);
-    Ok(Some(Image { width: w, height: h, pixels: Pixels::Rgba8(rgba), transform }))
-}
-
-/// The original image file: entry `c/N` is a stream whose root (`Blck`) holds it as `Data`.
-fn original(r: &mut Reader, name: &str) -> Result<Vec<u8>, Error> {
-    let bytes = r.archive.read(name)?;
-    let s = stream::parse(&bytes)?;
-    let root = s.object(s.root).ok_or(Error::Malformed("embedded image"))?;
-    match root.get(Tag::of(b"Data")) {
-        Some(Value::Blob(b)) if !b.is_empty() => Ok(b.clone()),
-        _ => Err(Error::Malformed("embedded image without data")),
-    }
-}
-
-/// Decode the source under the same pixel budget as tiled layers, checking its actual
-/// dimensions before allocating decoded pixels. Only JPEG and PNG sources are supported.
-fn source_pixels(bytes: &[u8], width: u32, height: u32) -> Result<Vec<u8>, Error> {
-    use image::{ImageFormat, ImageReader};
-    use std::io::Cursor;
-
-    if u64::from(width) * u64::from(height) > MAX_PIXELS {
-        return Err(Error::Limit("embedded image pixels"));
-    }
-    let mut reader = ImageReader::new(Cursor::new(bytes)).with_guessed_format().map_err(|_| Error::Malformed("embedded image format"))?;
-    if !matches!(reader.format(), Some(ImageFormat::Jpeg | ImageFormat::Png)) {
-        return Err(Error::Unsupported("embedded source pixel format"));
-    }
-    let dimensions = ImageReader::new(Cursor::new(bytes))
-        .with_guessed_format()
-        .map_err(|_| Error::Malformed("embedded image format"))?
-        .into_dimensions()
-        .map_err(|_| Error::Malformed("embedded image dimensions"))?;
-    if dimensions != (width, height) || width == 0 || height == 0 {
-        return Err(Error::Malformed("embedded source and bitmap dimensions differ"));
-    }
-    let mut limits = image::Limits::default();
-    limits.max_image_width = Some(width);
-    limits.max_image_height = Some(height);
-    limits.max_alloc = Some(MAX_PIXELS * 8);
-    reader.limits(limits);
-    let decoded = reader.decode().map_err(|e| match e {
-        image::ImageError::Limits(_) => Error::Limit("embedded image decoding"),
-        _ => Error::Malformed("embedded image decoding"),
-    })?;
-    Ok(decoded.into_rgba8().into_raw())
-}
-
-fn tag(prefix: &[u8; 3], c: usize) -> [u8; 4] {
-    [prefix[0], prefix[1], prefix[2], b'0' + c as u8]
-}
-
-/// One channel of level 0, cropped to (x0, y0, w, h) pixels; `bps` bytes per sample.
-fn plane(
-    r: &mut Reader,
-    bitmap: ObjId,
-    c: usize,
-    bps: usize,
-    (x0, y0, w, h): (u32, u32, u32, u32),
-    cache: &mut CachedPixels,
-) -> Result<Vec<u8>, Error> {
-    let CachedPixels { tiles: cache, source } = cache;
-    let s = r.s;
-    let width = s.int(bitmap, b"BmpW").and_then(|v| usize::try_from(v).ok()).unwrap_or(0);
-    let height = s.int(bitmap, b"BmpH").and_then(|v| usize::try_from(v).ok()).unwrap_or(0);
-    let tw = s.int(bitmap, &tag(b"TWi", c)).and_then(|v| usize::try_from(v).ok()).unwrap_or_else(|| (width * bps).div_ceil(TILE));
-    let th = s.int(bitmap, &tag(b"THi", c)).and_then(|v| usize::try_from(v).ok()).unwrap_or_else(|| height.div_ceil(TILE));
-    let states: Vec<u8> = match s.field(bitmap, &tag(b"Sta", c)) {
-        Some(Value::Array(a)) => a.iter().map(|v| if let Value::UInt(u) = v { u8::try_from(*u).unwrap_or(255) } else { 255 }).collect(),
-        _ => Vec::new(),
-    };
-    let tiles = s.objs(bitmap, &tag(b"Idx", c));
-    let row = (w as usize) * bps;
-    let mut out = vec![0u8; row * h as usize];
-    let (bx0, bx1) = (x0 as usize * bps, (x0 + w) as usize * bps);
-    let (py0, py1) = (y0 as usize, (y0 + h) as usize);
-    let mut next = 0usize;
-    for (t, state) in states.iter().enumerate().take(tw.saturating_mul(th)) {
-        let (ty, tx) = (t / tw.max(1), t % tw.max(1));
-        let fill = match state {
-            0 | 1 => None,
-            2 => Some(0xFF),
-            4 => {
-                let Some(blck) = tiles.get(next).copied() else { return Err(Error::Malformed("missing pixel tile")) };
-                next += 1;
-                let (ox, oy) = (tx * TILE, ty * TILE);
-                if ox >= bx1 || ox + TILE <= bx0 || oy >= py1 || oy + TILE <= py0 {
-                    continue;
-                }
-                let name = s.entry(blck, b"Data").ok_or(Error::Malformed("pixel tile without data"))?.to_string();
-                if !cache.contains_key(&name) {
-                    let mut data = r.archive.read(&name)?;
-                    // Older files wrap a tile in a one-field stream: header, then a 64 KiB blob.
-                    if data.len() == TILE_BYTES + 22 && data.starts_with(b"\x00\xffKS") {
-                        data = data.get(21..21 + TILE_BYTES).ok_or(Error::Malformed("pixel tile"))?.to_vec();
-                    }
-                    if data.len() != TILE_BYTES {
-                        return Err(Error::Malformed("pixel tile size"));
-                    }
-                    cache.insert(name.clone(), data);
-                }
-                let tile = cache.get(&name).ok_or(Error::Malformed("pixel tile"))?;
-                copy(&mut out, row, (bx0, py0, bx1, py1), (ox, oy), |x, y| tile.get(y * TILE + x).copied().unwrap_or(0));
-                continue;
-            }
-            3 => {
-                r.warn("32-bit pixel layers");
-                None
-            }
-            5 => {
-                if let Some((source_width, pixels)) = source.as_ref() {
-                    let (ox, oy) = (tx * TILE, ty * TILE);
-                    copy(&mut out, row, (bx0, py0, bx1, py1), (ox, oy), |x, y| {
-                        pixels.get(((oy + y) * source_width + ox + x) * 4 + c - 1).copied().unwrap_or(0)
-                    });
-                    continue;
-                }
-                r.warn("pixel layers drawn from an embedded image (left empty)");
-                None
-            }
-            _ => return Err(Error::Malformed("unknown pixel tile state")),
-        };
-        if let Some(v) = fill {
-            copy(&mut out, row, (bx0, py0, bx1, py1), (tx * TILE, ty * TILE), |_, _| v);
-        }
-    }
-    Ok(out)
-}
-
-/// Copy the overlap of a tile at byte column `ox`, row `oy` into the cropped plane.
-fn copy(out: &mut [u8], row: usize, (bx0, py0, bx1, py1): (usize, usize, usize, usize), (ox, oy): (usize, usize), at: impl Fn(usize, usize) -> u8) {
-    for y in oy.max(py0)..(oy + TILE).min(py1) {
-        for x in ox.max(bx0)..(ox + TILE).min(bx1) {
-            if let Some(b) = out.get_mut((y - py0) * row + (x - bx0)) {
-                *b = at(x - ox, y - oy);
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::model::Kind;
-    use crate::synth::{self, F, Method, tag};
-
-    fn png() -> Vec<u8> {
-        let pixels = image::RgbaImage::from_fn(300, 2, |x, y| image::Rgba([(x % 251) as u8, (y * 31) as u8, 77, 255]));
-        let mut bytes = std::io::Cursor::new(Vec::new());
-        pixels.write_to(&mut bytes, image::ImageFormat::Png).unwrap();
-        bytes.into_inner()
-    }
-
-    /// An original synthetic mixed source/cache bitmap. It exercises reader recovery,
-    /// not a claim that Affinity itself accepts the synthetic container.
-    fn fixture(source: &[u8], origin: i32) -> Vec<u8> {
-        let mut bitmap = vec![
-            (tag(b"Frmt"), F::Enum(0, 0)),
-            (tag(b"BmpW"), F::I32(300)),
-            (tag(b"BmpH"), F::I32(2)),
-            (tag(b"LInf"), F::I32(origin)),
-            (tag(b"TInf"), F::I32(0)),
-            (tag(b"Bckg"), F::Entry("c/1".into())),
-        ];
-        for c in 1..=4 {
-            bitmap.push((tag(&super::tag(b"TWi", c)), F::I32(2)));
-            bitmap.push((tag(&super::tag(b"THi", c)), F::I32(1)));
-            bitmap.push((tag(&super::tag(b"Sta", c)), F::U8s(vec![5, 4])));
-            bitmap.push((
-                tag(&super::tag(b"Idx", c)),
-                F::Shared(vec![F::Def(c as u32, vec![tag(b"Blck")], vec![(tag(b"Data"), F::Entry(format!("d/{c}")))])]),
-            ));
-        }
-        let mut crop = vec![0x17];
-        crop.extend(tag(b"BitR").0.to_le_bytes());
-        crop.extend([250i32, 0, 270, 2].into_iter().flat_map(i32::to_le_bytes));
-        let raster = F::Def(
-            10,
-            vec![tag(b"Rstr")],
-            vec![
-                (tag(b"Bitm"), F::Obj(tag(b"DyBm"), bitmap)),
-                (tag(b"BitR"), F::Raw(crop)),
-                (tag(b"Xfrm"), F::F64s(vec![0.0, -2.0, 10.0, 2.0, 0.0, 20.0])),
-            ],
-        );
-        let spread = F::Def(11, vec![tag(b"Sprd")], vec![(tag(b"Chld"), F::Shared(vec![raster]))]);
-        let doc = synth::stream(&[(tag(b"DocR"), F::Obj(tag(b"DocN"), vec![(tag(b"Chld"), F::Shared(vec![spread]))]))]);
-        let mut blob = vec![0x2d];
-        blob.extend(tag(b"Data").0.to_le_bytes());
-        blob.extend((source.len() as u32).to_le_bytes());
-        blob.extend(source);
-        let block = synth::stream(&[(tag(b"Data"), F::Raw(blob))]);
-        let tiles: Vec<_> = [200u8, 10, 30, 255].into_iter().map(|v| vec![v; TILE_BYTES]).collect();
-        synth::container(
-            &[
-                ("doc.dat", &doc, Method::Zlib),
-                ("c/1", &block, Method::Zlib),
-                ("d/1", &tiles[0], Method::Zlib),
-                ("d/2", &tiles[1], Method::Zlib),
-                ("d/3", &tiles[2], Method::Zlib),
-                ("d/4", &tiles[3], Method::Zlib),
-            ],
-            None,
-        )
-    }
-
-    #[test]
-    fn source_tiles_and_cached_edits_survive_crop_rotation_and_tile_boundaries() {
-        let doc = crate::read(&fixture(&png(), 0), crate::Limits::default()).unwrap();
-        assert_eq!(doc.warnings, ["edited placed images use their stored pixels"]);
-        let Kind::Image(image) = &doc.spreads[0].nodes[0].kind else { panic!() };
-        assert_eq!((image.width, image.height), (20, 2));
-        assert_eq!(image.transform, Affine([0.0, 2.0, -2.0, 0.0, 10.0, 520.0]));
-        let Pixels::Rgba8(pixels) = &image.pixels else { panic!() };
-        for y in 0..2 {
-            for x in 0..20 {
-                let expected = if x + 250 < 256 { [((x + 250) % 251) as u8, (y * 31) as u8, 77, 255] } else { [200, 10, 30, 255] };
-                assert_eq!(&pixels[(y * 20 + x) * 4..(y * 20 + x + 1) * 4], &expected);
-            }
-        }
-    }
-
-    #[test]
-    fn unreadable_sources_and_unknown_origins_preserve_cached_edits_and_warn() {
-        for bytes in [fixture(b"invalid image", 0), fixture(&png(), 1)] {
-            let doc = crate::read(&bytes, crate::Limits::default()).unwrap();
-            assert!(doc.warnings.iter().any(|w| w == "pixel layers drawn from an embedded image (left empty) (4×)"));
-            let Kind::Image(image) = &doc.spreads[0].nodes[0].kind else { panic!() };
-            let Pixels::Rgba8(pixels) = &image.pixels else { panic!() };
-            assert_eq!(&pixels[..4], &[0, 0, 0, 0]);
-            assert_eq!(&pixels[6 * 4..7 * 4], &[200, 10, 30, 255]);
-        }
-    }
-
-    #[test]
-    fn embedded_source_dimensions_and_pixel_budget_are_checked_before_decode() {
-        let bytes = png();
-        assert!(matches!(source_pixels(&bytes, 299, 2), Err(Error::Malformed(_))));
-        assert!(matches!(source_pixels(&bytes, u32::MAX, u32::MAX), Err(Error::Limit(_))));
-        assert_eq!(source_pixels(&bytes, 300, 2).unwrap().len(), 300 * 2 * 4);
-    }
-}
@@ -1,292 +0,0 @@
-//! Parametric shapes: Affinity stores the shape's parameters and its box, never the outline.
-//! Formulas were fitted to Affinity's own renders (the document thumbnails) of public files.
-
-use std::f64::consts::{FRAC_PI_2, PI, TAU};
-
-use crate::model::{Affine, Path, Point, Reader, SubPath};
-use crate::stream::{ObjId, Tag, Value};
-
-/// Handle length of a quarter circle of radius 1.
-const KAPPA: f64 = 0.552_284_749_830_793_4;
-/// Vertices of a polygon or star.
-const MAX_SIDES: i64 = 10_000;
-
-/// The last value of a tag: a shape changed from one kind to another keeps a stale first block.
-fn last<'a>(r: &'a Reader, id: ObjId, tag: &[u8; 4]) -> Option<&'a Value> {
-    let t = Tag::of(tag);
-    r.s.object(id)?.fields.iter().rev().find(|(k, _)| *k == t).map(|(_, v)| v)
-}
-
-fn num(r: &Reader, id: ObjId, tag: &[u8; 4]) -> Option<f64> {
-    match last(r, id, tag)? {
-        Value::Float(f) if f.is_finite() => Some(*f),
-        Value::UInt(u) => Some(*u as f64),
-        Value::Int(i) => Some(*i as f64),
-        _ => None,
-    }
-}
-
-fn sides(r: &Reader, id: ObjId, tag: &[u8; 4], default: f64) -> usize {
-    let n = num(r, id, tag).unwrap_or(default).round();
-    n.clamp(3.0, MAX_SIDES as f64) as usize
-}
-
-fn pt(x: f64, y: f64) -> Point {
-    Point { x, y }
-}
-
-fn polygon(pts: impl IntoIterator<Item = Point>) -> Option<SubPath> {
-    let mut it = pts.into_iter();
-    let start = it.next()?;
-    let segments = it.map(|p| [p, p, p]).collect();
-    Some(SubPath { start, segments, closed: true })
-}
-
-/// Outline of `shape` (a `Shpe` object) in the node box `b` = (x0, y0, x1, y1).
-pub(crate) fn shape(r: &mut Reader, shape: ObjId, b: [f64; 4], world: Affine) -> Option<Path> {
-    let [x0, y0, x1, y1] = b;
-    let (w, h) = (x1 - x0, y1 - y0);
-    let (cx, cy, rx, ry) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0, w / 2.0, h / 2.0);
-    let on_ellipse = |a: f64, f: f64| pt(cx + f * rx * a.cos(), cy + f * ry * a.sin());
-    let class = r.s.class(shape)?;
-    let sub = match &class.0.to_be_bytes() {
-        b"ShNR" | b"ShRR" => {
-            let types = match last(r, shape, b"CTyp") {
-                Some(Value::Array(a)) => a.iter().map(|t| if let Value::Enum { id, .. } = t { Some(*id) } else { None }).collect(),
-                _ => Vec::new(),
-            };
-            let radii = match last(r, shape, b"ShCR") {
-                Some(Value::Floats(v)) => v.iter().map(|f| if f.is_finite() && *f > 0.0 { *f } else { 0.0 }).collect(),
-                _ => Vec::new(),
-            };
-            // Corners follow the first one (top left) unless they were unlocked; then each has
-            // its own radius and type, clockwise from the top left.
-            let locked = !matches!(last(r, shape, b"Lock"), Some(Value::Bool(false)));
-            let corners: [(f64, Option<u16>); 4] = std::array::from_fn(|i| {
-                let i = if locked { 0 } else { i };
-                (radii.get(i).copied().unwrap_or(0.0), types.get(i).copied().flatten())
-            });
-            if types.is_empty() || corners.iter().all(|(f, _)| *f == 0.0) {
-                polygon([pt(x0, y0), pt(x1, y0), pt(x1, y1), pt(x0, y1)])?
-            } else {
-                if corners.iter().any(|(f, t)| *f > 0.0 && !matches!(t, Some(0 | 1 | 4))) {
-                    r.warn("rectangles with concave or other corner types (imported with round corners)");
-                }
-                let absolute = r.s.bool(shape, b"AbSz") == Some(true);
-                let [a, b2, c, d, ..] = world.0;
-                let (sx, sy) = ((a * a + b2 * b2).sqrt(), (c * c + d * d).sqrt());
-                cornered_rect(
-                    b,
-                    corners.map(|(f, t)| {
-                        let (crx, cry) = if !absolute {
-                            (f * w.min(h), f * w.min(h))
-                        } else if sx > 0.0 && sy > 0.0 {
-                            // An absolute radius is in document pixels, whatever the node's scale.
-                            (f / sx, f / sy)
-                        } else {
-                            (0.0, 0.0)
-                        };
-                        (crx, cry, t == Some(1))
-                    }),
-                )
-            }
-        }
-        b"ShpE" => ellipse(cx, cy, rx, ry),
-        b"ShPy" => {
-            let n = sides(r, shape, b"Side", 5.0);
-            let a = |i: usize| -FRAC_PI_2 + TAU * i as f64 / n as f64;
-            if r.s.object(shape).is_some_and(|_| matches!(last(r, shape, b"Smth"), Some(Value::Bool(true)))) {
-                // Smoothed: tangent handles of length curv·4/3·tan(π/2n) along the inscribed ellipse.
-                let k = num(r, shape, b"Curv").unwrap_or(0.0) * 4.0 / 3.0 * (PI / (2.0 * n as f64)).tan();
-                let v = |i: usize| on_ellipse(a(i), 1.0);
-                let t = |i: usize| pt(-rx * a(i).sin(), ry * a(i).cos());
-                let segments = (0..n)
-                    .map(|i| {
-                        let (p, q, tp, tq) = (v(i), v(i + 1), t(i), t(i + 1));
-                        [pt(p.x + k * tp.x, p.y + k * tp.y), pt(q.x - k * tq.x, q.y - k * tq.y), q]
-                    })
-                    .collect();
-                SubPath { start: v(0), segments, closed: true }
-            } else {
-                polygon((0..n).map(|i| on_ellipse(a(i), 1.0)))?
-            }
-        }
-        b"ShSt" => {
-            let n = sides(r, shape, b"Pnts", 5.0);
-            let q = num(r, shape, b"IRad").unwrap_or(0.382).clamp(0.0, 1.0);
-            if [b"CrcI", b"CrcO", b"CrvL", b"CrvR"].iter().any(|t| num(r, shape, t).is_some_and(|v| v.abs() > 1e-9)) {
-                r.warn("stars with rounded or curved points (imported with sharp points)");
-            }
-            polygon((0..2 * n).map(|i| on_ellipse(-FRAC_PI_2 + PI * i as f64 / n as f64, if i % 2 == 0 { 1.0 } else { q })))?
-        }
-        b"ShSS" => {
-            let n = sides(r, shape, b"Side", 5.0);
-            let ri = num(r, shape, b"COut").unwrap_or(0.5).clamp(0.0, 1.0);
-            let step = PI / n as f64;
-            let (l, hw, inner) = (step.cos(), ri * step.sin(), ri * step.cos());
-            polygon((0..n).flat_map(|k| {
-                let phi = -FRAC_PI_2 + step + TAU * k as f64 / n as f64;
-                let (c, s) = (phi.cos(), phi.sin());
-                [(inner, -hw), (l, -hw), (l, hw), (inner, hw)].map(|(u, v)| pt(cx + rx * (u * c - v * s), cy + ry * (u * s + v * c)))
-            }))?
-        }
-        b"ShPi" => {
-            let raw_start = num(r, shape, b"AngS").unwrap_or(0.0);
-            let raw_end = num(r, shape, b"AngE").unwrap_or(TAU);
-            // Normalize in constant time. Repeatedly adding TAU can hang on finite values
-            // large enough that floating-point addition no longer changes the endpoint.
-            let start = raw_start.rem_euclid(TAU);
-            let delta = raw_end - raw_start;
-            let sweep = if raw_end >= raw_start {
-                delta.min(TAU)
-            } else if delta.is_finite() {
-                delta.rem_euclid(TAU)
-            } else {
-                (raw_end.rem_euclid(TAU) - start).rem_euclid(TAU)
-            };
-            let inner = num(r, shape, b"IRad").unwrap_or(0.0).clamp(0.0, 1.0);
-            pie(cx, cy, rx, ry, start, start + sweep, inner)
-        }
-        b"ShpT" => {
-            let p = num(r, shape, b"Pos ").unwrap_or(0.5);
-            polygon([pt(x0 + p * w, y0), pt(x1, y1), pt(x0, y1)])?
-        }
-        b"ShTz" => {
-            let (l, rr) = (num(r, shape, b"PosL").unwrap_or(0.25), num(r, shape, b"PosR").unwrap_or(0.75));
-            polygon([pt(x0 + l * w, y0), pt(x0 + rr * w, y0), pt(x1, y1), pt(x0, y1)])?
-        }
-        _ => {
-            r.warn("cloud, heart, cog, callout, arrow, tear and other special shapes (imported as their bounding ellipse)");
-            ellipse(cx, cy, rx, ry)
-        }
-    };
-    Some(Path { subpaths: vec![sub] })
-}
-
-pub(crate) fn rectangle(x0: f64, y0: f64, x1: f64, y1: f64) -> SubPath {
-    SubPath { start: pt(x0, y0), segments: [pt(x1, y0), pt(x1, y1), pt(x0, y1)].map(|p| [p, p, p]).to_vec(), closed: true }
-}
-
-fn ellipse(cx: f64, cy: f64, rx: f64, ry: f64) -> SubPath {
-    let (kx, ky) = (KAPPA * rx, KAPPA * ry);
-    SubPath {
-        start: pt(cx + rx, cy),
-        segments: vec![
-            [pt(cx + rx, cy + ky), pt(cx + kx, cy + ry), pt(cx, cy + ry)],
-            [pt(cx - kx, cy + ry), pt(cx - rx, cy + ky), pt(cx - rx, cy)],
-            [pt(cx - rx, cy - ky), pt(cx - kx, cy - ry), pt(cx, cy - ry)],
-            [pt(cx + kx, cy - ry), pt(cx + rx, cy - ky), pt(cx + rx, cy)],
-        ],
-        closed: true,
-    }
-}
-
-/// A rectangle whose corners (top left, top right, bottom right, bottom left) are each rounded,
-/// or cut straight across, by their (horizontal, vertical) radii. Two radii that don't fit along
-/// one side shrink in proportion until they do.
-fn cornered_rect([x0, y0, x1, y1]: [f64; 4], corners: [(f64, f64, bool); 4]) -> SubPath {
-    let fit = |r: f64, pair: f64, side: f64| if pair > side { side * (r / pair) } else { r };
-    let [tl, tr, br, bl] = corners;
-    let (w, h) = (x1 - x0, y1 - y0);
-    let rx = [fit(tl.0, tl.0 + tr.0, w), fit(tr.0, tl.0 + tr.0, w), fit(br.0, bl.0 + br.0, w), fit(bl.0, bl.0 + br.0, w)];
-    let ry = [fit(tl.1, tl.1 + bl.1, h), fit(tr.1, tr.1 + br.1, h), fit(br.1, tr.1 + br.1, h), fit(bl.1, tl.1 + bl.1, h)];
-    let (kx, ky) = (rx.map(|r| (1.0 - KAPPA) * r), ry.map(|r| (1.0 - KAPPA) * r));
-    // (where the corner leaves the previous side, its two handles, where it joins the next side)
-    let arcs = [
-        [pt(x1 - rx[1], y0), pt(x1 - kx[1], y0), pt(x1, y0 + ky[1]), pt(x1, y0 + ry[1])],
-        [pt(x1, y1 - ry[2]), pt(x1, y1 - ky[2]), pt(x1 - kx[2], y1), pt(x1 - rx[2], y1)],
-        [pt(x0 + rx[3], y1), pt(x0 + kx[3], y1), pt(x0, y1 - ky[3]), pt(x0, y1 - ry[3])],
-        [pt(x0, y0 + ry[0]), pt(x0, y0 + ky[0]), pt(x0 + kx[0], y0), pt(x0 + rx[0], y0)],
-    ];
-    let mut segments = Vec::with_capacity(8);
-    for ([s, c1, c2, e], straight) in arcs.into_iter().zip([tr.2, br.2, bl.2, tl.2]) {
-        segments.push([s, s, s]);
-        if s != e {
-            segments.push(if straight { [e, e, e] } else { [c1, c2, e] });
-        }
-    }
-    SubPath { start: pt(x0 + rx[0], y0), segments, closed: true }
-}
-
-/// Elliptical arc from angle `a0` to `a1` (radians, measured y-up as Affinity's pie angles are),
-/// as cubic segments of at most a quarter turn.
-fn arc(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, a1: f64, out: &mut Vec<[Point; 3]>) {
-    let n = ((a1 - a0).abs() / FRAC_PI_2).ceil().clamp(1.0, 8.0) as usize;
-    let step = (a1 - a0) / n as f64;
-    let k = 4.0 / 3.0 * (step / 4.0).tan();
-    let p = |a: f64| pt(cx + rx * a.cos(), cy - ry * a.sin());
-    let d = |a: f64| pt(-rx * a.sin(), -ry * a.cos());
-    for i in 0..n {
-        let (s, e) = (a0 + step * i as f64, a0 + step * (i + 1) as f64);
-        let (ps, pe, ds, de) = (p(s), p(e), d(s), d(e));
-        out.push([pt(ps.x + k * ds.x, ps.y + k * ds.y), pt(pe.x - k * de.x, pe.y - k * de.y), pe]);
-    }
-}
-
-fn pie(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, a1: f64, inner: f64) -> SubPath {
-    let start = pt(cx + rx * a0.cos(), cy - ry * a0.sin());
-    let mut segments = Vec::new();
-    arc(cx, cy, rx, ry, a0, a1, &mut segments);
-    if inner > 0.0 {
-        let p = pt(cx + inner * rx * a1.cos(), cy - inner * ry * a1.sin());
-        segments.push([p, p, p]);
-        arc(cx, cy, inner * rx, inner * ry, a1, a0, &mut segments);
-    } else {
-        let c = pt(cx, cy);
-        segments.push([c, c, c]);
-    }
-    SubPath { start, segments, closed: true }
-}
-
-/// A polyline with circular corners of the given radii (Affinity's live corners on curves).
-pub(crate) fn fillet(pts: &[(Point, f64)], closed: bool) -> SubPath {
-    let n = pts.len();
-    let get = |i: isize| -> Option<Point> {
-        if closed { pts.get(i.rem_euclid(n as isize) as usize).map(|p| p.0) } else { usize::try_from(i).ok().and_then(|i| pts.get(i)).map(|p| p.0) }
-    };
-    let mut corners: Vec<(Point, Point, Point, Point)> = Vec::with_capacity(n);
-    for (i, (p, radius)) in pts.iter().enumerate() {
-        let (prev, next) = (get(i as isize - 1), get(i as isize + 1));
-        let (Some(a), Some(b)) = (prev, next) else {
-            corners.push((*p, *p, *p, *p));
-            continue;
-        };
-        let (u1, l1) = unit(*p, a);
-        let (u2, l2) = unit(*p, b);
-        let cos = (u1.x * u2.x + u1.y * u2.y).clamp(-1.0, 1.0);
-        let phi = cos.acos();
-        if *radius <= 0.0 || phi < 1e-6 || (PI - phi) < 1e-6 {
-            corners.push((*p, *p, *p, *p));
-            continue;
-        }
-        let t = (radius / (phi / 2.0).tan()).min(l1 / 2.0).min(l2 / 2.0);
-        let r = t * (phi / 2.0).tan();
-        let k = 4.0 / 3.0 * ((PI - phi) / 4.0).tan() * r;
-        let s = pt(p.x + u1.x * t, p.y + u1.y * t);
-        let e = pt(p.x + u2.x * t, p.y + u2.y * t);
-        corners.push((s, pt(s.x - u1.x * k, s.y - u1.y * k), pt(e.x - u2.x * k, e.y - u2.y * k), e));
-    }
-    let Some(first) = corners.first().copied() else { return SubPath { start: pt(0.0, 0.0), segments: vec![], closed } };
-    let mut segments = Vec::with_capacity(2 * n);
-    let mut cur = first.0;
-    let start = cur;
-    for (i, (s, c1, c2, e)) in corners.iter().enumerate() {
-        if i > 0 {
-            segments.push([cur, *s, *s]);
-        }
-        if s != e {
-            segments.push([*c1, *c2, *e]);
-        }
-        cur = *e;
-    }
-    if closed && cur != start {
-        segments.push([cur, start, start]);
-    }
-    SubPath { start, segments, closed }
-}
-
-fn unit(from: Point, to: Point) -> (Point, f64) {
-    let (dx, dy) = (to.x - from.x, to.y - from.y);
-    let l = (dx * dx + dy * dy).sqrt();
-    if l > 0.0 { (pt(dx / l, dy / l), l) } else { (pt(0.0, 0.0), 0.0) }
-}
@@ -1,402 +0,0 @@
-//! The tagged object stream inside `doc.dat`: a self-describing tree of objects whose fields carry
-//! a type code and a four-character tag. Parsing needs no schema; unknown fields are kept, so the
-//! document mapping can name what it could not import.
-
-use crate::Error;
-use crate::container::Cursor;
-
-/// A four-character tag in its readable order (`Desc`, `Chld`).
-#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
-pub struct Tag(pub u32);
-
-impl Tag {
-    pub const fn of(s: &[u8; 4]) -> Self {
-        Self(u32::from_be_bytes(*s))
-    }
-}
-
-impl std::fmt::Debug for Tag {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{}", String::from_utf8_lossy(&self.0.to_be_bytes()))
-    }
-}
-
-impl std::fmt::Display for Tag {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        std::fmt::Debug::fmt(self, f)
-    }
-}
-
-/// Index of an object in [`Stream::objects`].
-pub type ObjId = usize;
-
-#[derive(Debug, Clone, PartialEq)]
-pub enum Value {
-    Int(i64),
-    UInt(u64),
-    Float(f64),
-    Bool(bool),
-    Enum {
-        id: u16,
-        version: u16,
-    },
-    Str(String),
-    /// Fixed-length vectors of i32/f32/f64 (points, rectangles, transforms).
-    Ints(Vec<i64>),
-    Floats(Vec<f64>),
-    /// Fixed-size record (curve nodes, ids) or fixed-size struct (colour components).
-    Bytes(Vec<u8>),
-    Blob(Vec<u8>),
-    /// Name of another archive entry (raster tiles, embedded files).
-    Entry(String),
-    Flags(u64),
-    /// `None` is a null object.
-    Obj(Option<ObjId>),
-    Array(Vec<Value>),
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Kind {
-    Root,
-    /// Defined once and referenced by id elsewhere.
-    Shared,
-    Inline,
-    /// Untagged fields identified by position (curve data).
-    Positional,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Object {
-    pub class: Tag,
-    pub kind: Kind,
-    /// Class chain, most derived first (`ShpN`, `VNod`, `Node`).
-    pub chain: Vec<Tag>,
-    /// Fields in stream order; positional fields have tag 0.
-    pub fields: Vec<(Tag, Value)>,
-}
-
-impl Object {
-    pub fn get(&self, tag: Tag) -> Option<&Value> {
-        self.fields.iter().find(|(t, _)| *t == tag).map(|(_, v)| v)
-    }
-}
-
-#[derive(Debug)]
-pub struct Stream {
-    pub root: ObjId,
-    pub objects: Vec<Object>,
-}
-
-/// Deepest object nesting accepted; real documents stay well below (each layer level adds three).
-pub const MAX_DEPTH: usize = 384;
-
-const MAX_OBJECTS: usize = 8_000_000;
-
-/// Most values (fields and array elements) one stream may decode. A value takes about 40 bytes
-/// in memory however few it took in the file (a bool array packs eight in a byte), so the size
-/// of the input alone doesn't bound what parsing allocates: a small compressed entry could
-/// otherwise ask for tens of gigabytes. Real documents stay far below.
-pub const MAX_VALUES: usize = 1 << 24;
-
-struct Parser<'a> {
-    c: Cursor<'a>,
-    objects: Vec<Object>,
-    /// Shared ids, defined at first use and referenced backwards.
-    shared: std::collections::HashMap<u32, ObjId>,
-    depth: usize,
-    /// Values decoded so far, against [`MAX_VALUES`].
-    values: usize,
-}
-
-/// Parse a stream (`00 FF 4B 53` header). Bytes after the root's terminator are ignored.
-pub fn parse(bytes: &[u8]) -> Result<Stream, Error> {
-    let mut c = Cursor::new(bytes, 0);
-    if c.take(4)? != b"\x00\xffKS" {
-        return Err(Error::Malformed("document stream signature"));
-    }
-    let version = c.u16()?;
-    if version > 2 {
-        return Err(Error::Unsupported("document stream version"));
-    }
-    let class = Tag(c.u32()?);
-    c.u16()?;
-    if version == 2 {
-        c.u32()?;
-    }
-    let mut p = Parser { c, objects: Vec::new(), shared: std::collections::HashMap::new(), depth: 0, values: 0 };
-    let root = p.push(Object { class, kind: Kind::Root, chain: vec![class], fields: Vec::new() })?;
-    let fields = p.fields(true, class)?;
-    if let Some(o) = p.objects.get_mut(root) {
-        o.fields = fields;
-    }
-    Ok(Stream { root, objects: p.objects })
-}
-
-impl Parser<'_> {
-    fn push(&mut self, o: Object) -> Result<ObjId, Error> {
-        if self.objects.len() >= MAX_OBJECTS {
-            return Err(Error::Limit("too many objects"));
-        }
-        self.objects.push(o);
-        Ok(self.objects.len() - 1)
-    }
-
-    /// Counts `n` more values against [`MAX_VALUES`], before anything is allocated for them.
-    fn spend(&mut self, n: usize) -> Result<(), Error> {
-        self.values = self.values.checked_add(n).filter(|&v| v <= MAX_VALUES).ok_or(Error::Limit("too many values in the document stream"))?;
-        Ok(())
-    }
-
-    /// An empty array with room for `n` values, paid for first; an allocation that still fails
-    /// is an error, not an abort.
-    fn vec<T>(&mut self, n: usize) -> Result<Vec<T>, Error> {
-        self.spend(n)?;
-        let mut v = Vec::new();
-        v.try_reserve_exact(n).map_err(|_| Error::Limit("not enough memory for the document stream"))?;
-        Ok(v)
-    }
-
-    /// Element count of an array: each element takes at least `min` bytes, so a count the
-    /// remaining input cannot hold is rejected before anything is allocated.
-    fn count(&mut self, min: usize) -> Result<usize, Error> {
-        let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
-        if n.checked_mul(min.max(1)).is_none_or(|bytes| bytes > self.c.remaining()) {
-            return Err(Error::Malformed("array longer than its data"));
-        }
-        Ok(n)
-    }
-
-    fn fields(&mut self, tagged: bool, class: Tag) -> Result<Vec<(Tag, Value)>, Error> {
-        self.depth += 1;
-        if self.depth > MAX_DEPTH {
-            return Err(Error::Limit("objects nested too deeply"));
-        }
-        let mut out = Vec::new();
-        loop {
-            let t = self.c.u8()?;
-            let code = t & 0x7F;
-            if code == 0 {
-                break;
-            }
-            self.spend(1)?;
-            let tag = if tagged { Tag(self.c.u32()?) } else { Tag(0) };
-            let v = if t & 0x80 != 0 { self.array(code, class)? } else { self.scalar(code, tagged, class)? };
-            out.push((tag, v));
-        }
-        self.depth -= 1;
-        Ok(out)
-    }
-
-    fn string(&mut self) -> Result<String, Error> {
-        let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("string length"))?;
-        Ok(String::from_utf8_lossy(self.c.take(n)?).into_owned())
-    }
-
-    fn floats(&mut self, n: usize, wide: bool) -> Result<Value, Error> {
-        let mut v = Vec::with_capacity(n);
-        for _ in 0..n {
-            v.push(if wide { f64::from_le_bytes(self.c.array()?) } else { f64::from(f32::from_le_bytes(self.c.array()?)) });
-        }
-        Ok(Value::Floats(v))
-    }
-
-    fn scalar(&mut self, code: u8, tagged: bool, class: Tag) -> Result<Value, Error> {
-        let c = &mut self.c;
-        Ok(match code {
-            0x01 => Value::UInt(c.u8()?.into()),
-            0x02 => Value::UInt(c.u16()?.into()),
-            0x03 | 0x2f | 0x34 => Value::UInt(c.u32()?.into()),
-            0x04 => Value::UInt(c.u64()?),
-            0x05 => Value::Int(i8::from_le_bytes(c.array()?).into()),
-            0x06 => Value::Int(i16::from_le_bytes(c.array()?).into()),
-            0x07 => Value::Int(i32::from_le_bytes(c.array()?).into()),
-            0x08 => Value::Int(i64::from_le_bytes(c.array()?)),
-            0x09 => Value::Float(f32::from_le_bytes(c.array()?).into()),
-            0x0a => Value::Float(f64::from_le_bytes(c.array()?)),
-            0x15..=0x19 => {
-                let n = usize::from(code - 0x13);
-                let mut v = Vec::with_capacity(n);
-                for _ in 0..n {
-                    v.push(i32::from_le_bytes(c.array()?).into());
-                }
-                Value::Ints(v)
-            }
-            0x1f..=0x23 => return self.floats(usize::from(code - 0x1d), false),
-            0x24..=0x28 => return self.floats(usize::from(code - 0x22), true),
-            0x29 => Value::Bool(c.u8()? != 0),
-            0x2a => Value::Enum { id: c.u16()?, version: c.u16()? },
-            0x2b | 0x2e => Value::Str(self.string()?),
-            0x2c => {
-                let n = usize::from(c.u16()?);
-                Value::Bytes(c.take(n)?.to_vec())
-            }
-            0x35..=0x74 => Value::Bytes(c.take(usize::from(code - 0x34))?.to_vec()),
-            0x2d => {
-                let n = usize::try_from(c.u32()?).map_err(|_| Error::Malformed("blob length"))?;
-                Value::Blob(c.take(n)?.to_vec())
-            }
-            0x33 => {
-                c.u32()?;
-                let n = usize::try_from(c.u32()?).map_err(|_| Error::Malformed("entry name length"))?;
-                Value::Entry(String::from_utf8_lossy(c.take(n)?).into_owned())
-            }
-            0x75 => {
-                c.u16()?;
-                let n = usize::from(c.u8()?);
-                if n > 8 {
-                    return Err(Error::Malformed("flags wider than 64 bits"));
-                }
-                let mut b = [0u8; 8];
-                b.get_mut(..n).ok_or(Error::Malformed("flags"))?.copy_from_slice(c.take(n)?);
-                Value::Flags(u64::from_le_bytes(b))
-            }
-            0x30 => {
-                let fields = self.fields(false, class)?;
-                let id = self.push(Object { class, kind: Kind::Positional, chain: Vec::new(), fields })?;
-                Value::Obj(Some(id))
-            }
-            0x31 | 0x32 if !tagged => return Err(Error::Malformed("object without a field tag")),
-            0x31 => self.shared()?,
-            0x32 => self.inline(None)?,
-            _ => return Err(Error::Unsupported("unknown field type in document stream")),
-        })
-    }
-
-    fn array(&mut self, code: u8, class: Tag) -> Result<Value, Error> {
-        let min = match code {
-            0x01 | 0x05 | 0x29 => 1,
-            0x02 | 0x06 => 2,
-            0x03 | 0x07 | 0x09 | 0x2f | 0x34 => 4,
-            0x04 | 0x08 | 0x0a => 8,
-            0x15..=0x19 => 4 * usize::from(code - 0x13),
-            0x1f..=0x23 => 4 * usize::from(code - 0x1d),
-            0x24..=0x28 => 8 * usize::from(code - 0x22),
-            0x35..=0x74 => usize::from(code - 0x34),
-            _ => 1,
-        };
-        match code {
-            0x29 => {
-                let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
-                let bits = self.c.take(n.div_ceil(8))?;
-                let mut v = self.vec(n)?;
-                v.extend((0..n).map(|i| Value::Bool(bits.get(i / 8).is_some_and(|b| b >> (i % 8) & 1 != 0))));
-                Ok(Value::Array(v))
-            }
-            0x2a => {
-                let n = self.count(2)?;
-                let version = self.c.u16()?;
-                let mut v = self.vec(n)?;
-                for _ in 0..n {
-                    v.push(Value::Enum { id: self.c.u16()?, version });
-                }
-                Ok(Value::Array(v))
-            }
-            0x2b | 0x2e => {
-                self.c.u32()?;
-                let n = self.count(4)?;
-                let mut v = self.vec(n)?;
-                for _ in 0..n {
-                    v.push(Value::Str(self.string()?));
-                }
-                Ok(Value::Array(v))
-            }
-            0x2c => {
-                let n = usize::try_from(self.c.u32()?).map_err(|_| Error::Malformed("array length"))?;
-                let size = usize::from(self.c.u16()?);
-                if n.checked_mul(size).is_none_or(|b| b > self.c.remaining()) {
-                    return Err(Error::Malformed("array longer than its data"));
-                }
-                let mut v = self.vec(n)?;
-                for _ in 0..n {
-                    v.push(Value::Bytes(self.c.take(size)?.to_vec()));
-                }
-                Ok(Value::Array(v))
-            }
-            0x32 => {
-                let n = self.count(1)?;
-                let class = Tag(self.c.u32()?);
-                self.c.u16()?;
-                let mut v = self.vec(n)?;
-                for _ in 0..n {
-                    v.push(self.inline(Some(class))?);
-                }
-                Ok(Value::Array(v))
-            }
-            0x2d | 0x33 | 0x75 => Err(Error::Malformed("array of an unarrayable type")),
-            _ => {
-                let n = self.count(min)?;
-                let mut v = self.vec(n)?;
-                for _ in 0..n {
-                    v.push(self.scalar(code, true, class)?);
-                }
-                Ok(Value::Array(v))
-            }
-        }
-    }
-
-    /// Inline object; `class` is given once for a whole array of them.
-    fn inline(&mut self, class: Option<Tag>) -> Result<Value, Error> {
-        match self.c.u8()? {
-            0 => return Ok(Value::Obj(None)),
-            1 => {}
-            _ => return Err(Error::Malformed("object marker")),
-        }
-        let class = match class {
-            Some(c) => c,
-            None => {
-                let c = Tag(self.c.u32()?);
-                self.c.u16()?;
-                c
-            }
-        };
-        let fields = self.fields(true, class)?;
-        let id = self.push(Object { class, kind: Kind::Inline, chain: vec![class], fields })?;
-        Ok(Value::Obj(Some(id)))
-    }
-
-    fn shared(&mut self) -> Result<Value, Error> {
-        let flag = self.c.u8()?;
-        if flag == 0 {
-            return Ok(Value::Obj(None));
-        }
-        let key = self.c.u32()?;
-        match flag {
-            2 => return self.shared.get(&key).map(|id| Value::Obj(Some(*id))).ok_or(Error::Malformed("reference to an undefined object")),
-            1 => {}
-            _ => return Err(Error::Malformed("object marker")),
-        }
-        if self.shared.contains_key(&key) {
-            return Err(Error::Malformed("object defined twice"));
-        }
-        // Register before the fields: an object's own fields may refer back to it.
-        let id = self.push(Object { class: Tag(0), kind: Kind::Shared, chain: Vec::new(), fields: Vec::new() })?;
-        self.shared.insert(key, id);
-        let mut chain = Vec::new();
-        let mut fields = Vec::new();
-        loop {
-            match self.c.u8()? {
-                0 => {
-                    let tag = Tag(self.c.u32()?);
-                    self.c.u16()?;
-                    chain.push(tag);
-                    fields.extend(self.fields(true, tag)?);
-                }
-                1 => {
-                    chain.push(Tag(self.c.u32()?));
-                    break;
-                }
-                2 => break,
-                _ => return Err(Error::Malformed("object class chain")),
-            }
-            if chain.len() > 64 {
-                return Err(Error::Limit("object class chain too long"));
-            }
-        }
-        let class = chain.first().copied().unwrap_or(Tag(0));
-        fields.extend(self.fields(true, class)?);
-        if let Some(o) = self.objects.get_mut(id) {
-            *o = Object { class, kind: Kind::Shared, chain, fields };
-        }
-        Ok(Value::Obj(Some(id)))
-    }
-}
@@ -1,259 +0,0 @@
-//! Synthetic containers for tests and fuzz seeds (cargo feature `synth`).
-//!
-//! These builders write the layout the reader accepts, so tests can describe documents in a few
-//! lines. They are **not** an Affinity exporter: nothing written here has been opened in Affinity.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use crate::stream::Tag;
-
-/// A field value to encode.
-#[derive(Debug, Clone)]
-pub enum F {
-    U8(u8),
-    U32(u32),
-    I32(i32),
-    F32(f32),
-    F64(f64),
-    Bool(bool),
-    Enum(u16, u16),
-    Str(String),
-    /// f64 vector of 2..6 values (points, rectangles, transforms).
-    F64s(Vec<f64>),
-    /// Fixed-size struct (colour components), 1..64 bytes.
-    Struct(Vec<u8>),
-    /// Array of fixed-size records, all `size` bytes.
-    Records(u16, Vec<Vec<u8>>),
-    U8s(Vec<u8>),
-    Entry(String),
-    /// Shared object: `Def` defines id with class chain and fields, `Ref` links back.
-    Def(u32, Vec<Tag>, Vec<(Tag, F)>),
-    Ref(u32),
-    Null,
-    /// Inline object.
-    Obj(Tag, Vec<(Tag, F)>),
-    /// Positional (untagged) object.
-    Pos(Vec<F>),
-    /// Array of shared objects / links.
-    Shared(Vec<F>),
-    /// Array of inline objects of one class.
-    Objs(Tag, Vec<Vec<(Tag, F)>>),
-    /// Raw bytes appended verbatim (malformed-input tests).
-    Raw(Vec<u8>),
-}
-
-pub fn tag(s: &[u8; 4]) -> Tag {
-    Tag::of(s)
-}
-
-fn put_tag(out: &mut Vec<u8>, t: Tag) {
-    out.extend(t.0.to_le_bytes());
-}
-
-fn code(f: &F) -> u8 {
-    match f {
-        F::U8(_) => 0x01,
-        F::U32(_) => 0x03,
-        F::I32(_) => 0x07,
-        F::F32(_) => 0x09,
-        F::F64(_) => 0x0a,
-        F::Bool(_) => 0x29,
-        F::Enum(..) => 0x2a,
-        F::Str(_) => 0x2b,
-        F::F64s(v) => 0x22 + v.len() as u8,
-        F::Struct(b) => 0x34 + b.len() as u8,
-        F::Records(..) => 0x80 | 0x2c,
-        F::U8s(_) => 0x80 | 0x01,
-        F::Entry(_) => 0x33,
-        F::Def(..) | F::Ref(_) => 0x31,
-        F::Null => 0x31,
-        F::Obj(..) => 0x32,
-        F::Pos(_) => 0x30,
-        F::Shared(_) => 0x80 | 0x31,
-        F::Objs(..) => 0x80 | 0x32,
-        F::Raw(_) => 0,
-    }
-}
-
-fn payload(out: &mut Vec<u8>, f: &F) {
-    match f {
-        F::U8(v) => out.push(*v),
-        F::U32(v) => out.extend(v.to_le_bytes()),
-        F::I32(v) => out.extend(v.to_le_bytes()),
-        F::F32(v) => out.extend(v.to_le_bytes()),
-        F::F64(v) => out.extend(v.to_le_bytes()),
-        F::Bool(v) => out.push(u8::from(*v)),
-        F::Enum(id, ver) => {
-            out.extend(id.to_le_bytes());
-            out.extend(ver.to_le_bytes());
-        }
-        F::Str(s) => {
-            out.extend((s.len() as u32).to_le_bytes());
-            out.extend(s.as_bytes());
-        }
-        F::F64s(v) => v.iter().for_each(|x| out.extend(x.to_le_bytes())),
-        F::Struct(b) => out.extend(b),
-        F::Records(size, recs) => {
-            out.extend((recs.len() as u32).to_le_bytes());
-            out.extend(size.to_le_bytes());
-            recs.iter().for_each(|r| out.extend(r));
-        }
-        F::U8s(v) => {
-            out.extend((v.len() as u32).to_le_bytes());
-            out.extend(v);
-        }
-        F::Entry(name) => {
-            put_tag(out, tag(b"Data"));
-            out.extend((name.len() as u32).to_le_bytes());
-            out.extend(name.as_bytes());
-        }
-        F::Def(id, chain, fields) => {
-            out.push(1);
-            out.extend(id.to_le_bytes());
