Importers: PDF nesting inside compressed streams no longer crashes (hayro 0.8)

hayro-syntax 0.8.0 reads arrays and dictionaries 64 deep and no deeper wherever they are (the file's text, object streams, the content of pages, forms, patterns, glyphs and masks), walks the page tree without recursion and follows a chain of object streams once: what 0.7.2 overflowed the stack on. hayro-interpret 0.8.0 comes with it (a new device interface: the importer's device takes it as before). Our raw pre-scan of the file's text and page content goes: the reader's own cap covers more, and the scan miscounted the bytes of unfiltered binary streams. What 0.8.0 still builds by recursion with no cap is refused when the file opens: functions and colour spaces built on themselves or on one another more than 16 deep, and calculator functions whose procedures nest more than 64 deep. The import runs on a 16 MB thread, as the SVG importer does. hayro-syntax 0.8 turns on flate2's zlib-rs backend, which the whole app then deflates with: a compressed native file is the same gzip stream as before (header and data), but its deflate blocks now depend on how the data is fed, so the streaming test checks the header and the unpacked data instead of the bytes.
Importers: an SVG's linked files are read within the automation roots again
2026-10-15 03:36:51 -04:00 · 2026-10-14 10:13:45 +07:00 · 2026-10-14 10:13:45 +07:00 · 2026-10-14 09:51:48 +07:00 · 2026-10-14 09:51:34 +07:00 · 2026-10-14 09:51:24 +07:00
136 changed files with 6855 additions and 1323 deletions
@@ -1304,6 +1304,12 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"

+[[package]]
+name = "fearless_simd"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3296eb97d869113eaf148a6bdf01884e90b3828ad7ae2340b0f93362fc158611"
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.14"
@@ -1760,9 +1766,9 @@ dependencies = [

 [[package]]
 name = "hayro-ccitt"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f4d0e94ddd48749f06bbe4e5389fb9799a0c45bcaf00495042076ef05e3241a"
+checksum = "2866f0d976e76497480b853d5e258dab6e4b89ecfe991124e08f15dfa8fd03ad"

 [[package]]
 name = "hayro-cmap"
@@ -1776,9 +1782,9 @@ dependencies = [

 [[package]]
 name = "hayro-interpret"
-version = "0.7.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2613d0406898995042d0794c4245b2f2fba1246490c8ac593769bba6551129d"
+checksum = "ac9df074ff163a63864cec9b0bf640ccbff8abf4e44481df7369ce0ac172ffbe"
 dependencies = [
 "bitflags 2.13.2",
 "hayro-cmap",
@@ -1788,28 +1794,28 @@ dependencies = [
 "phf",
 "rustc-hash 2.1.3",
 "siphasher",
- "skrifa 0.42.1",
+ "skrifa 0.46.2",
 "smallvec",
 "yoke",
 ]

 [[package]]
 name = "hayro-jbig2"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69374b3668dd45aeb3d3145cda68f2c7b4f223aaa2511e67d076f1c7d741388d"
+checksum = "000e025850f4592ddcaee85640db70704151f2bafd43b6f431aa5b6a2c6a35a9"
 dependencies = [
- "fearless_simd",
+ "fearless_simd 1.1.0",
 "hayro-ccitt",
 ]

 [[package]]
 name = "hayro-jpeg2000"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c75ab947623ef4ccaa7acf0579edf7cbb5a73838e3839a7be73335e522f433a1"
+checksum = "122c5f834c37a2260b9c851bb8be685cf539b2a8b94b704a931ef7d2525d5835"
 dependencies = [
- "fearless_simd",
+ "fearless_simd 1.1.0",
 ]

 [[package]]
@@ -1820,9 +1826,9 @@ checksum = "885c5ef0654933139a9b9546fc2c69e18d37f38aa2520f079092b1be18f1fcaa"

 [[package]]
 name = "hayro-syntax"
-version = "0.7.2"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0edeafd70aa2db743de8ede8637d07ec87db05efe69cde371d03f1b185fcef27"
+checksum = "6cdc818d8d265dcb42081d488f7599df4f73fb79e9d347ecedcd3c23809d2026"
 dependencies = [
 "flate2",
 "hayro-ccitt",
@@ -3833,6 +3839,16 @@ dependencies = [
 "read-fonts 0.41.0",
 ]

+[[package]]
+name = "skrifa"
+version = "0.46.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4febebda507fb889c545a37a135517769d1391941013561292897961d1887d6"
+dependencies = [
+ "bytemuck",
+ "read-fonts 0.43.3",
+]
+
 [[package]]
 name = "skrifa"
 version = "0.47.0"
@@ -4986,7 +5002,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2e9aed918117e8152c9eddfd8362d73c465c23f26c44786aa331707b8a64fa2"
 dependencies = [
 "bytemuck",
- "fearless_simd",
+ "fearless_simd 0.4.1",
 "guillotiere",
 "log",
 "peniko",
@@ -5001,7 +5017,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbb2141a2bca6e6d598e471fd4d1d7eed8e020aad6a28187edda07f091a325dd"
 dependencies = [
 "bytemuck",
- "fearless_simd",
+ "fearless_simd 0.4.1",
 "guillotiere",
 "log",
 "peniko",
@@ -6,7 +6,7 @@

 **Stage: alpha** · next: beta, ~13 points (ready for real work ~62% → ~75%, and reliable `.ai` exchange) and ~170–270 h away

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (merges of 2026-10-14: anchor Align and Distribute, #1636; Direct Selection fixes, #1674, #1666, #1743; Escape while typing, #1686; Pen clicks and a Precise Cursors command, #1663; Expand on repeats, #1756; Roughen and Scribble, #1643, #1648; file and input hardening, #1776–#1783, #1786, #1807; MCP limits and envelope, #1727, #1728; Image Trace levelling and Flat Logo on scans, #1647, #1657; a guide's position in the Transform panel is a convenience, not a parity claim, #1659; headline numbers unchanged; later merges of 2026-10-13: SVG import of CSS transforms, percentage lengths in symbols, Inkscape flowed text and pages, #1565, #1596, #1568, #1601; Warp Arc, #1578; Pathfinder Trim, Merge and Crop strokes, #1570; saves to folders that refuse the temporary file, #1620 in part; OpenType stylistic sets, #1607; intersect Smart Guides, #1602 in part; headline numbers unchanged; control transport deadlines, #1726; Image Trace edges, strokes, memory and three new options, measured in `docs/image-trace-quality.md`, headline numbers unchanged; community PRs and fixes of 2026-10-13: Polish interface, #1498; compact native saves, #1492; PDF and EPS paste as vector art, #1499; `.ai`, PDF, EPS and SVG import fixes, #1528, #1530, #1531, #1544, #1551, #1553; guide objects, #1534; Join after Average, #1533; Keyboard Shortcuts lists commands outside the menus, #1539; headline numbers unchanged; community PRs and fixes of late 2026-10-12: type that does not fit its frame is reported, #1471; Tabs panel drags, #1458; template layers in Outline view, #1486; dialog slider rails, #1483; Direct Selection anchor precedence, #1508; print-size images, #1517; French catalog complete again, #1511; headline numbers unchanged; Image Trace colour and photo presets, measured in `docs/image-trace-quality.md`, headline numbers unchanged; community PRs and fixes of 2026-10-12: Split Into Grid options, #1462; Transform Objects and Reflect across an angle, #1448 and #1460; Pathfinder on a group, #1450; unknown parameter keys refused, #1442; grayscale TIFFs with alpha, #1466 in part; many-object edits, #1429 in part; headline numbers unchanged; Image Trace places edges to a fraction of a pixel, measured in `docs/image-trace-quality.md`, headline numbers unchanged; Transform dialogs preview and the transform tools act on direct-selected anchors, #1412 and #1408; `.ai` compound path paint, #1410, overprint, #1388, and text-only PDF parts, #1387; community PRs: strokes wider than their shape, corner drags without the bounding box, pasted pictures, compound paths in `document.inspect`, MCP guide; headline numbers unchanged; community PRs: `.ai` editing-data follow-ups (gradient stops, type of objects with an appearance, short area-type frames), PDF bleed with editing data, dialog keyboard focus, art flush with an artboard, font rescan, symbol instance redraw, `--control` port check; headline numbers unchanged; Rectangular Grid and Polar Grid tool options, #1377 in part; `.ai` files with placed (linked) pictures open from their editing data, #1264; community PRs: `.ai` and PDF bleed and editing-data import, gradient shapes imported as paths, ruler origin, Align To, Live Corners corner selection; headline numbers unchanged; G2: Film Grain added; Photoshop effects 29/57; 28 filters remain; community PRs: graph designs, Graph Data worksheet and Graph Type options; Align both centres; Pen endpoint fixes; earlier: Effect › Brush Strokes landed: Photoshop-style filters 28 of 57, raster effects 40% → 48%; `.ai` gradients, meshes and artboard names from the editing data; headline numbers unchanged; `.ai` art styles and clipping fills from the editing data; headline numbers unchanged; `editingData: "always"`; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (Image Trace: Shapes, stroke caps, enhanced presets, gradients over noise, #1845 to #1848, headline numbers unchanged; verified PngSuite downloads, #1729; synthetic control-input budgets, #1709; merges of 2026-10-14: anchor Align and Distribute, #1636; Direct Selection fixes, #1674, #1666, #1743; Escape while typing, #1686; Pen clicks and a Precise Cursors command, #1663; Expand on repeats, #1756; Roughen and Scribble, #1643, #1648; file and input hardening, #1776–#1783, #1786, #1807; MCP limits and envelope, #1727, #1728; Image Trace levelling and Flat Logo on scans, #1647, #1657; a guide's position in the Transform panel is a convenience, not a parity claim, #1659; headline numbers unchanged; later merges of 2026-10-13: SVG import of CSS transforms, percentage lengths in symbols, Inkscape flowed text and pages, #1565, #1596, #1568, #1601; Warp Arc, #1578; Pathfinder Trim, Merge and Crop strokes, #1570; saves to folders that refuse the temporary file, #1620 in part; OpenType stylistic sets, #1607; intersect Smart Guides, #1602 in part; headline numbers unchanged; control transport deadlines, #1726; Image Trace edges, strokes, memory and three new options, measured in `docs/image-trace-quality.md`, headline numbers unchanged; community PRs and fixes of 2026-10-13: Polish interface, #1498; compact native saves, #1492; PDF and EPS paste as vector art, #1499; `.ai`, PDF, EPS and SVG import fixes, #1528, #1530, #1531, #1544, #1551, #1553; guide objects, #1534; Join after Average, #1533; Keyboard Shortcuts lists commands outside the menus, #1539; headline numbers unchanged; community PRs and fixes of late 2026-10-12: type that does not fit its frame is reported, #1471; Tabs panel drags, #1458; template layers in Outline view, #1486; dialog slider rails, #1483; Direct Selection anchor precedence, #1508; print-size images, #1517; French catalog complete again, #1511; headline numbers unchanged; Image Trace colour and photo presets, measured in `docs/image-trace-quality.md`, headline numbers unchanged; community PRs and fixes of 2026-10-12: Split Into Grid options, #1462; Transform Objects and Reflect across an angle, #1448 and #1460; Pathfinder on a group, #1450; unknown parameter keys refused, #1442; grayscale TIFFs with alpha, #1466 in part; many-object edits, #1429 in part; headline numbers unchanged; Image Trace places edges to a fraction of a pixel, measured in `docs/image-trace-quality.md`, headline numbers unchanged; Transform dialogs preview and the transform tools act on direct-selected anchors, #1412 and #1408; `.ai` compound path paint, #1410, overprint, #1388, and text-only PDF parts, #1387; community PRs: strokes wider than their shape, corner drags without the bounding box, pasted pictures, compound paths in `document.inspect`, MCP guide; headline numbers unchanged; community PRs: `.ai` editing-data follow-ups (gradient stops, type of objects with an appearance, short area-type frames), PDF bleed with editing data, dialog keyboard focus, art flush with an artboard, font rescan, symbol instance redraw, `--control` port check; headline numbers unchanged; Rectangular Grid and Polar Grid tool options, #1377 in part; `.ai` files with placed (linked) pictures open from their editing data, #1264; community PRs: `.ai` and PDF bleed and editing-data import, gradient shapes imported as paths, ruler origin, Align To, Live Corners corner selection; headline numbers unchanged; G2: Film Grain added; Photoshop effects 29/57; 28 filters remain; community PRs: graph designs, Graph Data worksheet and Graph Type options; Align both centres; Pen endpoint fixes; earlier: Effect › Brush Strokes landed: Photoshop-style filters 28 of 57, raster effects 40% → 48%; `.ai` gradients, meshes and artboard names from the editing data; headline numbers unchanged; `.ai` art styles and clipping fills from the editing data; headline numbers unchanged; `editingData: "always"`; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)

 VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adobe Illustrator workflow. It runs
 on macOS, Windows, Linux, FreeBSD and the web (WASM), and agents can drive all of it over MCP, the CLI and a JSON
@@ -125,8 +125,12 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap

 ## Progress log

+- 2026-10-13: PngSuite downloads use pinned HTTPS files and a SHA-256 manifest; no archive extraction (#1729).
+
 | Date | What landed |
 |---|---|
+| 2026-10-14 | Image Trace: Shapes finds rounded rectangles and shapes in blurred and scanned art (98 to 100% of the plain-shape inputs, from 57 to 62%; #1845), square-ended lines get square caps (Outline's largest distance 2.94 px to 0.88; #1846), each documented preset has an enhanced version with Auto Grouping and Shapes that measures no worse than the preset (#1847), and blurred or noisy linear gradients trace as one gradient-filled path instead of 3 to 56 (#1848) ([`docs/image-trace-quality.md`](docs/image-trace-quality.md)). No headline number moves. |
+| 2026-10-13 | Synthetic control input has finite click/drag counts and pending-event limits, checked before queue mutation; control-channel bursts yield after 64 requests per frame (#1709). |
 | 2026-10-14 | Align and Distribute act on the anchor points selected with Direct Selection: the points of one path align to each other, not to the artboard, and Distribute spaces them (#1641, fixes #1636; aligning to a key anchor is still missing). Delete removes every selected anchor of a closed path (it used to remove the wrong ones), removes objects selected whole along with the selected anchors of others, and keeps the remainder selected so a second Delete removes it (#1674). In isolation mode Direct Selection and Group Selection pick only inside the isolated object (#1666). Escape cancels a Direct Selection drag (#1803, #1743). Escape while typing ends the edit, keeps the type selected and switches to the Selection tool (#1802, #1686, #1656). A filled Pencil path keeps a stroke of None (#1804, part of #1679). With the Pen, a press that moves under 3 screen pixels is a click (a corner without handles), and a Precise Cursors command toggles the existing preference and can take a shortcut (#1663). The [ and ] keys reach the Blob Brush, the Eraser and the Symbolism tools in the app (#1734, part of #1661). In the Pathfinder panel a group selected alone counts its nested shapes, so an expanded stroked object keeps the Shape Modes enabled (#1642, #1635). Object › Expand turns radial, grid and mirror repeats into groups of their instances (#1765, #1756). Select › Same matches type on its characters' fill and stroke (#1746, #1737). Fields commit what was typed when you click away or move to another field, as Enter does; Escape still discards it (#1787). Up and Down move through the command search results and Enter runs the highlighted one (#1798, #1757). Slider rails show on Medium Dark (#1808, #1662). On Windows the custom title bar's window stays truly borderless, so the pointer lines up with what is drawn on systems where the hidden caption offset it (#1791, #1758; awaiting the reporter's confirmation). Tool cursors are painted into the window on Wayland (#1652; not run on Linux, #1645 stays open until confirmed). Roughen with Smooth keeps turn-backs smooth instead of making cusps that draw as spikes (#1646, #1643). Scribble draws one zig-zag per region, with no lines across holes and notches; convex shapes are unchanged (#1651, #1648). EPS import: a stitched shading keeps its hard colour changes (#1654, #1653). WMF/EMF import refuses an oversized embedded PNG or JPEG from its header, before any pixels are decoded (#1776). PDF open no longer takes exponential time on a crafted name tree with shared nodes when it looks for the editing data (#1781). The size limits on a native file's embedded data also apply to files read from memory, not only streamed ones (#1783). Saving over a private file on Unix no longer leaves a readable temporary copy beside it while the file is written (#1778). An Export for Screens suffix can no longer place files outside the export folder (#1777). Package refuses a folder where it would overwrite the open document or one of its linked files (#1786). ruzstd 0.9.1 fixes a decompression bomb (RUSTSEC-2026-0344) reachable from EPS/`.ai` and Affinity import (#1807). File Info dates are stamped only after a save succeeds, so a failed save no longer changes them (#1774). Linked files that change during a drag are updated after the drag instead of being missed (#1773). Scatter graph data near the largest number is refused with a message instead of hanging the app (#1780). One very long Liquify stroke segment can no longer create an unbounded number of dabs (#1779). A drag whose last preview failed is no longer recorded as a committed command in the journal that actions and scripts read (#1775). Tests: text import fuzzing no longer searches installed fonts (#1785). Tests: render tests that add fonts no longer race the frame cache tests (#1795). `text.create`, `text.createInPath` and the MCP `add_text` tool take `justify`, so point type can be centred on or end at its point (#1752, #1748). Control replies are written through a 64 KiB buffer: a 10 MB `document.inspect` reply over loopback on Windows takes 0.25 s instead of 36 s (#1684). MCP limits: 16 MiB lines, 64-message batches, 256-step `command_batch` with 8 MiB of kept results and 256 MiB control replies (#1764, fixes #1727). MCP requires the JSON-RPC 2.0 envelope and matches control replies by id, and an app refusal without an id reports the app's reason (#1768, fixes #1728). The MCP server reconnects to the app before a call when the connection was closed or holds stray bytes, after an app restart or an idle expiry (#1739). Image Trace, measured in `image-trace-quality.md`: snap Curves To Lines moves no end of a line by more than 1.6 px, so long lines a degree or two off stay as the image has them (#1647: Technical Drawing's largest distance 4.21 px to 1.46); flat Logo takes the tones a scan's uneven paper makes of one colour for one colour (#1657: on scans 470 paths and 21 px off to 8.5 paths and 0.09 px). No headline number movLine truncated
 | 2026-10-13 | SVGs that move objects with a CSS transform (`translate(100px, 0)`, `rotate(45deg)`) or style type with the `font` shorthand import as drawn (#1565). SVG symbols whose shapes use percentage lengths import at the size and place they are drawn, the percentages being of the symbol's `viewBox` (#1596). Inkscape's flowed text (`flowRoot`) opens as area type in its rectangle, a paragraph per `flowPara`, instead of being dropped, and a region that can't be read is left out with a warning (#1569, fixes #1568). The warning for an unsupported SVG filter names the filter, its primitives and the object, and says the object is drawn without it (#1599, fixes #1598). The pages of an Inkscape multi-page SVG become artboards, named by their labels (#1603, fixes #1601). SVG export with CSS classes or style entities stays fast in documents with many distinct styles (#1567). PDF and `.ai` import: evenly letter-spaced or tightened type on a path keeps its length along the path instead of closing up to the font's advances (#1586), and type on a path whose stroke is written glyph by glyph comes in as one text object with its stroke, not one object per glyph (#1585). The ICC profiles embedded in JPEG, TIFF and PSD exports have every tag on a 4-byte boundary (ICC.1 §7.1.2), so strict readers accept them (#1589, fixes #1584). GIF, PNG-8 and other indexed exports find each pixel's palette colour through an index instead of a scan, with identical output (#1576). Saving to a network drive on macOS falls back to a plain fsync when the share refuses a full flush (#1625, part of #1620; not confirmed on a real share), and a save still succeeds when a folder refuses the temporary file, the rename over the document or copying permissions: the content is written elsewhere first and copied in, and a failed copy keeps the temporary file and names it (#1649, part of #1620). A document opened by a relative path finds its relatively linked images, and `vectorcraft-cli convert` lists what reading the input left out as `importWarnings` (#1606, fixes #1604). A zero-length subpath draws its round cap as a dot and its projecting cap as a square, so dots in imported `.ai` and SVG files show (#1619, fixes #1613). Pathfinder's Trim, Merge and Crop remove the objects' strokes, and Merge joins same-fill objects whatever their strokes were, as the public Pathfinder page describes (#1572, fixes #1570). Offset Path with an inset larger than the shapes says the offset leaves nothing, instead of asking to select paths (#1591, fixes #1590). The Symbols panel's New Symbol opens Symbol Options to name the symbol first, and Alt-click skips it (#1566, fixes #1560). Tool flyouts are as wide as their longest translated name and shortcut need, so names no longer run into shortcuts in Spanish and other languages (#1650, fixes #1616). Smart Guides: a point drawn with the Pen or a shape tool, and an anchor dragged with Direct Selection, snaps to where paths and ruler guides cross, labelled "intersect" (#1658, part of #1602; a moved selection's own anchors don't). The Transform panel shows a selected ruler guide's X or Y, and typing a value moves it (#1659, part of #1597). This is not established by the documentation we could find: the public help pages on guides, rulers and the Transform, Control and Properties panels (read again on 2026-10-14) describe selecting and dragging unlocked guides and the panels' X and Y for a selection, not a guide's position in a panel, and the one public statement of it is a user's [community answer](https://community.adobe.com/questions-652/adding-a-new-custom-guide-785586), which is not documentation. It is kept as a convenience pending the owner's decision, with no parity claim and nothing counted towards a score. Select Behind (Ctrl/Cmd-click) tests each object once, so a deep stack of overlapping objects no longer slows it; same objects in the same order (#1571). Commands that take `ids` run on the objects given with nothing selected, over MCP, the control channel and the CLI too (#1577, fixes #1575). Zig Zag spaces its ridges evenly along each segment, so lines and curves get a regular wave in Corner and Smooth (#1558). Warp › Arc (the effect and Envelope › Make with Warp) bends in the object's real proportions: a circular arc with concentric edges and no fold-over at 100%, so Arc on art that isn't square draws differently from before (#1581, fixes #1578). `effect.apply` and `effect.setParams` give an error for a misspelt or wrongly typed effect parameter instead of running the effect with its default (#1623, #1592). Area type in a non-rectangular shape moves a word too wide for the top lines down to the first line that holds it instead of breaking it (#1617, fixes #1615). Stylistic sets (ss01–ss20), stylistic and titling alternates, proportional and lining figures, and superscript and subscript glyphs can be turned on as OpenType features of a character style (`text.setStyle {features}`), and the OpenType panel kLine truncated
 | 2026-10-13 | Control sockets close after bounded idle, partial-line and reply-write waits, returning their connection slot (#1726); existing command processing timeout remains separate. |
@@ -162,6 +166,8 @@ The full pre-standard record of what landed is kept in [docs/roadmap.md](docs/ro

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-13 | minor | Pinned PngSuite HTTPS files verified by SHA-256 before publication; bounded downloads replace archive extraction (#1729). Scores and hours unchanged. |
+| 2026-10-13 | minor | Bounded synthetic control input (#1709): counts and queued events validated before mutation; control-channel bursts yield between frames. Scores and hours unchanged. |
 | 2026-10-14 | minor | Progress log row for the merges of 2026-10-14 (#1641–#1808 as listed there) and Image Trace's #1647 and #1657; the 2026-10-13 row now says that a guide's position in the Transform panel (#1659) is not established by the documentation found and is kept as a convenience pending the owner's decision; headline numbers unchanged. |
 | 2026-10-13 | minor | Control transport deadlines (#1726): idle and partial clients and blocked replies release connection slots; parity scores and estimates unchanged. |
 | 2026-10-10 | minor | Method aligned with the standard, no new evidence: full ready for real work is the additive weighted sum, ~62%; hours per audience; beta ~13 points away |
@@ -434,11 +434,8 @@ fn services(inbox: Inbox, place_inbox: PlaceInbox, ctx: egui::Context, locks: Op
                ctx.request_repaint();
            });
        })),
-        download: Some(Box::new(|name: &str, bytes: &[u8]| {
-            if let Err(e) = download(name, bytes) {
-                log::error!("download of {name} failed: {e}");
-            }
-        })),
+        // A download that couldn't be started fails the save or export it is for (#1693).
+        download: Some(Box::new(|name: &str, bytes: &[u8]| download(name, bytes).inspect_err(|e| log::error!("download of {name} failed: {e}")))),
        inbox: Some(inbox),
        recovery_store: Some(Arc::new(BrowserStore { locks })),
        // File → Print: the browser's print dialog.
@@ -517,7 +514,8 @@ fn download(path: &str, bytes: &[u8]) -> Result<(), String> {
    let revoke = wasm_bindgen::closure::Closure::once_into_js(move || {
        web_sys::Url::revoke_object_url(&url).ok();
    });
-    window.set_timeout_with_callback_and_timeout_and_arguments_0(revoke.unchecked_ref(), 10_000).map_err(js)?;
+    // The download has started: a timer that can't be set leaves the URL allocated, no more.
+    let _ = window.set_timeout_with_callback_and_timeout_and_arguments_0(revoke.unchecked_ref(), 10_000);
    Ok(())
 }

@@ -29,6 +29,21 @@ pub const MAX_CONNECTIONS: usize = 16;
 /// Size in bytes of the buffer that [`write_line`] writes a reply line through.
 const REPLY_CHUNK: usize = 64 * 1024;

+/// How long a request waits for the app's reply.
+const REPLY_WAIT: Duration = Duration::from_secs(60);
+
+/// The reply to a request the app didn't answer in [`REPLY_WAIT`]. One it had not started is
+/// withdrawn, so it never runs after its caller was told it failed; one it is running can't be
+/// stopped, and the reply says its outcome isn't known.
+fn timed_out(ticket: &vectorcraft_ui_egui::ControlTicket) -> Value {
+    let error = if ticket.give_up() {
+        "timeout: the app did not start the request in time; it was withdrawn and will not run"
+    } else {
+        "timeout: the app is still running the request; it may yet complete"
+    };
+    json!({"ok": false, "error": error})
+}
+
 #[derive(Clone, Copy)]
 struct ConnectionTimeouts {
    idle: Duration,
@@ -106,9 +121,10 @@ fn spawn_connection(
        let _slot = slot;
        serve_socket(stream, timeouts, |method, params| {
            let (req, rrx) = ControlRequest::new(method, params);
+            let ticket = req.ticket();
            tx.send(req).ok()?;
            ctx.request_repaint();
-            Some(rrx.recv_timeout(Duration::from_secs(60)).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"})))
+            Some(rrx.recv_timeout(REPLY_WAIT).unwrap_or_else(|_| timed_out(&ticket)))
        });
    })
 }
@@ -455,6 +471,19 @@ mod tests {
        json!({"ok": true, "result": {"layers": [{"children": paths, "id": 1, "kind": "Layer", "name": "Layer 1"}]}})
    }

+    /// #1725: a request its caller gave up before the app took it never runs; one the app took
+    /// first can't be withdrawn, and the timeout says so.
+    #[test]
+    fn a_timed_out_request_is_withdrawn_unless_it_started() {
+        let (waiting, _rx) = ControlRequest::new("engine.execute", json!({}));
+        assert!(timed_out(&waiting.ticket())["error"].as_str().unwrap().contains("will not run"));
+        assert!(!waiting.claim(), "the app skips a withdrawn request");
+        let (running, _rx) = ControlRequest::new("engine.execute", json!({}));
+        assert!(running.claim());
+        assert!(timed_out(&running.ticket())["error"].as_str().unwrap().contains("still running"));
+        assert!(!running.claim(), "a request is taken once");
+    }
+
    #[test]
    fn requests_are_answered_in_order_with_ids() {
        let (r, calls) = run(b"{\"id\":1,\"method\":\"a\"}\n\n{\"id\":2,\"method\":\"b\",\"params\":{}}\r\n{\"method\":\"c\"}");
@@ -1,137 +0,0 @@
-//! Format menu on macOS save sheets (#866). rfd's Cocoa backend combines the extensions of
-//! every filter but doesn't show their names. The accessory uses the same filters and updates
-//! the filename, whose extension already determines the format in the save command.
-//!
-//! AppKit owns the accessory until the sheet closes; its target is the accessory itself. The
-//! panel reference is weak, so closing the sheet releases both without a retain cycle.
-//! Native view handles and Objective-C subclassing require the scoped unsafe allowance.
-#![allow(unsafe_code)]
-
-use std::path::Path;
-
-use objc2::rc::{Retained, Weak};
-use objc2::{DefinedClass, MainThreadMarker, MainThreadOnly, define_class, msg_send, sel};
-use objc2_app_kit::{NSPopUpButton, NSSavePanel, NSTextField, NSView};
-use objc2_foundation::{NSObjectProtocol, NSPoint, NSRect, NSSize, NSString};
-use raw_window_handle::{HasWindowHandle, RawWindowHandle};
-use vectorcraft_ui_egui::{FilePick, i18n};
-
-type Filter = (&'static str, &'static [&'static str]);
-
-struct Ivars {
-    panel: Weak<NSSavePanel>,
-    filters: Vec<Filter>,
-}
-
-define_class!(
-    // SAFETY: NSView has no extra subclassing requirements; the subclass implements no Drop.
-    #[unsafe(super = NSView)]
-    #[thread_kind = MainThreadOnly]
-    #[ivars = Ivars]
-    #[name = "VectorcraftSaveFormatAccessory"]
-    struct FormatAccessory;
-
-    // SAFETY: NSObjectProtocol has no additional requirements.
-    unsafe impl NSObjectProtocol for FormatAccessory {}
-
-    impl FormatAccessory {
-        // SAFETY: AppKit's target/action sends the popup as the single object argument.
-        #[unsafe(method(chooseFormat:))]
-        fn choose_format(&self, sender: &NSPopUpButton) {
-            let Some(panel) = self.ivars().panel.load() else { return };
-            let Some(index) = usize::try_from(sender.indexOfSelectedItem()).ok() else { return };
-            let Some((_, extensions)) = self.ivars().filters.get(index) else { return };
-            let Some(extension) = extensions.first() else { return };
-            let name = panel.nameFieldStringValue().to_string();
-            let new = filename(&name, extension, &self.ivars().filters);
-            panel.setNameFieldStringValue(&NSString::from_str(&new));
-        }
-    }
-);
-
-/// The suggested file's type, or the request's default (the first filter).
-fn initial_format(name: &str, filters: &[Filter]) -> usize {
-    let extension = Path::new(name).extension().and_then(|e| e.to_str());
-    filters.iter().position(|(_, extensions)| extension.is_some_and(|e| extensions.iter().any(|x| e.eq_ignore_ascii_case(x)))).unwrap_or(0)
-}
-
-/// Replace a known format suffix; keep other dots (e.g. a version number) as part of the name.
-fn filename(name: &str, extension: &str, filters: &[Filter]) -> String {
-    if name.is_empty() {
-        return name.to_owned();
-    }
-    let path = Path::new(name);
-    if path
-        .extension()
-        .and_then(|e| e.to_str())
-        .is_some_and(|e| filters.iter().any(|(_, extensions)| extensions.iter().any(|x| e.eq_ignore_ascii_case(x))))
-    {
-        path.with_extension(extension).to_string_lossy().into_owned()
-    } else {
-        format!("{name}.{extension}")
-    }
-}
-
-/// Add a Format menu to the save sheet rfd just began on `window`. Open panels and requests
-/// without several named file types are left to rfd.
-pub fn attach(window: &winit::window::Window, pick: &FilePick) {
-    let Some(mtm) = MainThreadMarker::new() else { return };
-    let filters: Vec<_> = pick.filters.iter().copied().filter(|(_, extensions)| !extensions.is_empty() && !extensions.contains(&"*")).collect();
-    if filters.len() < 2 {
-        return;
-    }
-    let Ok(handle) = window.window_handle() else { return };
-    let RawWindowHandle::AppKit(handle) = handle.as_raw() else { return };
-    // SAFETY: winit keeps its content view alive while this window reference is in use.
-    let view = unsafe { handle.ns_view.cast::<NSView>().as_ref() };
-    let Some(sheet) = view.window().and_then(|w| w.attachedSheet()) else { return };
-    let Some(panel) = sheet.downcast_ref::<NSSavePanel>() else { return };
-    let selected = initial_format(&pick.name, &filters);
-    let this = FormatAccessory::alloc(mtm).set_ivars(Ivars { panel: Weak::new(panel), filters });
-    // SAFETY: NSView's designated initializer is called once on the allocated subclass.
-    let accessory: Retained<FormatAccessory> = unsafe { msg_send![super(this), initWithFrame: NSRect::new(NSPoint::ZERO, NSSize::new(360.0, 38.0))] };
-    let label = NSTextField::labelWithString(&NSString::from_str(i18n::t("Format:")), mtm);
-    label.setFrame(NSRect::new(NSPoint::new(0.0, 10.0), NSSize::new(80.0, 20.0)));
-    let popup =
-        NSPopUpButton::initWithFrame_pullsDown(NSPopUpButton::alloc(mtm), NSRect::new(NSPoint::new(82.0, 6.0), NSSize::new(278.0, 28.0)), false);
-    for (name, _) in &accessory.ivars().filters {
-        popup.addItemWithTitle(&NSString::from_str(i18n::t(name)));
-    }
-    // The filter list comes from the built-in format registry, small enough for NSInteger.
-    if let Ok(index) = isize::try_from(selected) {
-        popup.selectItemAtIndex(index);
-    }
-    // SAFETY: the accessory owns the popup and AppKit keeps the accessory while the sheet is
-    // open. The selector above has exactly the target/action signature expected by NSControl.
-    unsafe {
-        popup.setTarget(Some(&accessory));
-        popup.setAction(Some(sel!(chooseFormat:)));
-        accessory.addSubview(&label);
-        accessory.addSubview(&popup);
-    }
-    panel.setExtensionHidden(false);
-    panel.setAccessoryView(Some(&accessory));
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const FILTERS: &[Filter] = &[("VectorCraft", &["vectorcraft", "drawcraft"]), ("SVG", &["svg"]), ("PDF", &["pdf"])];
-
-    #[test]
-    fn current_suffix_selects_the_format_and_an_unknown_one_uses_the_default() {
-        for (name, index) in [("Untitled-1", 0), ("旧形式.drawcraft", 0), ("a b.SVG", 1), ("art.pdf", 2), ("version.2", 0)] {
-            assert_eq!(initial_format(name, FILTERS), index);
-        }
-    }
-
-    #[test]
-    fn changing_format_keeps_the_name_and_avoids_duplicate_extensions() {
-        for (name, expected) in
-            [("図面 1.vectorcraft", "図面 1.svg"), ("a.PDF", "a.svg"), ("art", "art.svg"), ("art.v2", "art.v2.svg"), ("art.svg", "art.svg"), ("", "")]
-        {
-            assert_eq!(filename(name, "svg", FILTERS), expected);
-        }
-    }
-}
@@ -35,8 +35,6 @@ mod mac_fonts;
 #[cfg(target_os = "macos")]
 mod mac_menu;
 #[cfg(target_os = "macos")]
-mod mac_save_format;
-#[cfg(target_os = "macos")]
 mod mac_window;
 #[cfg(target_os = "macos")]
 mod open_documents;
@@ -95,6 +93,11 @@ impl eframe::App for App {
            self.app.titlebar_inset = inset.unwrap_or(mac_window::DEFAULT_INSET);
        }
        file_access::unconfined(|| self.app.ui(ui));
+        // Preferences are written when confirmed, not only at exit: a session ended any other way
+        // (the system shutting down, the process ended or crashing) used to lose them (#1747).
+        if self.app.take_prefs_changed() {
+            file_access::unconfined(|| save_prefs(&self.app));
+        }
        // Not while a file dialog's sheet has the keyboard: its name field's composition would go.
        #[cfg(target_os = "macos")]
        if !self.app.file_dialog_open() && self.app.take_ime_discard() {
@@ -480,9 +483,10 @@ fn start_pick(request: PickRequest, parent: &Parent, ui: &egui::Context) -> Opti
            let picked = dialog.pick_files();
            Box::pin(async move { picked.await.unwrap_or_default().iter().map(path).collect() })
        }
-        PickRequest::Save(pick) => {
+        PickRequest::Save(_) => {
+            // Nothing is added to the sheet once rfd has begun it: an accessory view set then made
+            // recent macOS versions dismiss the sheet at once, so nothing could be saved (#1800).
            let picked = dialog.save_file();
-            mac_save_format::attach(window, &pick);
            Box::pin(async move { picked.await.iter().map(path).collect() })
        }
        PickRequest::Folder => {
@@ -296,12 +296,23 @@ const MAX_TREE_DEPTH: usize = 128;
 /// Total layer nodes imported.
 const MAX_NODES: usize = 500_000;