-            // Class chain: each level but the last carries no fields here; the last ends the chain.
-            let (last, rest) = chain.split_last().expect("class chain");
-            for t in rest {
-                out.push(0);
-                put_tag(out, *t);
-                out.extend(0u16.to_le_bytes());
-                out.push(0);
-            }
-            out.push(1);
-            put_tag(out, *last);
-            fields_into(out, fields, true);
-        }
-        F::Ref(id) => {
-            out.push(2);
-            out.extend(id.to_le_bytes());
-        }
-        F::Null => out.push(0),
-        F::Obj(class, fields) => {
-            out.push(1);
-            put_tag(out, *class);
-            out.extend(0u16.to_le_bytes());
-            fields_into(out, fields, true);
-        }
-        F::Pos(items) => {
-            for f in items {
-                out.push(code(f));
-                payload(out, f);
-            }
-            out.push(0);
-        }
-        F::Shared(items) => {
-            out.extend((items.len() as u32).to_le_bytes());
-            items.iter().for_each(|f| payload(out, f));
-        }
-        F::Objs(class, items) => {
-            out.extend((items.len() as u32).to_le_bytes());
-            put_tag(out, *class);
-            out.extend(0u16.to_le_bytes());
-            for fields in items {
-                out.push(1);
-                fields_into(out, fields, true);
-            }
-        }
-        F::Raw(b) => out.extend(b),
-    }
-}
-
-fn fields_into(out: &mut Vec<u8>, fields: &[(Tag, F)], tagged: bool) {
-    for (t, f) in fields {
-        if let F::Raw(b) = f {
-            out.extend(b);
-            continue;
-        }
-        out.push(code(f));
-        if tagged {
-            put_tag(out, *t);
-        }
-        payload(out, f);
-    }
-    out.push(0);
-}
-
-/// A `doc.dat` stream with root class `Pers`.
-pub fn stream(root: &[(Tag, F)]) -> Vec<u8> {
-    let mut out = b"\x00\xffKS".to_vec();
-    out.extend(2u16.to_le_bytes());
-    put_tag(&mut out, tag(b"Pers"));
-    out.extend(0u16.to_le_bytes());
-    out.extend(30u32.to_le_bytes());
-    fields_into(&mut out, root, true);
-    out
-}
-
-/// How an entry is stored.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Method {
-    Stored,
-    Zlib,
-    Zstd,
-}
-
-/// A version-12 container with one `#FT4` table holding `entries`, then an optional thumbnail record.
-pub fn container(entries: &[(&str, &[u8], Method)], thumbnail_png: Option<&[u8]>) -> Vec<u8> {
-    let mut out = vec![0u8; 72];
-    out[..4].copy_from_slice(crate::container::MAGIC);
-    out[4..6].copy_from_slice(&12u16.to_le_bytes());
-    out[6..8].copy_from_slice(&4u16.to_le_bytes());
-    out[8..12].copy_from_slice(b"nsrP");
-    out[12..16].copy_from_slice(b"#Inf");
-    out[64..68].copy_from_slice(b"Prot");
-    let mut records = Vec::new();
-    for (i, (name, data, method)) in entries.iter().enumerate() {
-        let packed = match method {
-            Method::Stored => data.to_vec(),
-            Method::Zlib => {
-                use std::io::Write;
-                let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::fast());
-                e.write_all(data).unwrap();
-                e.finish().unwrap()
-            }
-            Method::Zstd => ruzstd::encoding::compress_to_vec(*data, ruzstd::encoding::CompressionLevel::Fastest),
-        };
-        let offset = out.len() as u64;
-        out.extend(b"#Fil");
-        out.extend(&packed);
-        let mut r = Vec::new();
-        r.extend((i as u32 + 1).to_le_bytes());
-        r.push(0);
-        r.extend(offset.to_le_bytes());
-        r.extend((data.len() as u64).to_le_bytes());
-        r.extend((packed.len() as u64).to_le_bytes());
-        r.extend(crc32fast::hash(data).to_le_bytes());
-        r.push(match method {
-            Method::Stored => 0,
-            Method::Zlib => 1,
-            Method::Zstd => 2,
-        });
-        r.extend(0u32.to_le_bytes());
-        r.extend(0u32.to_le_bytes());
-        r.extend((name.len() as u16).to_le_bytes());
-        r.extend(name.as_bytes());
-        records.push(r);
-    }
-    let fat = out.len() as u64;
-    out.extend(b"#FT4");
-    out.extend(0u64.to_le_bytes());
-    out.extend(1_700_000_000u64.to_le_bytes());
-    out.extend([0u8; 24]);
-    out.extend((records.len() as u32).to_le_bytes());
-    out.extend([0u8; 8]);
-    out.extend(0u16.to_le_bytes());
-    out.push(0);
-    records.iter().for_each(|r| out.extend(r));
-    let thumb = out.len() as u64;
-    out[16..24].copy_from_slice(&fat.to_le_bytes());
-    if let Some(png) = thumbnail_png {
-        out[24..32].copy_from_slice(&thumb.to_le_bytes());
-        out.extend(b"\xff\xff\xff\xffThmb");
-        out.extend(1u32.to_le_bytes());
-        out.extend((png.len() as u32 + 13).to_le_bytes());
-        out.extend(29u32.to_le_bytes());
-        out.extend(0u32.to_le_bytes());
-        out.extend((png.len() as u32).to_le_bytes());
-        out.push(1);
-        out.extend(png);
-    }
-    out
-}
@@ -1,354 +0,0 @@
-//! Unit tests on synthetic inputs; `tests/real_files.rs` covers public Affinity documents.
-
-mod preview {
-    use crate::container::header;
-    use crate::*;
-    use proptest::prelude::*;
-
-    fn fixture() -> Vec<u8> {
-        let mut png = b"\x89PNG\r\n\x1a\n".to_vec();
-        png.extend(13u32.to_be_bytes());
-        png.extend(b"IHDR");
-        png.extend(2u32.to_be_bytes());
-        png.extend(1u32.to_be_bytes());
-        png.extend([8, 6, 0, 0, 0]);
-        png.extend(crc32fast::hash(&png[12..]).to_be_bytes());
-        png.extend([0; 4]);
-        png.extend(b"IDAT");
-        png.extend(crc32fast::hash(b"IDAT").to_be_bytes());
-        png.extend([0; 4]);
-        png.extend(b"IEND");
-        png.extend(crc32fast::hash(b"IEND").to_be_bytes());
-        let mut b = vec![0; 72];
-        b[..4].copy_from_slice(MAGIC);
-        b[4..6].copy_from_slice(&12u16.to_le_bytes());
-        b[8..12].copy_from_slice(b"nsrP");
-        b[12..16].copy_from_slice(b"#Inf");
-        b[24..32].copy_from_slice(&72u64.to_le_bytes());
-        b[64..68].copy_from_slice(b"Prot");
-        b.extend(b"\xff\xff\xff\xffThmb");
-        b.extend(1u32.to_le_bytes());
-        b.extend((png.len() as u32 + 13).to_le_bytes());
-        b.extend(29u32.to_le_bytes());
-        b.extend(0u32.to_le_bytes());
-        b.extend((png.len() as u32).to_le_bytes());
-        b.push(1);
-        b.extend(png);
-        b
-    }
-
-    #[test]
-    fn indexed_preview_and_header() {
-        let b = fixture();
-        assert_eq!(header(&b).unwrap().version, 12);
-        let p = preview(&b).unwrap();
-        assert_eq!((p.width, p.height), (2, 1));
-        assert_eq!(p.png, &b[101..]);
-    }
-
-    #[test]
-    fn every_truncation_is_rejected() {
-        let b = fixture();
-        for end in 0..b.len() {
-            assert!(preview(&b[..end]).is_err(), "{end}");
-        }
-    }
-
-    #[test]
-    fn rejects_assets_versions_offsets_lengths_and_bombs() {
-        let b = fixture();
-        for (offset, value) in [
-            (4, 13u64.to_le_bytes().to_vec()),
-            (8, b"urBR".to_vec()),
-            (24, u64::MAX.to_le_bytes().to_vec()),
-            (24, 1u64.to_le_bytes().to_vec()),
-            (24, 0u64.to_le_bytes().to_vec()),
-            (84, u32::MAX.to_le_bytes().to_vec()),
-            (88, 30u32.to_le_bytes().to_vec()),
-            (96, u32::MAX.to_le_bytes().to_vec()),
-            (117, 5000u32.to_be_bytes().to_vec()),
-        ] {
-            let mut broken = b.clone();
-            broken[offset..offset + value.len()].copy_from_slice(&value);
-            assert!(preview(&broken).is_err(), "offset {offset}");
-        }
-        // Versions 8 to 11 store the same record (checked on public Affinity 1 and 2 files).
-        for version in 8..12 {
-            let mut legacy = b.clone();
-            legacy[4..6].copy_from_slice(&(version as u16).to_le_bytes());
-            assert!(preview(&legacy).is_ok());
-        }
-        // Flags 4 and 8 occur in real files; the low two bits mark other container variants.
-        for (flags, ok) in [(4u16, true), (8, true), (1, false), (2, false)] {
-            let mut variant = b.clone();
-            variant[6..8].copy_from_slice(&flags.to_le_bytes());
-            assert_eq!(preview(&variant).is_ok(), ok, "flags {flags}");
-        }
-        let mut old = b.clone();
-        old[4..6].copy_from_slice(&7u16.to_le_bytes());
-        assert!(matches!(preview(&old), Err(Error::Unsupported(_))));
-    }
-
-    #[test]
-    fn an_unindexed_png_or_resource_is_never_used() {
-        let mut b = fixture();
-        b[24..32].copy_from_slice(&0u64.to_le_bytes());
-        assert!(preview(&b).is_err());
-        b[24..32].copy_from_slice(&72u64.to_le_bytes());
-        b[76..80].copy_from_slice(b"Meta");
-        assert!(preview(&b).is_err());
-    }
-
-    #[test]
-    fn every_chunk_checksum_including_the_end_is_checked() {
-        let b = fixture();
-        for at in [130, b.len() - 1] {
-            let mut damaged = b.clone();
-            damaged[at] ^= 1;
-            assert_eq!(preview(&damaged).unwrap_err(), Error::Malformed("PNG chunk checksum"));
-        }
-        let mut ancillary = vec![0; 4];
-        ancillary.extend(b"tEXt");
-        ancillary.extend(crc32fast::hash(b"tEXt").to_be_bytes());
-        let mut with_ancillary = b.clone();
-        let at = b.len() - 12;
-        with_ancillary.splice(at..at, ancillary);
-        let png_length = (with_ancillary.len() - 101) as u32;
-        with_ancillary[84..88].copy_from_slice(&(png_length + 13).to_le_bytes());
-        with_ancillary[96..100].copy_from_slice(&png_length.to_le_bytes());
-        assert!(preview(&with_ancillary).is_ok());
-        with_ancillary[at + 8] ^= 1;
-        assert_eq!(preview(&with_ancillary).unwrap_err(), Error::Malformed("PNG chunk checksum"));
-    }
-
-    #[test]
-    fn compressed_metadata_and_animation_are_not_preview_support() {
-        for kind in [b"zTXt", b"iTXt", b"iCCP", b"acTL", b"fcTL", b"fdAT"] {
-            let mut extra = vec![0; 4];
-            extra.extend(kind);
-            extra.extend(crc32fast::hash(kind).to_be_bytes());
-            let mut b = fixture();
-            let at = b.len() - 12;
-            b.splice(at..at, extra);
-            let length = (b.len() - 101) as u32;
-            b[84..88].copy_from_slice(&(length + 13).to_le_bytes());
-            b[96..100].copy_from_slice(&length.to_le_bytes());
-            assert!(matches!(preview(&b), Err(Error::Unsupported(_))));
-        }
-    }
-
-    #[test]
-    fn critical_chunks_follow_a_single_complete_png_layout() {
-        fn with_chunks(kinds: &[&[u8; 4]]) -> Vec<u8> {
-            let original = fixture();
-            let mut b = original[..134].to_vec(); // File, record and complete first IHDR.
-            for kind in kinds {
-                b.extend([0; 4]);
-                b.extend(*kind);
-                b.extend(crc32fast::hash(*kind).to_be_bytes());
-            }
-            let length = (b.len() - 101) as u32;
-            b[84..88].copy_from_slice(&(length + 13).to_le_bytes());
-            b[96..100].copy_from_slice(&length.to_le_bytes());
-            b
-        }
-        assert!(preview(&with_chunks(&[b"IDAT", b"IDAT", b"IEND"])).is_ok());
-        // PNG readers must not reject an otherwise valid unknown ancillary chunk just
-        // because its reserved (third-letter) bit is set; future versions can define it.
-        assert!(preview(&with_chunks(&[b"abct", b"IDAT", b"IEND"])).is_ok());
-        for kinds in [
-            vec![b"IEND"],
-            vec![b"IDAT", b"IHDR", b"IEND"],
-            vec![b"PLTE", b"PLTE", b"IDAT", b"IEND"],
-            vec![b"IDAT", b"PLTE", b"IEND"],
-            vec![b"IDAT", b"tEXt", b"IDAT", b"IEND"],
-            vec![b"ABCD", b"IDAT", b"IEND"],
-            vec![b"IDAT", b"IEND", b"tEXt"],
-        ] {
-            assert!(preview(&with_chunks(&kinds)).is_err(), "{kinds:?}");
-        }
-    }
-
-    proptest! {
-        #![proptest_config(ProptestConfig::with_cases(256))]
-        #[test]
-        fn arbitrary_input_never_panics(b in prop::collection::vec(any::<u8>(), 0..2048)) {
-            let _ = header(&b);
-            let _ = preview(&b);
-        }
-        #[test]
-        fn mutations_never_panic(edits in prop::collection::vec((0usize..200, any::<u8>()), 0..32)) {
-            let mut b = fixture();
-            for (i, value) in edits { if let Some(v) = b.get_mut(i) { *v = value; } }
-            let _ = preview(&b);
-        }
-    }
-}
-
-mod archive {
-    use crate::Error;
-    use crate::container::{Archive, Limits};
-    use crate::stream::{self, Kind, Tag, Value};
-    use crate::synth::{self, F, Method, tag};
-    use proptest::prelude::*;
-
-    fn doc() -> Vec<u8> {
-        synth::stream(&[
-            (tag(b"Desc"), F::Str("Document".into())),
-            (tag(b"Visi"), F::Bool(true)),
-            (tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 5.0, 0.0, 1.0, -2.0])),
-            (tag(b"Colr"), F::Def(7, vec![tag(b"RGBA")], vec![(tag(b"_col"), F::Struct([0u8; 16].to_vec()))])),
-            (tag(b"Same"), F::Ref(7)),
-            (tag(b"Null"), F::Null),
-            (tag(b"Kids"), F::Shared(vec![F::Def(8, vec![tag(b"Grup"), tag(b"Node")], vec![(tag(b"Desc"), F::Str("g".into()))]), F::Ref(8)])),
-            (
-                tag(b"Crvs"),
-                F::Obj(tag(b"PCvD"), vec![(tag(b"Data"), F::Pos(vec![F::U8(0), F::U32(1), F::Bool(true), F::Records(18, vec![vec![0; 18]; 4])]))]),
-            ),
-            (tag(b"Enum"), F::Enum(2, 1)),
-            (tag(b"Tile"), F::Entry("d/3".into())),
-            (tag(b"Stat"), F::U8s(vec![4, 0, 2])),
-        ])
-    }
-
-    #[test]
-    fn every_method_round_trips_with_checksums() {
-        let d = doc();
-        for method in [Method::Stored, Method::Zlib, Method::Zstd] {
-            let file = synth::container(&[("doc.dat", &d, method), ("d/3", b"tile", method)], None);
-            let mut a = Archive::open(&file, Limits::default()).unwrap();
-            assert_eq!(a.header.version, 12);
-            assert_eq!(a.read("doc.dat").unwrap(), d);
-            assert_eq!(a.read("d/3").unwrap(), b"tile");
-            assert_eq!(a.extracted(), d.len() + 4);
-            assert!(a.read("missing").is_err());
-        }
-    }
-
-    #[test]
-    fn the_stream_parses_into_shared_objects_and_links() {
-        let s = stream::parse(&doc()).unwrap();
-        let root = &s.objects[s.root];
-        assert_eq!(root.class, Tag::of(b"Pers"));
-        assert_eq!(root.get(Tag::of(b"Desc")), Some(&Value::Str("Document".into())));
-        assert_eq!(root.get(Tag::of(b"Xfrm")), Some(&Value::Floats(vec![1.0, 0.0, 5.0, 0.0, 1.0, -2.0])));
-        let (Some(Value::Obj(Some(a))), Some(Value::Obj(Some(b)))) = (root.get(Tag::of(b"Colr")), root.get(Tag::of(b"Same"))) else { panic!() };
-        assert_eq!(a, b);
-        assert_eq!(s.objects[*a].class, Tag::of(b"RGBA"));
-        assert_eq!(s.objects[*a].kind, Kind::Shared);
-        let Some(Value::Array(kids)) = root.get(Tag::of(b"Kids")) else { panic!() };
-        assert_eq!(kids[0], kids[1]);
-        let Value::Obj(Some(g)) = kids[0] else { panic!() };
-        assert_eq!(s.objects[g].chain, vec![Tag::of(b"Grup"), Tag::of(b"Node")]);
-        assert_eq!(root.get(Tag::of(b"Enum")), Some(&Value::Enum { id: 2, version: 1 }));
-        assert_eq!(root.get(Tag::of(b"Tile")), Some(&Value::Entry("d/3".into())));
-        assert_eq!(root.get(Tag::of(b"Null")), Some(&Value::Obj(None)));
-    }
-
-    #[test]
-    fn checksums_sizes_and_budgets_are_enforced() {
-        let d = doc();
-        let file = synth::container(&[("doc.dat", &d, Method::Zstd)], None);
-        // Flip a byte inside the compressed payload, past the "#Fil" tag at offset 72.
-        let mut broken = file.clone();
-        broken[90] ^= 0x55;
-        let mut a = Archive::open(&broken, Limits::default()).unwrap();
-        assert!(a.read("doc.dat").is_err());
-        let mut a = Archive::open(&file, Limits { max_entry: d.len() - 1, max_total: usize::MAX }).unwrap();
-        assert!(matches!(a.read("doc.dat"), Err(Error::Limit(_))));
-        let mut a = Archive::open(&file, Limits { max_entry: usize::MAX, max_total: d.len() + 1 }).unwrap();
-        a.read("doc.dat").unwrap();
-        assert!(matches!(a.read("doc.dat"), Err(Error::Limit(_))));
-    }
-
-    #[test]
-    fn a_declared_size_smaller_than_the_data_is_rejected_not_truncated() {
-        let big = vec![7u8; 1 << 20];
-        let mut file = synth::container(&[("doc.dat", &big, Method::Zlib)], None);
-        // Rewrite the declared size in the table to 1 KiB: decoding must stop and fail.
-        let fat = u64::from_le_bytes(file[16..24].try_into().unwrap()) as usize;
-        let size_at = fat + 59 + 5 + 8;
-        file[size_at..size_at + 8].copy_from_slice(&1024u64.to_le_bytes());
-        let mut a = Archive::open(&file, Limits::default()).unwrap();
-        assert_eq!(a.read("doc.dat").unwrap_err(), Error::Malformed("archive entry size mismatch"));
-    }
-
-    #[test]
-    fn libraries_and_cyclic_tables_are_rejected() {
-        let d = doc();
-        let mut file = synth::container(&[("doc.dat", &d, Method::Stored)], None);
-        let mut library = file.clone();
-        library[8..12].copy_from_slice(b"rAsA");
-        assert!(matches!(Archive::open(&library, Limits::default()), Err(Error::Unsupported(_))));
-        let fat = u64::from_le_bytes(file[16..24].try_into().unwrap());
-        let at = fat as usize + 4;
-        file[at..at + 8].copy_from_slice(&fat.to_le_bytes());
-        assert_eq!(Archive::open(&file, Limits::default()).unwrap_err(), Error::Malformed("allocation tables form a cycle"));
-    }
-
-    #[test]
-    fn hostile_streams_fail_cleanly() {
-        let deep = (0..2000).fold(Vec::new(), |inner, _| vec![(tag(b"Chld"), F::Obj(tag(b"Grup"), inner))]);
-        assert_eq!(stream::parse(&synth::stream(&deep)).unwrap_err(), Error::Limit("objects nested too deeply"));
-        // An array claiming four billion elements in a few bytes.
-        let huge = synth::stream(&[(tag(b"Big_"), F::Raw(vec![0x81, b'_', b'g', b'i', b'B', 0xff, 0xff, 0xff, 0xff, 0]))]);
-        assert_eq!(stream::parse(&huge).unwrap_err(), Error::Malformed("array longer than its data"));
-        let forward = synth::stream(&[(tag(b"Link"), F::Ref(99))]);
-        assert!(stream::parse(&forward).is_err());
-        let twice = synth::stream(&[(tag(b"A___"), F::Def(1, vec![tag(b"RGBA")], vec![])), (tag(b"B___"), F::Def(1, vec![tag(b"RGBA")], vec![]))]);
-        assert!(stream::parse(&twice).is_err());
-        let unknown = synth::stream(&[(tag(b"X___"), F::Raw(vec![0x0b, 1, 2, 3, 4]))]);
-        assert!(matches!(stream::parse(&unknown), Err(Error::Unsupported(_))));
-        let d = doc();
-        for end in 0..d.len() {
-            assert!(stream::parse(&d[..end]).is_err(), "{end}");
-        }
-    }
-
-    #[test]
-    fn a_small_compressed_entry_cannot_make_the_stream_allocate_gigabytes() {
-        // Each decoded value takes about 40 bytes, and a bool array packs eight in a byte: 16 MiB
-        // of zero bits, a few KiB once compressed, would ask for 2^27 values (about 4 GiB). An
-        // array of one-byte values just past the budget fails the same way, before allocating.
-        let field = |code: u8, n: u32, data: usize| {
-            let mut f = vec![0x80 | code];
-            f.extend(tag(b"Big_").0.to_le_bytes());
-            f.extend(n.to_le_bytes());
-            f.resize(f.len() + data, 0);
-            F::Raw(f)
-        };
-        let bools = 1u32 << 27;
-        let bytes = u32::try_from(stream::MAX_VALUES).unwrap() + 1;
-        for f in [field(0x29, bools, (bools / 8) as usize), field(0x01, bytes, bytes as usize)] {
-            let d = synth::stream(&[(tag(b"Big_"), f)]);
-            let file = synth::container(&[("doc.dat", &d, Method::Zstd)], None);
-            assert!(file.len() < d.len() / 100, "{} of {}", file.len(), d.len());
-            let entry = Archive::open(&file, Limits::default()).unwrap().read("doc.dat").unwrap();
-            assert_eq!(stream::parse(&entry).unwrap_err(), Error::Limit("too many values in the document stream"));
-        }
-    }
-
-    proptest! {
-        #![proptest_config(ProptestConfig::with_cases(512))]
-        #[test]
-        fn mutated_containers_and_streams_never_panic(edits in prop::collection::vec((0usize..4096, any::<u8>()), 1..24)) {
-            let d = doc();
-            for method in [Method::Stored, Method::Zlib, Method::Zstd] {
-                let mut file = synth::container(&[("doc.dat", &d, method)], None);
-                for (i, v) in &edits {
-                    let n = file.len();
-                    file[i % n] = *v;
-                }
-                if let Ok(bytes) = Archive::open(&file, Limits::default()).and_then(|mut a| a.read("doc.dat")) {
-                    let _ = stream::parse(&bytes);
-                }
-            }
-            let mut s = d.clone();
-            for (i, v) in &edits {
-                let n = s.len();
-                s[i % n] = *v;
-            }
-            let _ = stream::parse(&s);
-        }
-    }
-}
@@ -1,322 +0,0 @@
-//! Artistic and frame text: the story's characters with their font, size, colour, tracking and
-//! leading, the paragraph alignment and the first baseline. Layout (line breaks in frames, kerning,
-//! OpenType features) is left to the importing application.
-
-use crate::model::{Affine, Align, Point, Reader, Text, TextRun, rect};
-use crate::paint::{self, Color, Paint};
-use crate::stream::{ObjId, Value};
-
-/// Characters read per text node (stories are split into blocks; this caps hostile ones).
-const MAX_CHARS: usize = 1 << 20;
-/// Shared character attributes must not amplify into unbounded font/feature/gradient data.
-const MAX_ATTRIBUTE_BYTES: usize = 16 << 20;
-
-pub(crate) fn read(r: &mut Reader, id: ObjId, world: Affine) -> Option<Text> {
-    let s = r.s;
-    let story = s.obj(id, b"StSt")?;
-    let frame = s.obj(id, b"TxtH")?;
-    let artistic = s.is(frame, b"ArFr");
-    let bounds = s.floats::<4>(frame, b"FrmB").map(rect)?;
-    let mut runs = Vec::new();
-    let mut align = None;
-    let mut total = 0usize;
-    let mut placeholders = false;
-    let mut attribute_budget = Some(MAX_ATTRIBUTE_BYTES);
-    for block in s.objs(story, b"Blok") {
-        let Some(glyphs) = s.obj(block, b"Glyp") else {
-            r.warn("a text block without readable characters (left out)");
-            continue;
-        };
-        // Bound collection itself, including placeholders, before allocating the character buffer.
-        let budget = MAX_CHARS - total;
-
-        let mut chars: Vec<char> = match s.str(glyphs, b"Utf8") {
-            Some(t) => t.chars().take(budget + 1).collect(),
-            None => {
-                // Inline objects (page numbers, anchors) each take one index before the segment text.
-                let segments = s.objs(glyphs, b"Mixd");
-                if segments.is_empty() {
-                    r.warn("a text block without readable characters (left out)");
-                    continue;
-                }
-                let mut v = Vec::new();
-                for seg in segments {
-                    let inline = s.objs(seg, b"Glys").len();
-                    v.extend(std::iter::repeat_n('\u{FFFC}', inline.min(budget + 1 - v.len())));
-                    placeholders |= inline > 0;
-                    v.extend(s.str(seg, b"Utf8").unwrap_or_default().chars().take(budget + 1 - v.len()));
-                    if v.len() > budget {
-                        break;
-                    }
-                }
-                v
-            }
-        };
-        let truncated = chars.len() > budget;
-        if truncated {
-            chars.truncate(budget);
-            r.warn("text longer than a million characters (truncated)");
-        }
-        total += chars.len();
-        let mut start = 0usize;
-        for run in s.obj(block, b"GAtt").map(|g| s.objs(g, b"Runs")).unwrap_or_default() {
-            let Some(index) = s.int(run, b"Indx").and_then(|v| usize::try_from(v).ok()) else {
-                r.warn("invalid text attribute range (bounded; unassigned characters use defaults)");
-                continue;
-            };
-            let end = index.min(chars.len());
-            if index > chars.len() || end < start {
-                r.warn("invalid text attribute range (bounded; unassigned characters use defaults)");
-            }
-            if end <= start {
-                continue;
-            }
-            let text = characters(&chars, start, end);
-            start = end;
-            push_run(r, &mut runs, s.obj(run, b"Item"), text, world, &mut attribute_budget);
-        }
-        if start < chars.len() {
-            let text = characters(&chars, start, chars.len());
-            push_run(r, &mut runs, None, text, world, &mut attribute_budget);
-        }
-        for paragraph in s.obj(block, b"PAtt").map(|p| s.objs(p, b"Runs")).unwrap_or_default() {
-            if let Some(attrs) = s.obj(paragraph, b"Item") {
-                let paragraph = paragraph_align(r, attrs);
-                match align {
-                    None => align = Some(paragraph),
-                    Some(first) if first != paragraph => r.warn("mixed paragraph alignments (the first alignment is used)"),
-                    _ => {}
-                }
-            }
-        }
-        if truncated {
-            break;
-        }
-    }
-    if placeholders {
-        r.warn("text fields such as page numbers (left out of the text)");
-    }
-    let align = align.unwrap_or(Align::Left);
-    let first_baseline = bounds.y0 + s.f64(frame, b"ArtV").unwrap_or(0.0);
-    let anchor_x = match align {
-        Align::Center => (bounds.x0 + bounds.x1) / 2.0,
-        Align::Right => bounds.x1,
-        _ => bounds.x0,
-    };
-    if !artistic {
-        if s.objs(frame, b"ColW").len() > 1 || matches!(s.field(frame, b"ColW"), Some(Value::Array(a)) if a.len() > 1) {
-            r.warn("text frames with several columns (imported as one column)");
-        }
-        if s.class(id) == Some(crate::stream::Tag::of(b"TxtC")) {
-            r.warn("text frames with a curved outline (imported as rectangular frames)");
-        }
-    }
-    Some(Text { runs, align, anchor: Point { x: anchor_x, y: first_baseline }, frame: if artistic { None } else { Some(bounds) }, transform: world })
-}
-
-fn characters(chars: &[char], start: usize, end: usize) -> String {
-    chars.get(start..end).unwrap_or_default().iter().filter(|c| **c != '\0' && **c != '\u{FFFC}').collect()
-}
-
-fn push_run(r: &mut Reader, runs: &mut Vec<TextRun>, attrs: Option<ObjId>, text: String, world: Affine, attribute_budget: &mut Option<usize>) {
-    if text.is_empty() {
-        return;
-    }
-    let run = match attrs {
-        Some(attrs) if attribute_budget.is_some() => run_attrs(r, attrs, text, world, attribute_budget),
-        _ => {
-            // This is a recovery policy, not an assertion about unspecified Affinity attributes.
-            if attrs.is_none() {
-                r.warn("text without character attributes (characters preserved with default attributes)");
-            }
-            TextRun {
-                text,
-                postscript: String::new(),
-                family: String::new(),
-                weight: 400,
-                italic: false,
-                features: Vec::new(),
-                all_caps: false,
-                size: 12.0 * r.dpi / 72.0,
-                tracking: 0.0,
-                leading: None,
-                fill: Paint::Solid(Color::Gray { v: 0.0, a: 1.0 }),
-            }
-        }
-    };
-    runs.push(run);
-}
-
-fn slot<T: Copy>(v: Option<&Value>, i: usize, f: impl Fn(&Value) -> Option<T>) -> Option<T> {
-    match v? {
-        Value::Array(a) => a.get(i).and_then(f),
-        _ => None,
-    }
-}
-
-fn float(v: &Value) -> Option<f64> {
-    match v {
-        Value::Float(f) if f.is_finite() => Some(*f),
-        _ => None,
-    }
-}
-
-fn int(v: &Value) -> Option<i64> {
-    match v {
-        Value::Int(i) => Some(*i),
-        Value::UInt(u) => i64::try_from(*u).ok(),
-        _ => None,
-    }
-}
-
-fn run_attrs(r: &mut Reader, attrs: ObjId, text: String, world: Affine, attribute_budget: &mut Option<usize>) -> TextRun {
-    let s = r.s;
-    let doubles = s.field(attrs, b"Doub");
-    let ints = s.field(attrs, b"Ints");
-    let size = slot(doubles, 0, float).filter(|v| *v > 0.0 && *v < 1e6).unwrap_or(12.0 * r.dpi / 72.0);
-    let tracking = slot(doubles, 4, float).unwrap_or(0.0);
-    let leading = (slot(ints, 4, int) == Some(1)).then(|| slot(doubles, 13, float)).flatten().filter(|v| *v > 0.0);
-    let objects = match s.field(attrs, b"Objs") {
-        Some(Value::Array(a)) => a.iter().take(8).map(|v| if let Value::Obj(o) = v { *o } else { None }).collect(),
-        _ => Vec::new(),
-    };
-    let mut fill = match objects.first().copied().flatten().and_then(|f| paint::descriptor(r, f, world)) {
-        Some(fill) => fill,
-        None => {
-            r.warn("text without readable fill attributes (default black used)");
-            Paint::Solid(Color::Gray { v: 0.0, a: 1.0 })
-        }
-    };
-    // A single descriptor decode is bounded by paint::MAX_STOPS. Charge its owned stop data
-    // before keeping it; subsequent runs skip attribute decoding once the budget is exhausted.
-    if let Paint::Gradient(gradient) = &fill {
-        let bytes = gradient.stops.len().saturating_mul(std::mem::size_of::<paint::Stop>());
-        if !charge_attributes(r, attribute_budget, bytes) {
-            fill = Paint::Solid(Color::Gray { v: 0.0, a: 1.0 });
-        }
-    }
-    if attribute_budget.is_some() && objects.get(1).copied().flatten().and_then(|f| paint::descriptor(r, f, world)).is_some_and(|p| p != Paint::None)
-    {
-        r.warn("outlined (stroked) text");
-    }
-    if slot(doubles, 10, float).is_some_and(|h| (h - 1.0).abs() > 1e-3) {
-        r.warn("horizontally scaled text");
-    }
-    // A resolved font is populated on the emoji run of the public Affinity 3 text-runs file
-    // (Courier New requested, Segoe UI Emoji stored in RFnt). Empty RFnt records are common.
-    // Source: https://github.com/SethRobinson/Patchy/tree/de84eab550758b30fa062e479f5778cce7693b73/test-fixtures/af
-    let requested = s.obj(attrs, b"DFnt");
-    let resolved =
-        s.obj(attrs, b"RFnt").filter(|f| !s.str(*f, b"Famy").unwrap_or_default().is_empty() || !s.str(*f, b"Post").unwrap_or_default().is_empty());
-    let font = resolved.or(requested);
-    if let Some(resolved) = resolved {
-        let differs = [b"Famy", b"Post"]
-            .iter()
-            .any(|tag| s.str(resolved, tag).unwrap_or_default() != requested.and_then(|f| s.str(f, tag)).unwrap_or_default());
-        if differs {
-            r.warn("text uses a stored fallback font (imported with that font)");
-        }
-    }
-    if font.and_then(|f| s.int(f, b"Widh")).is_some_and(|w| w != 5) {
-        r.warn("font width variants (exact face depends on the installed PostScript font)");
-    }
-    let postscript = metadata_string(r, attribute_budget, font.and_then(|f| s.str(f, b"Post")).unwrap_or_default());
-    let family = metadata_string(r, attribute_budget, font.and_then(|f| s.str(f, b"Famy")).unwrap_or_default());
-    let (features, all_caps) = font_features(r, objects.get(7).copied().flatten(), attribute_budget);
-    let weight = font.and_then(|f| s.int(f, b"Wegt")).unwrap_or(400);
-    let weight = if (1..=1000).contains(&weight) {
-        weight
-    } else {
-        r.warn("invalid font weight (imported as regular)");
-        400
-    };
-    TextRun {
-        text,
-        postscript,
-        family,
-        weight,
-        italic: font.and_then(|f| s.bool(f, b"Ital")).unwrap_or(false),
-        features,
-        all_caps,
-        size,
-        tracking,
-        leading,
-        fill,
-    }
-}
-
-fn charge_attributes(r: &mut Reader, budget: &mut Option<usize>, bytes: usize) -> bool {
-    let Some(remaining) = *budget else { return false };
-    match remaining.checked_sub(bytes) {
-        Some(remaining) => {
-            *budget = Some(remaining);
-            true
-        }
-        None => {
-            *budget = None;
-            r.warn("text attribute budget exceeded (excess font names, features and gradients left out)");
-            false
-        }
-    }
-}
-
-fn metadata_string(r: &mut Reader, budget: &mut Option<usize>, value: &str) -> String {
-    let bytes = value.len().saturating_add(std::mem::size_of::<String>());
-    if value.is_empty() || !charge_attributes(r, budget, bytes) { String::new() } else { value.to_owned() }
-}
-
-/// The public Affinity 3 caps fixture stores `smcp` and the private `CAP\x01` selector in
-/// OtAt/Setn. Only the observed all-caps selector and boolean OpenType tags are mapped; other
-/// values are reported, never guessed. Standard tag syntax: https://learn.microsoft.com/en-us/typography/opentype/spec/featuretags
-fn font_features(r: &mut Reader, attrs: Option<ObjId>, attribute_budget: &mut Option<usize>) -> (Vec<String>, bool) {
-    let mut features = Vec::new();
-    let mut all_caps = false;
-    if attribute_budget.is_none() {
-        return (features, all_caps);
-    }
-    let s = r.s;
-    let Some(Value::Array(settings)) = attrs.and_then(|a| s.field(a, b"Setn")) else { return (features, all_caps) };
-    for (index, setting) in settings.iter().take(257).enumerate() {
-        if index == 256 {
-            r.warn("more than 256 text feature settings (truncated)");
-            break;
-        }
-        let Value::Obj(Some(setting)) = setting else {
-            r.warn("unreadable text feature settings (imported with defaults)");
-            continue;
-        };
-        let setting = *setting;
-        let tag = s.int(setting, b"Feat").and_then(|v| u32::try_from(v).ok()).map(u32::to_be_bytes);
-        let value = r.s.int(setting, b"Valu");
-        match (tag, value) {
-            (Some([b'C', b'A', b'P', 1]), Some(0 | 1)) => all_caps = value == Some(1),
-            (Some(tag), Some(value @ (0 | 1))) if tag.iter().all(u8::is_ascii_alphanumeric) => {
-                if !charge_attributes(r, attribute_budget, std::mem::size_of::<String>() + if value == 0 { 5 } else { 4 }) {
-                    break;
-                }
-                let name = String::from_utf8_lossy(&tag);
-                features.push(if value == 0 { format!("-{name}") } else { name.into_owned() });
-            }
-            _ => r.warn("text feature selectors or non-boolean OpenType settings (imported with defaults)"),
-        }
-    }
-    (features, all_caps)
-}
-
-fn paragraph_align(r: &mut Reader, p: ObjId) -> Align {
-    // Nonzero offsets in these slots are present in the public text-indent and text-para-spacing
-    // fixtures. Their layout is not represented by this importer; retain text and report the gap.
-    if (1..=6).any(|i| slot(r.s.field(p, b"Doub"), i, float).is_some_and(|v| v.abs() > 1e-9)) {
-        r.warn("paragraph indents or spacing (imported with defaults)");
-    }
-    match slot(r.s.field(p, b"Ints"), 0, int) {
-        Some(1) => Align::Center,
-        Some(2) => Align::Right,
-        Some(3) => Align::Justify,
-        Some(0) | None => Align::Left,
-        Some(_) => {
-            r.warn("an unknown paragraph alignment (imported as left)");
-            Align::Left
-        }
-    }
-}
@@ -1,204 +0,0 @@
-//! Original synthetic graph tests for bounded `.af` outline expansion. These model the reader's
-//! accepted schema, without using Affinity software, third-party parser code or external assets.
-#![cfg(feature = "synth")]
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use vectorcraft_affinity::{
-    Document, Limits,
-    model::{Kind, Path, Point},
-    synth::{self, F, Method, tag},
-};
-
-fn compound(id: u32, children: Vec<F>) -> F {
-    F::Def(id, vec![tag(b"Comp")], vec![(tag(b"Chld"), F::Shared(children))])
-}
-
-fn shape(id: u32, class: &[u8; 4], parameters: Vec<(vectorcraft_affinity::stream::Tag, F)>) -> F {
-    F::Def(
-        id,
-        vec![tag(b"ShpN")],
-        vec![(tag(b"ShpB"), F::F64s(vec![0.0, 0.0, 10.0, 20.0])), (tag(b"Shpe"), F::Def(id + 10_000, vec![tag(class)], parameters))],
-    )
-}
-
-fn read(definitions: Vec<F>, top: u32) -> Document {
-    let data = synth::stream(&[
-        (tag(b"Defs"), F::Shared(definitions)),
-        (
-            tag(b"DocR"),
-            F::Def(
-                1,
-                vec![tag(b"DocN")],
-                vec![(
-                    tag(b"Chld"),
-                    F::Shared(vec![F::Def(
-                        2,
-                        vec![tag(b"Sprd")],
-                        vec![(tag(b"SprB"), F::F64s(vec![0.0, 0.0, 400.0, 300.0])), (tag(b"Chld"), F::Shared(vec![F::Ref(top)]))],
-                    )]),
-                )],
-            ),
-        ),
-    ]);
-    let bytes = synth::container(&[("doc.dat", &data, Method::Zlib)], None);
-    vectorcraft_affinity::read(&bytes, Limits::default()).unwrap()
-}
-
-fn path(document: &Document) -> &Path {
-    match &document.spreads[0].nodes[0].kind {
-        Kind::Shape { path, .. } => path,
-        other => panic!("expected shape, got {other:?}"),
-    }
-}
-
-fn rejected(document: &Document, warning: &str) {
-    assert!(matches!(document.spreads[0].nodes[0].kind, Kind::Unsupported));
-    assert!(document.warnings.iter().any(|value| value.contains(warning)), "{:?}", document.warnings);
-}
-
-#[test]
-fn self_cycle_and_mutual_cycle_discard_the_entire_compound() {
-    // A valid first operand ensures a malformed later operand cannot leave a plausible partial path.
-    let rectangle = shape(100, b"ShNR", vec![]);
-    let self_cycle = compound(101, vec![F::Ref(100), F::Ref(101)]);
-    rejected(&read(vec![rectangle.clone(), self_cycle], 101), "compound outline that contains itself");
-    let mutual_cycle = compound(101, vec![F::Ref(100), compound(102, vec![F::Ref(101)])]);
-    rejected(&read(vec![rectangle, mutual_cycle], 101), "compound outline that contains itself");
-}
-
-#[test]
-fn deep_reference_chain_is_bounded_independently_of_stream_nesting() {
-    let mut definitions = vec![shape(100, b"ShNR", vec![])];
-    for id in 101..=250 {
-        definitions.push(compound(id, vec![F::Ref(id - 1)]));
-    }
-    rejected(&read(definitions, 250), "compound outlines nested deeper than 128 levels");
-}
-
-#[test]
-fn outline_at_the_depth_limit_is_still_imported() {
-    let mut definitions = vec![shape(100, b"ShNR", vec![])];
-    for id in 101..=227 {
-        definitions.push(compound(id, vec![F::Ref(id - 1)]));
-    }
-    let document = read(definitions, 227);
-    assert!(document.warnings.is_empty(), "{:?}", document.warnings);
-    assert_eq!(path(&document).subpaths.len(), 1);
-    assert_eq!(path(&document).subpaths[0].segments.len(), 3);
-}
-
-#[test]
-fn excessive_declared_curve_count_is_rejected_before_expansion() {
-    let curve = F::Def(
-        100,
-        vec![tag(b"PCrv")],
-        vec![(tag(b"Crvs"), F::Def(101, vec![tag(b"PCvD")], vec![(tag(b"Data"), F::Pos(vec![F::U8(0), F::U32(u32::MAX)]))]))],
-    );
-    rejected(&read(vec![curve], 100), "compound outlines exceeding the geometry work limit");
-}
-
-#[test]
-fn empty_shared_fanout_cannot_bypass_the_operand_visit_limit() {
-    // Only 21 on-disk objects, but an unbounded traversal would visit over two million operands.
-    let mut definitions = vec![compound(100, vec![])];
-    for id in 101..=120 {
-        definitions.push(compound(id, vec![F::Ref(id - 1), F::Ref(id - 1)]));
-    }
-    rejected(&read(definitions, 120), "compound outlines exceeding the operand visit limit");
-}
-
-#[test]
-fn shared_large_operands_are_charged_for_cumulative_geometry_work() {
-    // A small reference graph expands a 20,000-segment star. Count work across every reuse and
-    // transform, rather than permitting each individual operand's allocation limit repeatedly.
-    let mut definitions = vec![shape(100, b"ShSt", vec![(tag(b"Pnts"), F::I32(10_000))])];
-    for id in 101..=112 {
-        definitions.push(compound(id, vec![F::Ref(id - 1), F::Ref(id - 1)]));
-    }
-    rejected(&read(definitions, 112), "compound outlines exceeding the geometry work limit");
-}
-
-#[test]
-fn ordinary_nested_compound_preserves_repeated_operands_and_transforms() {
-    let mut rectangle = shape(100, b"ShNR", vec![]);
-    if let F::Def(_, _, fields) = &mut rectangle {
-        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 3.0, 0.0, 1.0, 7.0])));
-    }
-    let inner = compound(101, vec![F::Ref(100), F::Ref(100)]);
-    let mut outer = compound(102, vec![F::Ref(101)]);
-    if let F::Def(_, _, fields) = &mut outer {
-        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0, 0.0, 100.0, 0.0, 1.0, 200.0])));
-    }
-    let document = read(vec![rectangle, inner, outer], 102);
-    assert!(document.warnings.is_empty(), "{:?}", document.warnings);
-    let path = path(&document);
-    assert_eq!(path.subpaths.len(), 2);
-    assert_eq!(path.subpaths[0], path.subpaths[1]);
-    assert_eq!(path.subpaths[0].start, Point { x: 103.0, y: 207.0 });
-    assert_eq!(path.subpaths[0].segments.last().unwrap()[2], Point { x: 103.0, y: 227.0 });
-}
-
-#[test]
-fn overflowing_compound_transform_is_reported_before_processing_geometry() {
-    let mut child = shape(100, b"ShNR", vec![]);
-    if let F::Def(_, _, fields) = &mut child {
-        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0e308, 0.0, 0.0, 0.0, 1.0, 0.0])));
-    }
-    let mut outer = compound(101, vec![F::Ref(100)]);
-    if let F::Def(_, _, fields) = &mut outer {
-        fields.push((tag(b"Xfrm"), F::F64s(vec![1.0e308, 0.0, 0.0, 0.0, 1.0, 0.0])));
-    }
-    rejected(&read(vec![child, outer], 101), "compound operand with an invalid transform");
-}
-
-#[test]
-fn pie_angles_with_huge_finite_values_do_not_loop_or_emit_nonfinite_points() {
-    let document = read(vec![shape(100, b"ShPi", vec![(tag(b"AngS"), F::F64(1.0e308)), (tag(b"AngE"), F::F64(-1.0e308))])], 100);
-    for subpath in &path(&document).subpaths {
-        assert!(subpath.start.x.is_finite() && subpath.start.y.is_finite());
-        assert!(subpath.segments.len() <= 20);
-        assert!(subpath.segments.iter().flatten().all(|point| point.x.is_finite() && point.y.is_finite()));
-    }
-}
-
-#[test]
-fn wrapped_pie_angles_keep_the_same_geometry_as_the_positive_span() {
-    let make = |end| read(vec![shape(100, b"ShPi", vec![(tag(b"AngS"), F::F64(0.0)), (tag(b"AngE"), F::F64(end))])], 100);
-    assert_eq!(path(&make(-std::f64::consts::FRAC_PI_2)), path(&make(3.0 * std::f64::consts::FRAC_PI_2)));
-}
-
-/// `CTyp`: an array of corner-type enums (top left, top right, bottom right, bottom left).
-fn corner_types(ids: [u16; 4]) -> F {
-    let mut raw = vec![0xaa];
-    raw.extend(tag(b"CTyp").0.to_le_bytes());
-    raw.extend(4u32.to_le_bytes());
-    raw.extend(0u16.to_le_bytes());
-    raw.extend(ids.iter().flat_map(|id| id.to_le_bytes()));
-    F::Raw(raw)
-}
-
-#[test]
-fn unlocked_rectangle_corners_keep_their_own_radius_and_type() {
-    let p = |x: f64, y: f64| Point { x, y };
-    // 10×20 box: relative radii scale by 10. Round 5, round 1, straight 3, none.
-    let corners = |lock: Option<bool>| {
-        let mut fields = vec![(tag(b"ShCR"), F::F64s(vec![0.5, 0.1, 0.3, 0.0])), (tag(b"CTyp"), corner_types([0, 0, 1, 4]))];
-        fields.extend(lock.map(|l| (tag(b"Lock"), F::Bool(l))));
-        read(vec![shape(100, b"ShNR", fields)], 100)
-    };
-
-    let unlocked = corners(Some(false));
-    assert!(unlocked.warnings.is_empty(), "{:?}", unlocked.warnings);
-    let sub = &path(&unlocked).subpaths[0];
-    assert_eq!(sub.start, p(5.0, 0.0));
-    let ends: Vec<Point> = sub.segments.iter().map(|s| s[2]).collect();
-    assert_eq!(ends, [p(9.0, 0.0), p(10.0, 1.0), p(10.0, 17.0), p(7.0, 20.0), p(0.0, 20.0), p(0.0, 5.0), p(5.0, 0.0)]);
-    assert_eq!(sub.segments[3], [p(7.0, 20.0); 3], "the straight corner is a line");