+/// Pixels decoded from pixel layers over a whole document (2 GB as RGBA). The archive's limits
+/// count the bytes extracted from it, and a layer of one flat colour needs none (#1704).
+const MAX_LAYER_PIXELS: u64 = 512 << 20;
+
 /// Read a document: archive, `doc.dat` and the model.
 pub fn read(bytes: &[u8], limits: Limits) -> Result<Document, Error> {
+    read_within(bytes, limits, MAX_LAYER_PIXELS)
+}
+
+/// [`read`], its pixel layers holding at most `pixels` pixels together.
+pub(crate) fn read_within(bytes: &[u8], limits: Limits, pixels: u64) -> Result<Document, Error> {
    let mut archive = Archive::open(bytes, limits)?;
    let doc = archive.read("doc.dat")?;
    let s = stream::parse(&doc)?;
-    Reader::new(&s, &mut archive).document()
+    let mut reader = Reader::new(&s, &mut archive);
+    reader.pixels_left = pixels;
+    reader.document()
 }

 pub(crate) struct Reader<'s, 'a, 'b> {
@@ -311,11 +322,13 @@ pub(crate) struct Reader<'s, 'a, 'b> {
    warnings: BTreeMap<String, usize>,
    nodes: usize,
    active: HashSet<ObjId>,
+    /// Pixels the pixel layers still to come may decode ([`MAX_LAYER_PIXELS`] in all).
+    pub(crate) pixels_left: u64,
 }

 impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
    fn new(s: &'s Stream, archive: &'b mut Archive<'a>) -> Self {
-        Self { s, archive, dpi: 72.0, warnings: BTreeMap::new(), nodes: 0, active: HashSet::new() }
+        Self { s, archive, dpi: 72.0, warnings: BTreeMap::new(), nodes: 0, active: HashSet::new(), pixels_left: MAX_LAYER_PIXELS }
    }

    pub(crate) fn warn(&mut self, what: impl Into<String>) {
@@ -105,10 +105,17 @@ fn decode(r: &mut Reader, bitmap: ObjId, crop: (u32, u32, u32, u32), world: Affi
        return Ok(None);
    }
    let (w, h) = (x1 - x0, y1 - y0);
-    if u64::from(w) * u64::from(h) > MAX_PIXELS {
+    let pixels = u64::from(w) * u64::from(h);
+    if pixels > MAX_PIXELS {
        r.warn("pixel layers larger than 64 megapixels");
        return Ok(None);
    }
+    // Before anything is allocated: a layer's tiles can be flat colour, with nothing to extract.
+    let Some(left) = r.pixels_left.checked_sub(pixels) else {
+        r.warn("pixel layers beyond the pixels one document may hold");
+        return Ok(None);
+    };
+    r.pixels_left = left;
    let format = s.enumeration(bitmap, b"Frmt").map(|(f, _)| f);
    let (channels, bps) = match format {
        Some(0) => (4, 1),
@@ -404,6 +411,41 @@ mod tests {
        }
    }

+    /// Pixel layers of one flat colour: nothing in the archive but `doc.dat` (state 2 is a tile
+    /// of 0xFF). Written by hand for the reader, like [`fixture`].
+    fn flat_layers(count: u32, side: i32) -> Vec<u8> {
+        let layer = |i: u32| {
+            let mut bitmap = vec![(tag(b"Frmt"), F::Enum(0, 0)), (tag(b"BmpW"), F::I32(side)), (tag(b"BmpH"), F::I32(side))];
+            for c in 1..=4 {
+                bitmap.push((tag(&super::tag(b"TWi", c)), F::I32(1)));
+                bitmap.push((tag(&super::tag(b"THi", c)), F::I32(1)));
+                bitmap.push((tag(&super::tag(b"Sta", c)), F::U8s(vec![2])));
+            }
+            F::Def(10 + i, vec![tag(b"Rstr")], vec![(tag(b"Bitm"), F::Obj(tag(b"DyBm"), bitmap))])
+        };
+        let spread = F::Def(1, vec![tag(b"Sprd")], vec![(tag(b"Chld"), F::Shared((0..count).map(layer).collect()))]);
+        let doc = synth::stream(&[(tag(b"DocR"), F::Obj(tag(b"DocN"), vec![(tag(b"Chld"), F::Shared(vec![spread]))]))]);
+        synth::container(&[("doc.dat", &doc, Method::Zlib)], None)
+    }
+
+    /// #1704: the pixels of all pixel layers together are bounded, also when the archive holds
+    /// no data for them: the layers past the allowance are left out with a note.
+    #[test]
+    fn pixel_layers_share_one_allowance_for_the_whole_document() {
+        let file = flat_layers(5, 16);
+        let layers = |pixels: u64| {
+            let doc = crate::model::read_within(&file, crate::Limits::default(), pixels).unwrap();
+            let n = doc.spreads[0].nodes.iter().filter(|n| matches!(n.kind, Kind::Image(_))).count();
+            (n, doc.warnings)
+        };
+        assert_eq!(layers(5 * 256), (5, vec![]));
+        let (kept, warnings) = layers(3 * 256 + 255);
+        assert_eq!(kept, 3);
+        assert_eq!(warnings.len(), 1);
+        assert!(warnings[0].contains("pixel layers beyond the pixels one document may hold"), "{warnings:?}");
+        assert_eq!(crate::read(&file, crate::Limits::default()).unwrap().spreads[0].nodes.len(), 5);
+    }
+
    #[test]
    fn embedded_source_dimensions_and_pixel_budget_are_checked_before_decode() {
        let bytes = png();
@@ -214,6 +214,7 @@ pub fn import(bytes: &[u8], o: &ImportOptions) -> Result<Imported, String> {
    let (mut document, mut warnings) = build::Build::new(&d, o).run(layout, natural, ratio)?;
    document.units = if o.fit { unit } else { o.unit.unwrap_or(unit) };
    warnings.extend(damaged);
+    document.limit_depth_noting(&mut warnings);
    Ok(Imported { document, warnings })
 }

@@ -24,8 +24,10 @@ pub struct Clip {
 }

 /// Deepest nesting of clips, and of groups, an importer records ([`nest`] goes one level deeper
-/// for each): deeper ones are left out.
-pub const MAX_NEST: usize = 128;
+/// for each): deeper ones are left out. As deep as a document's objects may nest
+/// ([`crate::MAX_DEPTH`]) under a layer, around the art; clips in groups that deep together are
+/// merged by [`Document::limit_depth`].
+pub const MAX_NEST: usize = crate::MAX_DEPTH - 2;