-    assert_ne!(sub.segments[1][0], p(9.0, 0.0), "the round corner is a curve");
-
-    // Locked (the default): every corner follows the top left one.
-    let locked = corners(None);
-    let sub = &path(&locked).subpaths[0];
-    assert_eq!(sub.segments.len(), 8);
-    assert_eq!(sub.segments[3][2], p(5.0, 20.0));
-}
@@ -1,116 +0,0 @@
-//! Pixel retention on current Affinity 3 documents published under MIT by Patchy.
-//! Assertions use this reader's archive/stream and the original embedded image bytes;
-//! no third-party Affinity parser, source code or application is used as an oracle.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use vectorcraft_affinity::{
-    Archive, Limits,
-    model::{Affine, Document, Image, Kind, Node, Pixels},
-    stream,
-};
-
-#[path = "support/corpus.rs"]
-mod corpus;
-
-fn images(nodes: &[Node], out: &mut Vec<Image>) {
-    for node in nodes {
-        if let Kind::Image(image) = &node.kind {
-            out.push(image.clone());
-        }
-        images(&node.children, out);
-    }
-}
-
-fn read_fixture(name: &str) -> Option<(Vec<u8>, Document, Vec<Image>)> {
-    let dir = corpus::pinned()?;
-    let bytes = std::fs::read(dir.join(name)).unwrap();
-    let doc = vectorcraft_affinity::read(&bytes, Limits::default()).unwrap();
-    assert!(doc.saved_by.as_deref().unwrap().starts_with("Affinity 3."));
-    let mut out = Vec::new();
-    for spread in &doc.spreads {
-        images(&spread.nodes, &mut out);
-    }
-    Some((bytes, doc, out))
-}
-
-fn source(bytes: &[u8]) -> Vec<u8> {
-    let mut archive = Archive::open(bytes, Limits::default()).unwrap();
-    let doc = stream::parse(&archive.read("doc.dat").unwrap()).unwrap();
-    let bitmap =
-        doc.objects.iter().enumerate().find(|(_, o)| o.class == stream::Tag::of(b"DyBm") && o.get(stream::Tag::of(b"Bckg")).is_some()).unwrap().0;
-    let name = doc.entry(bitmap, b"Bckg").unwrap();
-    let block = stream::parse(&archive.read(name).unwrap()).unwrap();
-    block.bytes(block.root, b"Data").unwrap().to_vec()
-}
-
-#[test]
-fn source_backed_tiles_retain_the_embedded_jpeg_pixels() {
-    let Some((bytes, doc, images)) = read_fixture("patchy-embedded-jpeg.af") else { return };
-    assert!(doc.warnings.is_empty(), "{:?}", doc.warnings);
-    assert_eq!(images.len(), 1);
-    let image = &images[0];
-    assert_eq!((image.width, image.height), (400, 300));
-    assert_eq!(image.transform, Affine::IDENTITY);
-    let Pixels::Rgba8(pixels) = &image.pixels else { panic!("expected retained level-zero pixels") };
-    let expected = image::load_from_memory(&source(&bytes)).unwrap().into_rgba8();
-    assert_eq!(pixels.as_slice(), expected.as_raw());
-    assert!(pixels.as_chunks::<4>().0.iter().all(|p| p[3] == 255));
-    assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[0] != p[1]));
-}
-
-#[test]
-fn lazy_placed_images_keep_the_original_encoded_bytes() {
-    let Some((bytes, doc, images)) = read_fixture("patchy-lazy-placed.af") else { return };
-    assert!(doc.warnings.is_empty());
-    assert_eq!(images.len(), 1);
-    assert_eq!((images[0].width, images[0].height), (400, 300));
-    assert_eq!(images[0].transform, Affine::IDENTITY);
-    assert_eq!(images[0].pixels, Pixels::Encoded(source(&bytes)));
-}
-
-#[test]
-fn eight_and_sixteen_bit_channels_retain_the_same_pixel_pattern() {
-    let Some((_, doc8, images8)) = read_fixture("patchy-rgba8.af") else { return };
-    let (_, doc16, images16) = read_fixture("patchy-rgba16.af").unwrap();
-    assert!(doc8.warnings.is_empty());
-    assert!(doc16.warnings.is_empty());
-    assert_eq!(images8.len(), 1);
-    assert_eq!(images16, images8);
-    assert_eq!((images8[0].width, images8[0].height), (64, 48));
-    let Pixels::Rgba8(pixels) = &images8[0].pixels else { panic!() };
-    assert_eq!(pixels.len(), 64 * 48 * 4);
-    assert_eq!(&pixels[..4], &[0, 0, 0, 128]);
-    assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[3] < 255));
-    assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[0] != p[1]));
-    // Frozen pixel-retention baseline, including every alpha sample. It is not a render oracle.
-    assert_eq!(crc32fast::hash(pixels), 0xc8ee4dc1);
-}
-
-#[test]
-fn rotated_scaled_pixels_keep_the_full_affine_transform() {
-    let Some((_, doc, images)) = read_fixture("patchy-transform.af") else { return };
-    assert!(doc.warnings.is_empty());
-    assert_eq!(images.len(), 1);
-    assert_eq!((images[0].width, images[0].height), (80, 60));
-    let expected = [1.1742158910592235, 0.4286222593193142, -0.4286222593193142, 1.1742158910592235, 60.0, 40.0];
-    for (actual, expected) in images[0].transform.0.into_iter().zip(expected) {
-        assert!((actual - expected).abs() < 1e-12);
-    }
-    let Pixels::Rgba8(pixels) = &images[0].pixels else { panic!() };
-    assert_eq!(pixels.len(), 80 * 60 * 4);
-    assert!(pixels.as_chunks::<4>().0.iter().all(|p| p[3] == 255));
-    assert_eq!(crc32fast::hash(pixels), 0x3720a442);
-}
-
-#[test]
-fn cmyk_and_lab_losses_are_reported() {
-    let Some((_, cmyk, images)) = read_fixture("patchy-cmyk.af") else { return };
-    assert_eq!(images.len(), 1);
-    assert_eq!((images[0].width, images[0].height), (64, 48));
-    let Pixels::Rgba8(pixels) = &images[0].pixels else { panic!() };
-    assert_eq!(crc32fast::hash(pixels), 0x5872bb76);
-    assert_eq!(cmyk.warnings, ["CMYK pixel layers (converted to RGB without the document's colour profile)"]);
-    let (_, lab, images) = read_fixture("patchy-lab.af").unwrap();
-    assert!(images.is_empty());
-    assert_eq!(lab.warnings, ["pixel layers in grey, Lab or 32-bit formats"]);
-}
@@ -1,115 +0,0 @@
-//! Public Affinity documents: the pinned set `cargo xtask corpus --affinity` fetches into
-//! `corpus/affinity`, or any folder of `.af`/`.afdesign`/`.afphoto`/`.afpub` files named by
-//! `AFFINITY_SAMPLES` (searched recursively). CI requires a complete, checksum-verified pinned
-//! corpus via `AFFINITY_CORPUS_REQUIRED=1`; ordinary local runs may skip an absent corpus.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use std::path::{Path, PathBuf};
-
-use vectorcraft_affinity::{Archive, Limits, stream};
-
-#[path = "support/corpus.rs"]
-mod corpus;
-#[path = "support/features.rs"]
-mod features;
-
-fn files(dir: &Path, out: &mut Vec<PathBuf>) {
-    for e in std::fs::read_dir(dir).into_iter().flatten().flatten() {
-        let p = e.path();
-        if p.is_dir() {
-            files(&p, out);
-        } else if p.extension().and_then(|e| e.to_str()).is_some_and(|e| ["af", "afdesign", "afphoto", "afpub", "aftemplate"].contains(&e)) {
-            out.push(p);
-        }
-    }
-}
-
-fn samples() -> Option<PathBuf> {
-    let pinned = corpus::pinned();
-    std::env::var_os("AFFINITY_SAMPLES").map(PathBuf::from).or(pinned)
-}
-
-#[test]
-fn public_documents_parse_completely() {
-    let Some(dir) = samples() else { return };
-    let mut paths = Vec::new();
-    files(&dir, &mut paths);
-    assert!(!paths.is_empty(), "no Affinity documents under {dir:?}");
-    let mut failures = Vec::new();
-    for p in &paths {
-        let bytes = std::fs::read(p).unwrap();
-        let result = Archive::open(&bytes, Limits::default()).and_then(|mut a| {
-            let doc = a.read("doc.dat")?;
-            stream::parse(&doc).map(|s| s.objects.len())
-        });
-        match result {
-            Ok(n) => assert!(n > 0),
-            Err(e) => failures.push(format!("{}: {e}", p.display())),
-        }
-    }
-    assert!(failures.is_empty(), "{} of {} failed:\n{}", failures.len(), paths.len(), failures.join("\n"));
-    eprintln!("{} Affinity documents parsed", paths.len());
-}
-
-#[test]
-fn public_documents_map_to_the_model() {
-    let Some(dir) = samples() else { return };
-    let mut paths = Vec::new();
-    files(&dir, &mut paths);
-    assert!(!paths.is_empty(), "no Affinity documents under {dir:?}");
-    let mut warnings = std::collections::BTreeMap::<String, usize>::new();
-    let mut failures = Vec::new();
-    let (mut nodes, mut docs) = (0usize, 0usize);
-    fn count(n: &[vectorcraft_affinity::model::Node]) -> usize {
-        n.iter().map(|n| 1 + count(&n.children)).sum()
-    }
-    for p in &paths {
-        let bytes = std::fs::read(p).unwrap();
-        match vectorcraft_affinity::read(&bytes, Limits::default()) {
-            Ok(d) => {
-                docs += 1;
-                nodes += d.spreads.iter().map(|s| count(&s.nodes)).sum::<usize>();
-                for w in d.warnings {
-                    let key = w.split(" (").next().unwrap_or(&w).to_string();
-                    *warnings.entry(key).or_default() += 1;
-                }
-            }
-            Err(e) => failures.push(format!("{}: {e}", p.display())),
-        }
-    }
-    eprintln!("{docs} documents, {nodes} nodes");
-    for (w, n) in &warnings {
-        eprintln!("{n:4} documents: {w}");
-    }
-    assert!(failures.is_empty(), "{}", failures.join("\n"));
-}
-
-/// Measured structural baselines for actual Affinity 3 files. Unlike a parse-success test,
-/// this detects disappearing nodes, curves, runs, font names, artboards and loss warnings.
-/// It does not claim that an unsupported feature is faithfully rendered.
-#[test]
-fn affinity3_feature_retention_matches_pinned_signatures() {
-    let Some(dir) = corpus::pinned() else { return };
-    let expected = include_str!("support/affinity3-signatures.txt");
-    let mut checked = std::collections::BTreeSet::new();
-    for line in expected.lines().filter(|l| !l.starts_with('#') && !l.is_empty()) {
-        let (name, signature) = line.split_once('\t').expect("signature row must have a tab");
-        assert!(checked.insert(name), "duplicate fixture {name}");
-        let bytes = std::fs::read(dir.join(name)).unwrap();
-        let doc = vectorcraft_affinity::read(&bytes, Limits::default()).unwrap();
-        assert_eq!(
-            features::signature(&doc),
-            signature,
-            "{name}: imported feature retention changed; review the pinned input and warning changes before updating this baseline"
-        );
-        assert!(
-            doc.saved_by.as_deref().is_some_and(|v| v.starts_with("Affinity 3.")),
-            "{name}: expected an actual Affinity 3 document, got {:?}",
-            doc.saved_by
-        );
-    }
-    let manifest = include_str!("../../../xtask/affinity-corpus.sha256");
-    let af_names: std::collections::BTreeSet<_> =
-        manifest.lines().filter_map(|l| l.split_once("  ")).map(|(_, n)| n).filter(|n| n.ends_with(".af")).collect();
-    assert_eq!(checked, af_names, "every pinned .af file needs a reviewed structural baseline");
-}
@@ -1,33 +0,0 @@
-affinity3-mexican-guy.af	dpi=300;spreads=1;model_crc32=df3c417b;counts={"depth": 8, "fills": 169, "gradients": 0, "groups": 23, "nodes": 283, "opacity": 1, "segments": 1491, "shapes": 260, "strokes": 114, "subpaths": 264};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes) (114×)", "layer effects (shadows, glows, outlines, bevels…) (156×)"]
-affinity3-mexican-man.af	dpi=300;spreads=1;model_crc32=d0387de4;counts={"depth": 7, "fills": 277, "gradients": 2, "groups": 29, "nodes": 903, "segments": 3225, "shapes": 874, "strokes": 559, "subpaths": 881};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes) (545×)", "layer effects (shadows, glows, outlines, bevels…) (245×)"]
-affinity3-mexican-woman.af	dpi=300;spreads=1;model_crc32=b966f693;counts={"depth": 9, "fills": 527, "gradients": 0, "groups": 28, "nodes": 595, "segments": 3562, "shapes": 567, "strokes": 60, "subpaths": 570};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes) (54×)", "layer effects (shadows, glows, outlines, bevels…) (278×)"]
-affinity3-playing-cards.af	dpi=300;spreads=1;model_crc32=ac448123;counts={"depth": 5, "fills": 363, "gradients": 0, "groups": 758, "nodes": 1350, "segments": 4864, "shapes": 592, "strokes": 288, "subpaths": 656};boards=[];fonts={};warnings=["brush and pressure strokes (imported as plain strokes)", "layer effects (shadows, glows, outlines, bevels…) (339×)"]
-patchy-adjust-curves.af	dpi=72;spreads=1;model_crc32=10a37502;counts={"depth": 1, "images": 1, "nodes": 2, "unsupported": 1};boards=[];fonts={};warnings=["adjustment layers"]
-patchy-adjust-hsl.af	dpi=72;spreads=1;model_crc32=c65409b4;counts={"depth": 1, "images": 1, "nodes": 2, "unsupported": 1};boards=[];fonts={};warnings=["adjustment layers"]
-patchy-artboards.af	dpi=72;spreads=1;model_crc32=f1ae5644;counts={"artboards": 2, "depth": 2, "fills": 2, "gradients": 0, "nodes": 4, "segments": 7, "shapes": 2, "strokes": 0, "subpaths": 2};boards=["board-a:0.0000,0.0000,80.0000,60.0000", "board-b:100.0000,10.0000,160.0000,70.0000"];fonts={};warnings=[]
-patchy-blend-affinity.af	dpi=72;spreads=1;model_crc32=f6691ff9;counts={"depth": 2, "fills": 8, "gradients": 0, "images": 1, "layers": 1, "nodes": 10, "segments": 24, "shapes": 8, "strokes": 0, "subpaths": 8};boards=[];fonts={};warnings=["an unknown blend mode (imported as Normal) (2×)"]
-patchy-cmyk.af	dpi=72;spreads=1;model_crc32=5145b5a1;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=["CMYK pixel layers (converted to RGB without the document's colour profile)"]
-patchy-dpi300.af	dpi=300;spreads=1;model_crc32=0c23e7c8;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
-patchy-embedded-jpeg.af	dpi=72;spreads=1;model_crc32=090c674b;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
-patchy-fx-blur.af	dpi=72;spreads=1;model_crc32=3f1b8b44;counts={"depth": 1, "images": 2, "nodes": 2};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…) (2×)"]
-patchy-fx-gradient.af	dpi=72;spreads=1;model_crc32=e868c992;counts={"depth": 1, "images": 3, "nodes": 3};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…) (3×)"]
-patchy-fx.af	dpi=72;spreads=1;model_crc32=5a1c34ac;counts={"depth": 1, "images": 5, "nodes": 5};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…) (5×)"]
-patchy-group.af	dpi=72;spreads=1;model_crc32=c217ab38;counts={"depth": 2, "images": 3, "layers": 1, "nodes": 4};boards=[];fonts={};warnings=[]
-patchy-incremental-chain.af	dpi=72;spreads=1;model_crc32=63ad778e;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=["layer effects (shadows, glows, outlines, bevels…)"]
-patchy-lab.af	dpi=72;spreads=1;model_crc32=01e8a926;counts={"depth": 1, "nodes": 1, "unsupported": 1};boards=[];fonts={};warnings=["pixel layers in grey, Lab or 32-bit formats"]
-patchy-lazy-placed.af	dpi=72;spreads=1;model_crc32=9ce9937e;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
-patchy-live-filter.af	dpi=72;spreads=1;model_crc32=30c5f8ee;counts={"depth": 2, "fills": 2, "gradients": 0, "nodes": 4, "segments": 6, "shapes": 2, "strokes": 0, "subpaths": 2, "unsupported": 2};boards=[];fonts={};warnings=["adjustment layers", "unknown layers"]
-patchy-rgba16.af	dpi=72;spreads=1;model_crc32=1bb23571;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
-patchy-rgba8.af	dpi=72;spreads=1;model_crc32=1bb23571;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
-patchy-shapes-2.af	dpi=72;spreads=1;model_crc32=7828d3cd;counts={"depth": 1, "fills": 12, "gradients": 0, "nodes": 12, "segments": 62, "shapes": 12, "strokes": 0, "subpaths": 12};boards=[];fonts={};warnings=["cloud, heart, cog, callout, arrow, tear and other special shapes (imported as their bounding ellipse) (9×)"]
-patchy-shapes.af	dpi=72;spreads=1;model_crc32=7519f5fe;counts={"depth": 1, "fills": 4, "gradients": 0, "nodes": 4, "segments": 28, "shapes": 4, "strokes": 0, "subpaths": 4};boards=[];fonts={};warnings=[]
-patchy-text-artistic.af	dpi=72;spreads=1;model_crc32=b6137f6e;counts={"depth": 1, "nodes": 1, "text_chars": 5, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialMT:400:false"};warnings=[]
-patchy-text-caps.af	dpi=72;spreads=1;model_crc32=b5527e72;counts={"depth": 1, "nodes": 2, "text_chars": 21, "text_runs": 2, "texts": 2};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font) (2×)"]
-patchy-text-frame.af	dpi=72;spreads=1;model_crc32=7a2cd32d;counts={"depth": 1, "nodes": 1, "text_chars": 11, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialMT:400:false"};warnings=["paragraph indents or spacing (imported with defaults)"]
-patchy-text-indent.af	dpi=72;spreads=1;model_crc32=30ee834c;counts={"depth": 1, "nodes": 2, "text_chars": 104, "text_runs": 2, "texts": 2};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font) (2×)", "paragraph indents or spacing (imported with defaults) (2×)"]
-patchy-text-para-spacing.af	dpi=72;spreads=1;model_crc32=3d580ad2;counts={"depth": 1, "nodes": 1, "text_chars": 13, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font)", "paragraph indents or spacing (imported with defaults)"]
-patchy-text-rotated.af	dpi=72;spreads=1;model_crc32=ad77772a;counts={"depth": 1, "nodes": 1, "text_chars": 7, "text_runs": 1, "texts": 1};boards=[];fonts={"Arial:ArialNarrow:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font)"]
-patchy-text-runs.af	dpi=72;spreads=1;model_crc32=a8da3052;counts={"depth": 1, "nodes": 1, "text_chars": 7, "text_runs": 5, "texts": 1};boards=[];fonts={"Arial:ArialNarrow:400:false", "Courier New:CourierNewPSMT:400:false", "Segoe UI Emoji:SegoeUIEmoji:400:false", "Times New Roman:TimesNewRomanPSMT:400:false"};warnings=["font width variants (exact face depends on the installed PostScript font)", "paragraph indents or spacing (imported with defaults)", "text uses a stored fallback font (imported with that font)"]
-patchy-transform.af	dpi=72;spreads=1;model_crc32=f8807611;counts={"depth": 1, "images": 1, "nodes": 1};boards=[];fonts={};warnings=[]
-patchy-vector-mask.af	dpi=72;spreads=1;model_crc32=1851fd90;counts={"depth": 1, "fills": 2, "gradients": 0, "nodes": 2, "segments": 7, "shapes": 2, "strokes": 0, "subpaths": 2, "vector_masks": 1};boards=[];fonts={};warnings=["unknown layers attached to other layers (imported without them)"]
-patchy-vector.af	dpi=72;spreads=1;model_crc32=b89a91d3;counts={"depth": 1, "fills": 3, "gradients": 0, "nodes": 4, "segments": 17, "shapes": 4, "strokes": 2, "subpaths": 5};boards=[];fonts={};warnings=[]
@@ -1,30 +0,0 @@
-//! Shared pinned corpus gate: an installed corpus must be complete and unmodified.
-#![allow(dead_code)]
-
-use std::path::PathBuf;
-
-#[path = "../../../../xtask/src/sha256.rs"]
-mod sha256;
-
-pub fn pinned() -> Option<PathBuf> {
-    // This helper is compiled in both affinity and engine integration tests.
-    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../corpus/affinity");
-    let required = std::env::var_os("AFFINITY_CORPUS_REQUIRED").is_some_and(|v| v != "0");
-    if !dir.exists() {
-        assert!(!required, "required Affinity corpus absent: run `cargo xtask corpus --affinity`");
-        eprintln!("Affinity corpus absent: run `cargo xtask corpus --affinity` (CI sets AFFINITY_CORPUS_REQUIRED=1)");
-        return None;
-    }
-    assert!(dir.join("SOURCES.md").is_file(), "incomplete Affinity corpus: missing SOURCES.md; run `cargo xtask corpus --affinity`");
-    let manifest = include_str!("../../../../xtask/affinity-corpus.sha256");
-    let mut count = 0;
-    for line in manifest.lines().filter(|l| !l.trim().is_empty()) {
-        let (digest, name) = line.split_once("  ").expect("malformed pinned Affinity SHA256 manifest");
-        assert_eq!(digest.len(), 64, "invalid SHA256 for {name}");
-        let bytes = std::fs::read(dir.join(name)).unwrap_or_else(|e| panic!("missing pinned Affinity file {name}: {e}"));
-        assert_eq!(sha256::hex(&bytes), digest, "{name}: pinned corpus modified; run `cargo xtask corpus --affinity`");
-        count += 1;
-    }
-    assert!(count >= 4, "pinned Affinity manifest must include the four Affinity 3 .af fixtures");
-    Some(dir)
-}
@@ -1,63 +0,0 @@
-//! Structural regression signatures, measured from the pinned files through our own reader.
-//! These freeze feature retention; they are not independent visual or compatibility oracles.
-//! The model CRC covers every decoded field via its Debug representation (including paths,
-//! paint, masks, image pixels and text runs). A deliberate reader/Debug change needs review;
-//! input authenticity is independently checked with SHA256 by the corpus gate.
-use std::collections::{BTreeMap, BTreeSet};
-use vectorcraft_affinity::model::{Document, Kind, Node};
-use vectorcraft_affinity::paint::Paint;
-
-pub fn signature(doc: &Document) -> String {
-    fn visit(nodes: &[Node], counts: &mut BTreeMap<&'static str, usize>, fonts: &mut BTreeSet<String>, boards: &mut Vec<String>, depth: usize) {
-        for n in nodes {
-            *counts.entry("nodes").or_default() += 1;
-            counts.entry("depth").and_modify(|v| *v = (*v).max(depth)).or_insert(depth);
-            let key = match &n.kind {
-                Kind::Layer => "layers",
-                Kind::Group => "groups",
-                Kind::Artboard { rect, .. } => {
-                    boards.push(format!("{}:{:.4},{:.4},{:.4},{:.4}", n.name, rect.x0, rect.y0, rect.x1, rect.y1));
-                    "artboards"
-                }
-                Kind::Shape { path, fills, strokes, .. } => {
-                    *counts.entry("subpaths").or_default() += path.subpaths.len();
-                    *counts.entry("segments").or_default() += path.subpaths.iter().map(|p| p.segments.len()).sum::<usize>();
-                    *counts.entry("fills").or_default() += fills.len();
-                    *counts.entry("strokes").or_default() += strokes.len();
-                    *counts.entry("gradients").or_default() += fills.iter().filter(|p| matches!(p, Paint::Gradient(_))).count();
-                    "shapes"
-                }
-                Kind::Text(t) => {
-                    *counts.entry("text_runs").or_default() += t.runs.len();
-                    *counts.entry("text_chars").or_default() += t.runs.iter().map(|r| r.text.chars().count()).sum::<usize>();
-                    for r in &t.runs {
-                        fonts.insert(format!("{}:{}:{}:{}", r.family, r.postscript, r.weight, r.italic));
-                    }
-                    "texts"
-                }
-                Kind::Image(_) => "images",
-                Kind::Unsupported => "unsupported",
-            };
-            *counts.entry(key).or_default() += 1;
-            for (key, yes) in
-                [("hidden", !n.visible), ("vector_masks", n.mask.is_some()), ("pixel_masks", n.pixel_mask.is_some()), ("opacity", n.opacity < 1.0)]
-            {
-                if yes {
-                    *counts.entry(key).or_default() += 1;
-                }
-            }
-            visit(&n.children, counts, fonts, boards, depth + 1);
-        }
-    }
-    let (mut counts, mut fonts, mut boards) = (BTreeMap::new(), BTreeSet::new(), Vec::new());
-    for spread in &doc.spreads {
-        visit(&spread.nodes, &mut counts, &mut fonts, &mut boards, 1);
-    }
-    let model_crc32 = crc32fast::hash(format!("{:?}", doc.spreads).as_bytes());
-    format!(
-        "dpi={};spreads={};model_crc32={model_crc32:08x};counts={counts:?};boards={boards:?};fonts={fonts:?};warnings={:?}",
-        doc.dpi,
-        doc.spreads.len(),
-        doc.warnings
-    )
-}
@@ -1,170 +0,0 @@
-//! Original synthetic reader fixtures, shared by native and engine regression tests.
-//! These describe the reader's existing schema; no Affinity software or third-party parser was
-//! used to create them. They prove recovery/mapping behavior, not Affinity's layout or exporter.
-#![allow(dead_code)]
-
-use vectorcraft_affinity::synth::{self, F, Method, tag};
-
-pub fn array_f64(field: &[u8; 4], values: &[f64]) -> F {
-    let mut bytes = vec![0x8a];
-    bytes.extend(tag(field).0.to_le_bytes());
-    bytes.extend((values.len() as u32).to_le_bytes());
-    bytes.extend(values.iter().flat_map(|v| v.to_le_bytes()));
-    F::Raw(bytes)
-}
-
-pub fn array_i32(field: &[u8; 4], values: &[i32]) -> F {
-    let mut bytes = vec![0x87];
-    bytes.extend(tag(field).0.to_le_bytes());
-    bytes.extend((values.len() as u32).to_le_bytes());
-    bytes.extend(values.iter().flat_map(|v| v.to_le_bytes()));
-    F::Raw(bytes)
-}
-
-pub fn solid(alpha: f32) -> F {
-    F::Obj(
-        tag(b"FilS"),
-        vec![(
-            tag(b"Colr"),
-            F::Obj(tag(b"RGBA"), vec![(tag(b"_col"), F::Struct([0.2f32, 0.4, 0.6, alpha].iter().flat_map(|v| v.to_le_bytes()).collect()))]),
-        )],
-    )
-}
-
-pub fn attrs(family: &str, postscript: &str, weight: i32, italic: bool, size: f64) -> F {
-    let mut doubles = vec![0.0; 14];
-    doubles[0] = size;
-    doubles[4] = 0.025;
-    doubles[10] = 1.0;
-    doubles[13] = 30.0;
-    F::Obj(
-        tag(b"GAtt"),
-        vec![
-            (
-                tag(b"DFnt"),
-                F::Obj(
-                    tag(b"Font"),
-                    vec![
-                        (tag(b"Famy"), F::Str(family.into())),
-                        (tag(b"Post"), F::Str(postscript.into())),
-                        (tag(b"Wegt"), F::I32(weight)),
-                        (tag(b"Ital"), F::Bool(italic)),
-                    ],
-                ),
-            ),
-            (tag(b"Doub"), array_f64(b"Doub", &doubles)),
-            (tag(b"Ints"), array_i32(b"Ints", &[0, 0, 0, 0, 1])),
-            (tag(b"Objs"), F::Shared(vec![solid(1.0)])),
-        ],
-    )
-}
-
-pub fn run(end: i32, attrs: Option<F>) -> Vec<(vectorcraft_affinity::stream::Tag, F)> {
-    let mut fields = vec![(tag(b"Indx"), F::I32(end))];
-    if let Some(attrs) = attrs {
-        fields.push((tag(b"Item"), attrs));
-    }
-    fields
-}
-
-pub fn block(glyphs: F, runs: Vec<Vec<(vectorcraft_affinity::stream::Tag, F)>>, alignments: &[i32]) -> F {
-    F::Obj(
-        tag(b"StBl"),
-        vec![
-            (tag(b"Glyp"), glyphs),
-            (tag(b"GAtt"), F::Obj(tag(b"GlAS"), vec![(tag(b"Runs"), F::Objs(tag(b"GlAR"), runs))])),
-            (
-                tag(b"PAtt"),
-                F::Obj(
-                    tag(b"PaAS"),
-                    vec![(
-                        tag(b"Runs"),
-                        F::Objs(
-                            tag(b"PaAR"),
-                            alignments
-                                .iter()
-                                .map(|a| vec![(tag(b"Item"), F::Obj(tag(b"PAtt"), vec![(tag(b"Ints"), array_i32(b"Ints", &[*a]))]))])
-                                .collect(),
-                        ),
-                    )],
-                ),
-            ),
-        ],
-    )
-}
-
-pub fn utf8(text: &str) -> F {
-    F::Obj(tag(b"GStr"), vec![(tag(b"Utf8"), F::Str(text.into()))])
-}
-
-pub fn document(blocks: Vec<F>, frame: bool, dpi: f64, transform: [f64; 6]) -> Vec<u8> {
-    let text = F::Obj(
-        tag(if frame { b"TxtF" } else { b"TxtA" }),
-        vec![
-            (tag(b"StSt"), F::Obj(tag(b"Stry"), vec![(tag(b"Blok"), F::Shared(blocks))])),
-            (
-                tag(b"TxtH"),
-                F::Obj(
-                    tag(if frame { b"FrFr" } else { b"ArFr" }),
-                    vec![(tag(b"FrmB"), F::F64s(vec![10.0, 20.0, 210.0, 120.0])), (tag(b"ArtV"), F::F64(18.0))],
-                ),
-            ),
-            (tag(b"Xfrm"), F::F64s(transform.to_vec())),
-        ],
-    );
-    let mut root = vec![
-        (tag(b"UVCn"), F::Obj(tag(b"UVCn"), vec![(tag(b"UPPI"), F::F64(dpi))])),
-        (
-            tag(b"DocR"),
-            F::Obj(
-                tag(b"DocN"),
-                vec![(
-                    tag(b"Chld"),
-                    F::Shared(vec![F::Obj(
-                        tag(b"Sprd"),
-                        vec![(tag(b"SprB"), F::F64s(vec![0.0, 0.0, 400.0, 300.0])), (tag(b"Chld"), F::Shared(vec![text]))],
-                    )]),
-                )],
-            ),
-        ),
-    ];
-    let mut next_id = 1000;
-    for (_, value) in &mut root {
-        shared_objects(value, &mut next_id);
-    }
-    let stream = synth::stream(&root);
-    synth::container(&[("doc.dat", &stream, Method::Zlib)], None)
-}
-
-pub const IDENTITY: [f64; 6] = [1.0, 0.0, 0.0, 0.0, 1.0, 0.0];
-
-// Shared arrays require definitions/references, whereas inline fields use Obj. Give the original
-// fixture objects independent shared IDs without making the fixture descriptions noisy.
-fn shared_objects(value: &mut F, next_id: &mut u32) {
-    match value {
-        F::Shared(items) => {
-            for item in items {
-                if let F::Obj(class, fields) = item {
-                    let class = *class;
-                    let fields = std::mem::take(fields);
-                    *next_id += 1;
-                    *item = F::Def(*next_id, vec![class], fields);
-                }
-                shared_objects(item, next_id);
-            }
-        }
-        F::Obj(_, fields) | F::Def(_, _, fields) => {
-            for (_, value) in fields {
-                shared_objects(value, next_id);
-            }
-        }
-        F::Objs(_, items) => {
-            for fields in items {
-                for (_, value) in fields {
-                    shared_objects(value, next_id);
-                }
-            }
-        }
-        _ => {}
-    }
-}
@@ -1,322 +0,0 @@
-//! Synthetic `.af` version-12 text regression oracles; see support/text_fixture.rs for provenance.
-//! Unicode ranges below test the scalar-index contract corroborated by the pinned Affinity 3
-//! mixed-run fixture. Broad complex typography still needs independent visual validation.
-#![cfg(feature = "synth")]
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-mod support {
-    pub mod corpus;
-    pub mod text_fixture;
-}
-use support::text_fixture::*;
-use vectorcraft_affinity::{
-    Document, Limits,
-    model::{Align, Kind, Text},
-    paint::{Color, Paint},
-    synth::{F, tag},
-};
-
-fn read(blocks: Vec<F>) -> Document {
-    vectorcraft_affinity::read(&document(blocks, false, 96.0, IDENTITY), Limits::default()).unwrap()
-}
-fn text(d: &Document) -> &Text {
-    match &d.spreads[0].nodes[0].kind {
-        Kind::Text(t) => t,
-        other => panic!("expected text, got {other:?}"),
-    }
-}
-fn content(t: &Text) -> String {
-    t.runs.iter().map(|r| r.text.as_str()).collect()
-}
-fn warning(d: &Document, needle: &str) -> bool {
-    d.warnings.iter().any(|w| w.contains(needle))
-}
-
-#[test]
-fn mixed_fonts_keep_unicode_and_attribute_boundaries() {
-    let d = read(vec![block(
-        utf8("Aé😀e\u{301}אב日本\u{2028}x\u{2029}\0"),
-        vec![
-            run(3, Some(attrs("Family One", "FamilyOne-Regular", 400, false, 16.0))),
-            run(9, Some(attrs("Family Two", "FamilyTwo-BoldItalic", 700, true, 24.0))),
-            run(13, Some(attrs("Family Three", "FamilyThree-Light", 300, false, 20.0))),
-        ],
-        &[1],
-    )]);
-    let t = text(&d);
-    assert_eq!(t.runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["Aé😀", "e\u{301}אב日本", "\u{2028}x\u{2029}"]);
-    assert_eq!(content(t), "Aé😀e\u{301}אב日本\u{2028}x\u{2029}");
-    assert_eq!(
-        (t.runs[1].family.as_str(), t.runs[1].postscript.as_str(), t.runs[1].weight, t.runs[1].italic),
-        ("Family Two", "FamilyTwo-BoldItalic", 700, true)
-    );
-    assert_eq!((t.runs[1].size, t.runs[1].tracking, t.runs[1].leading), (24.0, 0.025, Some(30.0)));
-    assert!(matches!(t.runs[1].fill, Paint::Solid(Color::Rgb { a: 1.0, .. })));
-    assert_eq!(t.align, Align::Center);
-    assert_eq!((t.anchor.x, t.anchor.y), (110.0, 38.0));
-    assert!(d.warnings.is_empty(), "{:?}", d.warnings);
-}
-
-#[test]
-fn missing_attributes_and_uncovered_tail_preserve_characters() {
-    for runs in [vec![], vec![run(2, None)], vec![run(2, Some(attrs("First", "", 400, false, 14.0)))]] {
-        let d = read(vec![block(utf8("é😀 tail\0"), runs, &[])]);
-        assert_eq!(content(text(&d)), "é😀 tail");
-        assert!(warning(&d, "text without character attributes"));
-        assert!(matches!(text(&d).runs.last().unwrap().fill, Paint::Solid(Color::Gray { v: 0.0, a: 1.0 })));
-        assert_eq!(text(&d).runs.last().unwrap().size, 16.0); // Recovery default: 12 pt at 96 dpi.
-    }
-}
-
-#[test]
-fn malformed_ranges_do_not_discard_the_story() {
-    let mut missing = run(1, None);
-    missing.clear();
-    let d = read(vec![block(
-        utf8("abcdef"),
-        vec![missing, run(-1, None), run(3, Some(attrs("First", "", 400, false, 10.0))), run(2, None), run(i32::MAX, None)],
-        &[],
-    )]);
-    assert_eq!(content(text(&d)), "abcdef");
-    assert_eq!(text(&d).runs[0].text, "abc");
-    assert!(warning(&d, "invalid text attribute range"));
-}
-
-#[test]
-fn inline_fields_count_for_ranges_but_are_reported_and_omitted() {
-    let glyphs = F::Obj(
-        tag(b"GStr"),
-        vec![(
-            tag(b"Mixd"),
-            F::Objs(
-                tag(b"MixS"),
-                vec![
-                    vec![(tag(b"Glys"), F::Shared(vec![F::Obj(tag(b"FldN"), vec![])])), (tag(b"Utf8"), F::Str("é😀".into()))],
-                    vec![(tag(b"Utf8"), F::Str("尾\0".into()))],
-                ],
-            ),
-        )],
-    );
-    let d =
-        read(vec![block(glyphs, vec![run(3, Some(attrs("First", "", 400, false, 10.0))), run(5, Some(attrs("Second", "", 700, false, 15.0)))], &[])]);
-    assert_eq!(text(&d).runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["é😀", "尾"]);
-    assert!(warning(&d, "text fields such as page numbers"));
-}
-
-#[test]
-fn mixed_paragraph_alignments_are_explicitly_reported() {
-    let d = read(vec![block(utf8("one\u{2029}"), vec![run(4, None)], &[2]), block(utf8("two"), vec![run(3, None)], &[0, 1])]);
-    assert_eq!(content(text(&d)), "one\u{2029}two");
-    assert_eq!(text(&d).align, Align::Right);
-    assert!(warning(&d, "mixed paragraph alignments"));
-}
-
-#[test]
-fn unknown_alignment_and_invalid_font_weight_have_honest_fallbacks() {
-    let d = read(vec![block(utf8("test"), vec![run(4, Some(attrs("", "OnlyPostScript", -50, true, f64::NAN)))], &[99])]);
-    assert_eq!((text(&d).runs[0].weight, text(&d).runs[0].size), (400, 16.0));
-    assert_eq!(text(&d).align, Align::Left);
-    assert!(warning(&d, "invalid font weight"));
-    assert!(warning(&d, "unknown paragraph alignment"));
-}
-
-#[test]
-fn unreadable_block_does_not_remove_later_readable_text() {
-    let d = read(vec![F::Obj(tag(b"StBl"), vec![]), block(utf8("still here"), vec![], &[])]);
-    assert_eq!(content(text(&d)), "still here");
-    assert!(warning(&d, "a text block without readable characters"));
-}
-
-#[test]
-fn text_budget_preserves_prefix_and_reports_truncation() {
-    let d = read(vec![block(utf8(&"é".repeat((1 << 20) + 1)), vec![], &[]), block(utf8("later"), vec![], &[])]);
-    assert_eq!(content(text(&d)).chars().count(), 1 << 20);
-    assert!(content(text(&d)).chars().all(|c| c == 'é'));
-    assert!(warning(&d, "text longer than a million characters"));
-}
-
-#[test]
-fn boolean_opentype_and_observed_all_caps_selector_are_kept() {
-    let mut a = attrs("Family", "", 400, false, 12.0);
-    let settings = F::Obj(
-        tag(b"OtAt"),
-        vec![(
-            tag(b"Setn"),
-            F::Objs(
-                tag(b"OTFS"),
-                vec![
-                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"smcp"))), (tag(b"Valu"), F::I32(1))],
-                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"liga"))), (tag(b"Valu"), F::I32(0))],
-                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"CAP\x01"))), (tag(b"Valu"), F::I32(1))],
-                    vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"salt"))), (tag(b"Valu"), F::I32(2))],
-                ],
-            ),
-        )],
-    );
-    if let F::Obj(_, fields) = &mut a {
-        let objects = fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap();
-        objects.1 = F::Shared(vec![solid(1.0), F::Null, F::Null, F::Null, F::Null, F::Null, F::Null, settings]);
-    }
-    let d = read(vec![block(utf8("Mixed"), vec![run(5, Some(a))], &[])]);
-    assert_eq!(text(&d).runs[0].features, ["smcp", "-liga"]);
-    assert!(text(&d).runs[0].all_caps);
-    assert_eq!(content(text(&d)), "Mixed");
-    assert!(warning(&d, "non-boolean OpenType settings"));
-}
-
-#[test]
-fn stored_fallback_font_is_used_only_when_it_names_a_font() {
-    for (family, expected) in [("", "Requested"), ("Emoji Family", "Emoji Family")] {
-        let mut a = attrs("Requested", "RequestedPS", 700, true, 12.0);
-        if let F::Obj(_, fields) = &mut a {
-            fields.push((tag(b"RFnt"), F::Obj(tag(b"Font"), vec![(tag(b"Famy"), F::Str(family.into())), (tag(b"Wegt"), F::I32(400))])));
-        }
-        let d = read(vec![block(utf8("😀"), vec![run(1, Some(a))], &[])]);
-        assert_eq!(text(&d).runs[0].family, expected);
-        assert_eq!(warning(&d, "stored fallback font"), !family.is_empty());
-    }
-}
-
-#[test]
-fn real_affinity3_text_fixtures_confirm_unicode_and_caps_fields() {
-    let Some(corpus) = support::corpus::pinned() else { return };
-    // Files fetched at the commit and sha256 in xtask/affinity-corpus.sha256. No Patchy parser
-    // source was read; assertions describe this crate's parsing of its published MIT documents.
-    let load = |name: &str| vectorcraft_affinity::read(&std::fs::read(corpus.join(name)).unwrap(), Limits::default()).unwrap();
-    let d = load("patchy-text-runs.af");
-    let t = text(&d);
-    assert_eq!(t.runs.iter().map(|r| r.text.as_str()).collect::<Vec<_>>(), ["AB", "cd", "É", "😀", "X"]);
-    assert_eq!(t.runs[3].family, "Segoe UI Emoji");
-    assert_eq!(t.runs[4].family, "Courier New");
-    assert!(warning(&d, "stored fallback font"));
-    let d = load("patchy-text-caps.af");
-    let texts: Vec<_> = d.spreads[0].nodes.iter().filter_map(|n| if let Kind::Text(t) = &n.kind { Some(t) } else { None }).collect();
-    assert_eq!(texts.len(), 2);
-    assert!(texts[0].runs[0].all_caps);
-    assert_eq!(texts[1].runs[0].features, ["smcp"]);
-    for name in ["patchy-text-indent.af", "patchy-text-para-spacing.af"] {
-        let d = load(name);
-        assert!(warning(&d, "paragraph indents or spacing"), "{name}: {:?}", d.warnings);
-    }
-}
-
-proptest::proptest! {
-    #![proptest_config(proptest::test_runner::Config::with_cases(64))]
-    #[test]
-    fn arbitrary_unicode_survives_damaged_attribute_ranges(
-        chars in proptest::collection::vec(proptest::prelude::any::<char>(), 0..128),
-        ends in proptest::collection::vec(-10i32..200, 0..32),
-    ) {
-        let original: String = chars.into_iter().collect();
-        let expected: String = original.chars().filter(|c| *c != '\0' && *c != '\u{FFFC}').collect();
-        let d = read(vec![block(utf8(&original), ends.into_iter().map(|end| run(end, None)).collect(), &[])]);
-        proptest::prop_assert_eq!(content(text(&d)), expected);
-    }
-}
-
-#[test]
-fn partially_missing_attributes_use_visible_fill_but_explicit_no_fill_is_kept() {
-    let empty = F::Obj(tag(b"GAtt"), vec![]);
-    let none = F::Obj(tag(b"GAtt"), vec![(tag(b"Objs"), F::Shared(vec![F::Obj(tag(b"FilN"), vec![])]))]);
-    let d = read(vec![block(utf8("ab"), vec![run(1, Some(empty)), run(2, Some(none))], &[])]);
-    assert!(matches!(text(&d).runs[0].fill, Paint::Solid(Color::Gray { v: 0.0, a: 1.0 })));
-    assert_eq!(text(&d).runs[1].fill, Paint::None);
-    assert_eq!(content(text(&d)), "ab");
-    assert!(warning(&d, "without readable fill attributes"));
-}
-
-#[test]
-fn excessive_feature_settings_are_bounded_and_reported() {
-    let mut a = attrs("Family", "", 400, false, 12.0);
-    if let F::Obj(_, fields) = &mut a {
-        let settings = F::Obj(
-            tag(b"OtAt"),
-            vec![(
-                tag(b"Setn"),
-                F::Objs(
-                    tag(b"OTFS"),
-                    (0..257).map(|_| vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"smcp"))), (tag(b"Valu"), F::I32(1))]).collect(),
-                ),
-            )],
-        );
-        fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap().1 =
-            F::Shared(vec![solid(1.0), F::Null, F::Null, F::Null, F::Null, F::Null, F::Null, settings]);
-    }
-    let d = read(vec![block(utf8("x"), vec![run(1, Some(a))], &[])]);
-    assert_eq!(text(&d).runs[0].features.len(), 256);
-    assert!(warning(&d, "more than 256 text feature settings"));
-}
-
-#[test]
-fn shared_font_metadata_amplification_is_bounded_without_losing_characters() {
-    let mut a = attrs(&"F".repeat(16 * 1024), &"P".repeat(16 * 1024), 400, false, 12.0);
-    if let F::Obj(_, fields) = &mut a {
-        let settings = F::Obj(
-            tag(b"OtAt"),
-            vec![(
-                tag(b"Setn"),
-                F::Objs(
-                    tag(b"OTFS"),
-                    (0..256).map(|_| vec![(tag(b"Feat"), F::U32(u32::from_be_bytes(*b"smcp"))), (tag(b"Valu"), F::I32(1))]).collect(),
-                ),
-            )],
-        );
-        fields.iter_mut().find(|(t, _)| *t == tag(b"Objs")).unwrap().1 =
-            F::Shared(vec![solid(1.0), F::Null, F::Null, F::Null, F::Null, F::Null, F::Null, settings]);
-    }
-    let F::Obj(class, fields) = a else { panic!("attributes must be an object") };
-    let mut runs = vec![run(1, Some(F::Def(42, vec![class], fields)))];
-    runs.extend((2..=1000).map(|end| run(end, Some(F::Ref(42)))));
-    let d = read(vec![block(utf8(&"x".repeat(1000)), runs, &[])]);
-    let t = text(&d);
-    assert_eq!(content(t), "x".repeat(1000));
-    assert_eq!(t.runs.len(), 1000);
-    let metadata: usize = t
-        .runs
-        .iter()
-        .flat_map(|r| [&r.family, &r.postscript].into_iter().chain(r.features.iter()))
-        .filter(|s| !s.is_empty())
-        .map(|s| s.len() + std::mem::size_of::<String>())
-        .sum();
-    assert!(metadata <= 16 << 20, "shared metadata was amplified to {metadata} bytes");
-    assert_eq!(t.runs[0].family.len(), 16 * 1024);
-    assert_eq!(t.runs[0].features.len(), 256);
-    assert!(t.runs.last().unwrap().family.is_empty());
-    assert!(t.runs.last().unwrap().features.is_empty());
-    assert!(warning(&d, "text attribute budget exceeded"));
-}
-
-#[test]
-fn shared_gradient_attributes_are_bounded_without_losing_characters() {
-    let color =
-        F::Def(43, vec![tag(b"RGBA")], vec![(tag(b"_col"), F::Struct([0.2f32, 0.4, 0.6, 1.0].iter().flat_map(|v| v.to_le_bytes()).collect()))]);
-    let mut colors = vec![color];
-    colors.extend((1..1024).map(|_| F::Ref(43)));
-    let positions = (0..1024).map(|i| [(i as f32) / 1023.0, 0.5].iter().flat_map(|v| v.to_le_bytes()).collect()).collect();
-    let gradient = F::Obj(
-        tag(b"FilG"),
-        vec![(tag(b"Grad"), F::Obj(tag(b"Grad"), vec![(tag(b"Cols"), F::Shared(colors)), (tag(b"Posn"), F::Records(8, positions))]))],
-    );
-    let attrs = F::Def(42, vec![tag(b"GAtt")], vec![(tag(b"Objs"), F::Shared(vec![gradient]))]);
-    let mut runs = vec![run(1, Some(attrs))];
-    runs.extend((2..=1000).map(|end| run(end, Some(F::Ref(42)))));
-    let d = read(vec![block(utf8(&"x".repeat(1000)), runs, &[])]);
-    let t = text(&d);
-    assert_eq!(content(t), "x".repeat(1000));
-    assert_eq!(t.runs.len(), 1000);
-    let stop_count: usize = t
-        .runs
-        .iter()
-        .map(|r| match &r.fill {
-            Paint::Gradient(g) => g.stops.len(),
-            _ => 0,
-        })
-        .sum();
-    assert!(stop_count > 0);
-    assert!(stop_count * std::mem::size_of::<vectorcraft_affinity::paint::Stop>() <= 16 << 20);
-    let Paint::Gradient(first) = &t.runs[0].fill else { panic!("first gradient must fit") };
-    assert_eq!(first.stops.len(), 1024);
-    assert!(matches!(t.runs.last().unwrap().fill, Paint::Solid(_)));
-    assert!(warning(&d, "text attribute budget exceeded"));
-    assert!(!warning(&d, "text without character attributes"), "budget recovery must not claim source attributes are absent");
-}
@@ -4,21 +4,13 @@
 //! in the directions normal to the path. For nib axes `u`, `v` with semi-axes `a`, `b` the
 //! support point in direction `d` is `(a²(u·d)u + b²(v·d)v) / √(a²(u·d)² + b²(v·d)²)`, so the
 //! stroke's local width across direction `n` is `2·√(a²(u·n)² + b²(v·n)²)`.
-//!
-//! A Calligraphic brush with Pressure variation changes its nib along the stroke with the pen
-//! pressure recorded on it (`StrokeLayer::pressure`): the sweep is sampled densely and each
-//! sample takes the nib for the pressure there.