 /// The warning for clips left out for nesting deeper than [`MAX_NEST`].
 pub fn deep_clips() -> String {
@@ -0,0 +1,588 @@
+//! How deep objects may nest.
+//!
+//! The tree is walked by recursion everywhere (drawing, bounds, hit tests, saving, exporting), so
+//! a tree of unbounded depth overflows the stack: an abort no guard catches. No document deeper
+//! than [`MAX_DEPTH`] is ever kept, nor one whose symbols and patterns draw deeper than
+//! [`MAX_DRAWN_DEPTH`] (a symbol holding an instance of itself, or a pattern painting its own
+//! tile, draws without end): importers and the native reader merge deeper objects into the group
+//! around them and leave such instances and paints out
+//! ([`Document::limit_depth`], with [`merged_note`] and [`symbols_note`] as their warnings), and
+//! the engine refuses an edit that would nest deeper ([`Document::too_deep`]).
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use vectorcraft_color::Paint;
+
+use crate::{Document, Node, NodeKind};
+
+/// The deepest an object may be: a top-level layer is 1 deep, what it holds 2, and so on (the art
+/// of an opacity mask is one deeper than the object it masks). A symbol's or pattern's art counts
+/// from 1 again.
+///
+/// A native file writes three levels of JSON for each level of objects, and its reader stops at
+/// 128 levels: 32 leaves the deepest object 29 of them for its own data, so every document that
+/// can be made can be saved and opened again.
+pub const MAX_DEPTH: usize = 32;
+
+/// The deepest an object may be drawn: as [`MAX_DEPTH`], the art of a symbol counted under its
+/// instance and a pattern's tile under the object it paints (and what those use, under them).
+/// Symbols a few objects deep nest in one another dozens deep within it.
+pub const MAX_DRAWN_DEPTH: usize = 4 * MAX_DEPTH;
+
+/// The warning of a file whose objects were nested deeper than [`MAX_DEPTH`].
+pub fn merged_note() -> String {
+    format!("objects nested more than {MAX_DEPTH} deep were merged into the group around them")
+}
+
+/// The warning of a file with symbols or patterns that use themselves or are drawn deeper than
+/// [`MAX_DRAWN_DEPTH`].
+pub fn symbols_note() -> String {
+    format!(
+        "symbol instances and pattern paints inside their own symbol or pattern, or drawn more than {MAX_DRAWN_DEPTH} objects deep, were left out"
+    )
+}
+
+/// Run `f` where recursion has room: on a thread of its own with a 16 MB stack (the main thread
+/// has 1 MB on Windows), or here where there are no threads (the web) or none can be started. For
+/// readers whose recursion is capped but heavy; a panic in `f` goes on to the caller.
+pub fn with_deep_stack<T: Send>(f: impl Fn() -> T + Sync) -> T {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let threaded = std::thread::scope(|s| {
+            let thread = std::thread::Builder::new().stack_size(16 << 20).spawn_scoped(s, &f).ok()?;
+            Some(thread.join().unwrap_or_else(|panic| std::panic::resume_unwind(panic)))
+        });
+        if let Some(done) = threaded {
+            return done;
+        }
+    }
+    f()
+}
+
+/// Is anything in `now` (each `depth` deep) deeper than [`MAX_DEPTH`], or `over` (given its
+/// depth)? Without recursion: the trees may be of any depth. With `before` (the same list before
+/// an edit, within the caps), only what the edit changed is looked at: a subtree still shared with
+/// it, in the same place, is as it was.
+fn deeper(now: &[Arc<Node>], before: Option<&[Arc<Node>]>, depth: usize, over: &dyn Fn(&Node, usize) -> bool) -> bool {
+    type Pending<'a> = Vec<(&'a Node, Option<&'a Node>, usize)>;
+    fn push<'a>(stack: &mut Pending<'a>, now: &'a [Arc<Node>], before: Option<&'a [Arc<Node>]>, depth: usize) {
+        for (i, n) in now.iter().enumerate() {
+            let was = before.and_then(|b| b.get(i));
+            if !was.is_some_and(|w| Arc::ptr_eq(w, n)) {
+                stack.push((n, was.map(|w| &**w), depth));
+            }
+        }
+    }
+    let mut stack = vec![];
+    push(&mut stack, now, before, depth);
+    while let Some((n, was, d)) = stack.pop() {
+        if d > MAX_DEPTH || over(n, d) {
+            return true;
+        }
+        if let Some(ch) = n.children() {
+            push(&mut stack, ch, was.and_then(Node::children).map(Vec::as_slice), d + 1);
+        }
+        if let Some(m) = &n.extras().mask {
+            let was = was.and_then(|w| w.extras().mask.as_ref()).map(|m| std::slice::from_ref(&m.art));
+            push(&mut stack, std::slice::from_ref(&m.art), was, d + 1);
+        }
+    }
+    false
+}
+
+/// [`deeper`] for the nesting alone.
+fn nested_deeper(now: &[Arc<Node>], depth: usize) -> bool {
+    deeper(now, None, depth, &|_, _| false)
+}
+
+/// Merge what is deeper than [`MAX_DEPTH`] in `nodes` (each `depth` deep) into the group around
+/// it: a container at the cap is replaced by what it holds (a clipping group's clipping path and
+/// an opacity mask too deep are left out); what it held stays hidden or locked as it was. Returns
+/// whether anything changed. Recurses no deeper than the cap.
+fn limit(nodes: &mut Vec<Arc<Node>>, depth: usize) -> bool {
+    let mut changed = false;
+    let mut i = 0;
+    while let Some(n) = nodes.get_mut(i) {
+        if !nested_deeper(std::slice::from_ref(n), depth) {
+            i += 1;
+            continue;
+        }
+        changed = true;
+        let n = Arc::make_mut(n);
+        if n.extras().mask.as_ref().is_some_and(|m| nested_deeper(std::slice::from_ref(&m.art), depth + 1)) {
+            n.extras_mut().mask = None;
+        }
+        if depth < MAX_DEPTH {
+            if let Some(ch) = n.children_mut() {
+                limit(ch, depth + 1);
+            }
+            i += 1;
+            continue;
+        }
+        let clip = matches!(n.kind, NodeKind::Group { clip: true, .. } | NodeKind::Layer { clip: true, .. });
+        let (visible, locked) = (n.visible, n.locked);
+        let mut held = n.children_mut().map(std::mem::take).unwrap_or_default();
+        if clip && !held.is_empty() {
+            held.remove(0);
+        }
+        for c in &mut held {
+            if (!visible && c.visible) || (locked && !c.locked) {
+                let c = Arc::make_mut(c);
+                c.visible &= visible;
+                c.locked |= locked;
+            }
+        }
+        // What it held takes its place, and is looked at in its turn.
+        nodes.splice(i..=i, held);
+    }
+    changed
+}
+
+/// A symbol (`false`) or a pattern (`true`) of the document, by name: what art draws by name, an
+/// instance its symbol's art and a pattern paint its tile's.
+type Def<'a> = (bool, &'a str);
+
+/// How deep each symbol's and pattern's art is drawn, the art of the symbols and patterns it uses
+/// included (drawn under the object that uses them): `None` for one that uses itself, in its art
+/// or through what that uses, or is drawn deeper than [`MAX_DRAWN_DEPTH`].
+type Heights<'a> = HashMap<Def<'a>, Option<usize>>;
+
+/// What `n` itself draws by name: the symbol it is an instance of, the patterns that paint it.
+fn uses(n: &Node) -> impl Iterator<Item = Def<'_>> {
+    let symbol = match &n.kind {
+        NodeKind::SymbolInstance { symbol, .. } => Some((false, symbol.as_str())),
+        _ => None,
+    };
+    let patterns = crate::swatches::node_paints(n).filter_map(|p| match p {
+        Paint::Pattern { pattern, .. } => Some((true, pattern.as_str())),
+        _ => None,
+    });
+    symbol.into_iter().chain(patterns)
+}
+
+/// [`Heights`] of the document's symbols and patterns. Without recursion: they may use one
+/// another in a chain of any length. Their own art is within [`MAX_DEPTH`].
+fn heights(doc: &Document) -> Heights<'_> {
+    // Each one's own depth, and what its art uses with the deepest use of each.
+    type Own<'a> = (usize, Vec<(Def<'a>, usize)>);
+    let arts = (doc.symbols.iter().map(|s| ((false, s.name.as_str()), std::slice::from_ref(&s.art))))
+        .chain(doc.patterns.iter().map(|p| ((true, p.name.as_str()), &p.art[..])));
+    let mut own: HashMap<Def, Own> = HashMap::new();
+    for (def, art) in arts {
+        let (mut deepest, mut used) = (0, HashMap::<Def, usize>::new());
+        let mut stack: Vec<(&Node, usize)> = art.iter().map(|n| (&**n, 1)).collect();
+        while let Some((n, d)) = stack.pop() {
+            deepest = deepest.max(d);
+            for u in uses(n) {
+                let at = used.entry(u).or_default();
+                *at = (*at).max(d);
+            }
+            stack.extend(n.children().into_iter().flatten().chain(n.extras().mask.as_ref().map(|m| &m.art)).map(|c| (&**c, d + 1)));
+        }
+        // (The first of two of one name is the one drawn.)
+        own.entry(def).or_insert((deepest, used.into_iter().collect()));
+    }
+    // Depth first over what uses what. One met again while it is being worked out (`None` in its
+    // entry) uses itself.
+    let mut found: HashMap<Def, Option<Option<usize>>> = HashMap::new();
+    let starts: Vec<Def> = own.keys().copied().collect();
+    for start in starts {
+        if found.contains_key(&start) {
+            continue;
+        }
+        // (which, the next of its uses to look at, the deepest found so far: `None` once it can't be drawn)
+        let mut path: Vec<(Def, usize, Option<usize>)> = vec![(start, 0, own.get(&start).map(|o| o.0))];
+        found.insert(start, None);
+        while let Some(&(def, next, deepest)) = path.last() {
+            let used = own.get(&def).map_or(&[][..], |o| &o.1);
+            let Some(&(other, at)) = used.get(next) else {
+                // Everything it uses is worked out.
+                let deepest = deepest.filter(|d| *d <= MAX_DRAWN_DEPTH);
+                found.insert(def, Some(deepest));
+                path.pop();
+                if let Some((user, next, held)) = path.last_mut() {
+                    let at = own.get(user).and_then(|o| o.1.get(next.wrapping_sub(1))).map_or(1, |u| u.1);
+                    *held = held.zip(deepest).map(|(h, d)| h.max(at + d));
+                }
+                continue;
+            };
+            let known = found.get(&other).copied();
+            if known.is_none() && own.contains_key(&other) {
+                found.insert(other, None);
+            }
+            let Some((_, next, deepest)) = path.last_mut() else { break };
+            *next += 1;
+            match known {
+                // Not in the document: it draws nothing.
+                None if !own.contains_key(&other) => {}
+                None => path.push((other, 0, own.get(&other).map(|o| o.0))),
+                Some(Some(Some(d))) => *deepest = deepest.map(|h| h.max(at + d)),
+                // It uses itself (it is on the way down here), or can't be drawn.
+                Some(None | Some(None)) => *deepest = None,
+            }
+        }
+    }
+    found.into_iter().map(|(def, h)| (def, h.flatten())).collect()
+}
+
+/// Can't `used`, by an object `depth` deep, be drawn there?
+fn undrawable(heights: &Heights, used: Def, depth: usize) -> bool {
+    heights.get(&used).is_some_and(|h| h.is_none_or(|h| depth + h > MAX_DRAWN_DEPTH))
+}
+
+/// Take out of `nodes` (each `depth` deep) the uses `bad` picks (given the depth of the object):
+/// an instance goes, a pattern paint becomes no paint. Returns whether anything changed. For trees
+/// within [`MAX_DEPTH`].
+fn strip(nodes: &mut Vec<Arc<Node>>, depth: usize, bad: &dyn Fn(Def, usize) -> bool) -> bool {
+    let any = |n: &Node, d: usize| uses(n).any(|u| bad(u, d));
+    let before = nodes.len();
+    nodes.retain(|n| !matches!(&n.kind, NodeKind::SymbolInstance { symbol, .. } if bad((false, symbol.as_str()), depth)));
+    let mut changed = nodes.len() != before;
+    for n in nodes.iter_mut() {
+        if !deeper(std::slice::from_ref(n), None, depth, &any) {
+            continue;
+        }
+        changed = true;
+        let n = Arc::make_mut(n);
+        if uses(n).any(|u| bad(u, depth)) {
+            for p in crate::swatches::node_paints_mut(n) {
+                if matches!(p, Paint::Pattern { pattern, .. } if bad((true, pattern.as_str()), depth)) {
+                    *p = Paint::None;
+                }
+            }
+        }
+        // An opacity mask whose art is such an instance goes with it.
+        let mut mask = n.extras().mask.as_ref().map(|m| vec![m.art.clone()]);
+        if let Some(art) = &mut mask
+            && strip(art, depth + 1, bad)
+        {
+            match art.pop() {
+                Some(art) => {
+                    if let Some(m) = n.extras_mut().mask.as_mut() {
+                        m.art = art;
+                    }
+                }
+                None => n.extras_mut().mask = None,
+            }
+        }
+        if let Some(ch) = n.children_mut() {
+            strip(ch, depth + 1, bad);
+        }
+    }
+    changed
+}
+
+impl Document {
+    /// Is anything nested deeper than [`MAX_DEPTH`], or drawn deeper than [`MAX_DRAWN_DEPTH`]
+    /// (a symbol or pattern that uses itself is)? With `before` (this document before an edit,
+    /// itself within the caps), only what the edit changed is looked at.
+    pub fn too_deep(&self, before: Option<&Document>) -> bool {
+        fn symbol(d: &Document, i: usize) -> Option<&[Arc<Node>]> {
+            d.symbols.get(i).map(|s| std::slice::from_ref(&s.art))
+        }
+        fn pattern(d: &Document, i: usize) -> Option<&[Arc<Node>]> {
+            d.patterns.get(i).map(|p| &p.art[..])
+        }
+        let nested = |_: &Node, _: usize| false;
+        if (0..self.symbols.len()).any(|i| symbol(self, i).is_some_and(|art| deeper(art, before.and_then(|b| symbol(b, i)), 1, &nested)))
+            || (0..self.patterns.len()).any(|i| pattern(self, i).is_some_and(|art| deeper(art, before.and_then(|b| pattern(b, i)), 1, &nested)))
+        {
+            return true;
+        }
+        if self.symbols.is_empty() && self.patterns.is_empty() {
+            return deeper(&self.layers, before.map(|b| &b.layers[..]), 1, &nested);
+        }
+        let heights = heights(self);
+        if heights.values().any(Option::is_none) {
+            return true;
+        }
+        // Symbols and patterns draw as deep as before when none changed; else every use of them
+        // is looked at again.
+        let same = |x: &[Arc<Node>], y: &[Arc<Node>]| x.len() == y.len() && x.iter().zip(y).all(|(x, y)| Arc::ptr_eq(x, y));
+        let before = before.filter(|b| {
+            b.symbols.len() == self.symbols.len()
+                && b.patterns.len() == self.patterns.len()
+                && b.symbols.iter().zip(&self.symbols).all(|(x, y)| x.name == y.name && Arc::ptr_eq(&x.art, &y.art))
+                && b.patterns.iter().zip(&self.patterns).all(|(x, y)| x.name == y.name && same(&x.art, &y.art))
+        });
+        let over = |n: &Node, d: usize| uses(n).any(|u| undrawable(&heights, u, d));
+        deeper(&self.layers, before.map(|b| &b.layers[..]), 1, &over)
+    }
+
+    /// [`Self::limit_depth`] → whether objects were merged, and whether uses of symbols and
+    /// patterns were left out.
+    fn limit_depths(&mut self) -> (bool, bool) {
+        let mut merged = limit(&mut self.layers, 1);
+        for s in &mut self.symbols {
+            // The art itself is 1 deep, so it stays the one object it is.
+            let mut art = vec![s.art.clone()];
+            if limit(&mut art, 1)
+                && let Some(one) = art.pop()
+            {
+                s.art = one;
+                merged = true;
+            }
+        }
+        for p in &mut self.patterns {
+            merged |= limit(&mut p.art, 1);
+        }
+        if self.symbols.is_empty() && self.patterns.is_empty() {
+            return (merged, false);
+        }
+        // The symbols and patterns that can't be drawn lose what their art uses: each is then as
+        // deep as its own art, and what uses it can be drawn.
+        let (symbols, patterns): (Vec<usize>, Vec<usize>) = {
+            let heights = heights(self);
+            let bad = |def: Def| heights.get(&def).is_some_and(Option::is_none);
+            (
+                (0..self.symbols.len()).filter(|i| self.symbols.get(*i).is_some_and(|s| bad((false, s.name.as_str())))).collect(),
+                (0..self.patterns.len()).filter(|i| self.patterns.get(*i).is_some_and(|p| bad((true, p.name.as_str())))).collect(),
+            )
+        };
+        let mut left_out = !(symbols.is_empty() && patterns.is_empty());
+        let all = |_: Def, _: usize| true;
+        for i in symbols {
+            let Some(s) = self.symbols.get_mut(i) else { continue };
+            let mut art = vec![s.art.clone()];
+            strip(&mut art, 1, &all);
+            // (An instance alone was the whole art: an empty group stands in.)
+            s.art = art.pop().unwrap_or_else(|| Arc::new(Node::group(s.art.id, vec![])));
+        }
+        for i in patterns {
+            if let Some(p) = self.patterns.get_mut(i) {
+                strip(&mut p.art, 1, &all);
+            }
+        }
+        // Then the uses drawn too deep where they are.
+        let mut layers = self.layers.clone();
+        left_out |= {
+            let heights = heights(self);
+            strip(&mut layers, 1, &|used, depth| undrawable(&heights, used, depth))
+        };
+        self.layers = layers;
+        (merged, left_out)
+    }
+
+    /// Bring the document within the caps: merge the objects nested deeper than [`MAX_DEPTH`]
+    /// into the group around them, and leave out the uses of symbols and patterns that can't be
+    /// drawn (inside their own symbol or pattern, or deeper than [`MAX_DRAWN_DEPTH`]). What an
+    /// importer does to what it read. Returns whether anything changed.
+    pub fn limit_depth(&mut self) -> bool {
+        let (merged, left_out) = self.limit_depths();
+        merged || left_out
+    }
+
+    /// [`Self::limit_depth`], adding [`merged_note`] and [`symbols_note`] to an importer's
+    /// `warnings` for what it did.
+    pub fn limit_depth_noting(&mut self, warnings: &mut Vec<String>) {
+        let (merged, left_out) = self.limit_depths();
+        warnings.extend(merged.then(merged_note));
+        warnings.extend(left_out.then(symbols_note));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{NodeId, OpacityMask};
+
+    /// One path in `levels` groups, each holding a second path beside the next group.
+    fn nested(levels: usize) -> Arc<Node> {
+        let mut id = 0;
+        let mut next = || {
+            id += 1;
+            NodeId(id)
+        };
+        let path = |id| Arc::new(Node::path(id, Default::default(), Default::default()));
+        let mut inner = path(next());
+        for _ in 0..levels {
+            inner = Arc::new(Node::group(next(), vec![inner, path(next())]));
+        }
+        inner
+    }
+
+    fn doc(art: Arc<Node>) -> Document {
+        let mut d = Document::new(100.0, 100.0);
+        if let Some(ch) = d.layers.first_mut().and_then(|l| Arc::make_mut(l).children_mut()) {
+            ch.push(art);
+        }
+        d
+    }
+
+    #[test]
+    fn a_document_at_the_cap_is_left_alone() {
+        // The layer, the groups and the path in them: MAX_DEPTH deep.
+        let mut d = doc(nested(MAX_DEPTH - 2));
+        let before = d.clone();
+        assert!(!d.too_deep(None));
+        assert!(!d.limit_depth());
+        assert_eq!(d, before);
+    }
+
+    #[test]
+    fn deeper_objects_are_merged_into_the_group_around_them() {
+        for levels in [MAX_DEPTH - 1, MAX_DEPTH + 5, 100_000] {
+            let mut d = doc(nested(levels));
+            assert!(d.too_deep(None), "{levels}");
+            assert!(d.limit_depth(), "{levels}");
+            assert!(!d.too_deep(None), "{levels}");
+            // Every path is kept, under the layer and the groups down to the cap.
+            assert_eq!(d.node_count(), 1 + (MAX_DEPTH - 2) + (levels + 1), "{levels}");
+            assert!(!d.limit_depth(), "nothing more to merge");
+        }
+    }
+
+    #[test]
+    fn a_clipping_path_and_a_mask_too_deep_are_left_out_and_hidden_art_stays_hidden() {
+        let mut inner = Node::new(NodeId(9000), NodeKind::Group { children: vec![nested(0), nested(0)], clip: true });
+        inner.visible = false;
+        let mut art = Arc::new(inner);
+        for i in 0..MAX_DEPTH {
+            art = Arc::new(Node::group(NodeId(9001 + i as u64), vec![art]));
+        }
+        let mut masked = Node::group(NodeId(8000), vec![]);
+        masked.extras_mut().mask = Some(Box::new(OpacityMask::new((*nested(MAX_DEPTH)).clone(), true)));
+        let mut d = doc(art);
+        if let Some(ch) = d.layers.first_mut().and_then(|l| Arc::make_mut(l).children_mut()) {
+            ch.push(Arc::new(masked));
+        }
+        assert!(d.limit_depth());
+        assert!(!d.too_deep(None));
+        let mut leaves = vec![];
+        d.walk(|n| {
+            if n.children().is_none() {
+                leaves.push(n.visible);
+            }
+        });
+        assert_eq!(leaves, [false], "the clipping path is gone, what it clipped is still hidden");
+        assert!(d.node(NodeId(8000)).is_some_and(|n| n.extras().mask.is_none()));
+    }
+
+    #[test]
+    fn an_edit_is_checked_by_what_it_changed() {
+        let before = doc(nested(MAX_DEPTH - 2));
+        let mut wrapped = before.clone();
+        if let Some(ch) = wrapped.layers.first_mut().and_then(|l| Arc::make_mut(l).children_mut()) {
+            let all = std::mem::take(ch);
+            ch.push(Arc::new(Node::group(NodeId(7000), all)));
+        }
+        assert!(wrapped.too_deep(Some(&before)), "the same art, one deeper");
+        let mut beside = before.clone();
+        if let Some(ch) = beside.layers.first_mut().and_then(|l| Arc::make_mut(l).children_mut()) {
+            ch.push(nested(3));
+        }
+        assert!(!beside.too_deep(Some(&before)));
+        assert!(!before.too_deep(Some(&before)));
+    }
+
+    #[test]
+    fn symbols_and_patterns_are_limited_too() {
+        let mut d = Document::new(10.0, 10.0);
+        d.symbols.push(crate::Symbol { name: "s".into(), art: nested(MAX_DEPTH + 3) });
+        assert!(d.too_deep(None));
+        assert!(d.limit_depth());
+        assert!(!d.too_deep(None));
+        assert!(d.symbols.first().is_some_and(|s| s.art.children().is_some()), "still one object");
+    }
+
+    fn instance(id: u64, of: &str) -> Arc<Node> {
+        Arc::new(Node::new(NodeId(id), NodeKind::SymbolInstance { symbol: of.into(), xf: Default::default() }))
+    }
+
+    /// `count` symbols, each `levels` groups around an instance of the next; the last one's of `last`.
+    fn symbols(count: usize, levels: usize, last: &str) -> Document {
+        let mut d = doc(instance(1, "s0"));
+        for i in 0..count {
+            let mut art = instance(2, &if i + 1 < count { format!("s{}", i + 1) } else { last.to_string() });
+            for _ in 0..levels {
+                art = Arc::new(Node::group(NodeId(3), vec![art]));
+            }
+            d.symbols.push(crate::Symbol { name: format!("s{i}"), art });
+        }
+        d
+    }
+
+    fn instances(d: &Document) -> usize {
+        let mut n = 0;
+        let mut count = |x: &Node| n += usize::from(matches!(x.kind, NodeKind::SymbolInstance { .. }));
+        d.walk(&mut count);
+        d.symbols.iter().for_each(|s| s.art.walk(&mut count));
+        n
+    }
+
+    #[test]
+    fn symbols_in_symbols_are_drawn_only_so_deep() {
+        // Three objects deep each (two groups and the instance), under the instance on the layer.
+        let fits = MAX_DRAWN_DEPTH / 3 - 1;
+        let mut d = symbols(fits, 2, "none");
+        assert!(!d.too_deep(None) && !d.limit_depth());
+        let mut d = symbols(fits + 2, 2, "none");
+        assert!(d.too_deep(None));
+        let before = instances(&d);
+        assert!(d.limit_depth() && !d.too_deep(None));
+        assert!(instances(&d) < before && instances(&d) > 0, "only the instances drawn too deep go");
+        // A chain of any length is measured, not walked by recursion.
+        let mut d = symbols(100_000, 0, "none");
+        assert!(d.too_deep(None) && d.limit_depth() && !d.too_deep(None));
+    }
+
+    #[test]
+    fn a_symbol_holding_itself_loses_the_instance() {
+        for (count, last) in [(1, "s0"), (3, "s0"), (3, "s1")] {
+            let mut d = symbols(count, 1, last);
+            assert!(d.too_deep(None), "{count} {last}");
+            let mut warnings = vec![];
+            d.limit_depth_noting(&mut warnings);
+            assert_eq!(warnings, [symbols_note()]);
+            assert!(!d.too_deep(None), "{count} {last}");
+            assert!(d.symbols.iter().all(|s| s.art.children().is_some()), "the art is still a group");
+        }
+        // An edit that makes one hold itself is seen, whatever else stayed as it was.
+        let before = symbols(2, 1, "none");
+        let mut after = before.clone();
+        after.symbols[1].art = Arc::new(Node::group(NodeId(9), vec![instance(8, "s0")]));
+        assert!(!before.too_deep(None) && after.too_deep(Some(&before)));
+    }
+
+    /// A path painted with the pattern named `with`.
+    fn painted(id: u64, with: &str) -> Arc<Node> {
+        let fill = Paint::Pattern { pattern: with.into(), xf: Default::default() };
+        Arc::new(Node::path(NodeId(id), Default::default(), crate::Appearance::basic(fill, Paint::None, 0.0)))
+    }
+
+    fn pattern_fills(d: &Document) -> usize {
+        let mut n = 0;
+        d.visit_paints(&mut |p| n += usize::from(matches!(p, Paint::Pattern { .. })));
+        n
+    }
+
+    #[test]
+    fn a_pattern_painting_its_own_tile_loses_the_paint() {
+        // One that paints its own tile; two that paint each other's; one in a symbol it holds.
+        let itself = |d: &mut Document| d.patterns.push(crate::PatternDef::new("p", vec![painted(2, "p")]));
+        let each_other = |d: &mut Document| {
+            d.patterns.push(crate::PatternDef::new("p", vec![painted(2, "q")]));
+            d.patterns.push(crate::PatternDef::new("q", vec![painted(3, "p")]));
+        };
+        let through_a_symbol = |d: &mut Document| {
+            d.patterns.push(crate::PatternDef::new("p", vec![instance(2, "s")]));
+            d.symbols.push(crate::Symbol { name: "s".into(), art: painted(3, "p") });
+        };
+        for make in [&itself as &dyn Fn(&mut Document), &each_other, &through_a_symbol] {
+            let mut d = doc(painted(1, "p"));
+            make(&mut d);
+            assert!(d.too_deep(None));
+            let mut warnings = vec![];
+            d.limit_depth_noting(&mut warnings);
+            assert_eq!(warnings, [symbols_note()]);
+            assert!(!d.too_deep(None));
+            assert_eq!(pattern_fills(&d), 1, "the object on the layer keeps its pattern");
+        }
+        // A pattern whose tile is painted with another is fine.
+        let mut d = doc(painted(1, "p"));
+        d.patterns.push(crate::PatternDef::new("p", vec![painted(2, "q")]));
+        d.patterns.push(crate::PatternDef::new("q", vec![painted(3, "none")]));
+        assert!(!d.too_deep(None) && !d.limit_depth());
+    }
+}
@@ -11,6 +11,7 @@ pub mod blend;
 pub mod clipnest;
 pub mod cmyk;
 pub mod corners;
+pub mod depth;
 pub mod graph;
 pub mod hit;
 mod id_index;
@@ -30,6 +31,7 @@ pub mod overprint;
 pub mod pattern;
 pub mod perspective;
 mod pixels;
+pub use pixels::MAX_RASTER_ALLOC;
 pub mod placed_document;
 pub mod profiles;
 pub mod puppet;
@@ -79,6 +81,7 @@ pub use appearance::{
 };
 pub use assets::ExportAsset;
 pub use corners::LiveCorners;
+pub use depth::MAX_DEPTH;
 pub use graph::{
    GraphDesign, GraphKind, GraphSpec, LabelStyles, MAX_GRAPH_CATEGORIES, MAX_GRAPH_SERIES, PiePosition, PieSort, SeriesPaint, TickLength,
    ValueAxisSide,
@@ -773,7 +776,9 @@ impl Document {
    /// Allocate a fresh node id.
    pub fn alloc_id(&mut self) -> NodeId {
        let id = NodeId(self.next_id);
-        self.next_id += 1;
+        // Never reached from a counter [`Self::fix_next_id`] has seen (it stays under
+        // [`MAX_NEXT_ID`]); saturating so that no counter can overflow.
+        self.next_id = self.next_id.saturating_add(1);
        id
    }
    pub fn peek_next_id(&self) -> u64 {
@@ -781,14 +786,22 @@ impl Document {
    }
    /// Ensure `next_id` is above every id in the tree (after deserializing foreign data).
    pub fn fix_next_id(&mut self) {
+        // Ids from [`MAX_NEXT_ID`] up (a damaged or hand-made file: #1718) are left out, as is a
+        // counter up there: new ids start under them and never reach them, where counting on from
+        // the largest would run out and hand out ids the document already uses.
        let mut max = 0;
+        let mut see = |id: u64| {
+            if id < MAX_NEXT_ID {
+                max = max.max(id);
+            }
+        };
        for l in &self.layers {
-            l.walk(&mut |n| max = max.max(n.id.0));
+            l.walk(&mut |n| see(n.id.0));
        }
-        max = self.slices.iter().fold(max, |m, s| m.max(s.id.0));
-        max = self.assets.iter().fold(max, |m, a| m.max(a.id));
-        // An id of u64::MAX (a damaged file) can't overflow: ids after it are reused at worst.
-        self.next_id = self.next_id.max(max.saturating_add(1));
+        self.slices.iter().for_each(|s| see(s.id.0));
+        self.assets.iter().for_each(|a| see(a.id));
+        let counter = Some(self.next_id).filter(|n| *n <= MAX_NEXT_ID).unwrap_or(0);
+        self.next_id = counter.max(max.saturating_add(1));
    }

    /// Find a node anywhere in the tree.
@@ -1374,7 +1387,7 @@ impl Document {
        self.guides.extend(copies);
    }
    pub fn next_artboard_id(&self) -> u32 {
-        self.artboards.iter().map(|a| a.id).max().unwrap_or(0) + 1
+        free_id(self.artboards.iter().map(|a| a.id))
    }
    pub fn pattern(&self, name: &str) -> Option<&PatternDef> {
        self.patterns.iter().find(|p| p.name == name)
@@ -1458,7 +1471,7 @@ impl Document {
    }
    /// An id no graphic style has.
    pub fn next_graphic_style_id(&self) -> u32 {
-        self.graphic_styles.iter().map(|g| g.id).max().unwrap_or(0) + 1
+        free_id(self.graphic_styles.iter().map(|g| g.id))
    }
    /// The id of graphic style `index`, assigning one if it has none yet.
    pub fn graphic_style_id(&mut self, index: usize) -> u32 {
@@ -1497,11 +1510,29 @@ fn default_graphic_styles() -> Vec<GraphicStyle> {
    .collect()
 }

+/// Node, slice and asset ids are handed out below this: no document gets near it by counting, so
+/// larger ids in a file are damage (or made by hand) and the counter never follows them (#1718).
+const MAX_NEXT_ID: u64 = 1 << 62;
+
+/// An id (never 0) none of `used` has: one past the largest, or, when that is the largest there
+/// is (a damaged file), the smallest one free.
+fn free_id(used: impl Iterator<Item = u32>) -> u32 {
+    let mut used: Vec<u32> = used.collect();
+    if let Some(next) = used.iter().max().copied().unwrap_or(0).checked_add(1) {
+        return next;
+    }
+    used.sort_unstable();
+    used.dedup();
+    // Ids 1, 2, 3… as far as they are all taken: the first that isn't follows them.
+    let taken = used.iter().filter(|&&id| id != 0).zip(1u32..).take_while(|&(&id, n)| id == n).count();
+    u32::try_from(taken).map_or(u32::MAX, |n| n.saturating_add(1))
+}
+
 impl Document {
    /// Make the next id allocated at least `next`: ids handed out outside the layer tree (such
    /// as an importer's opacity mask and pattern art), which [`Document::fix_next_id`] doesn't see.
    pub fn reserve_ids(&mut self, next: u64) {
-        self.next_id = self.next_id.max(next);
+        self.next_id = self.next_id.max(next.min(MAX_NEXT_ID));
    }
 }

@@ -1626,6 +1657,45 @@ mod tests {
        assert_eq!(d.layer_color(l2), LAYER_COLORS[1].1);
    }

+    /// #1718: a file whose ids or counters are at their type's largest value still hands out ids
+    /// nothing in it uses (and never 0), instead of overflowing.
+    #[test]
+    fn exhausted_ids_in_a_file_dont_run_out() {
+        let (d, a, b) = doc_with_rects();
+        let mut v = serde_json::to_value(&d).unwrap();
+        v["next_id"] = serde_json::json!(u64::MAX);
+        // Object `a` gets the largest id there is.
+        fn renumber(v: &mut serde_json::Value, from: u64) {
+            match v {
+                serde_json::Value::Object(o) => {
+                    if o.get("id").and_then(serde_json::Value::as_u64) == Some(from) {
+                        o.insert("id".into(), serde_json::json!(u64::MAX));
+                    }
+                    o.values_mut().for_each(|c| renumber(c, from));
+                }
+                serde_json::Value::Array(a) => a.iter_mut().for_each(|c| renumber(c, from)),
+                _ => {}
+            }
+        }
+        renumber(&mut v["layers"], a.0);
+        let mut d: Document = serde_json::from_value(v).unwrap();
+        assert!(d.node(NodeId(u64::MAX)).is_some(), "the file's largest id is kept");
+        d.fix_next_id();
+        let fresh: Vec<NodeId> = (0..3).map(|_| d.alloc_id()).collect();
+        assert!(fresh.iter().all(|id| d.node(*id).is_none() && id.0 > b.0 && id.0 < MAX_NEXT_ID), "{fresh:?}");
+        assert!(fresh[0] != fresh[1] && fresh[1] != fresh[2]);
+        // A counter left at the end by other means stays there rather than wrapping to 0.
+        d.next_id = u64::MAX;
+        assert_eq!((d.alloc_id(), d.peek_next_id()), (NodeId(u64::MAX), u64::MAX));
+        d.reserve_ids(u64::MAX);
+        // Artboards and graphic styles: one past the largest, else the smallest id free.
+        assert_eq!(free_id([1, 2, 7].into_iter()), 8);
+        assert_eq!(free_id([u32::MAX, 0, 1, 2, 4].into_iter()), 3);
+        assert_eq!(free_id([u32::MAX].into_iter()), 1);
+        d.artboards[0].id = u32::MAX;
+        assert_eq!(d.next_artboard_id(), 1);
+    }
+
    #[test]
    fn serde_roundtrip() {
        let (d, _, _) = doc_with_rects();
@@ -6,6 +6,22 @@ use std::sync::Arc;

 use crate::ImageBlob;

+/// The most memory the decoded RGBA pixels of one image may take: the allowance the importers
+/// and the renderer decode within (a 60 in sheet at 300 ppi is ~475 MB). The web app has 4 GB to
+/// address and aborts when an allocation fails, so it keeps the decoder's own 512 MB.
+pub const MAX_RASTER_ALLOC: u64 = if cfg!(target_arch = "wasm32") { 512 << 20 } else { 2 << 30 };
+
+/// The pixels of encoded image `bytes` as RGBA; `None` when they can't be decoded or would take
+/// more than `max` bytes as RGBA. The size is read from the header first: the decoder's own limit
+/// is on the file's samples, and a grey image is a quarter of what it becomes here (#1717).
+fn rgba_within(bytes: &[u8], max: u64) -> Option<image::RgbaImage> {
+    let (w, h) = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().ok()?.into_dimensions().ok()?;
+    if u64::from(w) * u64::from(h) * 4 > max {
+        return None;
+    }
+    Some(image::load_from_memory(bytes).ok()?.to_rgba8())
+}
+
 impl ImageBlob {
    /// A PNG blob of `png` bytes.
    pub fn png(png: Vec<u8>) -> Self {
@@ -21,7 +37,7 @@ impl ImageBlob {
    /// pixels left alone, re-encoded as PNG. `f` runs once per distinct colour. `None` when the
    /// image can't be decoded or no pixel changed.
    pub fn map_rgb(&self, mut f: impl FnMut([u8; 3]) -> [u8; 3]) -> Option<ImageBlob> {
-        let mut img = image::load_from_memory(&self.bytes).ok()?.to_rgba8();
+        let mut img = rgba_within(&self.bytes, MAX_RASTER_ALLOC)?;
        let mut memo: HashMap<[u8; 3], [u8; 3]> = HashMap::new();
        let mut changed = false;
        for px in img.pixels_mut().filter(|p| p.0[3] > 0) {
@@ -67,7 +83,7 @@ impl ImageBlob {
        LAST.with_borrow_mut(|last| match last {
            Some((k, img)) if *k == key => Some(img.clone()),
            _ => {
-                let img = Arc::new(image::load_from_memory(&self.bytes).ok()?.to_rgba8());
+                let img = Arc::new(rgba_within(&self.bytes, MAX_RASTER_ALLOC)?);
                *last = Some((key, img.clone()));
                Some(img)
            }
@@ -115,6 +131,18 @@ mod tests {
        image::load_from_memory(&b.bytes).unwrap().to_rgba8().pixels().map(|p| p.0).collect()
    }

+    /// #1717: the RGBA size is checked from the header, before anything is decoded: a grey image
+    /// the decoder's own limit lets through is four times that as RGBA.
+    #[test]
+    fn pixels_past_the_allowance_are_not_decoded() {
+        let grey = image::GrayImage::from_raw(4, 2, vec![7; 8]).unwrap();
+        let mut png = Vec::new();
+        grey.write_to(&mut Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        assert!(rgba_within(&png, 31).is_none(), "8 grey bytes are 32 as RGBA");
+        assert_eq!(rgba_within(&png, 32).map(|i| i.dimensions()), Some((4, 2)));
+        assert!(rgba_within(b"not an image", u64::MAX).is_none());
+    }
+
    #[test]
    fn samples_a_pixel_or_the_average_around_it() {
        let b = blob(&[[255, 0, 0, 255], [0, 255, 0, 255], [0, 0, 255, 255], [9, 9, 9, 0]], 4, 1);
@@ -109,10 +109,11 @@ impl Document {
    }

    /// Visit every colour that can link to a swatch — solid paints and gradient stops of fills,
-    /// strokes and text runs — in the art, symbol definitions, pattern tiles, graphic styles and the
-    /// swatches themselves (tint swatches, gradient swatches' stops). `f(colour, link, tint)` may
-    /// change them and returns true when it did ([`Paint::map_links`]). Only nodes holding a changed
-    /// paint (and the paths to them) are copied. Returns the number of changed paints.
+    /// strokes and text runs — in the art (opacity masks included), symbol definitions, pattern
+    /// tiles, graphic styles and the swatches themselves (tint swatches, gradient swatches' stops).
+    /// `f(colour, link, tint)` may change them and returns true when it did
+    /// ([`Paint::map_links`]). Only nodes holding a changed paint (and the paths to them) are
+    /// copied. Returns the number of changed paints.
    pub fn map_solid_paints(&mut self, f: &mut LinkFn) -> usize {
        let mut n = map_trees(&mut self.layers, f);
        for s in &mut self.symbols {
@@ -152,11 +153,12 @@ impl Document {
 }

 impl Document {
-    /// Visit every paint held by the art, symbol definitions, pattern tiles and graphic styles
-    /// (fills, strokes and text runs), and the colour of every gradient-mesh point as a solid paint.
+    /// Visit every paint held by the art (opacity masks included), symbol definitions, pattern
+    /// tiles and graphic styles (fills, strokes and text runs), and the colour of every
+    /// gradient-mesh point as a solid paint.
    pub fn visit_paints(&self, f: &mut dyn FnMut(&Paint)) {
        let mut tree = |n: &Node| {
-            n.walk(&mut |m| {
+            walk_with_masks(n, &mut |m| {
                node_paints(m).for_each(&mut *f);
                if let NodeKind::Mesh(mesh) = &m.kind {
                    mesh.points.iter().for_each(|p| f(&Paint::solid(p.color)));
@@ -224,7 +226,7 @@ fn item_paint_mut(it: &mut AppearanceItem) -> &mut Paint {
 }

 /// The paints a node holds itself (not its children): appearance items, then text runs.
-fn node_paints(n: &Node) -> impl Iterator<Item = &Paint> {
+pub(crate) fn node_paints(n: &Node) -> impl Iterator<Item = &Paint> {
    let runs = match &n.kind {
        NodeKind::Text(t) => t.runs.as_slice(),
        _ => &[],
@@ -233,7 +235,7 @@ fn node_paints(n: &Node) -> impl Iterator<Item = &Paint> {
 }

 /// Mutable [`node_paints`], in the same order.
-fn node_paints_mut(n: &mut Node) -> impl Iterator<Item = &mut Paint> {
+pub(crate) fn node_paints_mut(n: &mut Node) -> impl Iterator<Item = &mut Paint> {
    let runs = match &mut n.kind {
        NodeKind::Text(t) => t.runs.as_mut_slice(),
        _ => &mut [],
@@ -280,9 +282,31 @@ fn map_node(n: &Node, f: &mut LinkFn) -> Option<(Node, usize)> {
            }
        }
    }
+    // Opacity mask art lives outside the tree, but its colours are the object's too (#1735).
+    if let Some(mask) = n.extras().mask.as_deref()
+        && let Some((new, k)) = map_node(&mask.art, f)
+    {
+        let m = out.get_or_insert_with(|| n.clone());
+        if let Some(slot) = m.extras_if_any().and_then(|e| e.mask.as_deref_mut()) {
+            slot.art = Arc::new(new);
+            count += k;
+        }
+    }
    out.map(|m| (m, count))
 }

+/// Visit `n` and its subtree, the art of opacity masks included (mask art after the masked
+/// object, before its children).
+fn walk_with_masks<'a>(n: &'a Node, f: &mut dyn FnMut(&'a Node)) {
+    f(n);
+    if let Some(mask) = n.extras().mask.as_deref() {
+        walk_with_masks(&mask.art, f);
+    }
+    for c in n.children().into_iter().flatten() {
+        walk_with_masks(c, f);
+    }
+}
+
 fn map_tree(n: &mut Arc<Node>, f: &mut LinkFn) -> usize {
    match map_node(n, f) {
        Some((new, count)) => {
@@ -108,6 +108,10 @@ const MAX_SCALE: f64 = 100_000.0;
 const MAX_MOVE: f64 = 1.0e7;
 /// The Transform effect's copies stop before one reaches further than this (pt) from the origin.
 const MAX_REACH: f64 = 1.0e9;
+/// Most anchors a Transform effect's copies make of a path, the original included: 1000 copies of
+/// a 2000-anchor path. Stacked Transform effects multiply their copies (three of 1000 copies make
+/// a thousand million of one square), so the limit is on the result, not on each effect's count.
+pub(crate) const MAX_COPY_ANCHORS: usize = 2_000_000;

 /// Transform effect: scale, rotate and reflect about reference point `reference` of the bounds
 /// (the 9-point grid, 4 = centre), then move; `copies` more times, each from the last. With
@@ -115,6 +119,11 @@ const MAX_REACH: f64 = 1.0e9;
 /// the angle a share of theirs, drawn from `seed` (the object's), so an object keeps its result
 /// on every redraw while each object varies its own way.
 pub fn transform(path: &PathData, b: Rect, p: &Value, seed: u64) -> PathData {
+    transform_within(path, b, p, seed, MAX_COPY_ANCHORS)
+}
+
+/// [`transform`] whose copies make at most `max` anchors of the path, the original included.
+pub(crate) fn transform_within(path: &PathData, b: Rect, p: &Value, seed: u64, max: usize) -> PathData {
    let random = flag(p, "random", false);
    // The share (0..1) of value `k` applied.
    let share = |k: u64| if random { (noise(seed, k, 0, 0) + 1.0) / 2.0 } else { 1.0 };
@@ -132,9 +141,17 @@ pub fn transform(path: &PathData, b: Rect, p: &Value, seed: u64) -> PathData {
        return path.transformed(m);
    }
    let within = |r: Rect| [r.x0, r.y0, r.x1, r.y1].iter().all(|v| v.abs() <= MAX_REACH);
+    // Each copy adds the path once more, and a Transform after this one copies the lot again:
+    // copies stop where the result would pass [`MAX_COPY_ANCHORS`] (#1705).
+    let each = path.anchor_count();
+    let mut anchors = each;
    let mut out = path.clone();
    let mut cur = path.clone();
    for _ in 0..copies {
+        anchors = anchors.saturating_add(each);
+        if anchors > max {
+            break;
+        }
        cur = cur.transformed(m);
        if !cur.bounds().is_some_and(within) {
            break;
@@ -113,19 +113,19 @@ fn profile(n: &Node) -> Option<(PathData, FillRule)> {
    }
 }

-fn facets(id: &str, path: &PathData, bounds: Rect, p: &Value) -> Result<Vec<Facet>, String> {
+fn facets(id: &str, path: &PathData, rule: FillRule, bounds: Rect, p: &Value) -> Result<Vec<Facet>, String> {
    let view = view_options(p);
    match id {
-        EXTRUDE => vectorcraft_three_d::extrude(path, bounds, extrude_options(p), view),
-        INFLATE => vectorcraft_three_d::inflate(path, bounds, inflate_options(p), view),
-        _ => vectorcraft_three_d::plane(path, bounds, view),
+        EXTRUDE => vectorcraft_three_d::extrude(path, rule, bounds, extrude_options(p), view),
+        INFLATE => vectorcraft_three_d::inflate(path, rule, bounds, inflate_options(p), view),
+        _ => vectorcraft_three_d::plane(path, rule, bounds, view),
    }
 }