 use vectorcraft_color::Paint;
-use vectorcraft_doc::{Node, PressureProfile, StrokeLayer};
+use vectorcraft_doc::Node;
 use vectorcraft_geom::{BezPath, PathData, Point, SubPath, Vec2};

 use crate::track::{Rng, Track, normal, seed_of, tracks};
-use crate::{Bristle, BristleShape, Calligraphic, Variation, filled, tolerance};
-
-/// The most pieces a varying nib cuts one segment of a subpath into, and about how many samples
-/// it takes along a whole subpath.
-const MAX_STEPS: f64 = 1024.0;
+use crate::{Bristle, BristleShape, Calligraphic, filled, tolerance};

 /// An elliptical nib.
 #[derive(Clone, Copy, Debug)]
@@ -51,53 +43,39 @@ fn rot(base: Vec2, angle: f64) -> Vec2 {
    base * angle.cos() + normal(base) * angle.sin()
 }

-/// Samples (point, tangent, fraction of the track's length) along a track, with extra tangents
-/// fanned in at corners so the outer edge of the sweep follows the nib around the corner. `step`
-/// (for a nib that varies along the track): segments are cut into pieces at most that long.
-fn samples(t: &Track, step: Option<f64>) -> Vec<(Point, Vec2, f64)> {
+/// Samples (point, tangent) along a track, with extra tangents fanned in at corners so the
+/// outer edge of the sweep follows the nib around the corner.
+fn samples(t: &Track) -> Vec<(Point, Vec2)> {
    let mut out = vec![];
    let n = t.segments();
-    let len = t.len().max(1e-12);
    for i in 0..=n {
        let p = t.verts[i];
-        let f = t.cum[i] / len;
        if t.corner[i] {
            let (a, b) = t.in_out(i);
            let turn = a.cross(b).atan2(a.dot(b));
            let steps = (turn.abs() / 10f64.to_radians()).ceil().max(1.0) as usize;
            for k in 0..=steps {
-                out.push((p, rot(a, turn * k as f64 / steps as f64), f));
+                out.push((p, rot(a, turn * k as f64 / steps as f64)));
            }
        } else {
-            out.push((p, t.tangents[i], f));
-        }
-        if let Some(step) = step
-            && i < n
-        {
-            let seg = t.cum[i + 1] - t.cum[i];
-            let pieces = (seg / step).ceil().clamp(1.0, MAX_STEPS) as usize;
-            for k in 1..pieces {
-                let u = k as f64 / pieces as f64;
-                out.push((p.lerp(t.verts[i + 1], u), t.dirs[i], (t.cum[i] + seg * u) / len));
-            }
+            out.push((p, t.tangents[i]));
        }
    }
    out
 }

-/// The swept outline along `t` of the nib `nib(f)` (`f`: the fraction of the track's length) as
-/// closed subpaths. `step`: how often a varying nib is sampled (None: a constant nib).
-pub(crate) fn sweep(t: &Track, nib: &dyn Fn(f64) -> Nib, step: Option<f64>) -> Vec<SubPath> {
-    let s = samples(t, step);
-    let left: Vec<Point> = s.iter().map(|(p, tg, f)| *p + nib(*f).support(normal(*tg))).collect();
-    let right: Vec<Point> = s.iter().map(|(p, tg, f)| *p + nib(*f).support(-normal(*tg))).collect();
+/// The swept outline of `nib` along `t` as closed subpaths.
+pub(crate) fn sweep(t: &Track, nib: &Nib) -> Vec<SubPath> {
+    let s = samples(t);
+    let left: Vec<Point> = s.iter().map(|(p, tg)| *p + nib.support(normal(*tg))).collect();
+    let right: Vec<Point> = s.iter().map(|(p, tg)| *p + nib.support(-normal(*tg))).collect();
    if t.closed {
        let mut r = right;
        r.reverse();
        return vec![SubPath::polyline(&left, true), SubPath::polyline(&r, true)];
    }
-    let cap = |(p, tg, f): (Point, Vec2, f64), from: f64, to: f64, out: &mut Vec<Point>| {
-        let (steps, nib) = (16, nib(f));
+    let cap = |p: Point, tg: Vec2, from: f64, to: f64, out: &mut Vec<Point>| {
+        let steps = 16;
        for k in 1..steps {
            let ang = from + (to - from) * k as f64 / steps as f64;
            out.push(p + nib.support(rot(tg, ang)));
@@ -105,66 +83,31 @@ pub(crate) fn sweep(t: &Track, nib: &dyn Fn(f64) -> Nib, step: Option<f64>) -> V
    };
    let half = std::f64::consts::FRAC_PI_2;
    let mut poly = left.clone();
-    let (Some(&end), Some(&start)) = (s.last(), s.first()) else { return Vec::new() };
-    cap(end, half, -half, &mut poly);
+    let (Some(&(pe, te)), Some(&(ps, ts))) = (s.last(), s.first()) else { return Vec::new() };
+    cap(pe, te, half, -half, &mut poly);
    poly.extend(right.iter().rev());
-    cap(start, -half, -3.0 * half, &mut poly);
+    cap(ps, ts, -half, -3.0 * half, &mut poly);
    vec![SubPath::polyline(&poly, true)]
 }

-/// The stroke's angle, roundness and size: Random ones drawn for this stroke (from `rng`), the
-/// others the brush's values.
-fn randomized(c: &Calligraphic, rng: &mut Rng) -> [f64; 3] {
-    let mut out = [c.angle, c.roundness, c.size];
-    for ((v, var), mode) in out.iter_mut().zip(c.variation).zip(c.modes()) {
-        // Every value draws, so a stroke's random values stay the same whatever the other modes.
-        let r = rng.range(-var, var);
-        if mode == Variation::Random {
-            *v += r;
-        }
-    }
-    let [angle, round, size] = out;
-    [angle, round.clamp(1.0, 100.0), size.max(0.05)]
+fn randomized(c: &Calligraphic, rng: &mut Rng) -> (f64, f64, f64) {
+    let [va, vr, vs] = c.variation;
+    let angle = c.angle + rng.range(-va, va);
+    let round = (c.roundness + rng.range(-vr, vr)).clamp(1.0, 100.0);
+    let size = (c.size + rng.range(-vs, vs)).max(0.05);
+    (angle, round, size)
 }

-/// The nib's angle, roundness and size at pen pressure `p` (0..1): each Pressure value goes from
-/// the brush's value less its variation (lightest) to the value plus the variation (heaviest),
-/// kept within its range; the others are `base`'s.
-fn pressured(c: &Calligraphic, base: [f64; 3], p: f64) -> [f64; 3] {
-    let values = [c.angle, c.roundness, c.size];
-    let mut out = base;
-    for (i, (v, mode)) in out.iter_mut().zip(c.modes()).enumerate() {
-        let (Some(&value), Some(&var), Some(&(lo, hi))) = (values.get(i), c.variation.get(i), Calligraphic::RANGES.get(i)) else { continue };
-        if mode == Variation::Pressure {
-            let x = value + var * (2.0 * p.clamp(0.0, 1.0) - 1.0);
-            *v = if x.is_finite() { x.clamp(lo, hi) } else { value.clamp(lo, hi) };
-        }
-    }
-    let [angle, round, size] = out;
-    [angle, round.clamp(1.0, 100.0), size.max(0.05)]
-}
-
-pub(crate) fn calligraphic(c: &Calligraphic, bp: &BezPath, weight: f64, stroke: &StrokeLayer, name: &str) -> Vec<Node> {
+pub(crate) fn calligraphic(c: &Calligraphic, bp: &BezPath, weight: f64, paint: &Paint, name: &str) -> Vec<Node> {
    let mut rng = Rng::new(seed_of(bp, name));
-    let base = randomized(c, &mut rng);
-    let subs: Vec<SubPath> = if c.uses_pressure() {
-        let pressure = stroke.pressure.as_ref();
-        let nib = |f: f64| {
-            let [angle, round, size] = pressured(c, base, pressure.map_or(PressureProfile::MID, |p| p.at(f)));
-            Nib::new(angle, round / 100.0, size * weight)
-        };
-        // Flattened for the largest nib the pressure gives.
-        let size = pressured(c, base, 0.0)[2].max(pressured(c, base, 1.0)[2]) * weight;
-        tracks(bp, tolerance(size)).iter().flat_map(|t| sweep(t, &nib, Some((t.len() / MAX_STEPS).max(0.25)))).collect()
-    } else {
-        let [angle, round, size] = base;
-        let nib = Nib::new(angle, round / 100.0, size * weight);
-        tracks(bp, tolerance(size * weight)).iter().flat_map(|t| sweep(t, &|_| nib, None)).collect()
-    };
+    let (angle, round, size) = randomized(c, &mut rng);
+    let size = size * weight;
+    let nib = Nib::new(angle, round / 100.0, size);
+    let subs: Vec<SubPath> = tracks(bp, tolerance(size)).iter().flat_map(|t| sweep(t, &nib)).collect();
    if subs.is_empty() {
        return vec![];
    }
-    vec![filled(PathData::new(subs), &stroke.paint)]
+    vec![filled(PathData::new(subs), paint)]
 }

 /// Offset a track sideways by `d` (a polyline following it).
@@ -222,7 +165,7 @@ pub(crate) fn bristle(b: &Bristle, bp: &BezPath, weight: f64, paint: &Paint, nam
            let Some(sp) = offset_track(&t, off, t0.min(l * 0.3), t1.min(l * 0.3)) else { continue };
            let w = thick * (0.6 + 0.4 * edge) * rng.range(0.8, 1.2);
            let nib = Nib::new(0.0, 1.0, w);
-            let subs: Vec<SubPath> = tracks(&sp, tolerance(w)).iter().flat_map(|tt| sweep(tt, &|_| nib, None)).collect();
+            let subs: Vec<SubPath> = tracks(&sp, tolerance(w)).iter().flat_map(|tt| sweep(tt, &nib)).collect();
            if subs.is_empty() {
                continue;
            }
@@ -115,31 +115,3 @@ pub fn instance_art(art: &Node, inst: &Node) -> Node {
    }
    a
 }
-
-/// The solid colours of the fills and strokes under `nodes`, most used first (then in the order
-/// they first appear): the colours Brush Options offers as Hue Shift's key colour, the first being
-/// its default.
-pub fn art_colors<'a>(nodes: impl IntoIterator<Item = &'a Node>) -> Vec<Color> {
-    fn walk(n: &Node, seen: &mut std::collections::HashMap<String, (usize, usize, Color)>) {
-        for it in &n.appearance.items {
-            let (visible, paint) = match it {
-                AppearanceItem::Fill(f) => (f.visible, &f.paint),
-                AppearanceItem::Stroke(s) => (s.visible, &s.paint),
-            };
-            if let (true, Some(c)) = (visible, paint.color()) {
-                let order = seen.len();
-                seen.entry(c.to_hex()).or_insert((0, order, c)).0 += 1;
-            }
-        }
-        for c in n.children().into_iter().flatten() {
-            walk(c, seen);
-        }
-    }
-    let mut seen = std::collections::HashMap::new();
-    for n in nodes {
-        walk(n, &mut seen);
-    }
-    let mut v: Vec<(usize, usize, Color)> = seen.into_values().collect();
-    v.sort_by(|a, b| b.0.cmp(&a.0).then(a.1.cmp(&b.1)));
-    v.into_iter().map(|(.., c)| c).collect()
-}
@@ -26,7 +26,7 @@ fn group(children: Vec<Node>) -> Node {
 fn compound(paths: Vec<PathData>, c: Color) -> Node {
    let children = paths.into_iter().map(|p| Arc::new(Node::path(NodeId(0), p, Appearance::default()))).collect();
    let mut n = Node::new(NodeId(0), NodeKind::Compound { children, rule: FillRule::EvenOdd });
-    n.appearance = fill(c).into();
+    n.appearance = fill(c);
    n
 }

@@ -121,7 +121,7 @@ pub(crate) fn stitch_tile() -> Node {
    let dash = path(shapes::rounded_rectangle(Rect::new(1.5, -0.75, 8.5, 0.75), 0.75), Color::BLACK);
    // Invisible spacer that fixes the tile width.
    let mut spacer = path(shapes::rectangle(Rect::new(0.0, -0.75, 10.0, 0.75)), Color::BLACK);
-    spacer.appearance = Appearance::default().into();
+    spacer.appearance = Appearance::default();
    group(vec![spacer, dash])
 }

@@ -132,7 +132,7 @@ fn diamond_tile() -> Node {
 }

 fn calli(name: &str, angle: f64, roundness: f64, size: f64) -> Brush {
-    Brush { name: name.into(), kind: BrushKind::Calligraphic(Calligraphic { angle, roundness, size, ..Default::default() }) }
+    Brush { name: name.into(), kind: BrushKind::Calligraphic(Calligraphic { angle, roundness, size, variation: [0.0; 3] }) }
 }

 /// The default library.
@@ -172,7 +172,6 @@ pub fn defaults() -> &'static [Brush] {
                    rotation: (-180.0, 180.0),
                    rotation_relative_to_path: false,
                    colorization: Colorization::Tints,
-                    modes: None,
                }),
            },
            Brush {
@@ -185,7 +184,6 @@ pub fn defaults() -> &'static [Brush] {
                    rotation: (-35.0, 35.0),
                    rotation_relative_to_path: true,
                    colorization: Colorization::None,
-                    modes: None,
                }),
            },
            Brush {
@@ -23,7 +23,7 @@ use vectorcraft_color::Paint;
 use vectorcraft_doc::{Appearance, AppearanceItem, Document, FillLayer, Node, NodeId, NodeKind, StrokeLayer};
 use vectorcraft_geom::{BezPath, Rect};

-pub use colorize::{art_colors, colorize, instance_art, stain, tint_node};
+pub use colorize::{colorize, instance_art, stain, tint_node};
 pub use defaults::defaults;
 pub use serde_json;

@@ -71,15 +71,6 @@ impl BrushKind {
            BrushKind::Bristle(_) => "bristle",
        }
    }
-    /// How the brush's art takes the stroke colour (Calligraphic and Bristle brushes paint with it).
-    pub fn colorization(&self) -> Colorization {
-        match self {
-            BrushKind::Art(a) => a.colorization,
-            BrushKind::Scatter(s) => s.colorization,
-            BrushKind::Pattern(p) => p.colorization,
-            BrushKind::Calligraphic(_) | BrushKind::Bristle(_) => Colorization::None,
-        }
-    }
 }

 /// How brush art takes the stroke colour.
@@ -97,29 +88,6 @@ pub enum Colorization {
    HueShift { key: vectorcraft_color::Color },
 }

-impl Colorization {
-    pub const IDS: [&'static str; 4] = ["none", "tints", "tintsAndShades", "hueShift"];
-    /// The name brush definitions use (`method`).
-    pub fn id(&self) -> &'static str {
-        match self {
-            Colorization::None => "none",
-            Colorization::Tints => "tints",
-            Colorization::TintsAndShades => "tintsAndShades",
-            Colorization::HueShift { .. } => "hueShift",
-        }
-    }
-    /// The method named `id` (`key`: the key colour of Hue Shift).
-    pub fn parse(id: &str, key: vectorcraft_color::Color) -> Option<Self> {
-        Some(match id {
-            "none" => Colorization::None,
-            "tints" => Colorization::Tints,
-            "tintsAndShades" => Colorization::TintsAndShades,
-            "hueShift" => Colorization::HueShift { key },
-            _ => return None,
-        })
-    }
-}
-
 /// Calligraphic brush: an elliptical nib swept along the path. Sizes are at 1 pt stroke weight
 /// (the stroke weight scales the brush).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -131,69 +99,13 @@ pub struct Calligraphic {
    pub roundness: f64,
    /// Nib diameter in points.
    pub size: f64,
-    /// How far angle (°), roundness (%) and size (pt) vary each way, as [`Self::modes`] say.
+    /// Random variation per stroke: angle (°), roundness (%), size (pt).
    pub variation: [f64; 3],
-    /// How angle, roundness and size vary. `None` (brushes saved before there were modes): Random
-    /// where the variation is non-zero, else Fixed — see [`Calligraphic::modes`].
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub modes: Option<[Variation; 3]>,
 }

 impl Default for Calligraphic {
    fn default() -> Self {
-        Self { angle: 0.0, roundness: 100.0, size: 3.0, variation: [0.0; 3], modes: None }
-    }
-}
-
-impl Calligraphic {
-    /// The ranges of angle (°), roundness (%) and size (pt), and the most each varies.
-    pub const RANGES: [(f64, f64); 3] = [(-180.0, 180.0), (0.0, 100.0), (0.0, 1296.0)];
-    pub const MAX_VARIATION: [f64; 3] = [180.0, 100.0, 1296.0];
-
-    /// How angle, roundness and size vary.
-    pub fn modes(&self) -> [Variation; 3] {
-        self.modes.unwrap_or_else(|| self.variation.map(|v| if v != 0.0 { Variation::Random } else { Variation::Fixed }))
-    }
-    /// Does the pen's pressure change the nib?
-    pub fn uses_pressure(&self) -> bool {
-        self.modes().contains(&Variation::Pressure)
-    }
-}
-
-/// How a Calligraphic brush's angle, roundness or size varies (Brush Options). Saved by name: new
-/// modes are appended, never renamed.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum Variation {
-    /// Always the value.
-    #[default]
-    Fixed,
-    /// A random value within the variation either side, new for each stroke.
-    Random,
-    /// From the value less the variation at the lightest pen pressure to the value plus the
-    /// variation at the heaviest.
-    Pressure,
-}
-
-impl Variation {
-    pub const ALL: [Variation; 3] = [Variation::Fixed, Variation::Random, Variation::Pressure];
-    /// The name brush definitions use.
-    pub fn id(self) -> &'static str {
-        match self {
-            Variation::Fixed => "fixed",
-            Variation::Random => "random",
-            Variation::Pressure => "pressure",
-        }
-    }
-    pub fn label(self) -> &'static str {
-        match self {
-            Variation::Fixed => "Fixed",
-            Variation::Random => "Random",
-            Variation::Pressure => "Pressure",
-        }
-    }
-    pub fn parse(id: &str) -> Option<Self> {
-        Self::ALL.into_iter().find(|v| v.id() == id)
+        Self { angle: 0.0, roundness: 100.0, size: 3.0, variation: [0.0; 3] }
    }
 }

@@ -213,12 +125,6 @@ pub struct Scatter {
    /// Rotation relative to the path direction (else to the page).
    pub rotation_relative_to_path: bool,
    pub colorization: Colorization,
-    /// How size, spacing, scatter and rotation vary between their two values: Fixed takes the
-    /// first, Random any value between them, Pressure the first at the lightest pen pressure and
-    /// the second at the heaviest. `None` (brushes saved before there were modes): Random where
-    /// the two differ, else Fixed — see [`Scatter::modes`].
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub modes: Option<[Variation; 4]>,
 }

 impl Default for Scatter {
@@ -231,25 +137,10 @@ impl Default for Scatter {
            rotation: (0.0, 0.0),
            rotation_relative_to_path: false,
            colorization: Colorization::None,
-            modes: None,
        }
    }
 }

-impl Scatter {
-    /// The ranges of size (%), spacing (%), scatter (%) and rotation (°).
-    pub const RANGES: [(f64, f64); 4] = [(1.0, 10000.0), (1.0, 10000.0), (-1000.0, 1000.0), (-180.0, 180.0)];
-
-    /// Size, spacing, scatter and rotation, each as its (first, second) values.
-    pub fn values(&self) -> [(f64, f64); 4] {
-        [self.size, self.spacing, self.scatter, self.rotation]
-    }
-    /// How size, spacing, scatter and rotation vary.
-    pub fn modes(&self) -> [Variation; 4] {
-        self.modes.unwrap_or_else(|| self.values().map(|(a, b)| if a != b { Variation::Random } else { Variation::Fixed }))
-    }
-}
-
 /// Direction the art runs in the brush definition.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -289,11 +180,6 @@ pub struct ArtBrush {
    pub colorization: Colorization,
 }

-impl ArtBrush {
-    /// The range of the width (%).
-    pub const WIDTH_RANGE: (f64, f64) = (1.0, 1000.0);
-}
-
 impl Default for ArtBrush {
    fn default() -> Self {
        Self {
@@ -344,12 +230,6 @@ pub struct PatternBrush {
    pub colorization: Colorization,
 }

-impl PatternBrush {
-    /// The ranges of the scale and of the spacing (%).
-    pub const SCALE_RANGE: (f64, f64) = (1.0, 10000.0);
-    pub const SPACING_RANGE: (f64, f64) = (0.0, 10000.0);
-}
-
 impl Default for PatternBrush {
    fn default() -> Self {
        Self {
@@ -404,104 +284,12 @@ pub struct Bristle {
    pub stiffness: f64,
 }

-impl Bristle {
-    /// The ranges of the size (pt), the bristle length (%) and the other percentages.
-    pub const SIZE_RANGE: (f64, f64) = (0.1, 1296.0);
-    pub const LENGTH_RANGE: (f64, f64) = (25.0, 300.0);
-    pub const PERCENT_RANGE: (f64, f64) = (1.0, 100.0);
-}
-
 impl Default for Bristle {
    fn default() -> Self {
        Self { shape: BristleShape::RoundPoint, size: 6.0, length: 100.0, density: 50.0, thickness: 40.0, opacity: 75.0, stiffness: 50.0 }
    }
 }

-// ---------- validation ----------
-
-/// `v` within `(lo, hi)`; `fallback` (kept within too) when it isn't a number.
-fn within(v: f64, (lo, hi): (f64, f64), fallback: f64) -> f64 {
-    if v.is_finite() { v.clamp(lo, hi) } else { fallback.clamp(lo, hi) }
-}
-
-fn within_pair((a, b): (f64, f64), range: (f64, f64), fallback: f64) -> (f64, f64) {
-    (within(a, range, fallback), within(b, range, fallback))
-}
-
-impl Colorization {
-    /// A Hue Shift key colour that isn't a colour (components out of reach) becomes black.
-    fn sanitize(&mut self) {
-        if let Colorization::HueShift { key } = self
-            && !key.to_rgb().iter().all(|c| c.is_finite())
-        {
-            *key = vectorcraft_color::Color::BLACK;
-        }
-    }
-}
-
-impl Brush {
-    /// The art the brush is made of: a scatter or art brush's art, a pattern brush's tiles.
-    pub fn art(&self) -> Vec<&Node> {
-        match &self.kind {
-            BrushKind::Scatter(s) => vec![&s.art],
-            BrushKind::Art(a) => vec![&a.art],
-            BrushKind::Pattern(p) => {
-                std::iter::once(&p.side).chain([&p.outer_corner, &p.inner_corner, &p.start, &p.end].into_iter().flatten()).collect()
-            }
-            BrushKind::Calligraphic(_) | BrushKind::Bristle(_) => vec![],
-        }
-    }
-
-    /// Keep every value of the definition within its range (definitions come from files and
-    /// commands, so they are untrusted): numbers are clamped, non-numbers take the default.
-    pub fn sanitize(&mut self) {
-        match &mut self.kind {
-            BrushKind::Calligraphic(c) => {
-                let d = Calligraphic::default();
-                let [angle, roundness, size] = Calligraphic::RANGES;
-                c.angle = within(c.angle, angle, d.angle);
-                c.roundness = within(c.roundness, roundness, d.roundness);
-                c.size = within(c.size, size, d.size);
-                for (v, max) in c.variation.iter_mut().zip(Calligraphic::MAX_VARIATION) {
-                    *v = within(*v, (0.0, max), 0.0);
-                }
-            }
-            BrushKind::Scatter(s) => {
-                let d = Scatter::default();
-                let [size, spacing, scatter, rotation] = Scatter::RANGES;
-                s.size = within_pair(s.size, size, d.size.0);
-                s.spacing = within_pair(s.spacing, spacing, d.spacing.0);
-                s.scatter = within_pair(s.scatter, scatter, 0.0);
-                s.rotation = within_pair(s.rotation, rotation, 0.0);
-                s.colorization.sanitize();
-            }
-            BrushKind::Art(a) => {
-                a.width = within(a.width, ArtBrush::WIDTH_RANGE, 100.0);
-                if let ArtScale::BetweenGuides { start, end } = &mut a.scale {
-                    *start = within(*start, (0.0, 1.0), 0.0);
-                    *end = within(*end, (0.0, 1.0), 1.0);
-                }
-                a.colorization.sanitize();
-            }
-            BrushKind::Pattern(p) => {
-                p.scale = within(p.scale, PatternBrush::SCALE_RANGE, 100.0);
-                p.spacing = within(p.spacing, PatternBrush::SPACING_RANGE, 0.0);
-                p.colorization.sanitize();
-            }
-            BrushKind::Bristle(b) => {
-                let d = Bristle::default();
-                b.size = within(b.size, Bristle::SIZE_RANGE, d.size);
-                b.length = within(b.length, Bristle::LENGTH_RANGE, d.length);
-                for (v, fallback) in
-                    [(&mut b.density, d.density), (&mut b.thickness, d.thickness), (&mut b.opacity, d.opacity), (&mut b.stiffness, d.stiffness)]
-                {
-                    *v = within(*v, Bristle::PERCENT_RANGE, fallback);
-                }
-            }
-        }
-    }
-}
-
 // ---------- library ----------

 /// The brush library of `doc`: its stored brushes, or the defaults when it has none.
@@ -512,15 +300,9 @@ pub fn library(doc: &Document) -> Vec<Brush> {
    }
 }

-/// Parse a stored library value (malformed entries are skipped, values kept within their
-/// ranges — see [`Brush::sanitize`]).
+/// Parse a stored library value (malformed entries are skipped).
 pub fn parse_library(v: &serde_json::Value) -> Vec<Brush> {
-    let parse = |b: &serde_json::Value| {
-        let mut b: Brush = serde_json::from_value(b.clone()).ok()?;
-        b.sanitize();
-        Some(b)
-    };
-    v.as_array().map(|a| a.iter().filter_map(parse).collect()).unwrap_or_default()
+    v.as_array().map(|a| a.iter().filter_map(|b| serde_json::from_value(b.clone()).ok()).collect()).unwrap_or_default()
 }

 /// Store `lib` as the document's brush library.
@@ -563,13 +345,18 @@ fn tolerance(scale: f64) -> f64 {
 pub fn stroke_pieces(brush: &Brush, bp: &BezPath, stroke: &StrokeLayer) -> Vec<Node> {
    let w = if stroke.width > 0.0 { stroke.width } else { 1.0 };
    let mut out = match &brush.kind {
-        BrushKind::Calligraphic(c) => calli::calligraphic(c, bp, w, stroke, &brush.name),
+        BrushKind::Calligraphic(c) => calli::calligraphic(c, bp, w, &stroke.paint, &brush.name),
        BrushKind::Bristle(b) => calli::bristle(b, bp, w, &stroke.paint, &brush.name),
        BrushKind::Art(a) => warp::art(a, bp, w),
-        BrushKind::Scatter(s) => warp::scatter(s, bp, w, stroke.pressure.as_ref(), &brush.name),
+        BrushKind::Scatter(s) => warp::scatter(s, bp, w, &brush.name),
        BrushKind::Pattern(p) => warp::pattern(p, bp, w),
    };
-    let colorization = brush.kind.colorization();
+    let colorization = match &brush.kind {
+        BrushKind::Art(a) => a.colorization,
+        BrushKind::Scatter(s) => s.colorization,
+        BrushKind::Pattern(p) => p.colorization,
+        _ => Colorization::None,
+    };
    for n in &mut out {
        colorize(n, colorization, &stroke.paint);
    }
@@ -16,7 +16,7 @@ fn stroke(w: f64) -> StrokeLayer {
 }

 fn calli(angle: f64, roundness: f64, size: f64) -> Brush {
-    Brush { name: "c".into(), kind: BrushKind::Calligraphic(Calligraphic { angle, roundness, size, ..Default::default() }) }
+    Brush { name: "c".into(), kind: BrushKind::Calligraphic(Calligraphic { angle, roundness, size, variation: [0.0; 3] }) }
 }

 fn bounds(nodes: &[Node]) -> Rect {
@@ -118,7 +118,7 @@ fn art_brush_arc_length_mapping_is_linear() {
        Node::path(NodeId(0), shapes::rectangle(Rect::new(5.0, -1.0, 6.0, 1.0)), Appearance::basic(Paint::solid(Color::BLACK), Paint::None, 0.0));
    let frame = rect_art(10.0, 2.0);
    let mut spacer = frame.clone();
-    spacer.appearance = Appearance::default().into();
+    spacer.appearance = Appearance::default();
    let art = Node::group(NodeId(0), vec![std::sync::Arc::new(spacer), std::sync::Arc::new(marker)]);
    let out = stroke_pieces(&art_brush(art, ArtScale::Stretch), &line(0.0, 0.0, 300.0, 0.0), &stroke(1.0));
    let g = &out[0];
@@ -334,190 +334,3 @@ fn expand_keeps_fill_and_adds_pieces() {
    let plain = Node::path(NodeId(9), shapes::rectangle(Rect::new(0.0, 0.0, 1.0, 1.0)), Appearance::default_art());
    assert!(expand(&d, &plain).is_none());
 }
-
-/// A Calligraphic brush (round nib) whose size follows the pen pressure by `var` either way.
-fn pressure_calli(size: f64, var: f64) -> Brush {
-    let c = Calligraphic {
-        size,
-        variation: [0.0, 0.0, var],
-        modes: Some([Variation::Fixed, Variation::Fixed, Variation::Pressure]),
-        ..Default::default()
-    };
-    Brush { name: "p".into(), kind: BrushKind::Calligraphic(c) }
-}
-
-/// The stroke's half-width (largest |y|) among outline points with x in `x0..x1`.
-fn half_width(nodes: &[Node], x0: f64, x1: f64) -> f64 {
-    let mut pts = vec![];
-    for n in nodes {
-        all_points(n, &mut pts);
-    }
-    pts.iter().filter(|p| p.x >= x0 && p.x <= x1).map(|p| p.y.abs()).fold(0.0, f64::max)
-}
-
-fn pressed(points: Vec<(f64, f64)>) -> StrokeLayer {
-    StrokeLayer { pressure: Some(vectorcraft_doc::PressureProfile { points }), ..stroke(1.0) }
-}
-
-/// #852: with Size on Pressure the nib goes from size − variation at the lightest pressure to
-/// size + variation at the heaviest, along the stroke where the pen pressed.
-#[test]
-fn pressure_maps_to_size_along_the_stroke() {
-    let b = pressure_calli(10.0, 4.0);
-    let light_to_heavy = pressed(vec![(0.0, 0.0), (1.0, 1.0)]);
-    let out = stroke_pieces(&b, &line(0.0, 0.0, 100.0, 0.0), &light_to_heavy);
-    // Lightest: 6 pt (half 3); heaviest: 14 pt (half 7); in between the pressure there.
-    assert!(near(half_width(&out, 0.5, 1.5), 3.0, 0.1), "{}", half_width(&out, 0.5, 1.5));
-    assert!(near(half_width(&out, 98.5, 99.5), 7.0, 0.1), "{}", half_width(&out, 98.5, 99.5));
-    assert!(near(half_width(&out, 49.5, 50.5), 5.0, 0.1), "{}", half_width(&out, 49.5, 50.5));
-    // The stroke weight scales it.
-    let heavy = StrokeLayer { width: 2.0, ..light_to_heavy };
-    let out = stroke_pieces(&b, &line(0.0, 0.0, 100.0, 0.0), &heavy);
-    assert!(near(half_width(&out, 98.5, 99.5), 14.0, 0.2));
-    // No pressure recorded (a mouse, or a path the brush was applied to): the size itself.
-    let out = stroke_pieces(&b, &line(0.0, 0.0, 100.0, 0.0), &stroke(1.0));
-    assert!(near(bounds(&out).height(), 10.0, 0.05), "{:?}", bounds(&out));
-    // Kept within the valid range: 2 ± 4 never goes below nothing.
-    let out = stroke_pieces(&pressure_calli(2.0, 4.0), &line(0.0, 0.0, 100.0, 0.0), &pressed(vec![(0.0, 0.0), (1.0, 0.0)]));
-    assert!(!out.is_empty() && bounds(&out).height() < 0.2, "{:?}", bounds(&out));
-}
-
-/// Angle and roundness follow the pressure the same way, clamped to their ranges.
-#[test]
-fn pressure_varies_angle_and_roundness() {
-    let c = |modes| Calligraphic { angle: 0.0, roundness: 60.0, size: 10.0, variation: [90.0, 60.0, 0.0], modes: Some(modes) };
-    let horizontal = line(0.0, 0.0, 100.0, 0.0);
-    let draw = |c: Calligraphic, p: f64| {
-        let b = Brush { name: "a".into(), kind: BrushKind::Calligraphic(c) };
-        bounds(&stroke_pieces(&b, &horizontal, &pressed(vec![(0.0, p), (1.0, p)]))).height()
-    };
-    use Variation::{Fixed, Pressure};
-    // Angle 0 ± 90: heavy pressure stands the flat nib up across the stroke.
-    assert!(near(draw(c([Pressure, Fixed, Fixed]), 0.5), 6.0, 0.05));
-    assert!(near(draw(c([Pressure, Fixed, Fixed]), 1.0), 10.0, 0.05));
-    // Roundness 60 ± 60, kept within 1..100: light is a hairline, heavy is round.
-    let vertical = Calligraphic { angle: 90.0, ..c([Fixed, Pressure, Fixed]) };
-    let wide = |p| {
-        let b = Brush { name: "r".into(), kind: BrushKind::Calligraphic(vertical.clone()) };
-        bounds(&stroke_pieces(&b, &line(0.0, 0.0, 0.0, 100.0), &pressed(vec![(0.0, p), (1.0, p)]))).width()
-    };
-    assert!(near(wide(0.0), 0.1, 0.05), "{}", wide(0.0));
-    assert!(near(wide(1.0), 10.0, 0.05), "{}", wide(1.0));
-}
-
-/// Brushes saved before the variation modes keep their look: a variation means Random, none
-/// means Fixed, and they are written back without modes.
-#[test]
-fn brushes_without_modes_vary_randomly_as_before() {
-    let old: Brush = serde_json::from_value(serde_json::json!({"name": "x", "type": "calligraphic", "size": 8, "variation": [0, 0, 3]})).unwrap();
-    let BrushKind::Calligraphic(c) = &old.kind else { panic!() };
-    assert_eq!(c.modes, None);
-    assert_eq!(c.modes(), [Variation::Fixed, Variation::Fixed, Variation::Random]);
-    assert!(!c.uses_pressure());
-    assert!(serde_json::to_value(&old).unwrap().get("modes").is_none(), "written back as it was");
-    // The same strokes as the brush with its modes spelled out.
-    let explicit = Brush {
-        kind: BrushKind::Calligraphic(Calligraphic { modes: Some([Variation::Fixed, Variation::Fixed, Variation::Random]), ..c.clone() }),
-        ..old.clone()
-    };
-    let bp = preview_path(120.0, 24.0);
-    assert_eq!(stroke_pieces(&old, &bp, &stroke(1.0)), stroke_pieces(&explicit, &bp, &stroke(1.0)));
-    // Fixed ignores the variation; Random still draws a different size per stroke.
-    let fixed = Brush { kind: BrushKind::Calligraphic(Calligraphic { modes: Some([Variation::Fixed; 3]), ..c.clone() }), ..old.clone() };
-    assert!(near(bounds(&stroke_pieces(&fixed, &line(0.0, 0.0, 100.0, 0.0), &stroke(1.0))).height(), 8.0, 0.05));
-    // Recorded pressure changes nothing for a brush that doesn't use it.
-    assert_eq!(stroke_pieces(&old, &bp, &stroke(1.0)), stroke_pieces(&old, &bp, &pressed(vec![(0.0, 0.0), (1.0, 1.0)])));
-    // Modes are saved by name.
-    assert_eq!(serde_json::to_value(Variation::ALL).unwrap(), serde_json::json!(["fixed", "random", "pressure"]));
-    assert!(Variation::ALL.iter().all(|v| Variation::parse(v.id()) == Some(*v)));
-}
-
-/// Junk definitions and pressure never panic and never draw non-finite art.
-#[test]
-fn junk_pressure_brushes_draw_finite_art() {
-    let bp = preview_path(120.0, 24.0);
-    for (size, var) in [(1e308, 1e308), (-1e308, 1e308), (0.0, -1e308), (f64::MAX, f64::MAX)] {
-        for profile in [vec![], vec![(0.0, 2.0), (0.0, -1.0), (5.0, 0.5)], vec![(1.0, 1.0), (0.0, 0.0)]] {
-            let out = stroke_pieces(&pressure_calli(size, var), &bp, &pressed(profile));
-            let mut pts = vec![];
-            for n in &out {
-                all_points(n, &mut pts);
-            }
-            assert!(pts.iter().all(|p| p.x.is_finite() && p.y.is_finite()), "{size} {var}");
-        }
-    }
-}
-
-/// A scatter brush of 10 × 4 pt rectangles whose size goes from `lo` % to `hi` % as `mode` says.
-fn sized_scatter(lo: f64, hi: f64, mode: Variation) -> Brush {
-    let s = scatter_brush(100.0);
-    let BrushKind::Scatter(sc) = s.kind else { panic!("not a scatter brush") };
-    let modes = [mode, Variation::Fixed, Variation::Fixed, Variation::Fixed];
-    Brush { kind: BrushKind::Scatter(Scatter { size: (lo, hi), modes: Some(modes), ..sc }), ..s }
-}
-
-/// Scatter Brush Options: Fixed takes the first value, Pressure goes from the first at the
-/// lightest pen pressure to the second at the heaviest; brushes saved before modes keep their look.
-#[test]
-fn scatter_values_follow_their_modes() {
-    let bp = line(0.0, 0.0, 400.0, 0.0);
-    let heights =
-        |b: &Brush, st: &StrokeLayer| -> Vec<f64> { stroke_pieces(b, &bp, st).iter().map(|n| n.geometric_bounds().unwrap().height()).collect() };
-    // Fixed: every copy at 50 %, whatever the second value.
-    assert!(heights(&sized_scatter(50.0, 300.0, Variation::Fixed), &stroke(1.0)).iter().all(|h| near(*h, 2.0, 1e-6)));
-    // Pressure: light at the start (50 %: 2 pt tall), heavy at the end (300 %: 12 pt).
-    let ramp = pressed(vec![(0.0, 0.0), (1.0, 1.0)]);
-    let h = heights(&sized_scatter(50.0, 300.0, Variation::Pressure), &ramp);
-    let (first, last) = (h[0], h[h.len() - 1]);
-    assert!(near(first, 2.0, 0.1) && last > 10.0, "{h:?}");
-    assert!(h.windows(2).all(|w| w[1] >= w[0] - 1e-9), "grows with the pressure: {h:?}");
-    // Without recorded pressure, half way between the two.
-    assert!(heights(&sized_scatter(50.0, 300.0, Variation::Pressure), &stroke(1.0)).iter().all(|h| near(*h, 7.0, 1e-6)));
-    // No modes saved: Random where the values differ, as before; Fixed and Random draw the same.
-    let old = sized_scatter(50.0, 300.0, Variation::Random);
-    let BrushKind::Scatter(sc) = &old.kind else { panic!("not a scatter brush") };
-    assert_eq!(Scatter { modes: None, ..sc.clone() }.modes(), [Variation::Random, Variation::Fixed, Variation::Fixed, Variation::Fixed]);
-    let unsaved = Brush { kind: BrushKind::Scatter(Scatter { modes: None, ..sc.clone() }), ..old.clone() };
-    assert_eq!(stroke_pieces(&old, &bp, &stroke(1.0)), stroke_pieces(&unsaved, &bp, &stroke(1.0)));
-    assert!(serde_json::to_value(&unsaved).unwrap().get("modes").is_none(), "not saved when unset");
-}
-
-/// Definitions from files and commands are kept within their ranges.
-#[test]
-fn sanitize_keeps_values_within_their_ranges() {
-    let mut v = serde_json::to_value(sized_scatter(1e308, -1e308, Variation::Random)).unwrap();
-    v["rotation"] = serde_json::json!([720.0, -1e300]);
-    v["scatter"] = serde_json::json!([5000.0, 0.0]);
-    let lib = parse_library(&serde_json::json!([
-        v,
-        {"name": "a", "type": "art", "art": rect_art(10.0, 4.0), "width": 1e308, "scale": {"mode": "betweenGuides", "start": -3.0, "end": 9.0}},
-        {"name": "p", "type": "pattern", "side": rect_art(10.0, 4.0), "scale": 0.0, "spacing": -5.0},
-        {"name": "c", "type": "calligraphic", "angle": 400.0, "roundness": -1.0, "size": 1e9, "variation": [1e9, -1.0, 2.0]},
-        {"name": "b", "type": "bristle", "size": 0.0, "length": 1000.0, "density": 0.0},
-    ]));
-    let [s, a, p, c, b] = lib.as_slice() else { panic!("{lib:?}") };
-    let BrushKind::Scatter(s) = &s.kind else { panic!() };
-    assert_eq!((s.size, s.rotation, s.scatter), ((10000.0, 1.0), (180.0, -180.0), (1000.0, 0.0)));
-    let BrushKind::Art(a) = &a.kind else { panic!() };
-    assert_eq!((a.width, a.scale), (1000.0, ArtScale::BetweenGuides { start: 0.0, end: 1.0 }));
-    let BrushKind::Pattern(p) = &p.kind else { panic!() };
-    assert_eq!((p.scale, p.spacing), (1.0, 0.0));
-    let BrushKind::Calligraphic(c) = &c.kind else { panic!() };
-    assert_eq!((c.angle, c.roundness, c.size, c.variation), (180.0, 0.0, 1296.0, [180.0, 0.0, 2.0]));
-    let BrushKind::Bristle(b) = &b.kind else { panic!() };
-    assert_eq!((b.size, b.length, b.density), (0.1, 300.0, 1.0));
-}
-
-/// Hue Shift's key colour defaults to the art's most used colour.
-#[test]
-fn art_colors_list_the_most_used_first() {
-    let red = Color::rgb(1.0, 0.0, 0.0);
-    let blue = Color::rgb(0.0, 0.0, 1.0);
-    let path =
-        |c: Color| Node::path(NodeId(0), shapes::rectangle(Rect::new(0.0, 0.0, 1.0, 1.0)), Appearance::basic(Paint::solid(c), Paint::None, 0.0));
-    let g = Node::group(NodeId(0), vec![Arc::new(path(red)), Arc::new(path(blue)), Arc::new(path(blue))]);
-    assert_eq!(art_colors([&g]), vec![blue, red]);
-    let b = defaults().iter().find(|b| b.name == "Chain").unwrap();
-    assert_eq!(b.art().len(), 3, "the side and both corner tiles");
-    assert!(calli(0.0, 100.0, 3.0).art().is_empty());
-}
@@ -6,11 +6,11 @@

 use std::sync::Arc;

-use vectorcraft_doc::{Node, NodeKind, PressureProfile};
+use vectorcraft_doc::{Node, NodeKind};
 use vectorcraft_geom::{Affine, BezPath, PathData, PathEl, Point, Rect, SubPath};

 use crate::track::{Rng, Track, seed_of, tracks};
-use crate::{ArtBrush, ArtScale, Direction, PatternBrush, PatternFit, Scatter, Variation, tolerance};
+use crate::{ArtBrush, ArtScale, Direction, PatternBrush, PatternFit, Scatter, tolerance};

 /// Longest mapped segment (points in document space).
 const MAX_SEG: f64 = 1.5;
@@ -188,28 +188,13 @@ pub(crate) fn art(a: &ArtBrush, bp: &BezPath, weight: f64) -> Vec<Node> {
    out
 }

-/// One of a scatter brush's values for the next copy: Fixed takes the first of `(a, b)`, Random a
-/// value between them, Pressure the first at pen pressure 0 and the second at 1. Every value
-/// draws, so a copy's random values stay the same whatever the other modes.
-fn vary(rng: &mut Rng, (a, b): (f64, f64), mode: Variation, pressure: f64) -> f64 {
-    let r = rng.range(a, b);
-    match mode {
-        Variation::Fixed => a,
-        Variation::Random => r,
-        Variation::Pressure => a + (b - a) * pressure.clamp(0.0, 1.0),
-    }
-}
-
-pub(crate) fn scatter(sc: &Scatter, bp: &BezPath, weight: f64, pressure: Option<&PressureProfile>, name: &str) -> Vec<Node> {
+pub(crate) fn scatter(sc: &Scatter, bp: &BezPath, weight: f64, name: &str) -> Vec<Node> {
    let Some(b) = sc.art.geometric_bounds() else { return vec![] };
    let (aw, ah) = (b.width().max(1e-3), b.height().max(1e-3));
    let mut rng = Rng::new(seed_of(bp, name));
-    let [size_mode, spacing_mode, scatter_mode, rotation_mode] = sc.modes();
    let mut out = vec![];
    for t in tracks(bp, 0.05) {
        let l = t.len();
-        // The pen pressure at arc length `at` (half way without a recorded one).
-        let pressure_at = |at: f64| pressure.map_or(PressureProfile::MID, |p| p.at(if l > 1e-9 { at / l } else { 0.0 }));
        let mut s: Option<f64> = None;
        let mut guard = 0;
        loop {
@@ -217,10 +202,8 @@ pub(crate) fn scatter(sc: &Scatter, bp: &BezPath, weight: f64, pressure: Option<
            if guard > 20000 {
                break;
            }
-            // Size and spacing place the next copy, so they take the pressure at the last one.
-            let p = pressure_at(s.unwrap_or(0.0));
-            let size = vary(&mut rng, sc.size, size_mode, p).max(1.0) / 100.0 * weight;
-            let spacing = vary(&mut rng, sc.spacing, spacing_mode, p).max(1.0) / 100.0;
+            let size = rng.range(sc.size.0, sc.size.1).max(1.0) / 100.0 * weight;
+            let spacing = rng.range(sc.spacing.0, sc.spacing.1).max(1.0) / 100.0;
            let step = aw * size * spacing;
            let pos = match s {
                None => step / 2.0,
@@ -230,9 +213,8 @@ pub(crate) fn scatter(sc: &Scatter, bp: &BezPath, weight: f64, pressure: Option<
                break;
            }
            s = Some(pos);
-            let p = pressure_at(pos);
-            let off = vary(&mut rng, sc.scatter, scatter_mode, p) / 100.0 * ah * size;
-            let rot = vary(&mut rng, sc.rotation, rotation_mode, p).to_radians();
+            let off = rng.range(sc.scatter.0, sc.scatter.1) / 100.0 * ah * size;
+            let rot = rng.range(sc.rotation.0, sc.rotation.1).to_radians();
            let (p, tg) = t.frame(pos);
            let place = p + crate::track::normal(tg) * off;
            // Page rotation is counter-clockwise on screen (y-down), like the calligraphic angle.
@@ -129,7 +129,7 @@ fn default_ratio(h: &reader::Header) -> (Unit, f64) {

 /// The name of `$INSUNITS` code `code`.
 fn units_name(code: i64) -> &'static str {
-    const NAMES: [&str; 25] = [
+    const NAMES: [&str; 22] = [
        "Unitless",
        "Inches",
        "Feet",
@@ -152,9 +152,6 @@ fn units_name(code: i64) -> &'static str {
        "Light years",
        "Parsecs",
        "US survey feet",
-        "US survey inches",
-        "US survey yards",
-        "US survey miles",
    ];
    usize::try_from(code).ok().and_then(|i| NAMES.get(i)).copied().unwrap_or("Unitless")
 }
@@ -66,8 +66,6 @@ pub(crate) struct Build<'d, 'a> {
 /// The unit of `$INSUNITS` code `code` in points (0, unitless: none).
 pub(crate) fn insunits_points(code: i64) -> Option<f64> {
    let m = 72.0 / 0.0254;
-    // The US survey foot: exactly 1200/3937 m.
-    let survey_ft = m * 1200.0 / 3937.0;
    Some(match code {
        1 => 72.0,
        2 => 864.0,
@@ -89,10 +87,7 @@ pub(crate) fn insunits_points(code: i64) -> Option<f64> {
        18 => m * 1.495_978_707e11,
        19 => m * 9.460_730_472_580_8e15,
        20 => m * 3.085_677_581e16,
-        21 => survey_ft,
-        22 => survey_ft / 12.0,
-        23 => survey_ft * 3.0,
-        24 => survey_ft * 5280.0,
+        21 => m * 1200.0 / 3937.0,
        _ => return None,
    })
 }
@@ -479,7 +474,7 @@ impl<'d, 'a> Build<'d, 'a> {
                .into_iter()
                .map(|sp| {
                    let mut c = Node::new(self.doc.alloc_id(), kind(PathData::single(sp)));
-                    c.appearance = appearance.clone().into();
+                    c.appearance = appearance.clone();
                    Arc::new(c)
                })
                .collect();
@@ -487,7 +482,7 @@ impl<'d, 'a> Build<'d, 'a> {
        } else {
            Node::new(self.doc.alloc_id(), kind(path))
        };
-        n.appearance = appearance.into();
+        n.appearance = appearance;
        Some(n)
    }

@@ -473,14 +473,7 @@ fn spline(g: &[Pair<'_>]) -> Option<BezPath> {
    let knots: Vec<f64> = g.iter().filter(|p| p.code == 40).map(|p| number(p.value)).collect::<Option<_>>()?;
    let weights: Vec<f64> = g.iter().filter(|p| p.code == 41).filter_map(|p| number(p.value)).collect();
    let weights = (flags & 4 != 0 && weights.len() == ctrl.len()).then_some(weights.as_slice());
-    curve::nurbs(degree, &knots, &ctrl, weights)
-        .map(|mut path| {
-            if flags & 1 != 0 {
-                path.close_path();
-            }
-            path
-        })
-        .or_else(|| curve::through(&points(g, 11)?, flags & 1 != 0))
+    curve::nurbs(degree, &knots, &ctrl, weights).or_else(|| curve::through(&points(g, 11)?, flags & 1 != 0))
 }

 /// Reads a hatch's boundary groups in order.
@@ -128,20 +128,6 @@ fn units_choose_the_default_scale() {
    let um = info(&drawing(&[(9, "$INSUNITS"), (70, "13")], &[], &[], LINE)).unwrap();
    assert_eq!((um.unit, um.units.as_str()), (Unit::Millimeters, "Microns"));
    assert!((um.scale - 1000.0).abs() < 1e-6);
-    // #1011: US survey inches, yards and miles (from the survey foot, 1200/3937 m), not unitless.
-    let survey_ft = 72.0 / 0.0254 * 1200.0 / 3937.0;
-    for (code, name, pt) in [
-        ("21", "US survey feet", survey_ft),
-        ("22", "US survey inches", survey_ft / 12.0),
-        ("23", "US survey yards", survey_ft * 3.0),
-        ("24", "US survey miles", survey_ft * 5280.0),
-    ] {
-        let i = info(&drawing(&[(9, "$INSUNITS"), (70, code)], &[], &[], LINE)).unwrap();
-        assert_eq!((i.unit, i.units.as_str()), (Unit::Millimeters, name));
-        assert!((i.scale * pt - 72.0 / 25.4).abs() < 1e-9, "{name}: 1 mm is {} units", i.scale);
-    }
-    let survey_in = open(&drawing(&[(9, "$INSUNITS"), (70, "22")], &[], &[], LINE), &ImportOptions::default()).document;
-    assert!((survey_in.artboards[0].rect.width() - 7200.0144000288).abs() < 1e-6, "{:?}", survey_in.artboards[0].rect);
    let imperial = info(&drawing(&[(9, "$MEASUREMENT"), (70, "0")], &[], &[], LINE)).unwrap();
    assert_eq!((imperial.unit, imperial.scale), (Unit::Inches, 1.0));
    // A ratio: 1 cm = 10 units is 1:1 in millimetres again.
@@ -270,53 +256,6 @@ fn nurbs_splines_stay_within_a_hundredth() {
    assert!(path_points(s).iter().any(|p| p.distance(Point::new(50.0, h - 40.0)) < 1e-9));
 }

-#[test]
-fn control_point_splines_honor_closed_flags_without_changing_their_curves() {
-    for returns in [false, true] {
-        for rational in [false, true] {
-            let mut original_curves = None;
-            for closed in [false, true] {
-                let flags = 8 | if rational { 4 } else { 0 } | i32::from(closed);
-                let mut e = vec![(0, "SPLINE".to_string()), (70, flags.to_string()), (71, "3".into()), (72, "11".into()), (73, "7".into())];
-                for k in [0, 0, 0, 0, 1, 1, 1, 2, 2, 2, 2] {
-                    e.push((40, k.to_string()));
-                }
-                let end = if returns { (20.0, 20.0) } else { (50.0, 25.0) };
-                for ((x, y), weight) in [(20.0, 20.0), (80.0, 0.0), (80.0, 80.0), (20.0, 80.0), (0.0, 80.0), (0.0, 20.0), end]
-                    .into_iter()
-                    .zip([1.0, 0.7, 0.7, 1.0, 0.9, 0.9, 1.0])
-                {
-                    e.extend([(10, x.to_string()), (20, y.to_string()), (30, "0".into())]);
-                    if rational {
-                        e.push((41, weight.to_string()));
-                    }
-                }
-                let e: Vec<_> = e.iter().map(|(c, v)| (*c, v.as_str())).collect();
-                let doc = open(&entities(&e), &points()).document;
-                let [n] = &leaves(&doc)[..] else { panic!("one spline") };
-                let path = n.path_data().unwrap();
-                assert_eq!(path.subpaths.len(), 1);
-                assert_eq!(path.subpaths[0].closed, closed, "flags {flags}, returns {returns}");
-                let curves: Vec<_> = path.to_bezpath().elements().iter().filter(|e| matches!(e, kurbo::PathEl::CurveTo(..))).copied().collect();
-                assert!(!curves.is_empty());
-                if let Some(original) = &original_curves {
-                    assert_eq!(&curves, original, "closure preserves the rational/non-rational curves");
-                } else {
-                    original_curves = Some(curves);
-                }
-            }
-        }
-    }
-    for flags in [8, 9] {
-        let flags_text = flags.to_string();
-        let e =
-            [(0, "SPLINE"), (70, flags_text.as_str()), (71, "3"), (74, "3"), (11, "0"), (21, "0"), (11, "50"), (21, "40"), (11, "100"), (21, "0")];
-        let doc = open(&entities(&e), &points()).document;
-        let [n] = &leaves(&doc)[..] else { panic!("one fit-point spline") };
-        assert_eq!(n.path_data().unwrap().subpaths[0].closed, flags & 1 != 0, "fit-point fallback stays closed/open");
-    }
-}
-
 /// A square with a round hole: a polyline loop and a loop of one edge (a whole arc).
 fn hatch(solid: &'static str) -> Vec<(i32, &'static str)> {
    vec![
@@ -2,9 +2,9 @@
 //!
 //! [`export`] writes the visible art of a document into one DXF drawing: each layer becomes a DXF
 //! layer (hidden ones switched off, locked ones locked, non-printing ones not plotted), paths
-//! become polylines (straight segments) or cubic splines (curves), fills their outlines and solid
-//! hatches, type text entities or glyph outlines, and placed images image entities linked to PNG
-//! or JPEG files the caller writes next to the drawing. Coordinates are y-up, in drawing units: `scale` units per
+//! become polylines (straight segments) or cubic splines (curves), fills solid hatches, type text
+//! entities or glyph outlines, and placed images image entities linked to PNG or JPEG files the
+//! caller writes next to the drawing. Coordinates are y-up, in drawing units: `scale` units per
 //! `unit` of the art, with the origin at the bottom-left corner of [`DxfOptions::region`].
 //!
 //! What DXF can't hold (blending modes, opacity masks, raster effects, gradients, patterns,
@@ -1,7 +1,6 @@
 //! The document walk: each visible object becomes DXF entities on its layer's DXF layer, in paint
-//! order. Fills are their outlines then solid hatches (the outlines alone in R12), strokes
-//! polylines and cubic splines with a lineweight and dashes, or filled outlines where the look
-//! needs them.
+//! order. Fills are solid hatches (outlines in R12), strokes polylines and cubic splines with a
+//! lineweight and dashes, or filled outlines where the look needs them.

 use std::collections::HashMap;
 use std::io::Cursor;
@@ -316,7 +315,7 @@ impl<'a> Scene<'a> {
                }
            }
            // Live blends, envelopes, meshes and repeats are written as their evaluated art.
-            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) => {
+            NodeKind::Blend { .. } | NodeKind::Envelope { .. } | NodeKind::Mesh(_) | NodeKind::Repeat(_) => {
                let g = vectorcraft_effects::expand_live_deep(Some(self.doc), n);
                for c in g.children().into_iter().flatten() {
                    self.node(c, false);
@@ -349,7 +348,7 @@ impl<'a> Scene<'a> {
        if n.blend != vectorcraft_color::BlendMode::Normal {
            self.warn("blending modes are left out");
        }
-        if n.extras().mask.as_ref().is_some_and(|m| !m.disabled) {
+        if n.mask.as_ref().is_some_and(|m| !m.disabled) {
            self.warn("opacity masks are left out");
        }
        let raster = |fx: &[vectorcraft_doc::Effect]| fx.iter().any(|e| e.visible && vectorcraft_effects::is_raster(&e.id));
@@ -505,9 +504,8 @@ impl<'a> Scene<'a> {
        Some(vectorcraft_brush::stroke_pieces(b, bp, st))
    }

-    /// A filled area as its outlines followed by a solid hatch (R12: the outlines alone). Laser
-    /// and cutter software reads the outlines and skips hatches. `clean`: the path has no
-    /// overlaps, so the hatch's even-odd rule reads it as it is.
+    /// A filled area as a solid hatch (R12: its outlines). `clean`: the path has no overlaps, so
+    /// the hatch's even-odd rule reads it as it is.
    fn area(&mut self, bp: &BezPath, rule: FillRule, style: &EntityStyle, clean: bool) {
        if !self.o.version.handles() {
            self.warn(NO_FILLS);
@@ -519,12 +517,10 @@ impl<'a> Scene<'a> {
            .then(|| vectorcraft_pathops::try_normalize(&PathData::from_bezpath(bp), rule).ok())
            .flatten()
            .map(|p| p.to_bezpath());
-        let outline = normalized.as_ref().unwrap_or(bp);
-        let loops: Vec<Vec<Point>> = polygons(outline).into_iter().filter(|p| p.len() >= 3).collect();
+        let loops: Vec<Vec<Point>> = polygons(normalized.as_ref().unwrap_or(bp)).into_iter().filter(|p| p.len() >= 3).collect();
        if loops.is_empty() {
            return;
        }
-        self.lines(outline, style, 0.0);
        let h = self.handle();
        let layer = self.layer.clone();
        self.e.entity("HATCH", h, fixed::MODEL_RECORD, &layer, style, "AcDbHatch");
@@ -652,10 +648,8 @@ impl<'a> Scene<'a> {
        let h = self.handle();
        self.e.entity("SPLINE", h, fixed::MODEL_RECORD, &layer, style, "AcDbSpline");
        self.e.normal();
-        // Planar (bit 3) and, if the subpath is closed, also closed (bit 0). A geometrically
-        // closed cut needs the closed flag set so CAM/CAM tools (e.g. VCarve) treat it as a
-        // pocket/profile rather than asking the operator to join endpoints. (#1299)
-        self.e.int(70, if sub.closed { 8 | 1 } else { 8 });
+        // Planar.
+        self.e.int(70, 8);
        self.e.int(71, 3);
        self.e.int(72, knots.len() as i64);
        self.e.int(73, ctrl.len() as i64);
@@ -129,43 +129,30 @@ fn every_version_declares_its_acadver_and_is_well_formed() {
 fn lines_are_lwpolylines_curves_splines_and_fills_hatches() {
    let d = shapes_doc();
    let out = export(&d, &opts(&d)).unwrap();
-    assert_eq!(
-        kinds(&out),
-        ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "SPLINE"],
-        "the fill's outline and hatch, then the stroke, then the ellipse's stroke"
-    );
+    assert_eq!(kinds(&out), ["HATCH", "LWPOLYLINE", "SPLINE"], "fill, then stroke, then the ellipse's stroke");
    let e = entities(&out);
    // The rectangle, y up from the artboard's bottom-left corner: 10..110 × 40..90.
-    let corners = |poly: &Pairs| {
-        let mut xs = all(poly, 10);
-        xs.sort_by(f64::total_cmp);
-        let mut ys = all(poly, 20);
-        ys.sort_by(f64::total_cmp);
-        (xs, ys)
-    };
-    let rect = (vec![10.0, 10.0, 110.0, 110.0], vec![40.0, 40.0, 90.0, 90.0]);
-    for poly in [&e[0], &e[2]] {
-        assert_eq!(get(poly, 70), Some("1"), "closed");
-        assert_eq!(corners(poly), rect);
-    }
-    // Laser and cutter software skips hatches: the fill's outline comes first, without a lineweight.
-    assert_eq!((get(&e[0], 370), get(&e[2], 370)), (None, Some("35")));
-    let hatch = &e[1];
+    let poly = &e[1];
+    assert_eq!(get(poly, 70), Some("1"), "closed");
+    let mut xs = all(poly, 10);
+    xs.sort_by(f64::total_cmp);
+    assert_eq!(xs, [10.0, 10.0, 110.0, 110.0]);
+    let mut ys = all(poly, 20);
+    ys.sort_by(f64::total_cmp);
+    assert_eq!(ys, [40.0, 40.0, 90.0, 90.0]);
+    let hatch = &e[0];
    assert_eq!((get(hatch, 2), get(hatch, 70), get(hatch, 91), get(hatch, 93)), (Some("SOLID"), Some("1"), Some("1"), Some("4")));
    // The ellipse: four cubics through clamped knots.
-    let spline = &e[3];
+    let spline = &e[2];
    assert_eq!((get(spline, 71), get(spline, 73)), (Some("3"), Some("13")));
-    assert_eq!(get(spline, 70), Some("9"), "closed planar spline (#1299): 1 = closed, 8 = planar");
    assert_eq!(all(spline, 40), [0.0, 0.0, 0.0, 0.0, 1.0, 1.0, 1.0, 2.0, 2.0, 2.0, 3.0, 3.0, 3.0, 4.0, 4.0, 4.0, 4.0]);
    // R14 has lightweight polylines but no lineweights: the stroke is a polyline width.
    let r14 = export(&d, &DxfOptions { version: DxfVersion::R14, ..opts(&d) }).unwrap();
-    assert_eq!(get(&entities(&r14)[2], 43), Some("1"));
-    assert_eq!(get(&entities(&r14)[2], 370), None);
-    assert_eq!(get(&entities(&r14)[0], 43), None, "a fill's outline has no width");
+    assert_eq!(get(&entities(&r14)[1], 43), Some("1"));
+    assert_eq!(get(&entities(&r14)[1], 370), None);
    // R13 has splines and hatches, and polylines of vertices.
    let r13 = export(&d, &DxfOptions { version: DxfVersion::R13, ..opts(&d) }).unwrap();
-    let poly = ["POLYLINE", "VERTEX", "VERTEX", "VERTEX", "VERTEX", "SEQEND"];
-    assert_eq!(kinds(&r13), [&poly[..], &["HATCH"], &poly, &["SPLINE"]].concat());
+    assert_eq!(kinds(&r13), ["HATCH", "POLYLINE", "VERTEX", "VERTEX", "VERTEX", "VERTEX", "SEQEND", "SPLINE"]);
    // R12: polylines only; the fill is its outline, the ellipse flattened.
    let r12 = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
    let k = kinds(&r12);
@@ -175,60 +162,6 @@ fn lines_are_lwpolylines_curves_splines_and_fills_hatches() {
    assert!(r12.warnings.iter().any(|w| w.contains("R12 has no fills")), "{:?}", r12.warnings);
 }

-#[test]
-fn spline_closed_flags_follow_path_intent_across_versions_without_changing_geometry() {
-    let cases = [(true, true), (true, false), (false, false), (false, true)];
-    let make_doc = |keep_closure: bool| {
-        doc_with(|d| {
-            cases
-                .iter()
-                .map(|&(closed, returns)| {
-                    let start = Point::new(20.0, 20.0);
-                    let mut b = kurbo::BezPath::new();
-                    b.move_to(start);
-                    b.curve_to((80.0, 0.0), (80.0, 80.0), (20.0, 80.0));
-                    if returns {
-                        b.curve_to((0.0, 80.0), (0.0, 20.0), (20.0, 20.0));
-                    }
-                    if closed {
-                        if keep_closure {
-                            b.close_path();
-                        } else if !returns {
-                            // The open reference has the same final straight segment.
-                            b.line_to(start);
-                        }
-                    }
-                    path(d, PathData::from_bezpath(&b), Paint::None, Paint::solid(Color::rgb(0.0, 0.0, 0.0)), 2.0)
-                })
-                .collect()
-        })
-    };
-    let closed = make_doc(true);
-    let open = make_doc(false);
-    for version in DxfVersion::ALL {
-        let out = export(&closed, &DxfOptions { version, ..opts(&closed) }).unwrap();
-        let actual = entities(&out);
-        if version == DxfVersion::R12 {
-            let polys: Vec<_> = actual.iter().filter(|e| kind(e) == "POLYLINE").collect();
-            assert_eq!(polys.len(), cases.len());
-            for (poly, &(closed, _)) in polys.iter().zip(&cases) {
-                assert_eq!(get(poly, 70), Some(if closed { "1" } else { "0" }));
-            }
-            assert!(!actual.iter().any(|e| kind(e) == "SPLINE"));
-            continue;
-        }
-        let reference = entities(&export(&open, &DxfOptions { version, ..opts(&open) }).unwrap());
-        assert_eq!(actual.len(), cases.len());
-        for ((spline, reference), &(closed, _)) in actual.iter().zip(&reference).zip(&cases) {
-            assert_eq!(kind(spline), "SPLINE");
-            assert_eq!(get(spline, 70), Some(if closed { "9" } else { "8" }), "{version:?}");
-            let mut normalized = spline.clone();
-            normalized.iter_mut().filter(|p| p.0 == 70).for_each(|p| p.1 = "8".into());
-            assert_eq!(&normalized, reference, "all other entity properties, knots and controls: {version:?}");
-        }
-    }
-}
-
 #[test]
 fn colours_map_to_the_index_palette_or_true_colour() {
    let d = shapes_doc();
@@ -238,9 +171,8 @@ fn colours_map_to_the_index_palette_or_true_colour() {
    };
    let out = export(&d, &opts(&d)).unwrap();
    assert_eq!(style(&out, 0), (Some("1".into()), Some("16711680".into())), "red: index 1, true colour 0xFF0000");
-    assert_eq!(style(&out, 1), style(&out, 0), "the fill's outline has the fill's colour");
-    assert_eq!(style(&out, 2), (Some("7".into()), Some("0".into())), "black is index 7");
-    assert_eq!(style(&out, 3), (Some("5".into()), Some("255".into())));
+    assert_eq!(style(&out, 1), (Some("7".into()), Some("0".into())), "black is index 7");
+    assert_eq!(style(&out, 2), (Some("5".into()), Some("255".into())));
    for depth in [ColorDepth::Aci8, ColorDepth::Aci16, ColorDepth::Aci256] {
        let o = export(&d, &DxfOptions { colors: depth, ..opts(&d) }).unwrap();
        assert_eq!(style(&o, 0), (Some("1".into()), None), "{depth:?}");
@@ -264,7 +196,7 @@ fn colours_map_to_the_index_palette_or_true_colour() {
 fn units_scale_coordinates_and_set_insunits() {
    let d = shapes_doc();
    let insunits = |o: &DxfOutput| header(&pairs(&o.bytes), "$INSUNITS");
-    let max_x = |o: &DxfOutput| all(&entities(o)[2], 10).into_iter().fold(f64::MIN, f64::max);
+    let max_x = |o: &DxfOutput| all(&entities(o)[1], 10).into_iter().fold(f64::MIN, f64::max);
    let mm = export(&d, &DxfOptions { unit: Unit::Millimeters, ..opts(&d) }).unwrap();
    assert_eq!(insunits(&mm).as_deref(), Some("4"));
    assert!((max_x(&mm) - 110.0 * 25.4 / 72.0).abs() < 1e-5);
@@ -276,9 +208,9 @@ fn units_scale_coordinates_and_set_insunits() {
    assert_eq!(insunits(&scaled).as_deref(), Some("0"));
    assert!((max_x(&scaled) - 110.0 / 72.0 * 10.0).abs() < 1e-5);
    // Lineweights: 1 pt is 0.35 mm, scaled with the drawing only when asked.
-    assert_eq!(get(&entities(&scaled)[2], 370), Some("35"));
+    assert_eq!(get(&entities(&scaled)[1], 370), Some("35"));
    let heavy = export(&d, &DxfOptions { unit: Unit::Inches, scale: 2.0, scale_lineweights: true, ..opts(&d) }).unwrap();
-    assert_eq!(get(&entities(&heavy)[2], 370), Some("70"));
+    assert_eq!(get(&entities(&heavy)[1], 370), Some("70"));
    assert!(export(&d, &DxfOptions { scale: 0.0, ..opts(&d) }).is_err());
    assert!(export(&d, &DxfOptions { scale: f64::NAN, ..opts(&d) }).is_err());
 }
@@ -306,7 +238,7 @@ fn layers_become_dxf_layers() {
    assert_eq!(names, ["0", "Layer 1", "Dims_ _top_", "Notes"], "the template layer is left out");
    assert!(layers[3].1.starts_with('-'), "a hidden layer is switched off");
    let on: Vec<String> = entities(&out).iter().map(|e| get(e, 8).unwrap().to_string()).collect();
-    assert_eq!(on, ["Layer 1", "Layer 1", "Layer 1", "Layer 1", "Dims_ _top_", "Dims_ _top_", "Notes", "Notes"]);
+    assert_eq!(on, ["Layer 1", "Layer 1", "Layer 1", "Dims_ _top_", "Notes"]);
    // Before 2000: capitals, letters, digits and $-_ only.
    let r12 = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
    let names: Vec<String> = table(&r12, "LAYER").iter().map(|o| get(o, 2).unwrap().to_string()).collect();
@@ -338,21 +270,18 @@ fn dashes_become_linetypes_and_opacity_transparency() {
 fn alter_paths_writes_strokes_as_filled_outlines() {
    let d = shapes_doc();
    let out = export(&d, &DxfOptions { alter_paths: true, ..opts(&d) }).unwrap();
-    // Each fill and stroke: its outlines, then its hatch.
-    let fill = ["LWPOLYLINE", "HATCH"];
-    let rect_stroke = ["LWPOLYLINE", "LWPOLYLINE", "HATCH"];
-    assert_eq!(kinds(&out), [&fill[..], &rect_stroke, &["SPLINE", "SPLINE", "HATCH"]].concat());
+    assert_eq!(kinds(&out), ["HATCH", "HATCH", "HATCH"]);
    // The rectangle's stroke: an outer and an inner boundary.
-    assert_eq!(get(&entities(&out)[4], 91), Some("2"));
+    assert_eq!(get(&entities(&out)[1], 91), Some("2"));
    // Preserve Appearance outlines only the strokes a line can't draw.
    let mut d = shapes_doc();
    let rect = d.layers[0].children().and_then(|c| c.first()).map(|n| n.id).unwrap();
    if let Some(st) = d.node_mut(rect).and_then(|n| n.appearance.stroke_mut()) {
        st.align = vectorcraft_doc::StrokeAlign::Outside;
    }
-    assert_eq!(kinds(&export(&d, &opts(&d)).unwrap()), [&fill[..], &rect_stroke, &["SPLINE"]].concat());
+    assert_eq!(kinds(&export(&d, &opts(&d)).unwrap()), ["HATCH", "HATCH", "SPLINE"]);
    let editable = export(&d, &DxfOptions { preserve: Preserve::Editability, ..opts(&d) }).unwrap();
-    assert_eq!(kinds(&editable), ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "SPLINE"]);
+    assert_eq!(kinds(&editable), ["HATCH", "LWPOLYLINE", "SPLINE"]);
    assert!(editable.warnings.iter().any(|w| w.contains("stroke alignment")));
 }

@@ -379,9 +308,7 @@ fn type_is_text_or_outlines() {
    // Outline Text, and Preserve Appearance: the glyphs as filled outlines.
    for o in [DxfOptions { preserve: Preserve::Editability, outline_text: true, ..opts(&d) }, opts(&d)] {
        let k = kinds(&export(&d, &o).unwrap());
-        assert!(k.iter().any(|k| k == "HATCH"), "{k:?}");
-        assert!(k.iter().all(|k| matches!(k.as_str(), "HATCH" | "LWPOLYLINE" | "SPLINE")), "{k:?}");
-        assert_eq!(k.first().map(String::as_str), Some("SPLINE"), "a glyph's outline before its hatch");
+        assert!(!k.is_empty() && k.iter().all(|k| k == "HATCH"), "{k:?}");
    }
 }

@@ -409,7 +336,7 @@ fn images_link_png_or_jpeg_files() {
            link: None,
            placement: Default::default(),
        };
-        vec![Node::new(d.alloc_id(), NodeKind::Image(Box::new(im)))]
+        vec![Node::new(d.alloc_id(), NodeKind::Image(im))]
    });
    d.images.insert("raster-1".into(), ImageBlob { mime: "image/png".into(), bytes: Arc::new(png), proxy: None });
    let out = export(&d, &opts(&d)).unwrap();
@@ -440,5 +367,5 @@ fn crop_leaves_out_art_outside_the_region() {
    // Only the ellipse (120..180) reaches into 115..200.
    let o = DxfOptions { region: Rect::new(115.0, 0.0, 200.0, 100.0), crop: true, ..opts(&d) };
    assert_eq!(kinds(&export(&d, &o).unwrap()), ["SPLINE"]);
-    assert_eq!(kinds(&export(&d, &DxfOptions { crop: false, ..o }).unwrap()).len(), 4);
+    assert_eq!(kinds(&export(&d, &DxfOptions { crop: false, ..o }).unwrap()).len(), 3);
 }
@@ -1,7 +1,7 @@
 //! ICC profiles through `moxcms` (pure Rust): built-in RGB spaces and user-supplied `.icc` files,
 //! and the profiles exports embed ([`encode_builtin`]), written in code from the CMS.

-use std::sync::{Arc, Mutex, OnceLock};
+use std::sync::{Arc, OnceLock};

 use moxcms::{
    ColorProfile, DataColorSpace, Layout, LocalizableString, LutMultidimensionalType, LutStore, LutWarehouse, Matrix3d, ProfileClass, ProfileText,
@@ -27,9 +27,6 @@ fn intent_index(i: Intent) -> usize {

 type Xf = Option<Arc<TransformF32Executor>>;

-/// A direct transform's cache key: destination name, intent index, black-point compensation.
-type DirectKey = (String, usize, bool);
-
 /// A parsed ICC profile plus lazily-built transforms to/from sRGB.
 pub struct IccProfile {
    pub name: String,
@@ -40,21 +37,6 @@ pub struct IccProfile {
    srgb: ColorProfile,
    to_srgb: [OnceLock<Xf>; 4],
    from_srgb: [OnceLock<Xf>; 4],
-    /// Direct transforms into other RGB profiles ([`Self::to_rgb_of`]), by destination, intent
-    /// and black-point compensation.
-    direct: Mutex<Vec<(DirectKey, Option<Arc<Direct>>)>>,
-}
-
-/// A transform from one profile into an RGB profile without passing through sRGB: into the
-/// destination's primaries with linear tone curves, where black-point compensation is a linear
-/// remap, then onto its own curves.
-struct Direct {
-    to_linear: Arc<TransformF32Executor>,
-    /// Linear → the destination's curves; `None` when the destination isn't a matrix profile
-    /// (the first transform goes straight into it, without compensation).
-    to_dest: Option<Arc<TransformF32Executor>>,
-    /// The source black's luminance in the linear destination (0: no compensation).
-    black: f32,
 }

 impl std::fmt::Debug for IccProfile {
@@ -90,7 +72,6 @@ impl IccProfile {
            srgb: ColorProfile::new_srgb(),
            to_srgb: Default::default(),
            from_srgb: Default::default(),
-            direct: Mutex::new(Vec::new()),
        })
    }

@@ -154,72 +135,6 @@ impl IccProfile {
        Some(dst.into_iter().map(|x| x.clamp(0.0, 1.0)).collect())
    }

-    /// Device values (RGB / CMYK / Gray, 0..1) → `dest`'s RGB, converted directly with `intent`:
-    /// not through sRGB, so colours outside sRGB keep their place in a wider space. With `bpc`
-    /// (and an intent other than absolute), this profile's black maps onto the destination's
-    /// black (black-point compensation, the darkest ink the profile prints becoming RGB 0 rather
-    /// than a dark grey). `None` when `dest` isn't RGB or no transform can be built.
-    pub fn to_rgb_of(&self, dest: &IccProfile, v: &[f32], intent: Intent, bpc: bool) -> Option<[f32; 3]> {
-        let t = self.direct_xf(dest, intent, bpc && intent != Intent::AbsoluteColorimetric)?;
-        let mut src = v.to_vec();
-        src.resize(self.channels(), 0.0);
-        let mut lin = [0.0f32; 3];
-        t.to_linear.transform(&src, &mut lin).ok()?;
-        let Some(to_dest) = &t.to_dest else { return Some(lin.map(|x| x.clamp(0.0, 1.0))) };
-        if t.black > 0.0 {
-            lin = lin.map(|x| (x - t.black) / (1.0 - t.black));
-        }
-        let lin = lin.map(|x| x.clamp(0.0, 1.0));
-        let mut out = [0.0f32; 3];
-        to_dest.transform(&lin, &mut out).ok()?;
-        Some(out.map(|x| x.clamp(0.0, 1.0)))
-    }
-
-    fn direct_xf(&self, dest: &IccProfile, intent: Intent, bpc: bool) -> Option<Arc<Direct>> {
-        if dest.kind != ProfileKind::Rgb {
-            return None;
-        }
-        let key = (dest.name.clone(), intent_index(intent), bpc);
-        let mut cache = self.direct.lock().unwrap_or_else(|e| e.into_inner());
-        if let Some((_, t)) = cache.iter().find(|(k, _)| *k == key) {
-            return t.clone();
-        }
-        let t = self.build_direct(dest, intent, bpc).map(Arc::new);
-        cache.push((key, t.clone()));
-        t
-    }
-
-    fn build_direct(&self, dest: &IccProfile, intent: Intent, bpc: bool) -> Option<Direct> {
-        let d = &dest.profile;
-        let matrix = d.red_trc.is_some() && d.green_trc.is_some() && d.blue_trc.is_some();
-        if !matrix {
-            let xf = self.profile.create_transform_f32(self.layout(), d, Layout::Rgb, Self::opts(intent)).ok()?;
-            return Some(Direct { to_linear: xf, to_dest: None, black: 0.0 });
-        }
-        let mut linear = d.clone();
-        for trc in [&mut linear.red_trc, &mut linear.green_trc, &mut linear.blue_trc] {
-            *trc = Some(ToneReprCurve::Parametric(vec![1.0]));
-        }
-        // A coding-independent code point names the transfer curve outright (moxcms's sRGB has
-        // one) and would override the linear curves.
-        linear.cicp = None;
-        let to_linear = self.profile.create_transform_f32(self.layout(), &linear, Layout::Rgb, Self::opts(intent)).ok()?;
-        let to_dest = linear.create_transform_f32(Layout::Rgb, d, Layout::Rgb, Self::opts(Intent::RelativeColorimetric)).ok()?;
-        // The source black: the darkest colour the profile reproduces, found as lcms does for an
-        // output profile (black sent into the profile and read back), made neutral.
-        let black = if bpc && self.kind == ProfileKind::Cmyk {
-            let inks = self.from_srgb([0.0; 3], Intent::RelativeColorimetric)?;
-            let mut lin = [0.0f32; 3];
-            to_linear.transform(&inks, &mut lin).ok()?;
-            let y = |c: &moxcms::Xyzd| c.y as f32;
-            let lum = lin[0] * y(&d.red_colorant) + lin[1] * y(&d.green_colorant) + lin[2] * y(&d.blue_colorant);
-            lum.clamp(0.0, 0.5)
-        } else {
-            0.0
-        };
-        Some(Direct { to_linear, to_dest: Some(to_dest), black })
-    }
-
    /// Whether transforms can be built for this profile (checked at registration).
    pub fn usable(&self) -> bool {
        self.to_xf(Intent::RelativeColorimetric).is_some() && self.inverse_xf(Intent::RelativeColorimetric).is_some()
@@ -356,37 +356,10 @@ impl Cms {
        }
    }