 /// Validate before a command changes the document; the evaluator bounds loaded files too.
 pub fn validate_solid(n: &Node, id: &str, p: &Value) -> Result<(), String> {
    let label = crate::effect_info(id).map_or("This effect", |e| e.label.trim_end_matches('…'));
-    let (path, _) =
+    let (path, rule) =
        profile(n).ok_or_else(|| format!("{label} currently requires a path or compound path. Convert type, images and groups to paths first."))?;
    let b = path.bounds().ok_or_else(|| format!("{label} requires a shape with at least two anchors"))?;
    if let Some(v) = p.get("bevel")
@@ -134,7 +134,7 @@ pub fn validate_solid(n: &Node, id: &str, p: &Value) -> Result<(), String> {
        let names: Vec<_> = BevelShape::ALL.iter().map(|b| b.id()).collect();
        return Err(format!("bevel must be none or one of {}", names.join(", ")));
    }
-    facets(id, &path, b, p).map(|_| ())
+    facets(id, &path, rule, b, p).map(|_| ())
 }

 /// One surface: each facet a path shaded from `paint`, as a group with the paint's opacity and
@@ -185,11 +185,12 @@ fn paint_of(item: &AppearanceItem) -> (Paint, f32, BlendMode) {
    }
 }

-/// The area `item` paints on `path`: the path itself for a fill, the stroke's outline for a stroke.
-fn region(path: &PathData, rule: FillRule, item: &AppearanceItem) -> PathData {
+/// The area `item` paints on `path`, and the rule that fills it: the path itself for a fill, the
+/// stroke's outline (whose contours nest as its holes do) for a stroke.
+fn region(path: &PathData, rule: FillRule, item: &AppearanceItem) -> (PathData, FillRule) {
    match item {
-        AppearanceItem::Stroke(s) if s.width > 0.0 && s.width.is_finite() => crate::stroke::outline_region(path, rule, s),
-        _ => path.clone(),
+        AppearanceItem::Stroke(s) if s.width > 0.0 && s.width.is_finite() => (crate::stroke::outline_region(path, rule, s), FillRule::EvenOdd),
+        _ => (path.clone(), rule),
    }
 }

@@ -204,7 +205,8 @@ fn art_for(n: &Node, fx: &Effect, path: &PathData, rule: FillRule, items: &[&App
        let mut out = vec![];
        for item in items {
            let (paint, opacity, blend) = paint_of(item);
-            let f = facets(ROTATE, &region(path, rule, item), b, &p).ok()?;
+            let (area, rule) = region(path, rule, item);
+            let f = facets(ROTATE, &area, rule, b, &p).ok()?;
            out.push(Arc::new(surface(n, f, &paint, opacity, blend)));
        }
        return Some(out);
@@ -213,7 +215,7 @@ fn art_for(n: &Node, fx: &Effect, path: &PathData, rule: FillRule, items: &[&App
    let (paint, opacity, blend) = paint_of(item);
    // A loaded file or a shape edited past the limits keeps drawing its source path instead of
    // failing the frame; commands validate the same evaluator and report its errors.
-    let f = facets(&fx.id, path, b, &p).ok()?;
+    let f = facets(&fx.id, path, rule, b, &p).ok()?;
    Some(vec![Arc::new(surface(n, f, &paint, opacity, blend))])
 }

@@ -206,6 +206,24 @@ fn random_transform_is_stable_per_object_and_within_the_values() {
    assert!(close(r.width(), 50.0, 1e-9) && close(r.center().x, 90.0, 1e-9), "{r:?}");
 }

+/// #1705: stacked Transform effects multiply their copies; the anchors they make are bounded,
+/// whatever each one's count.
+#[test]
+fn stacked_transform_copies_stay_within_the_anchor_budget() {
+    let p = json!({"copies": 1000});
+    let b = square().bounds().unwrap();
+    let mut path = square();
+    let mut counts = vec![];
+    for _ in 0..3 {
+        path = crate::distort::transform_within(&path, b, &p, 0, 100);
+        counts.push(path.anchor_count());
+    }
+    assert_eq!(counts, [100, 100, 100], "25 squares, then no room for a copy of them");
+    // Within the budget every copy is made, and the effect's own budget takes a thousand copies.
+    assert_eq!(crate::distort::transform_within(&square(), b, &json!({"copies": 24}), 0, 100).subpaths.len(), 25);
+    assert_eq!(run("distort.transform", p, &square()).subpaths.len(), 1001);
+}
+
 #[test]
 fn transform_copies_stop_before_they_overflow() {
    let out = run("distort.transform", json!({"scaleH": 100000, "scaleV": 100000, "copies": 1000}), &square());
@@ -120,7 +120,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Make",
            ["Object", "Image Trace"],
            None,
-            "{id?: image or Image Trace group (default: selection), preset?: name (imageTrace.presets), params?: {mode: \"blackAndWhite\"|\"grayscale\"|\"color\"|\"logo\", threshold: 0-255, palette: \"limited\"|\"fullTone\"|\"automatic\"|\"documentLibrary\" (color mode; limited: the `colors` best colours, fullTone: as many as the tones need, more with colorDetail, automatic: flat art with its own colours, else fullTone, documentLibrary: at most `colors` of the library's colours, as they are), colors: 2-256, colorDetail: 0-100 (fullTone, automatic), library: \"document\" (the document's swatches) or a swatch library id or name (swatch.library.list; documentLibrary), paths: 0-100, corners: 0-100, noise: px, method: \"abutting\"|\"overlapping\", ignoreWhite (leave out white areas), ignoreColor?: \"#rrggbb\" (with ignoreWhite: the colour left out instead of white), snapCurvesToLines, shapes: false (filled outlines that are a circle, an ellipse, a rectangle or a regular polygon come out as that live shape), autoGrouping: false (each path that has others inside it is grouped with them), gradients: false (grayscale and color: an area whose colour changes evenly along one direction is one path with a linear gradient fill), fills: true, strokes: false (Create: lines up to strokeWidth wide become stroked centre lines; without fills, wider areas become stroked outlines), strokeWidth: px (10), logoColors?: [\"#rrggbb\"…] (mode logo: flat-colour logos only; colours found automatically or named here, white is always its own colour, at most ten; noise = areas under noise/10 px ignored; edges to a fraction of a pixel, sharp corners restored, lines and circles snapped; enclosed transparent areas are painted white unless ignoreWhite makes them holes; fills/strokes are ignored; gradients and photos are refused)}, view?: as imageTrace.setView (default: the traced object's own, else tracingResult), ids?: [id…] (instead of id)} → {id, paths, anchors, colors}",
+            "{id?: image or Image Trace group (default: selection), preset?: name (imageTrace.presets), enhanced?: false (the preset's enhanced version: with Auto Grouping, and with Shapes in all but High Fidelity Photo; Flat Logo has none and is traced as it is), params?: {mode: \"blackAndWhite\"|\"grayscale\"|\"color\"|\"logo\", threshold: 0-255, palette: \"limited\"|\"fullTone\"|\"automatic\"|\"documentLibrary\" (color mode; limited: the `colors` best colours, fullTone: as many as the tones need, more with colorDetail, automatic: flat art with its own colours, else fullTone, documentLibrary: at most `colors` of the library's colours, as they are), colors: 2-256, colorDetail: 0-100 (fullTone, automatic), library: \"document\" (the document's swatches) or a swatch library id or name (swatch.library.list; documentLibrary), paths: 0-100, corners: 0-100, noise: px, method: \"abutting\"|\"overlapping\", ignoreWhite (leave out white areas), ignoreColor?: \"#rrggbb\" (with ignoreWhite: the colour left out instead of white), snapCurvesToLines, shapes: false (filled outlines that are a circle, an ellipse, a rectangle or a regular polygon come out as that live shape), autoGrouping: false (each path that has others inside it is grouped with them), gradients: false (grayscale and color: an area whose colour changes evenly along one direction is one path with a linear gradient fill), fills: true, strokes: false (Create: lines up to strokeWidth wide become stroked centre lines; without fills, wider areas become stroked outlines), strokeWidth: px (10), logoColors?: [\"#rrggbb\"…] (mode logo: flat-colour logos only; colours found automatically or named here, white is always its own colour, at most ten; noise = areas under noise/10 px ignored; edges to a fraction of a pixel, sharp corners restored, lines and circles snapped; enclosed transparent areas are painted white unless ignoreWhite makes them holes; fills/strokes are ignored; gradients and photos are refused)}, view?: as imageTrace.setView (default: the traced object's own, else tracingResult), ids?: [id…] (instead of id)} → {id, paths, anchors, colors}",
            has_selection_or_ids,
            |s, p| trace_make(s, p, false)
        ),
@@ -160,8 +160,8 @@ pub fn specs() -> Vec<CommandSpec> {
            has_selection_or_ids,
            trace_set_view
        ),
-        cmd!(query "imageTrace.presets", "Image Trace Presets", [], None, "{} → {presets: [{name, params}]}", always, |_, _| {
-            Ok(json!({ "presets": tr::presets().into_iter().map(|(n, p)| json!({ "name": n, "params": p })).collect::<Vec<_>>() }))
+        cmd!(query "imageTrace.presets", "Image Trace Presets", [], None, "{} → {presets: [{name, params, enhanced: the params of the preset's enhanced version, null if it has none}]}", always, |_, _| {
+            Ok(json!({ "presets": tr::presets().into_iter().map(|(n, p)| json!({ "name": n, "params": p, "enhanced": tr::enhanced_preset(n) })).collect::<Vec<_>>() }))
        }),
    ]
 }
@@ -657,7 +657,10 @@ fn view_param(cmd: &str, p: &Value) -> Result<Option<TraceView>> {

 fn trace_params(p: &Value) -> Result<tr::TraceParams> {
    let name = str_param(p, "preset").unwrap_or("Default");
-    let base = tr::preset(name).ok_or_else(|| bad("imageTrace.make", format!("unknown preset `{name}` (see imageTrace.presets)")))?;
+    let enhanced = p.get("enhanced").and_then(Value::as_bool).unwrap_or(false);
+    // (A preset without an enhanced version is traced as it is.)
+    let base = enhanced.then(|| tr::enhanced_preset(name)).flatten().or_else(|| tr::preset(name));
+    let base = base.ok_or_else(|| bad("imageTrace.make", format!("unknown preset `{name}` (see imageTrace.presets)")))?;
    let Some(over) = p.get("params").filter(|v| !v.is_null()) else { return Ok(base) };
    let mut v = serde_json::to_value(&base).map_err(|e| EngineError::Other(e.to_string()))?;
    let (Some(o), Some(src)) = (v.as_object_mut(), over.as_object()) else { return Err(bad("imageTrace.make", "params must be an object")) };
@@ -738,8 +741,9 @@ fn traced_gradient(g: &tr::TracedGradient, xf: vectorcraft_geom::Affine) -> Pain
 }

 /// Auto Grouping: `nodes` (one per traced path, bottom-most first) with each path that has others
-/// inside it (`parents`, as the tracer gives them) in a group with them: the path, then what is
-/// inside it. Without parents, the nodes as they are.
+/// inside it (`parents`, as the tracer gives them) in a group with them, in the order they had:
+/// abutting paths painted in another order would show a seam where they meet. Without parents,
+/// the nodes as they are.
 fn grouped(d: &mut Document, nodes: Vec<Node>, parents: &[Option<usize>]) -> Vec<Arc<Node>> {
    let n = nodes.len();
    let mut inside: Vec<Vec<usize>> = vec![vec![]; n];
@@ -761,8 +765,14 @@ fn grouped(d: &mut Document, nodes: Vec<Node>, parents: &[Option<usize>]) -> Vec
    let mut built: Vec<Option<Arc<Node>>> = vec![None; n];
    for &i in order.iter().rev() {
        let Some(node) = nodes.get_mut(i).and_then(Option::take) else { continue };
-        let within: Vec<Arc<Node>> = inside.get(i).into_iter().flatten().filter_map(|&c| built.get_mut(c)?.take()).collect();
-        let made = if within.is_empty() { node } else { Node::group(d.alloc_id(), std::iter::once(Arc::new(node)).chain(within).collect()) };
+        let mut within: Vec<(usize, Arc<Node>)> = inside.get(i).into_iter().flatten().filter_map(|&c| Some((c, built.get_mut(c)?.take()?))).collect();
+        let made = if within.is_empty() {
+            node
+        } else {
+            within.push((i, Arc::new(node)));
+            within.sort_by_key(|m| m.0);
+            Node::group(d.alloc_id(), within.into_iter().map(|m| m.1).collect())
+        };
        if let Some(slot) = built.get_mut(i) {
            *slot = Some(Arc::new(made));
        }
@@ -778,12 +788,11 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
    let mut params = trace_params(p)?;
    let view = view_param(C, p)?;
    let params_json = serde_json::to_value(&params).map_err(|e| EngineError::Other(e.to_string()))?;
-    // The preset's name if the parameters are exactly that preset's, else "Custom".
+    // The preset's name if the parameters are exactly that preset's or its enhanced version's,
+    // else "Custom".
    let named = str_param(p, "preset").unwrap_or("Default");
-    let preset_label = match tr::preset(named) {
-        Some(b) if serde_json::to_value(&b).ok().as_ref() == Some(&params_json) => named.to_string(),
-        _ => "Custom".to_string(),
-    };
+    let is = |b: Option<tr::TraceParams>| b.and_then(|b| serde_json::to_value(&b).ok()).as_ref() == Some(&params_json);
+    let preset_label = if is(tr::preset(named)) || is(tr::enhanced_preset(named)) { named.to_string() } else { "Custom".to_string() };
    let roots = root_ids(s, p)?;
    // The image (inside a trace group, or selected directly).
    let (target, img) = {
@@ -848,10 +857,10 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
            // Gradients: a path the tracer found to be a linear gradient is filled with it.
            let paint = tp.gradient.as_ref().map_or_else(|| Paint::solid(color), |g| traced_gradient(g, xf));
            n.appearance = match tp.stroke {
-                // Traced lines: round ends and corners, as drawn lines have.
+                // Traced lines: round corners, and ends round or square as the tracer found them.
                Some(width) => Appearance {
                    items: vec![AppearanceItem::Stroke(StrokeLayer {
-                        cap: LineCap::Round,
+                        cap: if tp.square_caps { LineCap::Square } else { LineCap::Round },
                        join: LineJoin::Round,
                        ..StrokeLayer::new(paint, width * unit)
                    })],
@@ -259,16 +259,23 @@ fn undo_group_end(s: &mut Session, p: &Value) -> Result<Value> {
    ok()
 }

-fn undo(s: &mut Session, _: &Value) -> Result<Value> {
-    // What is still in progress (typing, a drag) is the step to undo: keep it first, so Undo takes
-    // back only that and Redo brings it back, instead of dropping it and undoing the step before.
-    // A typing session also ends in the Type tool, whose caret and marked text (IME) must follow
-    // the document.
+/// What is still in progress (typing, a drag) is a step of its own: keep it before the history
+/// moves, so Undo takes back only that and Redo brings it back, instead of dropping it and undoing
+/// the step before. As any new edit it ends the steps to redo, so Redo never swaps the document
+/// under an interaction that would then preview on, or cancel to, the document from before (#1719).
+/// A typing session also ends in the Type tool, whose caret and marked text (IME) must follow the
+/// document.
+pub(crate) fn settle_interaction(s: &mut Session) -> Result<()> {
    let typing = typing_in_progress(s);
    s.commit_interaction()?;
    if typing {
        s.set_tool_option("endTyping", &Value::Bool(true));
    }
+    Ok(())
+}
+
+fn undo(s: &mut Session, _: &Value) -> Result<Value> {
+    settle_interaction(s)?;
    let st = s.doc_mut()?;
    let e = st.history.undo.pop().ok_or_else(|| EngineError::Other("nothing to undo".into()))?;
    let label = e.label.clone();
@@ -286,6 +293,7 @@ fn undo(s: &mut Session, _: &Value) -> Result<Value> {
 }

 fn redo(s: &mut Session, _: &Value) -> Result<Value> {
+    settle_interaction(s)?;
    let st = s.doc_mut()?;
    let e = st.history.redo.pop().ok_or_else(|| EngineError::Other("nothing to redo".into()))?;
    let label = e.label.clone();
@@ -32,6 +32,7 @@ pub(super) fn import(name: &str, bytes: &[u8]) -> Result<Imported> {
        Ok(d) => {
            let mut b = Builder { doc: Document::new(0.0, 0.0), warnings: Vec::new(), k: 72.0 / d.dpi, layer: 0 };
            b.document(&d)?;
+            b.doc.limit_depth_noting(&mut b.warnings);
            let mut warnings = d.warnings.iter().map(|w| format!("Affinity: not imported or approximated: {w}.")).collect::<Vec<_>>();
            warnings.extend(b.warnings.iter().map(|w| format!("Affinity: {w}.")));
            Ok(Imported { doc: b.doc, warnings, preview_only: false })
@@ -13,14 +13,22 @@ pub(super) fn batch(s: &mut Session, p: &Value) -> Result<Value> {
    // What an error rolls back besides the documents: session-level state a step may change
    // (paint defaults, drawing mode, clipboard, the Untitled-N count).
    let saved = (s.paint.clone(), s.fill_active, s.draw_mode, s.draw_inside, s.clipboard.clone(), s.untitled_counter);
-    let (start, active): (Vec<u64>, _) = (s.docs.iter().map(|d| d.uid).collect(), s.active);
+    // A drag or typing still in progress is a step of its own, as before Undo: the batch's steps
+    // would otherwise run inside it and take its baseline as theirs (#1697).
+    if s.active().is_some() {
+        super::super::edit::settle_interaction(s)?;
+    }
+    // The documents as they are now, whole: what a failed step brings back. Their art, history,
+    // file, format and saved state share their data with the open ones until a step changes them.
+    let start = s.docs.clone();
+    let active = s.active;
    s.batch_stash = Some(vec![]);
    let r = run_steps(s, &label, artboard, &mut cmds);
    let stash = s.batch_stash.take().unwrap_or_default();
    let results = match r {
        Ok(results) => results,
        Err(e) => {
-            roll_back(s, &start, stash);
+            roll_back(s, start, &stash);
            s.active = active;
            (s.paint, s.fill_active, s.draw_mode, s.draw_inside, s.clipboard, s.untitled_counter) = saved;
            s.pending_paint = None;
@@ -81,22 +89,17 @@ fn run_steps(s: &mut Session, label: &str, artboard: Option<u64>, cmds: &mut [Va
    Ok(results)
 }

-/// The documents as they were before the batch (`start`: their uids in order): the ones it opened
-/// close, the ones it closed or replaced (`stash`) come back, and each one's interaction is undone.
-fn roll_back(s: &mut Session, start: &[u64], mut stash: Vec<DocState>) {
-    let mut open = std::mem::take(&mut s.docs);
-    for &uid in start {
-        // The newest revision the document reached, so the restored one redraws.
-        let newest = open.iter().chain(&stash).filter(|d| d.uid == uid).map(|d| d.revision).max().unwrap_or_default();
-        // Its state before the batch: the first one a step closed or replaced, else the open one.
-        let st = match stash.iter().position(|d| d.uid == uid) {
-            Some(i) => Some(stash.remove(i)),
-            None => open.iter().position(|d| d.uid == uid).map(|i| open.remove(i)),
-        };
-        if let Some(mut st) = st {
-            st.undo_interaction();
-            st.revision = newest.saturating_add(1);
-            s.docs.push(st);
-        }
+/// The documents as they were before the batch (`start`), whatever the steps did to them: opened
+/// ones close, closed or replaced ones (`stash`) come back, and each has its art, selection,
+/// history, file, format and saved state again (#1697: undoing the batch's interaction alone left
+/// a Save As step's new file and an Undo step's history in place). Files the steps wrote stay
+/// written.
+fn roll_back(s: &mut Session, start: Vec<DocState>, stash: &[DocState]) {
+    let open = std::mem::take(&mut s.docs);
+    s.docs = start;
+    for st in &mut s.docs {
+        // Past the newest revision the document reached, so the restored one redraws.
+        let newest = open.iter().chain(stash).filter(|d| d.uid == st.uid).map(|d| d.revision).max().unwrap_or(st.revision);
+        st.revision = newest.saturating_add(1);
    }
 }
@@ -139,7 +139,8 @@ fn restore_or_import(
 /// (with a warning for each that can't be used).
 pub(crate) fn native_file(bytes: &[u8]) -> Result<(Document, vectorcraft_format::FileInfo, Vec<String>)> {
    let f = vectorcraft_format::load_file(bytes).map_err(err)?;
-    let warnings = super::native::install_profiles(f.profiles);
+    let mut warnings = super::native::install_profiles(f.profiles);
+    warnings.extend(f.depth_notes);
    Ok((f.doc, f.info, warnings))
 }

@@ -272,12 +273,17 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
 /// own): rasters stay linked, SVG files become art, missing ones placeholders (see
 /// [`vectorcraft_svg::ImportOptions`]).
 pub(crate) fn import_svg(text: &str, folder: Option<&str>) -> Result<(Document, Vec<String>)> {
+    // The importer reads on a thread of its own (for its stack): what may be read is what may be
+    // read here.
+    let scope = crate::file_access::ScopeHandle::capture();
    let read = |path: &str| {
-        // Only files (not folders or devices) are read.
-        file_stamp(path)?;
-        let bytes = read_file(path).ok()?;
-        let link = crate::cmd::links::link_info(path, &bytes);
-        Some((bytes, link))
+        scope.clone().run(|| {
+            // Only files (not folders or devices) are read.
+            file_stamp(path)?;
+            let bytes = read_file(path).ok()?;
+            let link = crate::cmd::links::link_info(path, &bytes);
+            Some((bytes, link))
+        })
    };
    vectorcraft_svg::import_with(text, &vectorcraft_svg::ImportOptions { folder, read: Some(&read) }).map_err(err)
 }
@@ -418,7 +424,7 @@ pub(super) fn new_from_template(s: &mut Session, p: &Value) -> Result<Value> {
 /// The most memory decoding one image may take: a 60 in print sheet at 300 ppi (18000 × 6600 px)
 /// is ~475 MB as RGBA, past the decoder's 512 MB default once it is converted. The web app keeps
 /// that default: wasm32 has 4 GB to address and aborts when an allocation fails.
-pub(crate) const MAX_RASTER_ALLOC: u64 = if cfg!(target_arch = "wasm32") { 512 << 20 } else { 2 << 30 };
+pub(crate) use vectorcraft_doc::MAX_RASTER_ALLOC;

 /// What to say of encoded image `bytes` that need more than [`MAX_RASTER_ALLOC`] to decode (its
 /// header says so; the pixels aren't read): the renderer, which has the same allowance, draws
@@ -202,7 +202,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Set Bounds",
            [],
            None,
-            "{x?, y?, width?, height?, reference?: 0..8 (9-point grid), proportional?, strokes?, corners?, copy?: bool, patterns?: bool (Transform Patterns), typeAreas?: bool (area type: the frame is reshaped and the text reflows at its size), objects?: bool (Transform Objects, as object.move)} (Transform panel; width/height and the reference point follow the bounding box, rotated with rotated objects; x, y are page coordinates; with Use Preview Bounds the values measure the visual bounds; strokes/corners as object.scale)",
+            "{x?, y?, width?, height?, reference?: 0..8 (9-point grid), proportional?, strokes?, corners?, copy?: bool, patterns?: bool (Transform Patterns), typeAreas?: bool (area type: the frame is reshaped and the text reflows at its size), objects?: bool (Transform Objects, as object.move)} (Transform panel; width/height and the reference point follow the bounding box, rotated with rotated objects; x, y are page coordinates; with Use Preview Bounds the values measure the visual bounds; strokes/corners as object.scale; with anchor points selected (Direct Selection) and no copy, the values are the box around those points, square to the page, and only they move or scale, as with object.move (#1824))",
            has_selection,
            set_bounds
        ),
@@ -1400,6 +1400,13 @@ fn distribute_spacing(s: &mut Session, p: &Value) -> Result<Value> {

 fn set_bounds(s: &mut Session, p: &Value) -> Result<Value> {
    let ids = selected_roots(s)?;
+    let st = s.doc()?;
+    if transforms_objects(p)
+        && !bool_or(p, "copy", false)
+        && let Some(b) = st.selection.anchor_bounds(&st.doc, s.prefs.use_preview_bounds)
+    {
+        return set_anchor_bounds(s, p, ids, b);
+    }
    let d = &s.doc()?.doc;
    // Sizes are measured square to the bounding box, which a rotation turns with the objects:
    // the math below runs in its frame.
@@ -1419,15 +1426,7 @@ fn set_bounds(s: &mut Session, p: &Value) -> Result<Value> {
    let fixed = [all[0] - m[0], all[1] - m[1], all[2] - m[2], all[3] - m[3]];
    let refi = p.get("reference").and_then(Value::as_u64).unwrap_or(4) as usize;
    let rp = vectorcraft_geom::reference_point(v, refi);
-    let mut w = f64_or(p, "width", v.width());
-    let mut h = f64_or(p, "height", v.height());
-    if bool_or(p, "proportional", false) {
-        if p.get("width").is_some() && v.width() > 0.0 {
-            h = v.height() * w / v.width();
-        } else if p.get("height").is_some() && v.height() > 0.0 {
-            w = v.width() * h / v.height();
-        }
-    }
+    let (w, h) = wanted_size(p, v);
    // The geometric scale that gives the visual size: margins grow by the strokes' scale `f`. It is
    // exact for proportional scales of one path; [`Spans::refit`] checks it, and solves for the
    // scales where it misses.
@@ -1477,6 +1476,35 @@ fn set_bounds(s: &mut Session, p: &Value) -> Result<Value> {
    apply_transform(s, "Transform", ids, frame.conjugate(Affine::translate(to - new_rp) * scale), p, false)
 }

+/// The `width` and `height` `object.setBounds` asks for a box now `b`: the one not given stays, or
+/// with `proportional` follows the one given.
+fn wanted_size(p: &Value, b: Rect) -> (f64, f64) {
+    let mut w = f64_or(p, "width", b.width());
+    let mut h = f64_or(p, "height", b.height());
+    if bool_or(p, "proportional", false) {
+        if p.get("width").is_some() && b.width() > 0.0 {
+            h = b.height() * w / b.width();
+        } else if p.get("height").is_some() && b.height() > 0.0 {
+            w = b.width() * h / b.height();
+        }
+    }
+    (w, h)
+}
+
+/// `object.setBounds` with anchors selected with Direct Selection (#1824): the values are those of
+/// `b`, the box around the anchors (and the objects selected whole) square to the page, and only
+/// the anchors, their handles with them, and those objects move or scale.
+fn set_anchor_bounds(s: &mut Session, p: &Value, ids: Vec<NodeId>, b: Rect) -> Result<Value> {
+    let refi = p.get("reference").and_then(Value::as_u64).unwrap_or(4) as usize;
+    let rp = vectorcraft_geom::reference_point(b, refi);
+    let (w, h) = wanted_size(p, b);
+    // A single anchor, or anchors in a line, have no size to scale on that side.
+    let ratio = |size: f64, now: f64| if now > 1e-9 { size / now } else { 1.0 };
+    let scale = about(rp, Affine::scale_non_uniform(ratio(w, b.width()), ratio(h, b.height())));
+    let to = Point::new(f64_or(p, "x", rp.x), f64_or(p, "y", rp.y));
+    apply_transform(s, "Transform", ids, Affine::translate(to - rp) * scale, p, true)
+}
+
 /// The visual box of `ids` square to `frame`, as [`Document::oriented_bounds`] measures it, with
 /// symbol instances measured without the strokes in their art
 /// ([`vectorcraft_doc::SymbolBoxes::without_art_strokes`]).
@@ -583,6 +583,10 @@ pub(crate) fn is_guide_path(d: &Document, id: NodeId) -> bool {
    d.node(id).is_some_and(|n| matches!(n.kind, NodeKind::Path { guide: true, .. }))
 }

+/// The error of an edit that would nest objects deeper than [`vectorcraft_doc::MAX_DEPTH`].
+pub const TOO_DEEP: &str = "objects can't be nested more than 32 deep";
+const _: () = assert!(vectorcraft_doc::MAX_DEPTH == 32, "TOO_DEEP (and its catalog rows) names the cap");
+
 /// Cheap sanity check after an edit: artboards and the objects just touched (the selection) must
 /// have finite, in-range geometry, so saved files always reload and renderers never see NaN/∞.
 fn doc_sane(d: &Document, sel: &Selection) -> bool {
@@ -712,7 +716,7 @@ pub struct Prefs {
    pub canvas_color: String,
    pub auto_collapse_icon_panels: bool,
    /// User Interface › Show Tool Group Labels: the toolbar's group names (Select, Shapes, Draw…);
-    /// off, a faint dash separates the groups instead (#663).
+    /// off (as it ships, #1736), the tools run on from group to group with nothing between them.
    pub tool_group_labels: bool,
    pub open_documents_as_tabs: bool,
    pub large_tabs: bool,
@@ -938,7 +942,7 @@ impl Default for Prefs {
            ui_brightness: s("mediumDark"),
            canvas_color: s("matchUi"),
            auto_collapse_icon_panels: false,
-            tool_group_labels: true,
+            tool_group_labels: false,
            open_documents_as_tabs: true,
            large_tabs: false,
            ui_scaling: 1.0,
@@ -1225,26 +1229,24 @@ impl Session {
        format!("Untitled-{}", self.untitled_counter)
    }
    /// Text layout bounds are a cache (not saved): compute them for a document just read, or
-    /// selection boxes and hit testing would use the rough estimate until each text is edited.
+    /// selection boxes and hit testing would use the rough estimate until each text is edited, and
+    /// what is fitted to type's bounds (an envelope warping it) would come out differently. That
+    /// holds for the type in symbol definitions, pattern tiles, graph designs and opacity masks too,
+    /// not only in the layers (#1738).
    pub(crate) fn refresh_text_bounds(doc: &mut Document) {
        // Inline graphics in text take their size from their symbols' art (not saved either).
        doc.resolve_inline_art();
-        let mut texts = vec![];
-        doc.walk(|n| {
-            if matches!(n.kind, NodeKind::Text(_)) {
-                texts.push(n.id);
-            }
-        });
-        for id in texts {
-            if let Some(NodeKind::Text(t)) = doc.node_mut(id).map(|n| &mut n.kind)
-                && t.cached_bounds.is_none()
-            {
-                cmd::typecmd::refresh_bounds(t);
-            }
+        let trees = doc.layers.iter_mut().chain(doc.symbols.iter_mut().map(|s| &mut s.art));
+        let trees = trees.chain(doc.graph_designs.iter_mut().map(|g| &mut g.art));
+        for tree in trees.chain(doc.patterns.iter_mut().flat_map(|p| p.art.iter_mut())) {
+            refresh_tree_text_bounds(tree);
        }
    }
    /// Add a document and make it active.
    pub fn add_document(&mut self, mut doc: Document, path: Option<String>) -> usize {
+        // Every edit is checked against the document before it, so the first one is within the cap
+        // (importers and the native reader have seen to theirs already, with a warning).
+        doc.limit_depth();
        Self::refresh_text_bounds(&mut doc);
        // Guides from files saved before guides had layers go on a layer.
        doc.adopt_guides();
@@ -1262,6 +1264,7 @@ impl Session {
        if index >= self.docs.len() {
            return false;
        }
+        doc.limit_depth();
        Self::refresh_text_bounds(&mut doc);
        doc.adopt_guides();
        if self.active == Some(index) {
@@ -1476,7 +1479,10 @@ impl Session {
                    if !st.doc.variables.bindings.is_empty() {
                        Arc::make_mut(&mut st.doc).prune_variable_bindings();
                    }
-                    if doc_sane(&st.doc, &st.selection) {
+                    if st.doc.too_deep(Some(&before)) {
+                        // Deeper trees overflow the stack of what walks them.
+                        Err(EngineError::Other(TOO_DEEP.into()))
+                    } else if doc_sane(&st.doc, &st.selection) {
                        Ok(v)
                    } else {
                        Err(EngineError::Other("result would exceed the canvas (coordinates out of range)".into()))
@@ -1693,6 +1699,31 @@ impl Session {
    }
 }

+/// Lay out the type in tree `n` (opacity mask art included) whose bounds aren't cached. Only the
+/// nodes on the way to such type are copied.
+fn refresh_tree_text_bounds(n: &mut Arc<vectorcraft_doc::Node>) {
+    fn stale(n: &vectorcraft_doc::Node) -> bool {
+        matches!(&n.kind, NodeKind::Text(t) if t.cached_bounds.is_none())
+            || n.extras().mask.as_deref().is_some_and(|m| stale(&m.art))
+            || n.children().is_some_and(|ch| ch.iter().any(|c| stale(c)))
+    }
+    if !stale(n) {
+        return;
+    }
+    let n = Arc::make_mut(n);
+    if let NodeKind::Text(t) = &mut n.kind
+        && t.cached_bounds.is_none()
+    {
+        cmd::typecmd::refresh_bounds(t);
+    }
+    if let Some(m) = n.extras_if_any().and_then(|e| e.mask.as_deref_mut()) {
+        refresh_tree_text_bounds(&mut m.art);
+    }
+    for c in n.children_mut().into_iter().flatten() {
+        refresh_tree_text_bounds(c);
+    }
+}
+
 #[cfg(test)]
 mod tests;
 #[cfg(test)]
@@ -821,6 +821,32 @@ fn transforms_act_on_direct_selected_anchors() {
    assert_eq!(points(&s), [(25.0, 0.0), (75.0, 0.0), (100.0, 100.0), (0.0, 100.0)]);
 }

+/// #1824: with anchors selected with Direct Selection, the Transform panel's X/Y/W/H
+/// (`object.setBounds`) are the box around those anchors, and only they move or scale.
+#[test]
+fn set_bounds_acts_on_direct_selected_anchors() {
+    let mut s = session();
+    let square = json!({"anchors": [{"x": 0, "y": 0}, {"x": 100, "y": 0}, {"x": 100, "y": 100}, {"x": 0, "y": 100}], "closed": true});
+    let id = NodeId(s.execute("path.create", &square).unwrap()["id"].as_u64().unwrap());
+    let points = |s: &Session| -> Vec<(f64, f64)> {
+        let NodeKind::Path { path, .. } = &s.doc().unwrap().doc.node(id).unwrap().kind else { panic!("a path") };
+        path.subpaths[0].anchors.iter().map(|a| (a.p.x.round(), a.p.y.round())).collect()
+    };
+    s.execute("select.anchors", &json!({"id": id.0, "anchors": [[0, 1]]})).unwrap();
+    s.execute("object.setBounds", &json!({"x": 130, "reference": 0})).unwrap();
+    assert_eq!(points(&s), [(0.0, 0.0), (130.0, 0.0), (100.0, 100.0), (0.0, 100.0)], "only the selected anchor moves");
+    s.execute("object.setBounds", &json!({"y": 20, "reference": 4})).unwrap();
+    assert_eq!(points(&s), [(0.0, 0.0), (130.0, 20.0), (100.0, 100.0), (0.0, 100.0)]);
+    // Two anchors: W scales their box about the reference point, the others stay.
+    s.execute("select.anchors", &json!({"id": id.0, "anchors": [[0, 2], [0, 3]]})).unwrap();
+    s.execute("object.setBounds", &json!({"width": 50, "reference": 3})).unwrap();
+    assert_eq!(points(&s), [(0.0, 0.0), (130.0, 20.0), (50.0, 100.0), (0.0, 100.0)]);
+    // The path selected whole moves as a whole.
+    s.execute("select.set", &json!({"ids": [id.0]})).unwrap();
+    s.execute("object.setBounds", &json!({"x": 10, "reference": 0})).unwrap();
+    assert_eq!(points(&s), [(10.0, 0.0), (140.0, 20.0), (60.0, 100.0), (10.0, 100.0)]);
+}
+
 /// Arrange commands that leave the stacking order as it is record no undo step: Bring to Front and
 /// Bring Forward on the front objects, Send to Back and Send Backward on the back ones, and Send to
 /// Current Layer on objects already on top of the current layer.
@@ -1480,6 +1506,26 @@ fn direct_selection_moves_one_anchor() {
    assert_eq!(p.subpaths[0].anchors[1].p, vectorcraft_geom::Point::new(200.0, 100.0));
 }