-    /// CMYK in the working space → display sRGB (`absolute` simulates the paper colour). An ICC
-    /// CMYK profile converts as [`Self::cmyk_to_rgb`] does into sRGB (with the settings'
-    /// black-point compensation), so what shows is what an RGB export writes.
+    /// CMYK in the working space → display sRGB (`absolute` simulates the paper colour).
    pub fn cmyk_to_srgb(&self, cmyk: [f32; 4], absolute: bool) -> [f32; 3] {
-        if let (false, CmykSpace::Icc(p)) = (absolute, &self.cmyk)
-            && let Some(srgb) = builtin_rgb_cache(SRGB)
-            && let Some(v) = p.to_rgb_of(&srgb, &cmyk.map(|v| v.clamp(0.0, 1.0)), Intent::RelativeColorimetric, self.settings.bpc)
-        {
-            return v;
-        }
        Self::cmyk_to_srgb_in(&self.cmyk, cmyk, absolute)
    }
-    /// CMYK in the working space → working RGB with `intent`. An ICC CMYK profile converts
-    /// directly into the RGB profile: not through display sRGB, which would clip colours a wider
-    /// RGB space holds (Wide Gamut RGB keeps CMYK cyan that sRGB can't show), and with the
-    /// settings' black-point compensation. The built-in CMYK spaces go through sRGB as before
-    /// (Generic CMYK compensates in its own model).
-    pub fn cmyk_to_rgb(&self, cmyk: [f32; 4], intent: Intent) -> [f32; 3] {
-        let cmyk = cmyk.map(|v| v.clamp(0.0, 1.0));
-        let src = match &self.cmyk {
-            CmykSpace::Icc(p) => Some(p.clone()),
-            CmykSpace::Generic(_) | CmykSpace::Device => None,
-        };
-        let dest = match &self.rgb {
-            RgbSpace::Icc(p) => Some(p.clone()),
-            RgbSpace::Srgb => builtin_rgb_cache(SRGB),
-        };
-        src.zip(dest)
-            .and_then(|(s, d)| s.to_rgb_of(&d, &cmyk, intent, self.settings.bpc))
-            .unwrap_or_else(|| self.srgb_to_rgb(self.cmyk_to_srgb(cmyk, false)))
-    }
    /// Display sRGB → working CMYK with `intent`.
    pub fn srgb_to_cmyk(&self, srgb: [f32; 3], intent: Intent) -> [f32; 4] {
        Self::srgb_to_cmyk_in(&self.cmyk, srgb, intent, self.settings.bpc)
@@ -451,10 +424,6 @@ impl Cms {
                let [c, m, y, k] = self.to_cmyk(c, intent);
                Color::Cmyk { c, m, y, k }
            }
-            (Color::Cmyk { c, m, y, k }, Model::Rgb) => {
-                let [r, g, b] = self.cmyk_to_rgb([*c, *m, *y, *k], intent);
-                Color::Rgb { r, g, b }
-            }
            (_, Model::Rgb) => {
                let [r, g, b] = self.srgb_to_rgb(self.display_rgb(c));
                Color::Rgb { r, g, b }
@@ -60,54 +60,3 @@ fn a_loaded_profile_is_embedded_as_loaded() {
    register_icc(&bytes, Some("Embedded As Loaded RGB".into())).unwrap();
    assert_eq!(&*icc_bytes("Embedded As Loaded RGB").unwrap(), &bytes[..]);
 }
-
-/// Settings with an ICC CMYK profile (Generic CMYK's, loaded as a file is) and Wide Gamut RGB.
-fn icc_cmyk(bpc: bool) -> Cms {
-    let name = register_icc(&icc_bytes(GENERIC_CMYK).unwrap(), Some("Test ICC CMYK".into())).unwrap().name;
-    Cms::new(&ColorSettings { rgb: WIDE_GAMUT_RGB.into(), cmyk: name, bpc, ..ColorSettings::default() }).unwrap()
-}
-
-#[test]
-fn icc_cmyk_converts_into_a_wide_rgb_space_directly_without_clipping_to_srgb() {
-    let wide = icc_cmyk(true);
-    let cyan = [1.0, 0.0, 0.0, 0.0];
-    let direct = wide.cmyk_to_rgb(cyan, Intent::RelativeColorimetric);
-    // Through sRGB, cyan clips to sRGB's gamut first: in the wider space that reads as a red
-    // channel well above zero.
-    let hub = wide.srgb_to_rgb(wide.cmyk_to_srgb(cyan, false));
-    assert!(direct[0] + 0.15 < hub[0], "direct {direct:?}, through sRGB {hub:?}");
-    // Same colour either way where sRGB holds it: a mid grey and paper white.
-    for inks in [[0.0, 0.0, 0.0, 0.5], [0.0; 4]] {
-        let (d, h) = (wide.cmyk_to_rgb(inks, Intent::RelativeColorimetric), wide.srgb_to_rgb(wide.cmyk_to_srgb(inks, false)));
-        assert!(d.iter().zip(h).all(|(a, b)| (a - b).abs() < 0.02), "{inks:?}: direct {d:?}, through sRGB {h:?}");
-    }
-    // Cms::convert takes the direct route for CMYK.
-    let Color::Rgb { r, .. } = wide.convert(&Color::Cmyk { c: 1.0, m: 0.0, y: 0.0, k: 0.0 }, Model::Rgb, Intent::RelativeColorimetric) else {
-        panic!("RGB")
-    };
-    assert!((r - direct[0]).abs() < 1e-6);
-}
-
-#[test]
-fn black_point_compensation_maps_the_darkest_ink_to_rgb_black() {
-    let rich = [0.75, 0.68, 0.67, 0.9];
-    let (on, off) = (icc_cmyk(true).cmyk_to_rgb(rich, Intent::RelativeColorimetric), icc_cmyk(false).cmyk_to_rgb(rich, Intent::RelativeColorimetric));
-    // Without compensation the profile's black is a dark grey; with it, rich black goes most of
-    // the way to RGB black (not all: it isn't quite the darkest ink the profile prints).
-    assert!(off.iter().all(|v| *v > 0.1), "without: {off:?}");
-    assert!(on.iter().zip(off).all(|(a, b)| *a < 0.08 && *a < b * 0.5), "with: {on:?}, without: {off:?}");
-    // The screen shows what an sRGB conversion writes, compensated alike.
-    let srgb = |bpc| {
-        let c = icc_cmyk(bpc);
-        Cms::new(&ColorSettings { rgb: SRGB.into(), ..c.settings().clone() }).unwrap()
-    };
-    for bpc in [true, false] {
-        let c = srgb(bpc);
-        assert_eq!(c.cmyk_to_srgb(rich, false), c.cmyk_to_rgb(rich, Intent::RelativeColorimetric), "bpc {bpc}");
-    }
-    // White is untouched, and absolute colorimetric never compensates.
-    let white = icc_cmyk(true).cmyk_to_rgb([0.0; 4], Intent::RelativeColorimetric);
-    assert!(white.iter().all(|v| *v > 0.99), "{white:?}");
-    let abs = |bpc| icc_cmyk(bpc).cmyk_to_rgb(rich, Intent::AbsoluteColorimetric);
-    assert_eq!(abs(true), abs(false));
-}
@@ -131,18 +131,10 @@ impl Gradient {
            std::iter::once((s.offset, s.color, s.opacity, None)).chain(mid)
        })
    }
-    /// The same ramp the other way round: the stops in reverse order at mirrored offsets, each
-    /// segment's midpoint mirrored with it.
    pub fn reverse(&mut self) {
        self.stops.reverse();
-        for i in 0..self.stops.len() {
-            // A midpoint belongs to the segment after its stop: reversed, stop i's segment is the
-            // one the next stop (not yet mirrored) had, measured from the other end.
-            let mid = self.stops.get(i + 1).map_or(0.5, |n| 1.0 - n.midpoint);
-            if let Some(s) = self.stops.get_mut(i) {
-                s.offset = 1.0 - s.offset;
-                s.midpoint = mid;
-            }
+        for s in &mut self.stops {
+            s.offset = 1.0 - s.offset;
        }
    }
    pub fn sort(&mut self) {
@@ -577,32 +569,6 @@ mod tests {
        assert_eq!(g.stops[0].offset, 0.0);
    }

-    /// #1007: reversing mirrors off-centre midpoints with their segments, so the ramp is the same
-    /// the other way round.
-    #[test]
-    fn reverse_mirrors_midpoints() {
-        let stop = |offset, hex, midpoint| GradientStop { midpoint, ..GradientStop::new(offset, Color::from_hex(hex).unwrap()) };
-        let two = Gradient { kind: GradientKind::Linear, stops: vec![stop(0.0, "#ff0000", 0.2), stop(1.0, "#0000ff", 0.5)] };
-        let three =
-            Gradient { kind: GradientKind::Linear, stops: vec![stop(0.0, "#ff0000", 0.2), stop(0.3, "#00ff00", 0.8), stop(1.0, "#0000ff", 0.5)] };
-        for g in [two, three] {
-            let mut r = g.clone();
-            r.reverse();
-            let mids: Vec<f32> = r.stops.iter().map(|s| s.midpoint).collect();
-            let want: Vec<f32> = g.stops.iter().rev().skip(1).map(|s| 1.0 - s.midpoint).chain([0.5]).collect();
-            assert!(mids.iter().zip(&want).all(|(a, b)| (a - b).abs() < 1e-6), "{mids:?} {want:?}");
-            for i in 0..=20 {
-                let t = i as f32 / 20.0;
-                let ((a, ao), (b, bo)) = (g.sample(t), r.sample(1.0 - t));
-                let same = a.to_rgba8(1.0).iter().zip(b.to_rgba8(1.0)).all(|(x, y)| x.abs_diff(y) <= 1);
-                assert!(same && (ao - bo).abs() < 1e-6, "t {t}: {a:?} vs {b:?}");
-            }
-            r.reverse();
-            let back = r.stops.iter().zip(&g.stops).all(|(a, b)| (a.offset - b.offset).abs() < 1e-6 && (a.midpoint - b.midpoint).abs() < 1e-6);
-            assert!(back, "reversed twice, it is as it was: {:?}", r.stops);
-        }
-    }
-
    fn close(a: Point, b: Point) -> bool {
        a.distance(b) < 1e-9
    }
@@ -1,10 +1,6 @@
 //! Swatch library files: the native `.vcswatches` JSON (colour models, global, spot, gradients
 //! and colour groups exactly), `.gpl` palettes (8-bit RGB; colour groups as `# Group:` comment
-//! headers), swatch exchange `.ase` files (binary: solid colors in their own model, global, spot
-//! and process colors, color groups), color books `.acb` (read only: the books a user owns, such
-//! as a Pantone book) and CSS custom properties (written only).
-
-use std::collections::{HashMap, HashSet};
+//! headers) and CSS custom properties (written only).

 use serde::{Deserialize, Serialize};

@@ -17,22 +13,18 @@ pub enum PaletteFormat {
    Native,
    /// `.gpl`: a plain-text RGB palette many paint and design tools read.
    Gpl,
-    /// `.ase`: a swatch exchange file (binary): solid colors in their own model, global, spot or
-    /// process, and color groups.
-    Ase,
    /// `.css`: custom properties on `:root` (colours and gradients; written only).
    Css,
 }

 impl PaletteFormat {
-    pub const ALL: [PaletteFormat; 4] = [PaletteFormat::Native, PaletteFormat::Gpl, PaletteFormat::Ase, PaletteFormat::Css];
+    pub const ALL: [PaletteFormat; 3] = [PaletteFormat::Native, PaletteFormat::Gpl, PaletteFormat::Css];

    /// The format's id, which is also its extension.
    pub fn id(self) -> &'static str {
        match self {
            PaletteFormat::Native => "vcswatches",
            PaletteFormat::Gpl => "gpl",
-            PaletteFormat::Ase => "ase",
            PaletteFormat::Css => "css",
        }
    }
@@ -40,7 +32,6 @@ impl PaletteFormat {
        match self {
            PaletteFormat::Native => "VectorCraft Swatches (.vcswatches)",
            PaletteFormat::Gpl => "GPL Palette (.gpl)",
-            PaletteFormat::Ase => "Swatch Exchange (.ase)",
            PaletteFormat::Css => "CSS Custom Properties (.css)",
        }
    }
@@ -53,23 +44,6 @@ impl PaletteFormat {
    pub fn readable(self) -> bool {
        self != PaletteFormat::Css
    }
-    /// Are files of this format binary rather than text?
-    pub fn binary(self) -> bool {
-        self == PaletteFormat::Ase
-    }
-    /// Does [`write`] keep a swatch with `paint` in a file of this format? None and patterns are
-    /// never written; `.gpl` and `.ase` hold solid colors only, and CSS holds no freeform gradients.
-    pub fn holds(self, paint: &Paint) -> bool {
-        match paint {
-            Paint::Solid { .. } => true,
-            Paint::Gradient(g) => match self {
-                PaletteFormat::Native => true,
-                PaletteFormat::Css => g.gradient.kind != GradientKind::Freeform,
-                PaletteFormat::Gpl | PaletteFormat::Ase => false,
-            },
-            Paint::None | Paint::Pattern { .. } => false,
-        }
-    }
 }

 /// The native file: a header around the library.
@@ -84,25 +58,12 @@ struct NativeFile {
 const NATIVE_FORMAT: &str = "vcswatches";
 const GPL_HEADER: &str = "GIMP Palette";
 const GPL_GROUP: &str = "# Group:";
-const ASE_SIGNATURE: &[u8] = b"ASEF";
-const ASE_GROUP_START: u16 = 0xC001;
-const ASE_GROUP_END: u16 = 0xC002;
-const ASE_COLOR: u16 = 0x0001;
-/// The most colors and groups read from one `.ase` file.
-const ASE_MAX_ENTRIES: usize = 100_000;
-/// The most UTF-16 code units of a name that are kept.
-const ASE_MAX_NAME: usize = 1024;
-const ASE_CUT_SHORT: &str = "the swatch exchange file is cut short";
-const ACB_SIGNATURE: &[u8] = b"8BCB";
-const ACB_CUT_SHORT: &str = "the color book is cut short";

-/// Write `lib` in `format` → the file's bytes. Pattern swatches (their tiles live in a document)
-/// and None are left out; `.gpl` keeps solid colours only, as 8-bit RGB, and `.ase` keeps solid
-/// colors in their own model. Writing `.ase` fails for a library with more colors and groups than
-/// [`read_bytes`] reads from one file.
-pub fn write(lib: &SwatchLibrary, format: PaletteFormat) -> Result<Vec<u8>, String> {
-    let keep = |w: &&Swatch| format.holds(&w.paint);
-    let text = match format {
+/// Write `lib` in `format`. Pattern swatches (their tiles live in a document) and None are left
+/// out; `.gpl` keeps solid colours only, as 8-bit RGB.
+pub fn write(lib: &SwatchLibrary, format: PaletteFormat) -> String {
+    let keep = |w: &&Swatch| matches!(w.paint, Paint::Solid { .. } | Paint::Gradient(_));
+    match format {
        PaletteFormat::Native => {
            let strip = |list: &[Swatch]| list.iter().filter(keep).cloned().collect::<Vec<_>>();
            let library = SwatchLibrary {
@@ -114,10 +75,8 @@ pub fn write(lib: &SwatchLibrary, format: PaletteFormat) -> Result<Vec<u8>, Stri
            serde_json::to_string_pretty(&file).unwrap_or_default()
        }
        PaletteFormat::Gpl => write_gpl(lib),
-        PaletteFormat::Ase => return write_ase(lib),
        PaletteFormat::Css => write_css(lib, keep),
-    };
-    Ok(text.into_bytes())
+    }
 }

 /// One line of text: no line breaks or tabs.
@@ -213,102 +172,6 @@ fn write_css(lib: &SwatchLibrary, keep: impl Fn(&&Swatch) -> bool) -> String {
    out
 }

-/// `.ase`, as [`read_ase`] reads it: version 1.0, the ungrouped colors, then each color group as a
-/// group start (its name), its colors and a group end, also for a group without colors. A color is
-/// written in its own model: RGB, CMYK and gray components from 0 to 1 (gray as a level, 1 is
-/// white), Lab lightness as a fraction of 100 and a and b from −128 to 127. Components are clamped
-/// to those ranges, and a component that isn't a finite number is written as 0. The color type is
-/// 1 for a spot color, 0 for another global color and 2 for a process color.
-///
-/// A swatch exchange file holds solid colors only: gradients, patterns and None are left out, and
-/// a tint swatch is written as the color it shows, a process color without its link to its base.
-/// The file has no library name ([`read_ase`] names a library after its file). More than
-/// [`ASE_MAX_ENTRIES`] colors and groups is an error.
-fn write_ase(lib: &SwatchLibrary) -> Result<Vec<u8>, String> {
-    let solid = |list: &[Swatch]| list.iter().filter(|w| w.paint.color().is_some()).count();
-    let entries = solid(&lib.swatches) + lib.groups.iter().map(|g| 1 + solid(&g.swatches)).sum::<usize>();
-    if entries > ASE_MAX_ENTRIES {
-        return Err(format!(
-            "VectorCraft reads at most {ASE_MAX_ENTRIES} colors and groups from a swatch exchange file, and this library has {entries}"
-        ));
-    }
-    let mut body = vec![];
-    let mut blocks = put_ase_colors(&mut body, &lib.swatches)?;
-    for g in &lib.groups {
-        let mut name = vec![];
-        put_ase_name(&mut name, &g.name)?;
-        put_ase_block(&mut body, ASE_GROUP_START, &name)?;
-        blocks += 2 + put_ase_colors(&mut body, &g.swatches)?;
-        put_ase_block(&mut body, ASE_GROUP_END, &[])?;
-    }
-    let blocks = u32::try_from(blocks).map_err(|_| "too many swatch exchange blocks".to_string())?;
-    let mut out = ASE_SIGNATURE.to_vec();
-    out.extend(1u16.to_be_bytes());
-    out.extend(0u16.to_be_bytes());
-    out.extend(blocks.to_be_bytes());
-    out.extend(body);
-    Ok(out)
-}
-
-/// The color blocks of the solid colors in `list` → how many were written.
-fn put_ase_colors(out: &mut Vec<u8>, list: &[Swatch]) -> Result<usize, String> {
-    let unit = |v: f32| if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 };
-    let ab = |v: f32| if v.is_finite() { v.clamp(-128.0, 127.0) } else { 0.0 };
-    let mut n = 0;
-    for (w, color) in list.iter().filter_map(|w| Some((w, w.paint.color()?))) {
-        let mut body = vec![];
-        put_ase_name(&mut body, &w.name)?;
-        let (model, values): (&[u8; 4], Vec<f32>) = match color {
-            Color::Rgb { r, g, b } => (b"RGB ", vec![unit(r), unit(g), unit(b)]),
-            Color::Cmyk { c, m, y, k } => (b"CMYK", vec![unit(c), unit(m), unit(y), unit(k)]),
-            Color::Lab { l, a, b } => (b"LAB ", vec![unit(l / 100.0), ab(a), ab(b)]),
-            Color::Gray { k } => (b"Gray", vec![1.0 - unit(k)]),
-        };
-        body.extend(model);
-        body.extend(values.iter().flat_map(|v| v.to_be_bytes()));
-        let kind: u16 = if w.spot {
-            1
-        } else if w.global {
-            0
-        } else {
-            2
-        };
-        body.extend(kind.to_be_bytes());
-        put_ase_block(out, ASE_COLOR, &body)?;
-        n += 1;
-    }
-    Ok(n)
-}
-
-/// A block: its type, the length of its body and the body.
-fn put_ase_block(out: &mut Vec<u8>, kind: u16, body: &[u8]) -> Result<(), String> {
-    let len = u32::try_from(body.len()).map_err(|_| "a swatch exchange block is too long".to_string())?;
-    out.extend(kind.to_be_bytes());
-    out.extend(len.to_be_bytes());
-    out.extend_from_slice(body);
-    Ok(())
-}
-
-/// A name as `.ase` stores it: a `u16` count of UTF-16 code units, the terminating zero included,
-/// then the units. NUL characters are left out, and a name longer than [`ASE_MAX_NAME`] code units
-/// is cut before the character that would pass that limit.
-fn put_ase_name(out: &mut Vec<u8>, name: &str) -> Result<(), String> {
-    let mut units: Vec<u16> = vec![];
-    for c in name.chars().filter(|&c| c != '\0') {
-        let mut buf = [0; 2];
-        let encoded = c.encode_utf16(&mut buf);
-        if units.len() + encoded.len() > ASE_MAX_NAME {
-            break;
-        }
-        units.extend_from_slice(encoded);
-    }
-    units.push(0);
-    let count = u16::try_from(units.len()).map_err(|_| "a swatch exchange name is too long".to_string())?;
-    out.extend(count.to_be_bytes());
-    out.extend(units.iter().flat_map(|u| u.to_be_bytes()));
-    Ok(())
-}
-
 /// Read a `.vcswatches` or `.gpl` library (detected from its content). `name` names it when the
 /// file doesn't.
 pub fn read(text: &str, name: &str) -> Result<SwatchLibrary, String> {
@@ -336,38 +199,16 @@ pub fn sniff(text: &str) -> bool {
    t.starts_with(GPL_HEADER) || (t.starts_with('{') && t.contains(NATIVE_FORMAT))
 }

-/// Read the bytes of a library file: a swatch exchange `.ase` file, else a `.vcswatches` or
-/// `.gpl` library ([`read`]). `name` names it when the file doesn't.
-pub fn read_bytes(bytes: &[u8], name: &str) -> Result<SwatchLibrary, String> {
-    if bytes.starts_with(ASE_SIGNATURE) {
-        return read_ase(bytes, name);
-    }
-    if bytes.starts_with(ACB_SIGNATURE) {
-        return read_acb(bytes, name).map_err(|e| if e == ASE_CUT_SHORT { ACB_CUT_SHORT.into() } else { e });
-    }
-    read(&String::from_utf8_lossy(bytes), name)
-}
-
-/// Are `bytes` a library [`read_bytes`] understands? Text that isn't valid UTF-8 is checked as
-/// [`read_bytes`] reads it, with the invalid bytes replaced (its first KiB is enough).
-pub fn sniff_bytes(bytes: &[u8]) -> bool {
-    bytes.starts_with(ASE_SIGNATURE)
-        || bytes.starts_with(ACB_SIGNATURE)
-        || std::str::from_utf8(bytes).is_ok_and(sniff)
-        || sniff(&String::from_utf8_lossy(bytes.get(..1024).unwrap_or(bytes)))
-}
-
 /// `.gpl`: `Name:` names the library, `# Group: name` starts a colour group, other `#` lines and
-/// headers (`Columns:`) are skipped, as are lines that aren't `r g b [name]`. Unnamed colors are
-/// named by their values and unnamed groups "Color Group"; a name a color or group already has gets
-/// a number ([`UniqueNames`]).
+/// headers (`Columns:`) are skipped, as are lines that aren't `r g b [name]`. Unnamed colours are
+/// named by their values; repeated names get a number.
 fn read_gpl(text: &str, fallback: &str) -> SwatchLibrary {
    let mut lib = SwatchLibrary { name: fallback.into(), ..Default::default() };
-    let mut names = UniqueNames::default();
+    let mut names: Vec<String> = vec![];
    for line in text.lines().skip(1) {
        let line = line.trim();
        if let Some(g) = line.strip_prefix(GPL_GROUP) {
-            lib.groups.push(SwatchGroup { name: names.unique(group_name(g)), swatches: vec![] });
+            lib.groups.push(SwatchGroup { name: g.trim().to_string(), swatches: vec![] });
            continue;
        }
        if let Some(n) = line.strip_prefix("Name:") {
@@ -380,7 +221,9 @@ fn read_gpl(text: &str, fallback: &str) -> SwatchLibrary {
        let [r, g, b] = rgb[..] else { continue };
        let rest = words[3..].join(" ");
        let base = if rest.is_empty() { format!("R={r} G={g} B={b}") } else { rest };
-        let w = Swatch { name: names.unique(base), paint: Paint::solid(Color::rgb8(r, g, b)), global: false, spot: false };
+        let name = (1..).map(|i| if i == 1 { base.clone() } else { format!("{base} {i}") }).find(|n| !names.contains(n)).unwrap_or(base);
+        names.push(name.clone());
+        let w = Swatch { name, paint: Paint::solid(Color::rgb8(r, g, b)), global: false, spot: false };
        match lib.groups.last_mut() {
            Some(grp) => grp.swatches.push(w),
            None => lib.swatches.push(w),
@@ -389,326 +232,10 @@ fn read_gpl(text: &str, fallback: &str) -> SwatchLibrary {
    lib
 }

-/// `.ase`, from public descriptions of the format: the layout from
-/// <https://www.selapa.net/swatches/colors/fileformats.php>, the component ranges from
-/// <https://github.com/nsfmc/swatch>. After the signature come, big-endian, a `u16` major (1) and
-/// minor version, a `u32` block count and the blocks, each a `u16` type, a `u32` body length and
-/// the body. A group start's body is a name. A color's body is a name, a four-character model
-/// (`RGB `, `CMYK`, `LAB `, `Gray`), its components as `f32` (3, 4, 3 and 1 of them) and a `u16`
-/// color type (0 global, 1 spot, 2 process). RGB, CMYK and gray components run from 0 to 1 (a
-/// gray level of 1 is white), Lab lightness from 0 to 1 and a and b from −128 to 127. A lightness
-/// above 1 is read as L* itself. A name is a `u16` count of UTF-16 code units, the terminating zero
-/// included, then the units.
-///
-/// Color groups become groups: a group start inside an open group ends that group, and a group
-/// left open ends with the file. Blocks of other types and colors in other models are skipped.
-/// Unnamed colors are named by their values and unnamed groups "Color Group"; a name a color or
-/// group already has gets a number ([`UniqueNames`]). A truncated file, a major version other than
-/// 1 or more than [`ASE_MAX_ENTRIES`] colors and groups is an error.
-fn read_ase(bytes: &[u8], fallback: &str) -> Result<SwatchLibrary, String> {
-    let mut data = AseData(bytes);
-    data.bytes(ASE_SIGNATURE.len())?;
-    let (major, minor) = (data.u16()?, data.u16()?);
-    if major != 1 {
-        return Err(format!("swatch exchange version {major}.{minor} isn't supported (only 1.x)"));
-    }
-    let blocks = data.u32()?;
-    let mut lib = SwatchLibrary { name: fallback.into(), ..Default::default() };
-    let mut names = UniqueNames::default();
-    let (mut in_group, mut entries) = (false, 0usize);
-    for _ in 0..blocks {
-        let kind = data.u16()?;
-        let len = usize::try_from(data.u32()?).unwrap_or(usize::MAX);
-        let mut body = AseData(data.bytes(len)?);
-        if matches!(kind, ASE_GROUP_START | ASE_COLOR) {
-            entries += 1;
-            if entries > ASE_MAX_ENTRIES {
-                return Err(format!("the swatch exchange file holds more than {ASE_MAX_ENTRIES} colors and groups"));
-            }
-        }
-        match kind {
-            ASE_GROUP_START => {
-                lib.groups.push(SwatchGroup { name: names.unique(group_name(&body.name()?)), swatches: vec![] });
-                in_group = true;
-            }
-            ASE_GROUP_END => in_group = false,
-            ASE_COLOR => {
-                let Some(mut w) = ase_swatch(&mut body)? else { continue };
-                w.name = names.unique(std::mem::take(&mut w.name));
-                match lib.groups.last_mut().filter(|_| in_group) {
-                    Some(g) => g.swatches.push(w),
-                    None => lib.swatches.push(w),
-                }
-            }
-            // Other blocks are skipped.
-            _ => {}
-        }
-    }
-    Ok(lib)
-}
-
-/// `.acb` (a color book, read only), from public descriptions of the format: after the signature
-/// come, big-endian, a `u16` version (1) and book id, the title, prefix, suffix and description
-/// as strings, a `u16` color count, page size and page selector offset, a `u16` color space (0
-/// RGB, 2 CMYK, 7 Lab) and the colors: each a name, a six-character catalog code and its
-/// components as bytes. RGB runs from 0 to 255, CMYK ink is stored inverted (255 is no ink), Lab
-/// lightness is 0 to 255 for 0 to 100 and a and b are offset by 128. A string is a `u32` count of
-/// UTF-16 code units, then the units; a `$$$/key=Text` string means `Text`, and `^R`, `^C` stand
-/// for ® and ©. An optional `spflspot` or `spflproc` at the end says whether the colors are spot
-/// or process colors (a book without it is a spot color book).
-///
-/// The book's colors are named with its prefix and suffix ("PANTONE 185 C"); colors without a
-/// name (the padding of a book's pages) are left out. A version other than 1, a color space other
-/// than those three or more than [`ASE_MAX_ENTRIES`] colors is an error.
-fn read_acb(bytes: &[u8], fallback: &str) -> Result<SwatchLibrary, String> {
-    let mut data = AseData(bytes);
-    data.bytes(ACB_SIGNATURE.len())?;
-    let version = data.u16()?;
-    if version != 1 {
-        return Err(format!("color book version {version} isn't supported (only 1)"));
-    }
-    let _book_id = data.u16()?;
-    let [title, prefix, suffix, _description] = [data.acb_string()?, data.acb_string()?, data.acb_string()?, data.acb_string()?];
-    let count = usize::from(data.u16()?);
-    if count > ASE_MAX_ENTRIES {
-        return Err(format!("the color book holds more than {ASE_MAX_ENTRIES} colors"));
-    }
-    let (_page_size, _page_offset) = (data.u16()?, data.u16()?);
-    let space = data.u16()?;
-    let mut colors = Vec::with_capacity(count);
-    for _ in 0..count {
-        let name = data.acb_string()?;
-        let _code = data.bytes(6)?;
-        let color = match space {
-            0 => {
-                let [r, g, b] = data.array::<3>()?;
-                Color::rgb8(r, g, b)
-            }
-            2 => {
-                let ink = |v: u8| f32::from(255 - v) / 255.0;
-                let [c, m, y, k] = data.array::<4>()?;
-                Color::cmyk(ink(c), ink(m), ink(y), ink(k))
-            }
-            7 => {
-                let [l, a, b] = data.array::<3>()?;
-                Color::lab(f32::from(l) * 100.0 / 255.0, f32::from(a) - 128.0, f32::from(b) - 128.0)
-            }
-            other => return Err(format!("color books in color space {other} aren't supported (only RGB, CMYK and Lab)")),
-        };
-        colors.push((name, color));
-    }
-    // Spot colors unless the book says process ones.
-    let spot = data.0.windows(8).last() != Some(b"spflproc".as_slice());
-    let mut lib = SwatchLibrary { name: if title.is_empty() { fallback.into() } else { title }, ..Default::default() };
-    let mut names = UniqueNames::default();
-    for (name, color) in colors.into_iter().filter(|(n, _)| !n.trim().is_empty()) {
-        let name = names.unique(format!("{prefix}{name}{suffix}").trim().to_string());
-        lib.swatches.push(Swatch { name, paint: Paint::solid(color), global: spot, spot });
-    }
-    Ok(lib)
-}
-
-/// The swatch of an `.ase` color block, `None` for a model other than RGB, CMYK, Lab and Gray.
-/// Components are clamped to their ranges.
-fn ase_swatch(body: &mut AseData) -> Result<Option<Swatch>, String> {
-    let name = body.name()?;
-    let unit = |v: f32| v.clamp(0.0, 1.0);
-    let color = match &body.array::<4>()? {
-        b"RGB " => {
-            let [r, g, b] = [body.f32()?, body.f32()?, body.f32()?];
-            Color::rgb(unit(r), unit(g), unit(b))
-        }
-        b"CMYK" => {
-            let [c, m, y, k] = [body.f32()?, body.f32()?, body.f32()?, body.f32()?];
-            Color::cmyk(unit(c), unit(m), unit(y), unit(k))
-        }
-        // Lightness is stored as a fraction of 100. Some writers store L* itself, which shows as a
-        // value above 1.
-        b"LAB " => {
-            let [l, a, b] = [body.f32()?, body.f32()?, body.f32()?];
-            let l = if l > 1.0 { l.min(100.0) } else { unit(l) * 100.0 };
-            Color::lab(l, a.clamp(-128.0, 127.0), b.clamp(-128.0, 127.0))
-        }
-        // A gray level (1 is white); a gray color holds its ink.
-        b"Gray" => Color::gray(1.0 - unit(body.f32()?)),
-        _ => return Ok(None),
-    };
-    // Some writers leave the color type out, which makes a process color.
-    let kind = if body.0.len() >= 2 { body.u16()? } else { 2 };
-    // Spot colors are global.
-    let (global, spot) = match kind {
-        0 => (true, false),
-        1 => (true, true),
-        _ => (false, false),
-    };
-    let name = if name.is_empty() { value_name(color) } else { name };
-    Ok(Some(Swatch { name, paint: Paint::solid(color), global, spot }))
-}
-
-/// A color's values in its own model, as new swatches are named ("C=10 M=20 Y=30 K=0",
-/// "R=255 G=128 B=0", "Gray K=40", "L=52 a=70 b=-30").
-fn value_name(c: Color) -> String {
-    let pct = |v: f32| (v * 100.0).round();
-    let byte = |v: f32| (v * 255.0).round();
-    match c {
-        Color::Cmyk { c, m, y, k } => format!("C={} M={} Y={} K={}", pct(c), pct(m), pct(y), pct(k)),
-        Color::Rgb { r, g, b } => format!("R={} G={} B={}", byte(r), byte(g), byte(b)),
-        Color::Gray { k } => format!("Gray K={}", pct(k)),
-        // `+ 0.0` turns a rounded -0 into 0.
-        Color::Lab { l, a, b } => format!("L={} a={} b={}", l.round() + 0.0, a.round() + 0.0, b.round() + 0.0),
-    }
-}
-
-/// `.ase` data, read field by field; reading past its end is an error.
-struct AseData<'a>(&'a [u8]);
-
-impl<'a> AseData<'a> {
-    fn bytes(&mut self, n: usize) -> Result<&'a [u8], String> {
-        let (head, rest) = self.0.split_at_checked(n).ok_or(ASE_CUT_SHORT)?;
-        self.0 = rest;
-        Ok(head)
-    }
-    fn array<const N: usize>(&mut self) -> Result<[u8; N], String> {
-        let (head, rest) = self.0.split_first_chunk::<N>().ok_or(ASE_CUT_SHORT)?;
-        self.0 = rest;
-        Ok(*head)
-    }
-    fn u16(&mut self) -> Result<u16, String> {
-        self.array().map(u16::from_be_bytes)
-    }
-    fn u32(&mut self) -> Result<u32, String> {
-        self.array().map(u32::from_be_bytes)
-    }
-    /// A component; one that isn't a finite number reads as 0.
-    fn f32(&mut self) -> Result<f32, String> {
-        let v = f32::from_be_bytes(self.array()?);
-        Ok(if v.is_finite() { v } else { 0.0 })
-    }
-    /// A color book string ([`read_acb`]): a `u32` count of UTF-16 code units, then the units,
-    /// with `$$$/key=Text` read as `Text` and `^R`, `^C` as ®, ©; at most [`ASE_MAX_NAME`] units
-    /// are kept.
-    fn acb_string(&mut self) -> Result<String, String> {
-        let n = usize::try_from(self.u32()?).unwrap_or(usize::MAX);
-        let (units, _) = self.bytes(n.checked_mul(2).ok_or(ASE_CUT_SHORT)?)?.as_chunks::<2>();
-        let units: Vec<u16> = units.iter().take(ASE_MAX_NAME).map(|u| u16::from_be_bytes(*u)).take_while(|&u| u != 0).collect();
-        let s = String::from_utf16_lossy(&units);
-        let s = match s.strip_prefix("$$$/") {
-            Some(key) => key.split_once('=').map_or("", |(_, text)| text).to_string(),
-            None => s,
-        };
-        Ok(s.replace("^R", "®").replace("^C", "©"))
-    }
-    /// A name up to its terminating zero, trimmed. A block that ends before it has no name.
-    fn name(&mut self) -> Result<String, String> {
-        if self.0.is_empty() {
-            return Ok(String::new());
-        }
-        let n = usize::from(self.u16()?);
-        let (units, _) = self.bytes(n * 2)?.as_chunks::<2>();
-        let units: Vec<u16> = units.iter().take(ASE_MAX_NAME).map(|u| u16::from_be_bytes(*u)).take_while(|&u| u != 0).collect();
-        Ok(String::from_utf16_lossy(&units).trim().to_string())
-    }
-}
-
-/// A group's name as a file gives it, trimmed; "Color Group" when it has none.
-fn group_name(name: &str) -> String {
-    let name = name.trim();
-    if name.is_empty() { "Color Group".into() } else { name.to_string() }
-}
-
-/// The swatch and group names a reader has handed out. Swatches and color groups share one set of
-/// names, as in a document, and a name already taken gets the first free number ("Black 2").
-#[derive(Default)]
-struct UniqueNames {
-    taken: HashSet<String>,
-    /// The last number tried for each repeated name.
-    last: HashMap<String, usize>,
-}
-
-impl UniqueNames {
-    fn unique(&mut self, base: String) -> String {
-        if self.taken.insert(base.clone()) {
-            return base;
-        }
-        // Each pass tries the next number, and only finitely many names are taken.
-        let n = self.last.entry(base.clone()).or_insert(1);
-        loop {
-            *n += 1;
-            let name = format!("{base} {n}");
-            if self.taken.insert(name.clone()) {
-                return name;
-            }
-        }
-    }
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
    use crate::{Gradient, GradientPaint, GradientStop};
-    use proptest::prelude::*;
-
-    /// A color book's string: a `u32` count of UTF-16 code units, then the units.
-    fn acb_str(out: &mut Vec<u8>, s: &str) {
-        let units: Vec<u16> = s.encode_utf16().collect();
-        out.extend((units.len() as u32).to_be_bytes());
-        units.iter().for_each(|u| out.extend(u.to_be_bytes()));
-    }
-
-    /// A color book in `space` (0 RGB, 2 CMYK, 7 Lab) with `colors` (name, components) and an
-    /// optional spot/process marker.
-    fn acb(space: u16, colors: &[(&str, &[u8])], marker: &[u8]) -> Vec<u8> {
-        let mut b = b"8BCB".to_vec();
-        b.extend(1u16.to_be_bytes());
-        b.extend(3000u16.to_be_bytes());
-        for s in ["$$$/colorbook/Test/title=Test Book^R", "TEST ", " C", "a book"] {
-            acb_str(&mut b, s);
-        }
-        b.extend((colors.len() as u16).to_be_bytes());
-        b.extend(7u16.to_be_bytes());
-        b.extend(0u16.to_be_bytes());
-        b.extend(space.to_be_bytes());
-        for (name, comps) in colors {
-            acb_str(&mut b, name);
-            b.extend(b"TST001");
-            b.extend(*comps);
-        }
-        b.extend(marker);
-        b
-    }
-
-    /// #831: color books (`.acb`) are read: their colors in RGB, CMYK or Lab, named with the book's
-    /// prefix and suffix, spot unless the book says process; page padding is left out.
-    #[test]
-    fn color_books_are_read() {
-        let lib = read_bytes(&acb(0, &[("185", &[228, 0, 43]), ("", &[0, 0, 0]), ("Red 032", &[239, 51, 64])], b"spflspot"), "fallback").unwrap();
-        assert_eq!(lib.name, "Test Book®");
-        let names: Vec<&str> = lib.swatches.iter().map(|s| s.name.as_str()).collect();
-        assert_eq!(names, ["TEST 185 C", "TEST Red 032 C"]);
-        assert!(lib.swatches.iter().all(|s| s.spot && s.global));
-        assert_eq!(lib.swatches[0].paint.color(), Some(Color::rgb8(228, 0, 43)));
-        // CMYK ink is stored inverted; a book marked process gives process colors.
-        let lib = read_bytes(&acb(2, &[("Cyan", &[0, 255, 255, 255])], b"spflproc"), "x").unwrap();
-        assert_eq!(lib.swatches[0].paint.color(), Some(Color::cmyk(1.0, 0.0, 0.0, 0.0)));
-        assert!(!lib.swatches[0].spot && !lib.swatches[0].global);
-        // Lab: lightness 0..255 for 0..100, a and b offset by 128; no marker: spot.
-        let lib = read_bytes(&acb(7, &[("Grey", &[255, 128, 128])], b""), "x").unwrap();
-        assert_eq!(lib.swatches[0].paint.color(), Some(Color::lab(100.0, 0.0, 0.0)));
-        assert!(lib.swatches[0].spot);
-        assert!(sniff_bytes(&acb(0, &[], b"")));
-        // Unsupported versions and color spaces, and short files, are errors.
-        let mut v2 = acb(0, &[], b"");
-        v2[5] = 2;
-        assert!(read_bytes(&v2, "x").is_err());
-        assert!(read_bytes(&acb(1, &[("x", &[1, 2, 3])], b""), "x").is_err());
-        let full = acb(0, &[("185", &[228, 0, 43])], b"");
-        for cut in 4..full.len() {
-            assert!(read_bytes(&full[..cut], "x").is_err(), "{cut} bytes");
-        }
-        let mut huge = b"8BCB\0\x01\0\x01".to_vec();
-        huge.extend(u32::MAX.to_be_bytes());
-        assert!(read_bytes(&huge, "x").is_err(), "a string longer than the file");
-    }

    fn sample() -> SwatchLibrary {
        let grad = Paint::Gradient(Box::new(GradientPaint::new(Gradient {
@@ -735,15 +262,10 @@ mod tests {
        }
    }

-    /// `lib` written as text format `f`.
-    fn written(lib: &SwatchLibrary, f: PaletteFormat) -> String {
-        String::from_utf8(write(lib, f).unwrap()).unwrap()
-    }
-
    #[test]
    fn native_round_trip_keeps_cmyk_spot_and_groups() {
        let lib = sample();
-        let text = written(&lib, PaletteFormat::Native);
+        let text = write(&lib, PaletteFormat::Native);
        assert!(sniff(&text));
        let back = read(&text, "fallback").unwrap();
        let mut expected = lib.clone();
@@ -756,7 +278,7 @@ mod tests {

    #[test]
    fn gpl_writes_rgb_with_group_headers_and_reads_comments_and_headers() {
-        let text = written(&sample(), PaletteFormat::Gpl);
+        let text = write(&sample(), PaletteFormat::Gpl);
        assert!(text.starts_with("GIMP Palette\nName: Brand */ Colours\n"));
        assert!(text.contains("# Group: Neutrals\n255   0   0\tR=255 G=0 B=0\n"), "{text}");
        assert!(!text.contains("Fade") && !text.contains("Tiles"), "only solid colours");
@@ -772,11 +294,6 @@ mod tests {
        assert_eq!(names, ["Sky Blue", "R=10 G=20 B=30", "Black", "Black 2"]);
        assert_eq!(lib.swatches[0].paint.color(), Some(Color::rgb8(0, 128, 255)));
        assert_eq!(read("GIMP Palette\n1 2 3 x\n", "Fallback").unwrap().name, "Fallback");
-        // Colors and groups share names; an unnamed group is "Color Group".
-        let lib = read("GIMP Palette\n0 0 0 Black\n# Group: Black\n1 1 1 Black\n# Group:\n", "x").unwrap();
-        let groups: Vec<(&str, Vec<&str>)> =
-            lib.groups.iter().map(|g| (g.name.as_str(), g.swatches.iter().map(|w| w.name.as_str()).collect())).collect();
-        assert_eq!(groups, [("Black 2", vec!["Black 3"]), ("Color Group", vec![])]);
    }

    #[test]
@@ -786,7 +303,7 @@ mod tests {
        assert_eq!(css_property("#FF00CC"), "--\\#ff00cc");
        assert_eq!(css_property("Café 50%"), "--café-50\\%");
        assert_eq!(css_property("  "), "--swatch");
-        let text = written(&sample(), PaletteFormat::Css);
+        let text = write(&sample(), PaletteFormat::Css);
        assert!(text.starts_with("/* Brand * / Colours */\n:root {\n"), "{text}");
        assert!(text.contains("  --ink: #"), "{text}");
        assert!(text.contains("; /* spot */"));
@@ -800,333 +317,8 @@ mod tests {
            swatches: ["Red", "red"].map(|n| Swatch { name: n.into(), paint: Paint::solid(Color::BLACK), global: false, spot: false }).to_vec(),
            groups: vec![],
        };
-        let text = written(&lib, PaletteFormat::Css);
+        let text = write(&lib, PaletteFormat::Css);
        assert!(text.contains("--red: #000000;") && text.contains("--red-2: #000000;"));
        assert!(read(&text, "x").is_err(), "CSS is written only");
    }
-
-    #[test]
-    fn holds_counts_the_swatches_each_format_writes() {
-        // `sample()` holds the spot color Ink, the linear gradient Fade, the pattern Tiles and two solid colors in a group.
-        let mut lib = sample();
-        let Paint::Gradient(mut mesh) = lib.swatches[1].paint.clone() else { panic!("Fade is a gradient") };
-        mesh.gradient.kind = GradientKind::Freeform;
-        lib.swatches.push(Swatch { name: "Mesh".into(), paint: Paint::Gradient(mesh), global: false, spot: false });
-        lib.swatches.push(Swatch { name: "[None]".into(), paint: Paint::None, global: false, spot: false });
-        let held = |f: PaletteFormat| lib.iter().filter(|w| f.holds(&w.paint)).count();
-        assert_eq!(PaletteFormat::ALL.map(held), [5, 3, 3, 4], "vcswatches, gpl, ase, css");
-        for f in [PaletteFormat::Native, PaletteFormat::Gpl, PaletteFormat::Ase] {
-            assert_eq!(read_bytes(&write(&lib, f).unwrap(), "x").unwrap().len(), held(f), "{f:?}");
-        }
-        let css = written(&lib, PaletteFormat::Css);
-        assert_eq!(css.lines().filter(|l| l.starts_with("  --")).count(), held(PaletteFormat::Css), "one property each: {css}");
-    }
-
-    /// A swatch exchange file of `blocks` (type, body).
-    fn ase(blocks: &[(u16, Vec<u8>)]) -> Vec<u8> {
-        let mut out = b"ASEF\0\x01\0\0".to_vec();
-        out.extend((blocks.len() as u32).to_be_bytes());
-        for (kind, body) in blocks {
-            out.extend(kind.to_be_bytes());
-            out.extend((body.len() as u32).to_be_bytes());
-            out.extend(body);
-        }
-        out
-    }
-
-    /// A name as `.ase` stores it.
-    fn ase_name(name: &str) -> Vec<u8> {
-        let units: Vec<u16> = name.encode_utf16().chain([0]).collect();
-        let mut out = (units.len() as u16).to_be_bytes().to_vec();
-        out.extend(units.iter().flat_map(|u| u.to_be_bytes()));
-        out
-    }
-
-    /// A color block: name, model, components and color type.
-    fn ase_color(name: &str, model: &[u8; 4], values: &[f32], kind: u16) -> (u16, Vec<u8>) {
-        let mut body = ase_name(name);
-        body.extend(model);
-        body.extend(values.iter().flat_map(|v| v.to_be_bytes()));
-        body.extend(kind.to_be_bytes());
-        (ASE_COLOR, body)
-    }
-
-    #[test]
-    fn ase_reads_color_models_kinds_and_groups() {
-        let bytes = ase(&[
-            ase_color("Sky", b"RGB ", &[0.0, 0.5, 1.0], 0),
-            ase_color("Ink", b"CMYK", &[1.0, 0.5, 0.0, 0.2], 1),
-            (ASE_GROUP_START, ase_name("Neutrals")),
-            ase_color("Mist", b"Gray", &[0.75], 2),
-            ase_color("Clay", b"LAB ", &[0.5, 20.0, -30.0], 2),
-            (ASE_GROUP_END, vec![]),
-            ase_color("Paper", b"RGB ", &[1.0, 1.0, 1.0], 2),
-        ]);
-        assert!(sniff_bytes(&bytes));
-        let sw = |name: &str, color, global, spot| Swatch { name: name.into(), paint: Paint::solid(color), global, spot };
-        let expected = SwatchLibrary {
-            name: "Brand".into(),
-            swatches: vec![
-                sw("Sky", Color::rgb(0.0, 0.5, 1.0), true, false),
-                sw("Ink", Color::cmyk(1.0, 0.5, 0.0, 0.2), true, true),
-                sw("Paper", Color::WHITE, false, false),
-            ],
-            groups: vec![SwatchGroup {
-                name: "Neutrals".into(),
-                swatches: vec![sw("Mist", Color::gray(0.25), false, false), sw("Clay", Color::lab(50.0, 20.0, -30.0), false, false)],
-            }],
-        };
-        assert_eq!(read_bytes(&bytes, "Brand").unwrap(), expected, "named after the file; 0 global, 1 spot, 2 process");
-        // A lightness above 1 is L* itself.
-        let deep = read_bytes(&ase(&[ase_color("Deep", b"LAB ", &[53.0, 20.0, -30.0], 2)]), "x").unwrap();
-        assert_eq!(deep.swatches[0].paint.color(), Some(Color::lab(53.0, 20.0, -30.0)));
-        // Text libraries read through the same call, also when they aren't valid UTF-8.
-        assert!(sniff_bytes(b"GIMP Palette\n1 2 3 x\n") && !sniff_bytes(b"ASE") && !sniff_bytes(&[0xff, 0xfe, 0]));
-        assert_eq!(read_bytes(b"GIMP Palette\n1 2 3 x\n", "F").unwrap().swatches.len(), 1);
-        let latin1 = b"GIMP Palette\n1 2 3 Caf\xe9\n";
-        assert!(sniff_bytes(latin1));
-        assert_eq!(read_bytes(latin1, "F").unwrap().swatches.len(), 1);
-    }
-
-    #[test]
-    fn ase_names_unnamed_and_repeated_entries_and_skips_other_blocks() {
-        let mut untyped = ase_color("Plain", b"RGB ", &[0.2, 0.4, 0.6], 2);
-        untyped.1.truncate(untyped.1.len() - 2);
-        let bytes = ase(&[
-            ase_color("Café 🎨", b"RGB ", &[1.0, 0.0, 0.0], 2),
-            ase_color("", b"CMYK", &[0.1, 0.2, 0.3, 0.0], 2),
-            ase_color(" Red ", b"RGB ", &[2.0, -1.0, f32::NAN], 0),
-            ase_color("Red", b"Gray", &[0.0], 2),
-            untyped,
-            ase_color("Hue", b"HSB ", &[0.1, 0.2, 0.3], 2),
-            (0x0042, vec![1, 2, 3]),
-            (ASE_GROUP_END, vec![]),
-            (ASE_GROUP_START, ase_name("")),
-            (ASE_GROUP_START, ase_name("Red")),
-            ase_color("Red", b"Gray", &[1.0], 2),
-        ]);
-        let lib = read_bytes(&bytes, "x").unwrap();
-        let names: Vec<&str> = lib.swatches.iter().map(|w| w.name.as_str()).collect();
-        assert_eq!(names, ["Café 🎨", "C=10 M=20 Y=30 K=0", "Red", "Red 2", "Plain"], "an HSB color and an unknown block are skipped");
-        assert_eq!(lib.swatches[2].paint.color(), Some(Color::rgb(1.0, 0.0, 0.0)), "clamped, NaN read as 0");
-        assert!(lib.swatches[2].global && !lib.swatches[4].global, "without a color type: process");
-        // A group start ends the open group, and groups and colors share names.
-        let groups: Vec<(&str, Vec<&str>)> =
-            lib.groups.iter().map(|g| (g.name.as_str(), g.swatches.iter().map(|w| w.name.as_str()).collect())).collect();
-        assert_eq!(groups, [("Color Group", vec![]), ("Red 3", vec!["Red 4"])]);
-        assert_eq!(lib.groups[1].swatches[0].paint.color(), Some(Color::gray(0.0)), "gray level 1 is white");
-    }
-
-    #[test]
-    fn damaged_ase_files_are_errors() {
-        let good = ase(&[(ASE_GROUP_START, ase_name("G")), ase_color("Sky", b"RGB ", &[0.0, 0.5, 1.0], 0)]);
-        assert_eq!(read_bytes(&good, "x").unwrap().len(), 1);
-        for n in ASE_SIGNATURE.len()..good.len() {
-            assert!(read_bytes(&good[..n], "x").is_err(), "cut at {n}");
-        }
-        let mut v2 = good.clone();
-        v2[5] = 2;
-        assert!(read_bytes(&v2, "x").unwrap_err().contains("2.0"), "version 2.0");
-        // Too many colors, or too many groups (empty group starts take 6 bytes each).
-        let colors: Vec<(u16, Vec<u8>)> = (0..=ASE_MAX_ENTRIES).map(|_| ase_color("Gray", b"Gray", &[0.5], 2)).collect();
-        assert!(read_bytes(&ase(&colors), "x").unwrap_err().contains("more than"));
-        let groups: Vec<(u16, Vec<u8>)> = (0..=ASE_MAX_ENTRIES).map(|_| (ASE_GROUP_START, vec![])).collect();
-        assert!(read_bytes(&ase(&groups), "x").unwrap_err().contains("more than"));
-        assert_eq!(read_bytes(&ase(&groups[1..]), "x").unwrap().groups.len(), ASE_MAX_ENTRIES, "up to the limit");
-    }
-
-    #[test]
-    fn ase_writes_each_model_kind_and_group() {
-        let sw = |name: &str, color, global, spot| Swatch { name: name.into(), paint: Paint::solid(color), global, spot };
-        let tint = Swatch {
-            name: "Ink 40%".into(),
-            paint: Paint::Solid { color: Color::cmyk(0.4, 0.2, 0.0, 0.08), swatch: Some("Ink".into()), tint: 0.4 },
-            global: false,
-            spot: false,
-        };
-        // `sample()` holds the spot color Ink, the gradient Fade, the pattern Tiles and the group Neutrals.
-        let mut lib = sample();
-        lib.swatches.insert(0, sw("Sky", Color::rgb(0.0, 0.5, 1.0), true, false));
-        lib.swatches.push(tint);
-        lib.groups[0].swatches = vec![sw("Mist", Color::gray(0.25), false, false), sw("Clay", Color::lab(50.0, 20.0, -30.0), false, false)];
-        lib.groups.push(SwatchGroup { name: "Empty".into(), swatches: vec![] });
-        let bytes = write(&lib, PaletteFormat::Ase).unwrap();
-        let expected = ase(&[
-            ase_color("Sky", b"RGB ", &[0.0, 0.5, 1.0], 0),
-            ase_color("Ink", b"CMYK", &[1.0, 0.5, 0.0, 0.2], 1),
-            ase_color("Ink 40%", b"CMYK", &[0.4, 0.2, 0.0, 0.08], 2),
-            (ASE_GROUP_START, ase_name("Neutrals")),
-            ase_color("Mist", b"Gray", &[0.75], 2),
-            ase_color("Clay", b"LAB ", &[0.5, 20.0, -30.0], 2),
-            (ASE_GROUP_END, vec![]),
-            (ASE_GROUP_START, ase_name("Empty")),
-            (ASE_GROUP_END, vec![]),
-        ]);
-        assert_eq!(bytes, expected, "no gradient or pattern; the tint as the process color it shows");
-        let back = read_bytes(&bytes, "Brand").unwrap();
-        assert_eq!((back.len(), back.groups.len()), (5, 2), "the empty group stays");
-        assert_eq!(PaletteFormat::parse(".ASE"), Some(PaletteFormat::Ase));
-        assert!(PaletteFormat::Ase.readable() && PaletteFormat::Ase.binary() && !PaletteFormat::Gpl.binary());
-    }
-
-    #[test]
-    fn ase_names_lose_nul_and_stop_at_the_reader_limit() {
-        let names = ["Re\0d".to_string(), "é".repeat(1030), format!("a{}", "🎨".repeat(600))];
-        let swatches = names.iter().map(|n| Swatch { name: n.clone(), paint: Paint::solid(Color::BLACK), global: false, spot: false }).collect();
-        let lib = SwatchLibrary { name: "x".into(), swatches, groups: vec![] };
-        let back = read_bytes(&write(&lib, PaletteFormat::Ase).unwrap(), "x").unwrap();
-        let got: Vec<&str> = back.swatches.iter().map(|w| w.name.as_str()).collect();
-        // At most 1024 UTF-16 code units, cut between characters: "a" and 511 two-unit emoji.
-        assert_eq!(got, ["Red".to_string(), "é".repeat(1024), format!("a{}", "🎨".repeat(511))]);
-    }
-
-    #[test]
-    fn ase_clamps_components_and_writes_non_finite_ones_as_zero() {
-        let sw = |name: &str, color| Swatch { name: name.into(), paint: Paint::solid(color), global: false, spot: false };
-        let swatches = vec![
-            sw("Lab", Color::lab(100.5, 300.0, -300.0)),
-            sw("Rgb", Color::rgb(2.0, -1.0, f32::NAN)),
-            sw("Cmyk", Color::cmyk(1.5, 0.0, 0.0, f32::INFINITY)),
-            sw("Gray", Color::gray(1.5)),
-        ];
-        let bytes = write(&SwatchLibrary { name: "x".into(), swatches, groups: vec![] }, PaletteFormat::Ase).unwrap();
-        let expected = ase(&[
-            ase_color("Lab", b"LAB ", &[1.0, 127.0, -128.0], 2),
-            ase_color("Rgb", b"RGB ", &[1.0, 0.0, 0.0], 2),
-            ase_color("Cmyk", b"CMYK", &[1.0, 0.0, 0.0, 0.0], 2),
-            ase_color("Gray", b"Gray", &[0.0], 2),
-        ]);
-        assert_eq!(bytes, expected, "clamped to the ranges .ase holds, a component that isn't finite as 0");
-        // Lightness 100.5 is written as 1, which reads back as L* 100.
-        let back = read_bytes(&bytes, "x").unwrap();
-        assert_eq!(back.swatches[0].paint.color(), Some(Color::lab(100.0, 127.0, -128.0)));
-    }
-
-    #[test]
-    fn ase_write_refuses_more_entries_than_the_reader_takes() {
-        let gray = |i: usize| Swatch { name: format!("G{i}"), paint: Paint::solid(Color::gray(0.5)), global: false, spot: false };
-        // The limit counts colors and groups: a group and `ASE_MAX_ENTRIES - 1` colors reach it.
-        let mut lib = SwatchLibrary {
-            name: "x".into(),
-            swatches: (1..ASE_MAX_ENTRIES).map(gray).collect(),
-            groups: vec![SwatchGroup { name: "Group".into(), swatches: vec![] }],
-        };
-        let back = read_bytes(&write(&lib, PaletteFormat::Ase).unwrap(), "x").unwrap();
-        assert_eq!((back.len(), back.groups.len()), (ASE_MAX_ENTRIES - 1, 1));
-        lib.swatches.push(gray(0));
-        let e = write(&lib, PaletteFormat::Ase).unwrap_err();
-        assert!(e.contains("reads at most 100000 colors and groups from a swatch exchange file, and this library has 100001"), "{e}");
-        // A gradient is left out and is not counted.
-        lib.swatches.last_mut().unwrap().paint = sample().swatches[1].paint.clone();
-        assert!(write(&lib, PaletteFormat::Ase).is_ok());
-    }
-
-    /// A color in one of the four models, in the ranges `.ase` holds.
-    fn arb_color() -> impl Strategy<Value = Color> {
-        let unit = || 0.0f32..=1.0;
-        prop_oneof![
-            (unit(), unit(), unit()).prop_map(|(r, g, b)| Color::rgb(r, g, b)),
-            (unit(), unit(), unit(), unit()).prop_map(|(c, m, y, k)| Color::cmyk(c, m, y, k)),
-            unit().prop_map(Color::gray),
-            (0.0f32..=100.0, -128.0f32..=127.0, -128.0f32..=127.0).prop_map(|(l, a, b)| Color::lab(l, a, b)),
-        ]
-    }
-
-    /// A swatch's paint with its global and spot flags: a solid color with any flags, a tint swatch
-    /// (both flags off) or a gradient.
-    fn arb_paint() -> impl Strategy<Value = (Paint, bool, bool)> {
-        prop_oneof![
-            4 => (arb_color(), any::<bool>(), any::<bool>()).prop_map(|(c, global, spot)| (Paint::solid(c), global, spot)),
-            1 => arb_color().prop_map(|c| (Paint::Solid { color: c, swatch: Some("Base".into()), tint: 0.4 }, false, false)),
-            1 => Just((sample().swatches[1].paint.clone(), false, false)),
-        ]
-    }
-
-    /// Ungrouped swatches and color groups. A name is a number and up to 12 characters of any script
-    /// but NUL, trimmed, so swatches and groups have unique names, as in a document.
-    fn arb_library() -> impl Strategy<Value = SwatchLibrary> {
-        let swatches = || prop::collection::vec((arb_paint(), "[^\\x00]{0,12}"), 0..12);
-        (swatches(), prop::collection::vec(("[^\\x00]{0,12}", swatches()), 0..4)).prop_map(|(loose, groups)| {
-            let mut n = 0;
-            let mut name = |prefix: &str, base: &str| {
-                n += 1;
-                format!("{prefix}{n} {base}").trim().to_string()
-            };
-            let mut lib = SwatchLibrary { name: "Fuzz".into(), ..Default::default() };
-            for ((paint, global, spot), base) in loose {
-                lib.swatches.push(Swatch { name: name("", &base), paint, global, spot });
-            }
-            for (base, list) in groups {
-                let mut g = SwatchGroup { name: name("G", &base), swatches: vec![] };
-                for ((paint, global, spot), base) in list {
-                    g.swatches.push(Swatch { name: name("", &base), paint, global, spot });
-                }
-                lib.groups.push(g);
-            }
-            lib
-        })
-    }
-
-    /// Are `got` and `want` in the same model, with every component within 1e-4? Lab lightness and
-    /// gray read back within `f32` rounding.
-    fn close(got: Color, want: Color) -> bool {
-        let near = |a: f32, b: f32| (a - b).abs() < 1e-4;
-        match (got, want) {
-            (Color::Rgb { r, g, b }, Color::Rgb { r: r2, g: g2, b: b2 }) => near(r, r2) && near(g, g2) && near(b, b2),
-            (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => near(c, c2) && near(m, m2) && near(y, y2) && near(k, k2),
-            (Color::Gray { k }, Color::Gray { k: k2 }) => near(k, k2),
-            (Color::Lab { l, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => near(l, l2) && near(a, a2) && near(b, b2),
-            _ => false,
-        }
-    }
-
-    /// The swatches of `list` as an `.ase` file reads them back: solid colors only, unlinked, spot
-    /// colors global.
-    fn ase_expected(list: &[Swatch]) -> Vec<Swatch> {
-        list.iter()
-            .filter_map(|w| Some(Swatch { name: w.name.clone(), paint: Paint::solid(w.paint.color()?), global: w.global || w.spot, spot: w.spot }))
-            .collect()
-    }
-
-    /// Do swatches `got` have the names, flags and unlinked colors (within 1e-4) of `want`?
-    fn same_swatches(got: &[Swatch], want: &[Swatch]) -> bool {
-        got.len() == want.len()
-            && got.iter().zip(want).all(|(g, w)| {
-                let color = match (&g.paint, w.paint.color()) {
-                    (Paint::Solid { color, swatch: None, .. }, Some(c)) => close(*color, c),
-                    _ => false,
-                };
-                g.name == w.name && g.global == w.global && g.spot == w.spot && color
-            })
-    }
-
-    proptest! {
-        #![proptest_config(ProptestConfig { failure_persistence: None, ..ProptestConfig::default() })]
-
-        /// A written `.ase` file reads back as the library's solid colors in their own model, with
-        /// their names, kinds and color groups.
-        #[test]
-        fn ase_round_trip_keeps_models_kinds_and_groups(lib in arb_library()) {
-            let bytes = write(&lib, PaletteFormat::Ase).unwrap();
-            prop_assert!(sniff_bytes(&bytes));
-            let back = read_bytes(&bytes, &lib.name).unwrap();
-            prop_assert_eq!(&back.name, &lib.name);
-            prop_assert!(same_swatches(&back.swatches, &ase_expected(&lib.swatches)), "{:?}", back.swatches);
-            prop_assert_eq!(back.groups.len(), lib.groups.len());
-            for (g, want) in back.groups.iter().zip(&lib.groups) {
-                prop_assert_eq!(&g.name, &want.name);
-                prop_assert!(same_swatches(&g.swatches, &ase_expected(&want.swatches)), "{}: {:?}", g.name, g.swatches);
-            }
-        }
-
-        /// A written `.vcswatches`, `.gpl` or `.ase` file reads back with as many swatches as
-        /// [`PaletteFormat::holds`] counts.
-        #[test]
-        fn written_files_read_back_with_the_swatches_holds_counts(lib in arb_library()) {
-            for f in [PaletteFormat::Native, PaletteFormat::Gpl, PaletteFormat::Ase] {
-                let back = read_bytes(&write(&lib, f).unwrap(), &lib.name).unwrap();
-                prop_assert_eq!(back.len(), lib.iter().filter(|w| f.holds(&w.paint)).count(), "{:?}", f);
-            }
-        }
-    }
 }
@@ -293,129 +293,6 @@ impl WidthProfile {
    }
 }

-/// Pen pressure recorded along a stroke (the Paintbrush with a graphics tablet): (position 0..1
-/// along the path, pressure 0..1) samples in order, positions measured as a [`WidthProfile`]'s
-/// are. Calligraphic brushes with Pressure variation read it; everything else ignores it.
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-pub struct PressureProfile {
-    pub points: Vec<(f64, f64)>,
-}
-
-impl PressureProfile {
-    /// The pressure of a stroke drawn without one (a mouse, or a path the brush was applied to):
-    /// half way, so a Pressure brush draws its own value there.
-    pub const MID: f64 = 0.5;
-    /// The most samples a stroke keeps (after simplifying them).
-    pub const MAX_POINTS: usize = 512;
-    /// How far (in pressure) simplifying may move the recorded curve.
-    const TOLERANCE: f64 = 0.01;
-
-    /// The pressure at `t` (0..1), linear between samples; [`Self::MID`] without any.
-    pub fn at(&self, t: f64) -> f64 {
-        let p = &self.points;
-        let (Some(first), Some(last)) = (p.first(), p.last()) else { return Self::MID };
-        let v = if t <= first.0 {
-            first.1
-        } else {
-            p.windows(2)
-                .find_map(|w| match w {
-                    [a, b] if t <= b.0 => Some(a.1 + (b.1 - a.1) * ((t - a.0) / (b.0 - a.0).max(1e-9)).clamp(0.0, 1.0)),
-                    _ => None,
-                })
-                .unwrap_or(last.1)
-        };
-        if v.is_finite() { v.clamp(0.0, 1.0) } else { Self::MID }
-    }
-
-    /// A profile from (position, pressure) samples in order along the stroke: values are clamped
-    /// into 0..1 (non-finite ones dropped), the curve is simplified to within 1 % and kept to
-    /// [`Self::MAX_POINTS`]. `None` without a sample.
-    pub fn from_samples(samples: impl IntoIterator<Item = (f64, f64)>) -> Option<Self> {
-        let pts: Vec<(f64, f64)> =
-            samples.into_iter().filter(|(t, p)| t.is_finite() && p.is_finite()).map(|(t, p)| (t.clamp(0.0, 1.0), p.clamp(0.0, 1.0))).collect();
-        if pts.is_empty() {
-            return None;
-        }
-        // Simplifying is quadratic at worst: a huge stroke is thinned evenly first.
-        let mut pts = thin(pts, 16 * Self::MAX_POINTS);
-        // Positions only ever go forward.
-        let mut prev = 0.0;
-        for p in &mut pts {
-            p.0 = p.0.max(prev);
-            prev = p.0;
-        }
-        let keep = simplify_1d(&pts, Self::TOLERANCE);
-        let pts = thin(pts.iter().zip(keep).filter(|(_, k)| *k).map(|(p, _)| *p).collect(), Self::MAX_POINTS);
-        let round = |v: f64| (v * 1e4).round() / 1e4;
-        Some(Self { points: pts.into_iter().map(|(t, p)| (round(t), round(p))).collect() })
-    }
-
-    /// The pressure of a path `old_len` long (`old`; None: drawn without pressure) continued at its
-    /// end by a stroke `added_len` long (`added`). None when neither has pressure.
-    pub fn extended(old: Option<&Self>, old_len: f64, added: Option<&Self>, added_len: f64) -> Option<Self> {
-        if old.is_none() && added.is_none() {
-            return None;
-        }
-        let (old_len, added_len) = (old_len.max(0.0), added_len.max(0.0));
-        let total = old_len + added_len;
-        if !total.is_finite() || total <= 1e-9 {
-            return old.or(added).cloned();
-        }
-        let flat = Self { points: vec![(0.0, Self::MID), (1.0, Self::MID)] };
-        let (old, added) = (old.unwrap_or(&flat), added.unwrap_or(&flat));
-        let o = old_len / total;
-        let old_pts = old.points.iter().map(|&(t, p)| (t * o, p));
-        Self::from_samples(old_pts.chain(added.points.iter().map(|&(u, p)| (o + u * (1.0 - o), p))))
-    }
-
-    /// The pressure of the path reversed.
-    pub fn reversed(&self) -> Self {
-        Self { points: self.points.iter().rev().map(|&(t, p)| (1.0 - t, p)).collect() }
-    }
-
-    /// A light–heavy–light stroke, for previews of pressure-sensitive brushes.
-    pub fn sample() -> Self {
-        Self { points: vec![(0.0, 0.0), (0.5, 1.0), (1.0, 0.0)] }
-    }
-}
-
-/// At most `max` of `pts`, evenly spread (the ends kept).
-fn thin(pts: Vec<(f64, f64)>, max: usize) -> Vec<(f64, f64)> {
-    let n = pts.len();
-    if n <= max || max < 2 {
-        return pts;
-    }
-    (0..max).filter_map(|i| pts.get(i * (n - 1) / (max - 1)).copied()).collect()
-}
-
-/// Douglas–Peucker over a function sampled at `pts`: which samples to keep so the polyline through
-/// them stays within `tol` (vertically) of every sample. The ends are always kept.
-fn simplify_1d(pts: &[(f64, f64)], tol: f64) -> Vec<bool> {
-    let mut keep = vec![false; pts.len()];
-    let Some(last) = pts.len().checked_sub(1) else { return keep };
-    for i in [0, last] {
-        if let Some(k) = keep.get_mut(i) {
-            *k = true;
-        }
-    }
-    let mut stack = vec![(0, last)];
-    while let Some((i, j)) = stack.pop() {
-        let (Some(&a), Some(&b)) = (pts.get(i), pts.get(j)) else { continue };
-        let line = |t: f64| if b.0 - a.0 > 1e-12 { a.1 + (b.1 - a.1) * (t - a.0) / (b.0 - a.0) } else { (a.1 + b.1) / 2.0 };
-        let far = (i + 1..j).filter_map(|k| pts.get(k).map(|q| (k, (q.1 - line(q.0)).abs()))).max_by(|x, y| x.1.total_cmp(&y.1));
-        if let Some((k, d)) = far
-            && d > tol
-        {
-            if let Some(f) = keep.get_mut(k) {
-                *f = true;
-            }
-            stack.push((i, k));
-            stack.push((k, j));
-        }
-    }
-    keep
-}
-
 /// A width profile saved to the Profile list under a name (Add to Profiles), kept with the
 /// preferences.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -509,11 +386,6 @@ pub struct StrokeLayer {
    /// How a gradient paint maps onto the stroke (within, along or across it).
    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
    pub gradient_mode: StrokeGradientMode,
-    /// The pen pressure the stroke was drawn with (Paintbrush with a tablet): pressure-sensitive
-    /// brushes vary with it. It belongs to this path's shape, so appearances copied to other
-    /// art leave it behind ([`Appearance::without_pressure`]).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub pressure: Option<PressureProfile>,
 }

 /// How a gradient on a stroke is laid out (the Gradient panel's Stroke buttons). Saved by variant
@@ -584,7 +456,6 @@ impl StrokeLayer {
            arrow_align: ArrowAlign::Extend,
            overprint: false,
            gradient_mode: StrokeGradientMode::Within,
-            pressure: None,
        }
    }
    /// Weight of the start (`end == false`) or end arrowhead: stroke weight × its scale, at least
@@ -769,15 +640,6 @@ impl Appearance {
    pub fn stroke_mut(&mut self) -> Option<&mut StrokeLayer> {
        self.items.iter_mut().rev().find_map(|i| if let AppearanceItem::Stroke(s) = i { Some(s) } else { None })
    }
-    /// This appearance for other art: the pen pressure its strokes were drawn with stays with them.
-    pub fn without_pressure(mut self) -> Self {
-        for it in &mut self.items {
-            if let AppearanceItem::Stroke(s) = it {
-                s.pressure = None;
-            }
-        }
-        self
-    }
    pub fn fill_paint(&self) -> Paint {
        self.fill().map(|f| f.paint.clone()).unwrap_or(Paint::None)
    }
@@ -942,7 +804,7 @@ impl Appearance {
        })
    }
    /// Gradient paints of the fills and strokes.
-    pub(crate) fn gradients(&self) -> impl Iterator<Item = &vectorcraft_color::GradientPaint> {
+    fn gradients(&self) -> impl Iterator<Item = &vectorcraft_color::GradientPaint> {
        self.items.iter().filter_map(|i| match i {
            AppearanceItem::Fill(FillLayer { paint: Paint::Gradient(g), .. })
            | AppearanceItem::Stroke(StrokeLayer { paint: Paint::Gradient(g), .. }) => Some(&**g),
@@ -1241,58 +1103,6 @@ mod tests {
        assert!(matches!(a.items[0], AppearanceItem::Fill(_)));
    }

-    /// #852: pen pressure is kept simplified along the stroke and read back by position.
-    #[test]
-    fn pressure_profile_samples_simplify_and_interpolate() {
-        // A steady ramp keeps only its ends; a bump keeps its peak.
-        let ramp = PressureProfile::from_samples((0..=100).map(|i| (i as f64 / 100.0, i as f64 / 100.0))).unwrap();
-        assert_eq!(ramp.points, vec![(0.0, 0.0), (1.0, 1.0)]);
-        assert!((ramp.at(0.25) - 0.25).abs() < 1e-9);
-        let bump = PressureProfile::from_samples([(0.0, 0.2), (0.3, 0.2), (0.5, 0.9), (0.7, 0.2), (1.0, 0.2)]).unwrap();
-        assert!(bump.points.contains(&(0.5, 0.9)) && (bump.at(0.4) - 0.55).abs() < 1e-9, "{bump:?}");
-        // Junk is clamped or dropped; positions never go back; nothing at all is no profile.
-        let junk = PressureProfile::from_samples([(f64::NAN, 0.5), (0.5, 7.0), (0.2, -1.0), (2.0, f64::INFINITY)]).unwrap();
-        assert_eq!(junk.points, vec![(0.5, 1.0), (0.5, 0.0)]);
-        assert!(PressureProfile::from_samples([(f64::NAN, 0.5)]).is_none());
-        assert_eq!(PressureProfile::default().at(0.3), PressureProfile::MID);
-        // A long noisy stroke stays bounded.
-        let noisy = PressureProfile::from_samples((0..1_000_000).map(|i| (i as f64 / 1e6, (i % 2) as f64))).unwrap();
-        assert!(noisy.points.len() <= PressureProfile::MAX_POINTS);
-        // Out-of-order points (a hand-edited file) still read within 0..1.
-        let odd = PressureProfile { points: vec![(1.0, 5.0), (0.0, -3.0)] };
-        assert!((0.0..=1.0).contains(&odd.at(0.5)));
-    }
-
-    #[test]
-    fn pressure_profile_extends_and_reverses() {
-        let old = PressureProfile { points: vec![(0.0, 0.0), (1.0, 1.0)] };
-        let added = PressureProfile { points: vec![(0.0, 1.0), (1.0, 0.0)] };
-        // A 30 pt path continued by 10 pt: its ramp fills the first three quarters.
-        let joined = PressureProfile::extended(Some(&old), 30.0, Some(&added), 10.0).unwrap();
-        assert!((joined.at(0.75) - 1.0).abs() < 1e-9 && (joined.at(0.375) - 0.5).abs() < 1e-9 && joined.at(1.0) == 0.0, "{joined:?}");
-        // A side without pressure is half way.
-        let half = PressureProfile::extended(None, 10.0, Some(&added), 10.0).unwrap();
-        assert_eq!(half.at(0.25), PressureProfile::MID);
-        assert!(PressureProfile::extended(None, 10.0, None, 10.0).is_none());
-        assert_eq!(PressureProfile::extended(Some(&old), 0.0, None, f64::NAN), Some(old.clone()));
-        assert_eq!(old.reversed().points, vec![(0.0, 1.0), (1.0, 0.0)]);
-    }
-
-    /// Strokes saved before pen pressure load as they were, and are written without it.
-    #[test]
-    fn strokes_without_pressure_round_trip_unchanged() {
-        let json = serde_json::to_value(StrokeLayer::new(Paint::None, 2.0)).unwrap();
-        assert!(json.get("pressure").is_none());
-        let st: StrokeLayer = serde_json::from_value(json).unwrap();
-        assert_eq!(st.pressure, None);
-        let pressed = StrokeLayer { pressure: Some(PressureProfile::sample()), ..st };
-        let back: StrokeLayer = serde_json::from_value(serde_json::to_value(&pressed).unwrap()).unwrap();
-        assert_eq!(back, pressed);
-        let mut ap = Appearance::basic(Paint::None, Paint::None, 1.0);
-        ap.stroke_mut().unwrap().pressure = Some(PressureProfile::sample());
-        assert_eq!(ap.without_pressure().stroke().unwrap().pressure, None);
-    }
-
    #[test]
    fn profile_interp() {
        let p = WidthProfile::lens();
@@ -50,9 +50,7 @@ impl Document {

    /// `ids` that are in the document, back to front.
    pub fn paint_order(&self, ids: impl IntoIterator<Item = NodeId>) -> Vec<NodeId> {
-        let ids: Vec<NodeId> = ids.into_iter().collect();
-        let paths = self.index_paths(ids.iter().copied());
-        let mut v: Vec<(Vec<usize>, NodeId)> = ids.into_iter().filter_map(|id| paths.get(&id).map(|p| (p.clone(), id))).collect();
+        let mut v: Vec<(Vec<usize>, NodeId)> = ids.into_iter().filter_map(|id| self.index_path(id).map(|p| (p, id))).collect();
        v.sort();
        v.into_iter().map(|(_, id)| id).collect()
    }
@@ -527,8 +527,7 @@ impl Lerp {
            (NodeKind::Mesh(ma), NodeKind::Mesh(mb)) if ma.rows == mb.rows && ma.cols == mb.cols && ma.points.len() == mb.points.len() => Shape::Mesh,
            (NodeKind::Text(_), NodeKind::Text(_))
            | (NodeKind::SymbolInstance { .. }, NodeKind::SymbolInstance { .. })
-            | (NodeKind::Image(_), NodeKind::Image(_))
-            | (NodeKind::PlacedDocument(_), NodeKind::PlacedDocument(_)) => Shape::Placed,
+            | (NodeKind::Image(_), NodeKind::Image(_)) => Shape::Placed,
            _ => match (node_path(a), node_path(b)) {
                (Some((pa, ra, ma)), Some((pb, rb, mb))) => {
                    Shape::Path { pair: PathPair::new(&pa, &pb, starts), rules: (ra, rb), members: ma.zip(mb) }
@@ -562,7 +561,7 @@ impl Lerp {
                        }
                    }
                }
-                n.extras_mut().mask = None;
+                n.mask = None;
                n
            }
            Shape::Path { pair, rules, members } => {
@@ -587,10 +586,9 @@ impl Lerp {
                        *o = lerp_affine(*x, *y, t)
                    }
                    (NodeKind::Image(o), NodeKind::Image(x), NodeKind::Image(y)) => o.xf = lerp_affine(x.xf, y.xf, t),
-                    (NodeKind::PlacedDocument(o), NodeKind::PlacedDocument(x), NodeKind::PlacedDocument(y)) => o.xf = lerp_affine(x.xf, y.xf, t),
                    _ => {}
                }
-                n.extras_mut().mask = None;
+                n.mask = None;
                n
            }
            Shape::Other => {
@@ -614,12 +612,12 @@ impl Lerp {
                for c in n.children_mut().into_iter().flatten() {
                    zero_ids(Arc::make_mut(c));
                }
-                n.extras_mut().mask = None;
+                n.mask = None;
                n
            }
        };
        n.id = NodeId(0);
-        n.appearance = lerp_appearance(&a.appearance, &b.appearance, t).into();
+        n.appearance = lerp_appearance(&a.appearance, &b.appearance, t);
        n.opacity = lerp_f32(a.opacity, b.opacity, t as f32);
        n.blend = base.blend;
        n.visible = true;
@@ -994,7 +992,7 @@ fn paints_opaquely(n: &Node) -> bool {
    };
    n.opacity >= 1.0
        && n.blend == vectorcraft_color::BlendMode::Normal
-        && n.extras().mask.is_none()
+        && n.mask.is_none()
        && n.appearance.effects.is_empty()
        && n.appearance
            .items
@@ -136,116 +136,10 @@ fn tiff_inks(bytes: &[u8]) -> Option<Inks> {
    Inks::new(w, h, data)
 }

-/// A TIFF whose pixels have samples after their colour, which the image decoder doesn't read at
-/// all, as RGBA pixels: CMYK with an alpha channel (5 samples), each colour converted by `rgb` (ink
-/// amounts 0..1 → sRGB 0..1; the inks can't be kept with the transparency, so they show as RGB),
-/// and grayscale with extra samples, of which the first is the alpha when the file says so (other
-/// channels are left out). Associated (premultiplied) alpha is divided back out. `None` for other
-/// images, planar ones and ones larger than [`MAX_CMYK_PIXELS`].
-pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3]) -> Option<image::RgbaImage> {
-    use tiff::tags::Tag;
-    let (kind, mut d) = tiff(bytes)?;
-    let (w, h) = d.dimensions().ok()?;
-    let planar = d.find_tag_unsigned::<u16>(Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
-    // 0: white is zero, 1: black is zero (the two grayscales).
-    let photometric = d.find_tag_unsigned::<u16>(Tag::PhotometricInterpretation).ok().flatten();
-    // ExtraSamples 1: associated alpha (premultiplied colour), 2: unassociated alpha, 0: not alpha.
-    let extra = d.find_tag_unsigned_vec::<u16>(Tag::ExtraSamples).ok().flatten().and_then(|v| v.first().copied());
-    // (samples in a pixel, how many of them are its colour, is the next one alpha?)
-    let (samples, colour, alpha) = match kind {
-        tiff::ColorType::CMYKA(8 | 16) => (5, 4, true),
-        tiff::ColorType::Multiband { bit_depth: 8 | 16, num_samples: n @ 2.. } if matches!(photometric, Some(0 | 1)) => {
-            (usize::from(n), 1, matches!(extra, Some(1 | 2)))
-        }
-        _ => return None,
-    };
-    if planar {
-        return None;
-    }
-    let n = usize::try_from(pixels(w, h)?).ok()?;
-    let data: Vec<u8> = match d.read_image().ok()? {
-        tiff::decoder::DecodingResult::U8(v) => v,
-        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
-        _ => return None,
-    };
-    if Some(data.len()) != n.checked_mul(samples) {
-        return None;
-    }
-    let mut out = Vec::with_capacity(n * 4);
-    for p in data.chunks_exact(samples) {
-        let opacity = if alpha { p.get(colour).copied().unwrap_or(u8::MAX) } else { u8::MAX };
-        let a = f32::from(opacity) / 255.0;
-        let level = |v: u8| {
-            let v = f32::from(v) / 255.0;
-            if extra == Some(1) && a > 0.0 { (v / a).min(1.0) } else { v }
-        };
-        let [r, g, b] = match *p {
-            [c, m, y, k, ..] if colour == 4 => rgb([level(c), level(m), level(y), level(k)]),
-            [v, ..] if photometric == Some(0) => [1.0 - level(v); 3],
-            [v, ..] => [level(v); 3],
-            [] => continue,
-        };
-        out.extend([r, g, b].map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8));
-        out.push(opacity);
-    }
-    image::RgbaImage::from_raw(w, h, out)
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;

-    #[test]
-    fn a_cmyk_tiff_with_alpha_reads_as_rgba() {
-        use tiff::encoder::{TiffEncoder, colortype::CMYKA8};
-        // 2 × 1: full cyan opaque, then 100% K at half alpha (premultiplied: K 128, alpha 128).
-        let mut file = Cursor::new(Vec::new());
-        let mut enc = TiffEncoder::new(&mut file).unwrap();
-        let mut img = enc.new_image::<CMYKA8>(2, 1).unwrap();
-        img.encoder().write_tag(tiff::tags::Tag::ExtraSamples, &[1u16][..]).unwrap();
-        img.write_data(&[255, 0, 0, 0, 255, 0, 0, 0, 128, 128]).unwrap();
-        let bytes = file.into_inner();
-        let naive = |[c, m, y, k]: [f32; 4]| [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)];
-        let px = extra_samples_tiff_rgba(&bytes, naive).expect("CMYKA reads");
-        assert_eq!(px.dimensions(), (2, 1));
-        assert_eq!(px.get_pixel(0, 0).0, [0, 255, 255, 255], "cyan, opaque");
-        assert_eq!(px.get_pixel(1, 0).0, [0, 0, 0, 128], "the premultiplied K divided back out: black at half alpha");
-        // Not CMYKA: not this reader's.
-        assert!(extra_samples_tiff_rgba(&ImageBlob::cmyk_tiff(&inks()).unwrap().bytes, naive).is_none());
-    }
-
-    /// Two 8-bit samples a pixel: gray and one extra sample, which the file's `ExtraSamples` names.
-    struct GrayExtra8;
-    impl tiff::encoder::colortype::ColorType for GrayExtra8 {
-        type Inner = u8;
-        const TIFF_VALUE: tiff::tags::PhotometricInterpretation = tiff::tags::PhotometricInterpretation::BlackIsZero;
-        const BITS_PER_SAMPLE: &'static [u16] = &[8, 8];
-        const SAMPLE_FORMAT: &'static [tiff::tags::SampleFormat] = &[tiff::tags::SampleFormat::Uint; 2];
-        fn horizontal_predict(row: &[u8], result: &mut Vec<u8>) {
-            result.extend_from_slice(row);
-        }
-    }
-
-    /// A grayscale TIFF with an alpha channel, or with a channel that isn't one (#1466): the image
-    /// decoder reads neither.
-    #[test]
-    fn a_grayscale_tiff_with_an_extra_channel_reads_as_rgba() {
-        let gray = |extra: u16| {
-            let mut file = Cursor::new(Vec::new());
-            let mut enc = tiff::encoder::TiffEncoder::new(&mut file).unwrap();
-            let mut img = enc.new_image::<GrayExtra8>(3, 1).unwrap();
-            img.encoder().write_tag(tiff::tags::Tag::ExtraSamples, &[extra][..]).unwrap();
-            // White opaque, a gray of 64 at 80% alpha (premultiplied: 51), black with no alpha.
-            img.write_data(&[255, 255, 51, 204, 0, 0]).unwrap();
-            let bytes = file.into_inner();
-            assert!(image::load_from_memory(&bytes).is_err(), "the image decoder reads it now: this reader may go");
-            extra_samples_tiff_rgba(&bytes, |_| [0.0; 3]).expect("gray with an extra sample reads").into_raw()
-        };
-        assert_eq!(gray(1), [255, 255, 255, 255, 64, 64, 64, 204, 0, 0, 0, 0], "associated alpha, divided back out");
-        assert_eq!(gray(2), [255, 255, 255, 255, 51, 51, 51, 204, 0, 0, 0, 0], "unassociated alpha");
-        assert_eq!(gray(0), [255, 255, 255, 255, 51, 51, 51, 255, 0, 0, 0, 255], "a channel that isn't alpha: opaque");
-    }
-
    fn inks() -> Inks {
        Inks::new(3, 2, vec![0, 40, 100, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 12, 34, 56, 78]).unwrap()
    }
@@ -1,271 +0,0 @@
-//! Live Corners on any path: the corners of its uncut outline (a live rectangle's or polygon's, a
-//! live path's, or a plain path's own), each one's radius and kind, and the anchors of the path as
-//! drawn that belong to each. [`set_corners`] edits them.
-
-use std::borrow::Cow;
-use std::collections::BTreeSet;
-
-use vectorcraft_geom::corners::{Corner, cut_corners, path_corners};
-use vectorcraft_geom::shapes::{self, CornerKind};
-use vectorcraft_geom::{Affine, PathData, Rect};
-
-use crate::node::{LiveShape, Node, NodeKind};
-use crate::selection::AnchorRef;
-
-/// The Live Corners of a path.
-#[derive(Clone, Debug)]
-pub struct LiveCorners<'a> {
-    /// The path with its corners uncut, in the corners' own space: a live rectangle's (its size
-    /// and radii in document units, see [`LiveShape::folded`]), else the document's.
-    pub base: Cow<'a, PathData>,
-    /// Maps `base` into the document.
-    pub xf: Affine,
-    /// The corners that can be cut, in anchor order ([`path_corners`] of `base`).
-    pub corners: Vec<Corner>,
-    radii: Vec<f64>,
-    kinds: Vec<CornerKind>,
-    /// For each anchor of the path as drawn (per subpath), the anchor of `base` it comes from.
-    sources: Vec<Vec<usize>>,
-}
-
-impl<'a> LiveCorners<'a> {
-    /// The Live Corners of `path` and its live shape; `None` for shapes without corners (ellipses,
-    /// lines).
-    pub fn new(path: &'a PathData, live: Option<&'a LiveShape>) -> Option<Self> {
-        let (base, xf, radii, kinds) = match live {
-            None => (Cow::Borrowed(path), Affine::IDENTITY, vec![], vec![]),
-            Some(l @ LiveShape::Rectangle { .. }) => {
-                let LiveShape::Rectangle { w, h, radii, kinds, xf } = l.folded() else { return None };
-                (Cow::Owned(shapes::rectangle(Rect::new(0.0, 0.0, w, h))), xf, radii.to_vec(), kinds.to_vec())
-            }
-            Some(l @ LiveShape::Polygon { radii, kinds, .. }) => (Cow::Owned(l.polygon_outline()), Affine::IDENTITY, radii.clone(), kinds.clone()),
-            Some(LiveShape::Path { base, radii, kinds }) => (Cow::Borrowed(base), Affine::IDENTITY, radii.clone(), kinds.clone()),
-            Some(LiveShape::Ellipse { .. } | LiveShape::Line { .. }) => return None,
-        };
-        let sources = if radii.iter().any(|r| *r > 0.0) {
-            cut_corners(&base, &radii, &kinds).1
-        } else {
-            let mut first = 0;
-            base.subpaths
-                .iter()
-                .map(|sp| {
-                    first += sp.anchors.len();
-                    (first - sp.anchors.len()..first).collect()
-                })
-                .collect()
-        };
-        Some(Self { corners: path_corners(&base), base, xf, radii, kinds, sources })
-    }
-
-    /// The Live Corners of a path object.
-    pub fn of(node: &'a Node) -> Option<Self> {
-        let NodeKind::Path { path, live, .. } = &node.kind else { return None };
-        Self::new(path, live.as_deref())
-    }
-
-    /// The corner at anchor `index` of `base`.
-    pub fn corner(&self, index: usize) -> Option<&Corner> {
-        self.corners.binary_search_by_key(&index, |c| c.index).ok().and_then(|i| self.corners.get(i))
-    }
-
-    /// The radius corner `index` is set to, in document units (drawn no larger than fits).
-    pub fn radius(&self, index: usize) -> f64 {
-        self.radii.get(index).copied().unwrap_or(0.0)
-    }
-
-    /// The kind corner `index` is cut with.
-    pub fn kind(&self, index: usize) -> CornerKind {
-        self.kinds.get(index).copied().unwrap_or_default()
-    }
-
-    /// Every corner.
-    pub fn all(&self) -> BTreeSet<usize> {
-        self.corners.iter().map(|c| c.index).collect()
-    }
-
-    /// The corners holding one of `anchors` (of the path as drawn).
-    pub fn corners_of(&self, anchors: &BTreeSet<AnchorRef>) -> BTreeSet<usize> {
-        anchors.iter().filter_map(|(si, ai)| self.sources.get(*si)?.get(*ai).copied()).filter(|k| self.corner(*k).is_some()).collect()
-    }
-
-    /// The corners Live Corners edit for a selection: those holding a selected anchor when the
-    /// path is partly selected (Direct Selection), else every corner.
-    pub fn picked(&self, partial: Option<&BTreeSet<AnchorRef>>) -> BTreeSet<usize> {
-        let picked = partial.map(|a| self.corners_of(a)).unwrap_or_default();
-        if picked.is_empty() { self.all() } else { picked }
-    }
-
-    /// The anchors of the path as drawn that belong to `corners` (to keep them selected as the
-    /// path changes).
-    pub fn anchors_of(&self, corners: &BTreeSet<usize>) -> BTreeSet<AnchorRef> {
-        let mut out = BTreeSet::new();
-        for (si, from) in self.sources.iter().enumerate() {
-            out.extend(from.iter().enumerate().filter(|(_, k)| corners.contains(k)).map(|(ai, _)| (si, ai)));
-        }
-        out
-    }
-
-    /// For each anchor of the path as drawn (per subpath), the anchor of `base` it comes from.
-    pub fn sources(&self) -> &[Vec<usize>] {
-        &self.sources
-    }
-
-    /// The radius (document units) and kind `corners` share (each `None` when they differ, or
-    /// for no corners).
-    pub fn style(&self, corners: &BTreeSet<usize>) -> (Option<f64>, Option<CornerKind>) {
-        fn shared<T: Copy>(mut it: impl Iterator<Item = T>, same: impl Fn(T, T) -> bool) -> Option<T> {
-            let first = it.next()?;
-            it.all(|x| same(x, first)).then_some(first)
-        }
-        let radius = shared(corners.iter().map(|k| self.radius(*k)), |a, b| (a - b).abs() < 1e-9);
-        (radius, shared(corners.iter().map(|k| self.kind(*k)), |a, b| a == b))
-    }
-}
-
-/// Set `radius` (document units; negative: 0) and/or `kind` on the `corners` (anchor indices of
-/// the uncut outline, see [`LiveCorners`]) of a path and its live shape, then cut the path again.
-/// A path that isn't a live shape keeps its uncut outline as a [`LiveShape::Path`], which is a
-/// plain path again once no corner is cut. Ellipses and lines have no corners: they stay as they
-/// are.
-pub fn set_corners(path: &mut PathData, live: &mut Option<Box<LiveShape>>, corners: &BTreeSet<usize>, radius: Option<f64>, kind: Option<CornerKind>) {
-    fn edit(radii: &mut [f64], kinds: &mut [CornerKind], corners: &BTreeSet<usize>, radius: Option<f64>, kind: Option<CornerKind>) {
-        for k in corners {
-            if let (Some(r), Some(slot)) = (radius, radii.get_mut(*k)) {
-                *slot = r.max(0.0);
-            }
-            if let (Some(kind), Some(slot)) = (kind, kinds.get_mut(*k)) {
-                *slot = kind;
-            }
-        }
-    }
-    /// One radius and kind per corner of an outline of `n` anchors while editing; none saved
-    /// when all are sharp or round.
-    fn edit_vec(
-        n: usize,
-        radii: &mut Vec<f64>,
-        kinds: &mut Vec<CornerKind>,
-        corners: &BTreeSet<usize>,
-        radius: Option<f64>,
-        kind: Option<CornerKind>,
-    ) {
-        radii.resize(n, 0.0);
-        kinds.resize(n, CornerKind::Round);
-        edit(radii, kinds, corners, radius, kind);
-        if radii.iter().all(|r| *r <= 0.0) {
-            radii.clear();
-        }
-        if kinds.iter().all(|k| *k == CornerKind::Round) {
-            kinds.clear();
-        }
-    }
-    let l = live.get_or_insert_with(|| Box::new(LiveShape::Path { base: path.clone(), radii: vec![], kinds: vec![] }));
-    // Radii are document lengths and corners circular, also on a rectangle from a file that kept
-    // an uneven scale in its transform (#442).
-    l.fold_scale();
-    match &mut **l {
-        LiveShape::Rectangle { radii, kinds, .. } => edit(radii, kinds, corners, radius, kind),
-        LiveShape::Polygon { sides, radii, kinds, .. } => edit_vec(*sides as usize, radii, kinds, corners, radius, kind),
-        LiveShape::Path { base, radii, kinds } => edit_vec(base.anchor_count(), radii, kinds, corners, radius, kind),
-        LiveShape::Ellipse { .. } | LiveShape::Line { .. } => return,
-    }
-    match live.as_deref_mut() {
-        Some(LiveShape::Path { base, radii, kinds }) if radii.is_empty() && kinds.is_empty() => {
-            *path = std::mem::take(base);
-            *live = None;
-        }
-        Some(l) => *path = l.to_path(),
-        None => {}
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use vectorcraft_geom::{Point, SubPath};
-
-    fn set(v: &[usize]) -> BTreeSet<usize> {
-        v.iter().copied().collect()
-    }
-
-    fn anchors(v: &[usize]) -> BTreeSet<AnchorRef> {
-        v.iter().map(|ai| (0, *ai)).collect()
-    }
-
-    #[test]
-    fn rectangle_corners_map_to_their_anchors() {
-        let l = LiveShape::Rectangle { w: 100.0, h: 50.0, radii: [0.0, 10.0, 0.0, 0.0], kinds: Default::default(), xf: Affine::IDENTITY };
-        let path = l.to_path();
-        let c = LiveCorners::new(&path, Some(&l)).unwrap();
-        // Anchors: top-left, the top-right corner's two, bottom-right, bottom-left.
-        assert_eq!(c.sources(), [vec![0, 1, 1, 2, 3]]);
-        assert_eq!(path.anchor_count(), 5);
-        assert_eq!(c.corners_of(&anchors(&[2, 4])), set(&[1, 3]));
-        assert!(c.corners_of(&anchors(&[9])).is_empty(), "out of range");
-        assert_eq!(c.anchors_of(&set(&[1, 3])), anchors(&[1, 2, 4]));
-        // Partly selected: the corners of the selected anchors; wholly (or no anchor): all four.
-        assert_eq!(c.picked(Some(&anchors(&[0]))), set(&[0]));
-        assert_eq!(c.picked(None), set(&[0, 1, 2, 3]));
-        assert_eq!(c.picked(Some(&anchors(&[]))), set(&[0, 1, 2, 3]));
-        assert_eq!(c.style(&set(&[1])), (Some(10.0), Some(CornerKind::Round)));
-        assert_eq!(c.style(&set(&[0, 1])), (None, Some(CornerKind::Round)));
-        assert_eq!(c.style(&set(&[0, 2, 3])), (Some(0.0), Some(CornerKind::Round)));
-        let e = LiveShape::Ellipse { w: 1.0, h: 1.0, pie: (0.0, 360.0), xf: Affine::IDENTITY };
-        assert!(LiveCorners::new(&e.to_path(), Some(&e)).is_none());
-    }
-
-    /// #511: a plain path (a star) rounds its corners and keeps them editable; with none cut it
-    /// is plain again.
-    #[test]
-    fn a_plain_path_keeps_its_cut_corners_live() {
-        let star = shapes::star(Point::new(100.0, 100.0), 50.0, 25.0, 5, 0.0);
-        let (mut path, mut live) = (star.clone(), None);
-        set_corners(&mut path, &mut live, &set(&[0, 2]), Some(5.0), None);
-        let Some(LiveShape::Path { base, radii, kinds }) = live.as_deref() else { panic!("live corners: {live:?}") };
-        assert_eq!((base, radii.len(), kinds.len()), (&star, 10, 0));
-        assert_eq!(path.anchor_count(), 12, "two corners cut");
-        let c = LiveCorners::new(&path, live.as_deref()).unwrap();
-        assert_eq!(c.style(&set(&[0, 2])), (Some(5.0), Some(CornerKind::Round)));
-        assert_eq!(c.corners_of(&anchors(&[0, 11])), set(&[0]), "the first corner's cut ends the path");
-        // Kinds alone keep it live; squaring every corner makes it the plain star again.
-        set_corners(&mut path, &mut live, &set(&[0, 2]), Some(0.0), Some(CornerKind::Chamfer));
-        assert!(matches!(live.as_deref(), Some(LiveShape::Path { radii, .. }) if radii.is_empty()));
-        set_corners(&mut path, &mut live, &set(&[0, 2]), None, Some(CornerKind::Round));
-        assert_eq!((path, live), (star, None));
-    }
-
-    /// A polygon's corners are cut in the document and survive a change of sides when shared.
-    #[test]
-    fn polygon_corners_follow_their_sides() {
-        let mut l = LiveShape::Polygon { radius: 50.0, sides: 6, xf: Affine::translate((100.0, 100.0)), radii: vec![], kinds: vec![] };
-        let (mut path, mut live) = (l.to_path(), Some(Box::new(l.clone())));
-        set_corners(&mut path, &mut live, &set(&[0, 1, 2, 3, 4, 5]), Some(8.0), None);
-        assert_eq!(path.anchor_count(), 12);
-        l = *live.clone().unwrap();
-        l.set_sides(8);
-        assert!(matches!(&l, LiveShape::Polygon { radii, .. } if *radii == vec![8.0; 8]));
-        assert_eq!(l.to_path().anchor_count(), 16);
-        // Mixed radii: the new corners are sharp.
-        set_corners(&mut path, &mut live, &set(&[1]), Some(3.0), None);
-        let mut l = *live.unwrap();
-        l.set_sides(7);
-        assert!(matches!(&l, LiveShape::Polygon { radii, .. } if *radii == [8.0, 3.0, 8.0, 8.0, 8.0, 8.0, 0.0]));
-        // An uneven scale keeps the cuts circular: the radius scales by the mean scale.
-        let mut p = l.clone();
-        assert!(p.transform(Affine::scale_non_uniform(4.0, 1.0)));
-        assert!(matches!(&p, LiveShape::Polygon { radii, .. } if (radii[0] - 16.0).abs() < 1e-9));
-        assert!(!p.transform(Affine::translate((5.0, 0.0))), "a move needs no new cuts");
-    }
-
-    #[test]
-    fn open_paths_and_curves_keep_their_ends_and_smooth_anchors() {
-        let pen = PathData::single(SubPath::polyline(&[Point::new(0.0, 0.0), Point::new(100.0, 0.0), Point::new(100.0, 80.0)], false));
-        let c = LiveCorners::new(&pen, None).unwrap();
-        assert_eq!(c.all(), set(&[1]));
-        assert_eq!(c.picked(Some(&anchors(&[0]))), set(&[1]), "an end is no corner: every corner");
-        let (mut path, mut live) = (pen.clone(), None);
-        set_corners(&mut path, &mut live, &c.all(), Some(10.0), None);
-        assert_eq!(path.anchor_count(), 4);
-        assert_eq!(path.subpaths[0].anchors[0].p, Point::new(0.0, 0.0));
-        assert_eq!(path.subpaths[0].anchors[3].p, Point::new(100.0, 80.0));
-    }
-}
@@ -1,15 +1,8 @@
 //! Graphs (Illustrator's graph tools): a group whose art is generated from a [`GraphSpec`].

-use std::collections::HashSet;
-
 use serde::{Deserialize, Serialize};
 use vectorcraft_geom::Rect;

-/// Most categories (rows) and series (columns) a graph's data grid holds: the grid is built in full for drawing and
-/// for the data window, so a file can't make it allocate without bound.
-pub const MAX_GRAPH_CATEGORIES: usize = 10_000;
-pub const MAX_GRAPH_SERIES: usize = 256;
-
 /// The nine graph types, in the Graph tool group's order.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -69,200 +62,6 @@ impl GraphKind {
            GraphKind::Radar => "Radar",
        }
    }
-    /// Whether a series of this type can be drawn in a graph of type `graph` (Combine different graph types): the
-    /// column, stacked column, line and area types share a vertical value axis, the bar types a horizontal one.
-    /// Scatter, pie and radar lay their data out on their own and take no other types.
-    pub fn combines_with(self, graph: GraphKind) -> bool {
-        use GraphKind::*;
-        let vertical = |k| matches!(k, Column | StackedColumn | Line | Area);
-        let horizontal = |k| matches!(k, Bar | StackedBar);
-        self == graph || (vertical(self) && vertical(graph)) || (horizontal(self) && horizontal(graph))
-    }
-}
-
-/// A graph design (Object › Graph › Design…): named art that graphs draw in place of their default marks.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct GraphDesign {
-    pub name: String,
-    pub art: std::sync::Arc<crate::Node>,
-}
-
-impl GraphDesign {
-    /// Most designs a document keeps, objects in one design's art, and characters in a design's name.
-    pub const MAX: usize = 1000;
-    pub const MAX_NODES: usize = 2000;
-    pub const MAX_NAME: usize = 64;
-
-    /// A design name cleaned up: trimmed, without control characters, at most [`Self::MAX_NAME`] long; `None` when
-    /// nothing is left.
-    pub fn clean_name(name: &str) -> Option<String> {
-        let n: String = name.trim().chars().filter(|c| !c.is_control()).take(Self::MAX_NAME).collect();
-        Some(n.trim().to_string()).filter(|n| !n.is_empty())
-    }
-
-    /// `art` as plain design art: a graph inside it becomes the plain group it draws as, so a marker never holds a
-    /// graph of its own (that its commands would then edit).
-    pub fn plain_art(art: &crate::Node) -> crate::Node {
-        let mut n = art.clone();
-        {
-            let mut e = n.extras_mut();
-            e.graph = None;
-            e.series_index = None;
-        }
-        if let Some(ch) = n.children_mut() {
-            let old = std::mem::take(ch);
-            *ch = old.iter().map(|c| std::sync::Arc::new(Self::plain_art(c))).collect();
-        }
-        n
-    }
-}
-
-impl crate::Document {
-    /// The graph designs a file gave, made safe to list and draw: at most [`GraphDesign::MAX`], each with a clean,
-    /// unique name, art of at most [`GraphDesign::MAX_NODES`] objects and no graph inside.
-    pub fn tidy_graph_designs(&mut self) {
-        let mut kept: Vec<GraphDesign> = vec![];
-        for d in std::mem::take(&mut self.graph_designs) {
-            if kept.len() >= GraphDesign::MAX {
-                break;
-            }
-            let Some(name) = GraphDesign::clean_name(&d.name) else { continue };
-            if kept.iter().any(|k| k.name == name) || d.art.count() > GraphDesign::MAX_NODES {
-                continue;
-            }
-            kept.push(GraphDesign { name, art: std::sync::Arc::new(GraphDesign::plain_art(&d.art)) });
-        }
-        self.graph_designs = kept;
-    }
-}
-
-/// The character style a graph's labels keep through regeneration once formatted (Format the text in graphs): the
-/// value axis numbers, the category labels (category axis, radar spokes, pie names) and the legend labels (beside or
-/// across the top, or in pie wedges). `None` draws the default 9 pt black.
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-#[serde(default, rename_all = "camelCase")]
-pub struct LabelStyles {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub values: Option<crate::CharStyle>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub categories: Option<crate::CharStyle>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub legend: Option<crate::CharStyle>,
-}
-
-impl LabelStyles {
-    fn is_default(&self) -> bool {
-        *self == Self::default()
-    }
-}
-
-/// Graph Type › Position for pie graphs with several pies: the same size (Even), sized by their totals (Ratio), or
-/// stacked one on another, sized by their totals (Stacked).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum PiePosition {
-    #[default]
-    Even,
-    Ratio,
-    Stacked,
-}
-
-/// Graph Type › Sort for pie graphs: wedges in data order (None), largest first in each pie (All), or in the first
-/// pie's largest-first order in every pie (First).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum PieSort {
-    #[default]
-    None,
-    All,
-    First,
-}
-
-macro_rules! ids {
-    ($t:ty { $($v:ident => $id:literal),* }) => {
-        impl $t {
-            pub fn id(self) -> &'static str {
-                match self { $(Self::$v => $id),* }
-            }
-            pub fn parse(s: &str) -> Option<Self> {
-                [$(Self::$v),*].into_iter().find(|k| k.id().eq_ignore_ascii_case(s))
-            }
-            fn is_default(&self) -> bool {
-                *self == Self::default()
-            }
-        }
-    };
-}
-ids!(PiePosition { Even => "even", Ratio => "ratio", Stacked => "stacked" });
-ids!(PieSort { None => "none", All => "all", First => "first" });
-
-/// Graph Type › Value Axis: which side of the plot the value axis is drawn on.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ValueAxisSide {
-    #[default]
-    Left,
-    Right,
-    Both,
-}
-
-impl ValueAxisSide {
-    pub fn id(self) -> &'static str {
-        match self {
-            ValueAxisSide::Left => "left",
-            ValueAxisSide::Right => "right",
-            ValueAxisSide::Both => "both",
-        }
-    }
-    pub fn parse(s: &str) -> Option<Self> {
-        [ValueAxisSide::Left, ValueAxisSide::Right, ValueAxisSide::Both].into_iter().find(|k| k.id().eq_ignore_ascii_case(s))
-    }
-    fn is_left(&self) -> bool {
-        *self == ValueAxisSide::Left
-    }
-}
-
-/// Graph Type › Tick Marks › Length: no tick marks, short ones outside the axis, or lines across the whole plot.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum TickLength {
-    None,
-    #[default]
-    Short,
-    Full,
-}
-
-impl TickLength {
-    pub fn id(self) -> &'static str {
-        match self {
-            TickLength::None => "none",
-            TickLength::Short => "short",
-            TickLength::Full => "full",
-        }
-    }
-    pub fn parse(s: &str) -> Option<Self> {
-        [TickLength::None, TickLength::Short, TickLength::Full].into_iter().find(|k| k.id().eq_ignore_ascii_case(s))
-    }
-    fn is_short(&self) -> bool {
-        *self == TickLength::Short
-    }
-    fn is_none(&self) -> bool {
-        *self == TickLength::None
-    }
-}
-
-/// The fill and stroke captured from one series' generated marks. An absent paint keeps whatever
-/// the generator draws for that part (greyscale for a series fill, the part's own stroke otherwise).
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-#[serde(default, rename_all = "camelCase")]
-pub struct SeriesPaint {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub fill: Option<vectorcraft_color::Paint>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub stroke: Option<vectorcraft_color::Paint>,
-    /// Stroke weight in points, kept with [`Self::stroke`].
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub stroke_width: Option<f64>,
 }

 /// Graph data and options. `rows` are categories (one per row of the Graph Data window), each
@@ -271,26 +70,15 @@ pub struct SeriesPaint {
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
 pub struct GraphSpec {
-    /// Paint taken from the series' marks (Group Selection). One entry per series index; missing
-    /// entries keep the generator's own fill and stroke.
-    pub series_paints: Vec<SeriesPaint>,
    pub kind: GraphKind,
-    /// Graph types chosen for single series (Combine different graph types), by series index; `None` and missing
-    /// entries draw as [`Self::kind`].
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub series_kinds: Vec<Option<GraphKind>>,
    /// The plot rectangle (the area the graph tool dragged), document points.
    pub rect: Rect,
    pub series: Vec<String>,
    pub categories: Vec<String>,
    pub rows: Vec<Vec<f64>>,
-    /// Blank cells as `[category, series]`: their `rows` entry is a 0 placeholder, so a file still reads (as zeros)
-    /// in a version that doesn't know blanks. Cells past the end of a short row are blank too.
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub blanks: Vec<[usize; 2]>,
-    /// Column/bar width as a % of the available category width (90); past 100 the columns overlap.
+    /// Column/bar width as a % of the available category width (90).
    pub column_width: f64,
-    /// Cluster width as a % (80); past 100 the clusters overlap.
+    /// Cluster width as a % (80).
    pub cluster_width: f64,
    /// Legend on the right (Graph Type options: Add Legend Across Top = false).
    pub legend: bool,
@@ -298,179 +86,30 @@ pub struct GraphSpec {
    pub ticks: usize,
    pub axis_min: Option<f64>,
    pub axis_max: Option<f64>,
-    /// Graph Type › Value Axis side. Column, stacked column, line, area and scatter graphs (the bar graphs' value axis
-    /// runs along the bottom and stays there).
-    #[serde(skip_serializing_if = "ValueAxisSide::is_left")]
-    pub value_axis: ValueAxisSide,
-    /// Graph Type › Separate Scales: with the value axis on both sides, the series on the right axis
-    /// ([`Self::right_series`]) get a scale of their own there.
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub separate_scales: bool,
-    /// Indexes of the series assigned to the right value axis.
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub right_series: Vec<usize>,
-    /// The right value axis' tick values, used with separate scales: tick count (0 = automatic) and min/max override.
-    #[serde(skip_serializing_if = "is_zero")]
-    pub right_ticks: usize,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub right_axis_min: Option<f64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub right_axis_max: Option<f64>,
-    /// The labels' character styles, kept from formatting them.
-    #[serde(skip_serializing_if = "LabelStyles::is_default")]
-    pub label_styles: LabelStyles,
-    /// Graph Type › First Row in Front (each series' first category drawn over the next when columns overlap) and
-    /// First Column in Front (the first series drawn over the others); Draw Filled Lines (lines as filled bands).
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub first_row_in_front: bool,
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub first_column_in_front: bool,
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub filled_lines: bool,
-    /// Graph Type › Add Drop Shadow (behind columns, bars, lines and pie wedges) and Add Legend Across Top (the
-    /// legend in rows above the plot instead of a column on its right).
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub drop_shadow: bool,
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub legend_across_top: bool,
-    /// Pie graphs: Legends in Wedges (the series labels inside their wedges instead of a legend beside the pies),
-    /// Position and Sort.
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub pie_legend_in_wedges: bool,
-    #[serde(skip_serializing_if = "PiePosition::is_default")]
-    pub pie_position: PiePosition,
-    #[serde(skip_serializing_if = "PieSort::is_default")]
-    pub pie_sort: PieSort,
-    /// Object › Graph › Marker: the graph design each series' data points (and legend swatch) are drawn with, by
-    /// series index, for line, scatter and radar series; `None` and missing entries draw the default square.
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub series_markers: Vec<Option<String>>,
-    /// Graph Type › Tick Marks for the value axis (the left one, or the bottom one of bar graphs) and the right one:
-    /// length, and tick marks per division (0 and 1 = one, at the labels).
-    #[serde(skip_serializing_if = "TickLength::is_short")]
-    pub tick_length: TickLength,
-    #[serde(skip_serializing_if = "at_most_one")]
-    pub tick_marks: usize,
-    #[serde(skip_serializing_if = "TickLength::is_short")]
-    pub right_tick_length: TickLength,
-    #[serde(skip_serializing_if = "at_most_one")]
-    pub right_tick_marks: usize,
-    /// Tick Marks for the category axis (none by default), and Draw Tick Marks Between Labels.
-    #[serde(skip_serializing_if = "TickLength::is_none")]
-    pub category_tick_length: TickLength,
-    #[serde(skip_serializing_if = "at_most_one")]
-    pub category_tick_marks: usize,
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub ticks_between_labels: bool,
-    /// Graph Type › Add Labels: text before and after the value axes' numbers.
-    #[serde(skip_serializing_if = "String::is_empty")]
-    pub prefix: String,
-    #[serde(skip_serializing_if = "String::is_empty")]
-    pub suffix: String,
-    #[serde(skip_serializing_if = "String::is_empty")]
-    pub right_prefix: String,
-    #[serde(skip_serializing_if = "String::is_empty")]
-    pub right_suffix: String,
-    /// Line, scatter and radar graphs: mark data points, connect them.
+    /// Line graphs: mark data points, connect them, fill (area-like) the lines.
    pub mark_points: bool,
    pub connect_points: bool,
-    /// Line graphs: run the lines from edge to edge of the plot; off (the default for new graphs), the points sit
-    /// at the centres of their categories, like the columns of a column graph. Graphs saved before the option
-    /// existed were drawn edge to edge and keep it.
-    #[serde(default = "edge_to_edge_before_the_option")]
-    pub edge_to_edge: bool,
    /// Bounds of the art when it was last generated (detects moves/scales of the graph group).
    #[serde(skip_serializing_if = "Option::is_none")]
    pub placed: Option<Rect>,
 }

-fn at_most_one(n: &usize) -> bool {
-    *n <= 1
-}
-
-fn is_zero(n: &usize) -> bool {
-    *n == 0
-}
-
-/// Edge-to-Edge Lines for a graph saved before the option existed: on, as it was drawn then.
-fn edge_to_edge_before_the_option() -> bool {
-    true
-}
-
-impl GraphSpec {
-    /// The type series `s` is drawn as: its own type when it combines with the graph's, else the graph's.
-    pub fn series_kind(&self, s: usize) -> GraphKind {
-        self.series_kinds.get(s).copied().flatten().filter(|k| k.combines_with(self.kind)).unwrap_or(self.kind)
-    }
-
-    /// The data with blank cells as `None`, every row as long as the longest (at most [`MAX_GRAPH_CATEGORIES`] rows
-    /// of [`MAX_GRAPH_SERIES`] cells).
-    pub fn cells(&self) -> Vec<Vec<Option<f64>>> {
-        let width = self.rows.iter().map(Vec::len).max().unwrap_or(0).min(MAX_GRAPH_SERIES);
-        let blank: HashSet<[usize; 2]> = self.blanks.iter().copied().collect();
-        self.rows
-            .iter()
-            .take(MAX_GRAPH_CATEGORIES)
-            .enumerate()
-            .map(|(c, r)| (0..width).map(|s| r.get(s).copied().filter(|_| !blank.contains(&[c, s]))).collect())
-            .collect()
-    }
-
-    /// Store `cells`, a blank (`None`) as a 0 placeholder listed in `blanks`.
-    pub fn set_cells(&mut self, cells: Vec<Vec<Option<f64>>>) {
-        self.blanks =
-            cells.iter().enumerate().flat_map(|(c, r)| r.iter().enumerate().filter(|(_, v)| v.is_none()).map(move |(s, _)| [c, s])).collect();
-        self.rows = cells.into_iter().map(|r| r.into_iter().map(|v| v.unwrap_or(0.0)).collect()).collect();
-    }
-}
-
 impl Default for GraphSpec {
    fn default() -> Self {
        Self {
-            series_paints: vec![],
            kind: GraphKind::Column,
-            series_kinds: vec![],
            rect: Rect::new(0.0, 0.0, 200.0, 150.0),
            series: vec![],
            categories: vec![],
            rows: vec![vec![1.0]],
-            blanks: vec![],
            column_width: 90.0,
            cluster_width: 80.0,
            legend: true,
            ticks: 0,
            axis_min: None,
            axis_max: None,
-            value_axis: ValueAxisSide::Left,
-            separate_scales: false,
-            right_series: vec![],
-            right_ticks: 0,
-            right_axis_min: None,
-            right_axis_max: None,
-            series_markers: vec![],
-            label_styles: LabelStyles::default(),
-            first_row_in_front: false,
-            first_column_in_front: false,
-            filled_lines: false,
-            drop_shadow: false,
-            legend_across_top: false,
-            pie_legend_in_wedges: false,
-            pie_position: PiePosition::Even,
-            pie_sort: PieSort::None,
-            tick_length: TickLength::Short,
-            tick_marks: 1,
-            right_tick_length: TickLength::Short,
-            right_tick_marks: 1,
-            category_tick_length: TickLength::None,
-            category_tick_marks: 1,
-            ticks_between_labels: false,
-            prefix: String::new(),
-            suffix: String::new(),
-            right_prefix: String::new(),
-            right_suffix: String::new(),
            mark_points: true,
            connect_points: true,
-            edge_to_edge: false,
            placed: None,
        }
    }
@@ -31,10 +31,6 @@ impl Hit {
    /// The object the Selection tool selects: the child of the layer (the outermost group).
    /// Inside isolation mode (`scope`), the child of the isolated container instead.
    pub fn top_object(&self, scope: Option<NodeId>) -> NodeId {
-        // A single object isolated: it is the only object.
-        if scope == Some(self.leaf) {
-            return self.leaf;
-        }
        // The innermost of the isolated container and an envelope whose contents are edited.
        let at = |s: Option<NodeId>| s.and_then(|s| self.ancestry.iter().position(|x| *x == s));
        if let Some(i) = at(scope).max(at(self.contents_of)) {
@@ -48,8 +44,6 @@ impl Hit {
 /// Options for hit testing.
 #[derive(Clone, Copy, Debug)]
 pub struct HitOptions {
-    /// The isolated construction container, whose retained Shaper sources are hittable.
-    pub scope: Option<NodeId>,
    /// Tolerance in document units (screen tolerance / zoom).
    pub tol: f64,
    /// Outline mode: only outlines are hittable.
@@ -64,28 +58,21 @@ pub struct HitOptions {

 impl Default for HitOptions {
    fn default() -> Self {
-        Self { tol: 3.0, outline: false, path_only: false, type_path_only: false, scope: None }
+        Self { tol: 3.0, outline: false, path_only: false, type_path_only: false }
    }
 }

 /// Topmost editable object under `p`.
 pub fn hit_test(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit> {
-    hit_test_skipping(doc, p, opt, &|_| false, true)
-}
-
-/// Topmost visible art for read-only sampling: locked objects and template layers participate,
-/// including art outside the editing scope. This never changes their editability.
-pub fn hit_test_visible(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit> {
-    hit_test_skipping(doc, p, opt, &|_| false, false)
+    hit_test_skipping(doc, p, opt, &|_| false)
 }

 /// The objects under `p` that [`Hit::top_object`] picks in `scope` (isolation mode), topmost
 /// first: what clicks there select, one below the other (Cmd/Ctrl-click selects behind).
 pub fn objects_at(doc: &Document, p: Point, opt: HitOptions, scope: Option<NodeId>) -> Vec<NodeId> {
-    let opt = HitOptions { scope: scope.or(opt.scope), ..opt };
    let mut tops: Vec<NodeId> = vec![];
    // Each round leaves out the objects found so far (and everything inside them).
-    while let Some(top) = hit_test_skipping(doc, p, opt, &|id| tops.contains(&id), true).map(|h| h.top_object(scope)) {
+    while let Some(top) = hit_test_skipping(doc, p, opt, &|id| tops.contains(&id)).map(|h| h.top_object(scope)) {
        if tops.contains(&top) {
            break;
        }
@@ -95,40 +82,25 @@ pub fn objects_at(doc: &Document, p: Point, opt: HitOptions, scope: Option<NodeI
 }

 /// [`hit_test`] passing over the nodes `skip` names (and their contents).
-fn hit_test_skipping(doc: &Document, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool, editable_only: bool) -> Option<Hit> {
-    let finish = |mut h: Hit| {
-        h.contents_of = h.ancestry.iter().rev().copied().find(|a| doc.node(*a).is_some_and(edits_contents));
-        h.layers = h.ancestry.iter().take_while(|a| doc.node(**a).is_some_and(Node::is_layer)).count();
-        h
-    };
-    // Isolation mode: only what is inside the isolated container hits. The art around it is
-    // locked, and clicks pass through it (#833).
-    if editable_only
-        && let Some(scope) = opt.scope
-        && let Some(isolated) = doc.node(scope)
-        && let Some(mut chain) = doc.ancestry(scope)
-    {
-        if isolated.is_container() {
-            return hit_children(isolated, p, opt, skip, &mut chain, editable_only).map(finish);
-        }
-        // A single object isolated (a path, an image…): only it hits, among its siblings.
-        chain.pop();
-        let parent = chain.last().and_then(|id| doc.node(*id))?;
-        return hit_children(parent, p, opt, &|id| id != scope || skip(id), &mut chain, editable_only).map(finish);
-    }
+fn hit_test_skipping(doc: &Document, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool) -> Option<Hit> {
    let mut chain = Vec::new();
    for layer in doc.layers.iter().rev() {
-        if !layer.visible || editable_only && (layer.locked || layer.is_template()) {
+        if !layer.visible || layer.locked {
+            continue;
+        }
+        if layer.is_template() {
            continue;
        }
        // Pattern editing mode: only the tile art is editable.
-        if editable_only && doc.pattern_edit.as_ref().is_some_and(|e| e.layer != layer.id) {
+        if doc.pattern_edit.as_ref().is_some_and(|e| e.layer != layer.id) {
            continue;
        }
        chain.push(layer.id);
        let opt = if matches!(layer.kind, NodeKind::Layer { preview: false, .. }) { HitOptions { outline: true, ..opt } } else { opt };
-        if let Some(h) = hit_children(layer, p, opt, skip, &mut chain, editable_only) {
-            return Some(finish(h));
+        if let Some(mut h) = hit_children(layer, p, opt, skip, &mut chain) {
+            h.contents_of = h.ancestry.iter().rev().copied().find(|a| doc.node(*a).is_some_and(edits_contents));
+            h.layers = h.ancestry.iter().take_while(|a| doc.node(**a).is_some_and(Node::is_layer)).count();
+            return Some(h);
        }
        chain.pop();
    }
@@ -150,14 +122,7 @@ fn clip_contains(clip: &Node, p: Point) -> bool {
    clip.clip_shapes(Some(&frame)).iter().any(|(bp, rule)| fill_contains(bp, *rule, p))
 }

-fn hit_children(
-    parent: &Node,
-    p: Point,
-    opt: HitOptions,
-    skip: &dyn Fn(NodeId) -> bool,
-    chain: &mut Vec<NodeId>,
-    editable_only: bool,
-) -> Option<Hit> {
+fn hit_children(parent: &Node, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool, chain: &mut Vec<NodeId>) -> Option<Hit> {
    let children = parent.children()?;
    // A clip group (or a layer with a clipping mask) only hits inside its clipping path.
    if parent.clips()
@@ -166,20 +131,13 @@ fn hit_children(
    {
        return None;
    }
-    for (i, c) in children.iter().enumerate().rev() {
-        if parent.extras().shaper.is_some() {
-            let construction = children.first().is_some_and(|source| Some(source.id) == opt.scope);
-            if (i == 0) != construction {
-                continue;
-            }
-        }
-        // Read-only samples can read locked/template art; hidden art never participates.
-        if !c.visible || editable_only && (c.locked || c.is_template()) || skip(c.id) {
+    for c in children.iter().rev() {
+        // Hidden, locked and template sublayers block clicks like top-level layers do.
+        if !c.visible || c.locked || c.is_template() || skip(c.id) {
            continue;
        }
        // (An envelope's content sits where it was, not where the envelope draws it.)
-        if !(edits_contents(c)
-            || c.extras().shaper.is_some() && c.children().and_then(|children| children.first()).is_some_and(|source| Some(source.id) == opt.scope))
+        if !edits_contents(c)
            && let Some(b) = c.reach_bounds()
            && !b.inflate(opt.tol, opt.tol).contains(p)
        {
@@ -188,13 +146,13 @@ fn hit_children(
        chain.push(c.id);
        let hit = match &c.kind {
            // A sublayer whose Preview is off is clicked in outline, like an outline view.
-            NodeKind::Layer { preview: false, .. } => hit_children(c, p, HitOptions { outline: true, ..opt }, skip, chain, editable_only),
-            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, skip, chain, editable_only),
+            NodeKind::Layer { preview: false, .. } => hit_children(c, p, HitOptions { outline: true, ..opt }, skip, chain),
+            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, skip, chain),
            // Edit Contents: the envelope's content hits, undistorted.
-            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, skip, chain, editable_only),
+            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, skip, chain),
            // A blend's key objects first (Direct and Group Selection pick them); its steps hit
            // as the blend.
-            NodeKind::Blend { .. } => hit_children(c, p, opt, skip, chain, editable_only)
+            NodeKind::Blend { .. } => hit_children(c, p, opt, skip, chain)
                .or_else(|| hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 })),
            _ => hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 }),
        };
@@ -241,12 +199,9 @@ fn hit_leaf(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
            n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p))?;
            on_type_path(n, t, p, opt.tol).then_some(HitKind::Outline)
        }
-        NodeKind::Text(_)
-        | NodeKind::Image(_)
-        | NodeKind::PlacedDocument(_)
-        | NodeKind::SymbolInstance { .. }
-        | NodeKind::Blend { .. }
-        | NodeKind::Envelope { .. } => n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds),
+        NodeKind::Text(_) | NodeKind::Image(_) | NodeKind::SymbolInstance { .. } | NodeKind::Blend { .. } | NodeKind::Envelope { .. } => {
+            n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds)
+        }
        NodeKind::Repeat(r) => r.expand().iter().find_map(|g| hit_any(g, p, opt)),
        NodeKind::Mesh(m) => {
            let bp = m.outline().to_bezpath();
@@ -293,11 +248,7 @@ fn hit_any(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
 pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) -> Vec<NodeId> {
    let mut out = Vec::new();
    let tops: Vec<&std::sync::Arc<Node>> = match scope.and_then(|s| doc.node(s)) {
-        Some(s) => match s.children() {
-            Some(c) => c.iter().collect(),
-            // A single object isolated: only it.
-            None => doc.parent_of(s.id).and_then(|p| doc.node(p)).and_then(Node::children).into_iter().flatten().filter(|c| c.id == s.id).collect(),
-        },
+        Some(s) => s.children().map(|c| c.iter().collect()).unwrap_or_default(),
        // The objects of the layers, looking through sublayers (hidden, locked and template ones
        // are left out).
        None => doc
@@ -400,20 +351,6 @@ mod tests {
        assert!(hit_test(&d, Point::new(50.5, 25.0), HitOptions::default()).is_some());
    }

-    /// #1103: a marquee drawn over a background picks what is on it, not the background, whose
-    /// outline it doesn't touch.
-    #[test]
-    fn a_marquee_inside_a_background_leaves_the_background() {
-        let mut d = Document::new(200.0, 200.0);
-        let l = d.layers[0].id;
-        let (back, small) = (d.alloc_id(), d.alloc_id());
-        d.insert(Some(l), 0, Node::path(back, shapes::rectangle(Rect::new(0.0, 0.0, 200.0, 200.0)), Appearance::default_art())).unwrap();
-        d.insert(Some(l), 1, Node::path(small, shapes::rectangle(Rect::new(50.0, 50.0, 60.0, 60.0)), Appearance::default_art())).unwrap();
-        assert_eq!(marquee(&d, Rect::new(40.0, 40.0, 70.0, 70.0), None, false), vec![small]);
-        // Reaching the background's edge takes it too.
-        assert_eq!(marquee(&d, Rect::new(-5.0, 40.0, 70.0, 70.0), None, false), vec![back, small]);
-    }
-
    #[test]
    fn group_top_object() {
        let mut d = Document::new(200.0, 200.0);
@@ -488,7 +425,7 @@ mod tests {
        d.insert(Some(l), 0, Node::path(a, shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art())).unwrap();
        let inner = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(100.0, 0.0, 150.0, 50.0)), Appearance::default());
        let mut compound = Node::new(c, NodeKind::Compound { children: vec![Arc::new(inner)], rule: vectorcraft_geom::FillRule::NonZero });
-        compound.appearance = Appearance::default_art().into();
+        compound.appearance = Appearance::default_art();
        d.insert(Some(l), 9, compound).unwrap();
        let path_only = HitOptions { path_only: true, ..Default::default() };
        for (id, inside, edge) in [(a, Point::new(25.0, 25.0), Point::new(0.5, 25.0)), (c, Point::new(125.0, 25.0), Point::new(100.5, 25.0))] {
@@ -548,7 +485,7 @@ mod tests {
        let l = d.layers[0].id;
        let mut add = |t: TextObject, perspective: Option<Affine>| {
            let mut n = Node::new(d.alloc_id(), NodeKind::Text(Box::new(t)));
-            n.extras_mut().perspective = perspective.map(|a| {
+            n.perspective = perspective.map(|a| {
                Box::new(PerspectiveAttachment { projection: Some(Homography::from_affine(a).to_array()), ..PerspectiveAttachment::new("left", 0.0) })
            });
            let id = n.id;
@@ -610,11 +547,7 @@ world",
        d.insert(Some(l), 9, far).unwrap();
        let at = |x: f64, scope| objects_at(&d, Point::new(x, 25.0), HitOptions::default(), scope);
        assert_eq!(at(30.0, None), vec![g, a_id]);
-        assert_eq!(at(30.0, Some(g)), [c_id, b_id], "isolated: the group's own objects");
-        // Isolated, the art around the group is locked: clicks pass through it (#833).
-        assert!(at(5.0, Some(g)).is_empty());
-        assert!(at(130.0, Some(g)).is_empty());
-        assert!(hit_test(&d, Point::new(5.0, 25.0), HitOptions { scope: Some(g), ..HitOptions::default() }).is_none());
+        assert_eq!(at(30.0, Some(g))[..2], [c_id, b_id], "isolated: the group's own objects");
        assert_eq!(at(5.0, None), vec![a_id]);
        assert!(at(90.0, None).is_empty());
    }
@@ -631,25 +564,4 @@ world",
        d.node_mut(l).unwrap().visible = false;
        assert!(hit_test(&d, Point::new(10.0, 10.0), HitOptions::default()).is_none());
    }
-
-    #[test]
-    fn visible_sampling_reads_locked_art_and_layers_but_excludes_hidden_art() {
-        let mut d = Document::new(200.0, 200.0);
-        let l = d.layers[0].id;
-        let a = d.alloc_id();
-        d.insert(Some(l), 0, Node::path(a, shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art())).unwrap();
-        let p = Point::new(10.0, 10.0);
-        for lock in [a, l] {
-            d.node_mut(lock).unwrap().locked = true;
-            assert!(hit_test(&d, p, HitOptions::default()).is_none());
-            assert_eq!(hit_test_visible(&d, p, HitOptions::default()).unwrap().leaf, a);
-            assert!(d.node(lock).unwrap().locked);
-            d.node_mut(lock).unwrap().locked = false;
-        }
-        d.node_mut(a).unwrap().visible = false;
-        assert!(hit_test_visible(&d, p, HitOptions::default()).is_none());
-        d.node_mut(a).unwrap().visible = true;
-        d.node_mut(l).unwrap().visible = false;
-        assert!(hit_test_visible(&d, p, HitOptions::default()).is_none());
-    }
 }
@@ -1,155 +0,0 @@
-//! A cache of every node's index path, so a lookup by id checks one path instead of walking the
-//! tree.
-//!
-//! The tree is edited in many places through public fields, so the cache can't be kept in step
-//! with it. It is checked instead: a cached path is used only while the node at that path still
-//! has the id (a check as deep as the tree). A path that no longer checks out rebuilds the cache,
-//! and an id the cache doesn't have (deleted, or added since) is looked up by walking, as before.
-//! An id that appears more than once (a damaged file) is never cached, so lookups keep returning
-//! its first place in tree order.
-//!
-//! The one case a cached lookup can answer differently from a walk: a second node with an
-//! existing id put in the tree *after* the cache was built, earlier in tree order than the first.
-//! The lookup then returns the original node (also one with that id) instead of the new one. The
-//! app never makes such a node (paste and duplicate give new ids, undo restores whole trees);
-//! duplicated ids come from damaged files, which are cached afresh when opened.
-
-use std::collections::HashMap;
-use std::hash::{BuildHasherDefault, Hasher};
-use std::sync::{Arc, RwLock};
-
-use crate::{Node, NodeId};
-
-/// Hasher for node ids: one multiply. Ids are small counters, not attacker-chosen keys, and the
-/// default SipHash dominated the cost of building the cache.
-#[derive(Default)]
-pub struct IdHasher(u64);
-
-impl Hasher for IdHasher {
-    fn write(&mut self, bytes: &[u8]) {
-        for &b in bytes {
-            self.0 = (self.0 ^ u64::from(b)).wrapping_mul(0x100_0000_01b3);
-        }
-    }
-    fn write_u64(&mut self, v: u64) {
-        self.0 = (self.0 ^ v).wrapping_mul(0x9e37_79b9_7f4a_7c15);
-    }
-    fn finish(&self) -> u64 {
-        self.0 ^ (self.0 >> 29)
-    }
-}
-
-/// A map keyed by node id with [`IdHasher`].
-pub type IdMap<V> = HashMap<NodeId, V, BuildHasherDefault<IdHasher>>;
-/// Where each node is: its parent's entry (`u32::MAX` for a top-level layer) and its index among
-/// its siblings. One flat table, so building it allocates nothing per node.
-#[derive(Default)]
-pub(crate) struct Paths {
-    /// Each id's entry in `at`; `None` for an id that appears more than once.
-    ids: IdMap<Option<u32>>,
-    at: Vec<(u32, u32)>,
-}
-
-impl Paths {
-    /// The index path of `id`: `Some(None)` when the id appears more than once, `None` when it
-    /// isn't in the table.
-    pub(crate) fn get(&self, id: &NodeId) -> Option<Option<Vec<usize>>> {
-        let e = (*self.ids.get(id)?)?;
-        let mut path = Vec::new();
-        let mut cur = e;
-        // Each step goes to a parent entry, made before its children: at most `at.len()` steps.
-        for _ in 0..=self.at.len() {
-            let Some(&(parent, i)) = self.at.get(cur as usize) else { return Some(None) };
-            path.push(i as usize);
-            if parent == u32::MAX {
-                path.reverse();
-                return Some(Some(path));
-            }
-            cur = parent;
-        }
-        Some(None)
-    }
-    pub(crate) fn contains_key(&self, id: &NodeId) -> bool {
-        self.ids.contains_key(id)
-    }
-    pub(crate) fn len(&self) -> usize {
-        self.ids.len()
-    }
-}
-
-/// Lookups that had to walk (the cache didn't have the id, or its path no longer checks out)
-/// before the cache is rebuilt: a rebuild costs a few walks, so rebuilding only after a few keeps
-/// a lookup's cost within a small factor of a walk whatever the edit pattern (say, delete an
-/// object and look the next one up, again and again).
-const MISSES_PER_REBUILD: u32 = 4;
-
-/// The cache, shared by clones of a document (each checks every path it uses against its own tree).
-#[derive(Default)]
-pub struct IdIndex(RwLock<Option<Arc<Paths>>>, std::sync::atomic::AtomicU32);
-
-impl IdIndex {
-    /// The current cache, if one was built.
-    pub(crate) fn get(&self) -> Option<Arc<Paths>> {
-        self.0.read().ok().and_then(|g| g.clone())
-    }
-
-    /// Let go of the cache (a document kept in the undo history): the next lookup builds it again.
-    pub(crate) fn clear(&self) {
-        if let Ok(mut g) = self.0.write() {
-            *g = None;
-        }
-        self.1.store(0, std::sync::atomic::Ordering::Relaxed);
-    }
-
-    /// Whether a cache was built (and not cleared since).
-    pub(crate) fn is_built(&self) -> bool {
-        self.0.read().is_ok_and(|g| g.is_some())
-    }
-
-    /// Rebuild the cache from `layers` (one walk) and return it.
-    pub(crate) fn rebuild(&self, layers: &[Arc<Node>]) -> Arc<Paths> {
-        fn walk(nodes: &[Arc<Node>], parent: u32, out: &mut Paths) {
-            for (i, n) in nodes.iter().enumerate() {
-                let e = out.at.len() as u32;
-                out.at.push((parent, i as u32));
-                out.ids.entry(n.id).and_modify(|x| *x = None).or_insert(Some(e));
-                if let Some(ch) = n.children() {
-                    walk(ch, e, out);
-                }
-            }
-        }
-        let mut out = Paths::default();
-        walk(layers, u32::MAX, &mut out);
-        let out = Arc::new(out);
-        if let Ok(mut g) = self.0.write() {
-            *g = Some(out.clone());
-        }
-        self.1.store(0, std::sync::atomic::Ordering::Relaxed);
-        out
-    }
-
-    /// Note a lookup that had to walk (an id the cache didn't have, or a path that no longer
-    /// checks out); true when it's time to rebuild.
-    pub(crate) fn missed(&self) -> bool {
-        self.1.fetch_add(1, std::sync::atomic::Ordering::Relaxed) + 1 >= MISSES_PER_REBUILD
-    }
-}
-
-impl Clone for IdIndex {
-    fn clone(&self) -> Self {
-        IdIndex(RwLock::new(self.get()), Default::default())
-    }
-}
-
-/// A cache, not document content: two documents are equal whatever their caches hold.
-impl PartialEq for IdIndex {
-    fn eq(&self, _: &Self) -> bool {
-        true
-    }
-}
-
-impl std::fmt::Debug for IdIndex {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str("IdIndex")
-    }
-}
				`@@ -1 +0,0 @@`
				`<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="butt" stroke-linejoin="miter"><path d="M12 3V21M3 12H21" stroke-width="1.5" /><rect x="6.5" y="6.5" width="11" height="11" fill="currentColor" fill-opacity="1.0" stroke="none"/></svg>`