+/// #1816: with Snap to Grid on, a dragged anchor lands on the grid's subdivisions, not on whole
+/// points, even with Snap to Pixel left on too.
+#[test]
+fn direct_selection_snaps_anchors_to_the_grid() {
+    let mut s = session();
+    let a = rect(&mut s, 101.0, 101.0, 100.0, 100.0);
+    s.execute("select.none", &json!({})).unwrap();
+    let step = s.doc().unwrap().doc.grid.spacing / f64::from(s.doc().unwrap().doc.grid.subdivisions.max(1));
+    let on_grid = |v: f64| (v / step - (v / step).round()).abs() < 1e-9;
+    let v = ViewInfo { snap_to_grid: true, snap_to_pixel: true, ..ViewInfo::default() };
+    s.select_tool("directSelection", v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Down, 101.0, 101.0), v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Drag, 131.0, 113.0), v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Up, 131.0, 113.0), v).unwrap();
+    let p = s.doc().unwrap().doc.node(a).unwrap().path_data().unwrap().clone();
+    let moved = p.subpaths[0].anchors[0].p;
+    assert!(on_grid(moved.x) && on_grid(moved.y), "anchor at {moved:?}, grid step {step}");
+    assert_eq!(p.subpaths[0].anchors[1].p, vectorcraft_geom::Point::new(201.0, 101.0));
+}
+
 /// Follow-up to #1254: toggling or adding anchors of a path selected as a whole starts from all
 /// its anchors, so toggling one deselects it alone and adding one keeps them all.
 #[test]
@@ -737,6 +737,18 @@ fn image_trace_auto_grouping_groups_what_is_inside() {
        (0..120).flat_map(|x| (0..80).map(move |y| (x, y))).map(|(x, y)| img.pixel(x, y)).collect::<Vec<_>>()
    };
    assert_eq!(shot(&s), shot(&flat));
+    // In black and white too, where the white inside the ring is a path traced before the ring:
+    // it stays under the ring in their group (over it, the ring's inner edge would show a seam).
+    let bw = |grouping: bool| {
+        let mut s = session();
+        add_image(&mut s, &art, Affine::IDENTITY);
+        let r = s.execute("imageTrace.make", &json!({"params": {"autoGrouping": grouping}})).unwrap();
+        let groups = traced_paths(&node(&s, NodeId(r["id"].as_u64().unwrap()))).iter().filter(|n| matches!(n.kind, NodeKind::Group { .. })).count();
+        (s, groups)
+    };
+    let (grouped, flat) = (bw(true), bw(false));
+    assert!(grouped.1 > 0 && flat.1 == 0);
+    assert_eq!(shot(&grouped.0), shot(&flat.0));
    // Traced again without the option, it is flat again; expanded, the groups stay.
    let r = s.execute("imageTrace.make", &json!({"preset": "6 Colors", "params": {"ignoreWhite": true}})).unwrap();
    assert_eq!(traced_paths(&node(&s, NodeId(r["id"].as_u64().unwrap()))).len(), 3);
@@ -773,6 +785,29 @@ fn image_trace_gradients_fills_with_a_gradient() {
    assert!(flat.len() > 1 && flat.iter().all(|n| matches!(n.appearance.fill_paint(), Paint::Solid { .. })));
 }

+/// A preset's enhanced version: the preset with Auto Grouping and Shapes, under the preset's name.
+#[test]
+fn image_trace_enhanced_presets() {
+    let mut s = session();
+    image_doc(&mut s);
+    let r = s.execute("imageTrace.make", &json!({"preset": "6 Colors", "enhanced": true})).unwrap();
+    let n = node(&s, NodeId(r["id"].as_u64().unwrap()));
+    let stored = n.extras().trace.clone().unwrap();
+    assert_eq!(stored["preset"], "6 Colors");
+    assert_eq!((stored["params"]["shapes"].as_bool(), stored["params"]["autoGrouping"].as_bool()), (Some(true), Some(true)));
+    // The disc of the test image is a live ellipse, in a group with nothing (it has nothing inside).
+    let shapes: Vec<_> = traced_paths(&n).into_iter().filter(|c| matches!(&c.kind, NodeKind::Path { live: Some(_), .. })).collect();
+    assert_eq!(shapes.len(), 1);
+    // Listed with each preset; the legacy preset is as it was.
+    let list = s.execute("imageTrace.presets", &json!({})).unwrap();
+    let six = list["presets"].as_array().unwrap().iter().find(|p| p["name"] == "6 Colors").unwrap().clone();
+    assert_eq!((six["params"]["shapes"].as_bool(), six["enhanced"]["shapes"].as_bool()), (Some(false), Some(true)));
+    assert_eq!(list["presets"].as_array().unwrap().iter().find(|p| p["name"] == "High Fidelity Photo").unwrap()["enhanced"]["shapes"], false);
+    assert!(s.execute("imageTrace.make", &json!({"preset": "No Such", "enhanced": true})).is_err());
+    // Flat Logo, a preset of our own, has no enhanced version.
+    assert!(list["presets"].as_array().unwrap().iter().find(|p| p["name"] == "Flat Logo").unwrap()["enhanced"].is_null());
+}
+
 #[test]
 fn image_trace_release_and_expand() {
    let mut s = session();
@@ -874,7 +909,8 @@ fn image_trace_create_strokes_makes_stroked_centre_lines() {
    assert!(line.appearance.fill_paint().color().is_none(), "not filled");
    let st = line.appearance.items.iter().find_map(|i| if let AppearanceItem::Stroke(st) = i { Some(st) } else { None }).expect("stroked");
    assert!((st.width - 6.0).abs() < 1.0, "3 px at 2× is about 6 pt: {}", st.width);
-    assert_eq!((st.cap, st.join), (LineCap::Round, LineJoin::Round));
+    // (The line is cut square at its ends, and so is its stroke.)
+    assert_eq!((st.cap, st.join), (LineCap::Square, LineJoin::Round));
    assert_eq!(st.paint, Paint::solid(Color::rgb8(0, 0, 0)));
    let sp = &line.path_data().unwrap().subpaths[0];
    assert!(!sp.closed);
@@ -288,3 +288,35 @@ fn enveloped_type_keeps_each_runs_colour_on_the_canvas() {
    }
    assert!(red > 100 && black > 100, "{red} red, {black} black");
 }
+
+/// #1738: type warped by an envelope inside a symbol looks the same after a native save and
+/// reopen: the type in symbol definitions gets its layout bounds back (they aren't saved), so the
+/// envelope is fitted to the same box as before.
+#[test]
+fn warped_type_in_a_symbol_reopens_unchanged() {
+    let mut s = session();
+    s.execute("text.create", &json!({"x": 30, "y": 160, "text": "STUDIO", "size": 72, "color": "#E3AB49"})).unwrap();
+    s.execute("object.envelope.makeWithWarp", &json!({"style": "wave", "bend": 18})).unwrap();
+    s.execute("symbol.new", &json!({"name": "Master"})).unwrap();
+    let render = |s: &Session| vectorcraft_render::Renderer::new().render(&s.doc().unwrap().doc, 400, 300, Affine::IDENTITY, &Default::default());
+    let before = render(&s);
+    let dir = std::env::temp_dir().join(format!("vectorcraft-1738-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("warped.vectorcraft");
+    s.execute("document.save", &json!({"path": path})).unwrap();
+    let mut o = Session::new();
+    o.execute("document.open", &json!({"path": path})).unwrap();
+    let _ = std::fs::remove_dir_all(&dir);
+    let d = &o.doc().unwrap().doc;
+    let mut texts = 0;
+    d.symbols[0].art.walk(&mut |n| {
+        if let NodeKind::Text(t) = &n.kind {
+            texts += 1;
+            assert!(t.cached_bounds.is_some(), "the symbol's type has no layout bounds after reopening");
+        }
+    });
+    assert_eq!(texts, 1);
+    let after = render(&o);
+    let differ = (0..300).flat_map(|y| (0..400).map(move |x| (x, y))).filter(|&(x, y)| before.pixel(x, y) != after.pixel(x, y)).count();
+    assert_eq!(differ, 0, "{differ} pixels changed on reopening");
+}
@@ -153,3 +153,29 @@ fn undo_and_redo_reuse_the_estimates() {
    let delete = st.history.undo.last().unwrap();
    assert_eq!(delete.bytes, fresh(delete, &st.doc));
 }
+
+/// #1719: Redo while a drag is in progress keeps the drag as a step (which ends the steps to redo,
+/// as any new edit does) instead of swapping the document under it: before, the next preview or a
+/// cancel went back to the document from before the redo while the history said it was redone.
+#[test]
+fn redo_during_an_interaction_keeps_the_history_and_the_document_in_step() {
+    let mut s = session_with_rects(1);
+    s.execute("object.move", &json!({"dx": 10, "dy": 0})).unwrap();
+    let moved = first_x(&s);
+    s.execute("edit.undo", &json!({})).unwrap();
+    let start = first_x(&s);
+    // A drag that changed nothing yet is no step: Redo redoes, and a cancel has nothing to undo.
+    s.begin_interaction("Move").unwrap();
+    s.execute("edit.redo", &json!({})).unwrap();
+    s.cancel_interaction().unwrap();
+    assert_eq!(first_x(&s), moved, "the redone move stays");
+    s.execute("edit.undo", &json!({})).unwrap();
+    // A drag that moved the art is the newest step: nothing is left to redo, and nothing is lost.
+    s.begin_interaction("Move").unwrap();
+    s.preview("object.move", &json!({"dx": 3, "dy": 0})).unwrap();
+    assert!(s.execute("edit.redo", &json!({})).is_err(), "the drag ended the steps to redo");
+    assert!(!s.in_interaction());
+    assert_eq!(first_x(&s), start + 3.0);
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(first_x(&s), start);
+}
@@ -314,6 +314,32 @@ fn a_copy_stays_inside_the_write_root() {
    let _ = std::fs::remove_dir_all(&root);
 }

+/// An SVG's linked files are read on the importer's own thread (it needs a deep stack): the roots
+/// in force on the thread that opens the SVG hold there too.
+#[test]
+fn an_svg_reads_its_links_within_the_read_root() {
+    let root = folder("svg-roots");
+    for dir in ["in", "out"] {
+        write(&root.join(dir).join("dot.png"), &png(4, 4, RED));
+    }
+    // What came of an SVG linking to the picture in `dir`: the pictures read, and the warnings.
+    let import = |dir: &str| {
+        let href = root.join(dir).join("dot.png").to_string_lossy().replace('\\', "/");
+        let svg =
+            format!("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"10\" height=\"10\"><image width=\"4\" height=\"4\" href=\"{href}\"/></svg>");
+        let (doc, warnings) = crate::cmd::fileio::import_svg(&svg, None).unwrap();
+        (doc.images.len(), warnings)
+    };
+    let (inside, outside) = (import("in"), import("out"));
+    assert_eq!(inside, outside, "both are read with no roots in force");
+    let roots = crate::file_access::AutomationRoots::new(Some(&root.join("in")), None).unwrap();
+    crate::file_access::confine(roots.as_ref(), || {
+        assert_eq!(import("in"), inside, "inside the read root: read as before");
+        assert_ne!(import("out"), outside, "outside the read root: not read");
+    });
+    let _ = std::fs::remove_dir_all(&root);
+}
+
 #[test]
 fn junk_search_params_never_fail_internally() {
    let root = folder("junk");
@@ -353,3 +353,33 @@ fn a_group_from_a_mesh_holds_its_point_colours() {
    let names = r["swatches"].as_array().unwrap();
    assert!(names.contains(&json!("R=255 G=0 B=0")) && names.contains(&json!("R=255 G=255 B=255")), "{r}");
 }
+
+/// #1735: a global swatch edit reaches opacity-mask art: the mask's colour (and with it what the
+/// mask shows) follows the swatch, and a swatch used only in a mask isn't "unused".
+#[test]
+fn global_swatch_edits_reach_opacity_mask_art() {
+    let mut s = session();
+    run(&mut s, "swatch.new", json!({"name": "MaskTone", "color": "#ffffff", "global": true}));
+    let obj = rect(&mut s);
+    run(&mut s, "paint.setFill", json!({"color": "#ff0000", "ids": [obj.0]}));
+    let m = rect(&mut s);
+    run(&mut s, "paint.setFill", json!({"swatch": "MaskTone", "ids": [m.0]}));
+    run(&mut s, "select.set", json!({"ids": [obj.0, m.0]}));
+    run(&mut s, "transparency.makeOpacityMask", json!({"clip": true, "invert": false}));
+    let mask_fill = |s: &Session| {
+        let n = doc(s).node(obj).unwrap();
+        n.extras().mask.as_deref().unwrap().art.appearance.fill_paint()
+    };
+    assert_eq!(mask_fill(&s).color(), Some(Color::rgb(1.0, 1.0, 1.0)));
+    assert!(!run(&mut s, "swatch.unused", json!({}))["names"].as_array().unwrap().iter().any(|n| n == "MaskTone"), "used by the mask");
+
+    let r = run(&mut s, "swatch.edit", json!({"name": "MaskTone", "color": "#000000"}));
+    assert_eq!(r["relinked"], 1, "{r}");
+    let fill = mask_fill(&s);
+    assert_eq!(fill.color(), Some(Color::rgb(0.0, 0.0, 0.0)));
+    assert!(matches!(&fill, Paint::Solid { swatch: Some(n), .. } if n == "MaskTone"), "{fill:?}");
+
+    // Undo brings the mask's colour back with the swatch.
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(mask_fill(&s).color(), Some(Color::rgb(1.0, 1.0, 1.0)));
+}
@@ -188,7 +188,9 @@ impl Session {
            guides: view.guides && !self.menu.guides_locked,
            snap_to_grid: view.snap_to_grid,
            show_bbox: view.show_bbox,
-            snap_to_pixel: view.snap_to_pixel,
+            // Snap to Grid and Snap to Pixel are exclusive, as in Illustrator; left both on, the grid
+            // wins instead of pixels quietly rounding every drag to whole points (#1816).
+            snap_to_pixel: view.snap_to_pixel && !view.snap_to_grid,
            snap_to_point: view.snap_to_point,
            corner_widgets: view.corner_widgets,
            fill_active: self.fill_active,
@@ -538,17 +538,29 @@ proptest! {
 // ---------- PDF ----------

 fn handmade_pdf(content: &str, resources: &str, media: &str) -> Vec<u8> {
-    let objs = [
+    handmade_pdf_with(content, resources, media, &[])
+}
+
+/// The same, followed by the objects `more` (numbered from 5).
+fn handmade_pdf_with(content: &str, resources: &str, media: &str, more: &[Vec<u8>]) -> Vec<u8> {
+    let page = [
        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
        format!("<< /Type /Page /Parent 2 0 R /MediaBox {media} /Contents 4 0 R /Resources {resources} >>"),
        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len() + 1),
    ];
+    pdf_of(&page.into_iter().map(String::into_bytes).chain(more.iter().cloned()).collect::<Vec<_>>())
+}
+
+/// The PDF of the objects `objs` (numbered from 1, the catalog first).
+fn pdf_of(objs: &[Vec<u8>]) -> Vec<u8> {
    let mut out = b"%PDF-1.7\n".to_vec();
    let mut offsets = vec![];
    for (i, o) in objs.iter().enumerate() {
        offsets.push(out.len());
-        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
    }
    let xref = out.len();
    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
@@ -2157,10 +2169,15 @@ fn arb_ai_token() -> impl Strategy<Value = String> {

 /// The testkit's sample editing data, compressed as older `.ai` files compress it.
 fn ai_sample_compressed() -> Vec<u8> {
+    [&b"%AI12_CompressedData"[..], &deflated(&vectorcraft_testkit::ai::sample_data())].concat()
+}
+
+/// `data` compressed (zlib).
+fn deflated(data: &[u8]) -> Vec<u8> {
    use std::io::Write as _;
    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
-    e.write_all(&vectorcraft_testkit::ai::sample_data()).unwrap();
-    [&b"%AI12_CompressedData"[..], &e.finish().unwrap()].concat()
+    e.write_all(data).unwrap();
+    e.finish().unwrap()
 }

 proptest! {
@@ -2440,3 +2457,620 @@ proptest! {
        checked("mutated script", json!({"dataBase64": vectorcraft_format::base64_encode(&bytes), "name": "sample.jsx"}))?;
    }
 }
+
+// ---------- deep nesting ----------
+//
+// The tree is walked by recursion, so a file nested deeply enough overflowed the stack: an abort,
+// which nothing catches. Every reader caps what it reads, and no document is deeper than
+// `MAX_DEPTH`. These run on a thread with the stack of a Windows main thread (1 MB), where an
+// overflow ends the test run.
+
+use vectorcraft_doc::MAX_DEPTH;
+
+/// `f` on a thread with a 1 MB stack.
+fn on_a_small_stack(f: impl FnOnce() + Send + 'static) {
+    std::thread::Builder::new().stack_size(1 << 20).spawn(f).unwrap().join().unwrap();
+}
+
+/// Open `bytes` as the file `name`: an error, or a document within the cap that renders and
+/// exports. Returns the document and the import's warnings.
+fn open_deep(name: &str, bytes: &[u8]) -> Option<(Document, Vec<String>)> {
+    let loaded = vectorcraft_engine::cmd::fileio::load(name, bytes).ok()?;
+    assert!(!loaded.doc.too_deep(None), "{name}: deeper than the cap");
+    let doc = loaded.doc.clone();
+    survive(name, move || Some(doc)).unwrap();
+    Some((loaded.doc, loaded.warnings))
+}
+
+fn merged(warnings: &[String]) -> bool {
+    warnings.iter().any(|w| w.contains("nested more than"))
+}
+
+fn paths_in(doc: &Document) -> usize {
+    let mut paths = 0;
+    doc.walk(|n| paths += usize::from(n.path_data().is_some()));
+    paths
+}
+
+const SVG_NS: &str = "xmlns=\"http://www.w3.org/2000/svg\"";
+
+/// `n` groups in one another, each named (so it is kept) and with a rectangle beside the next.
+fn nested_svg(n: usize) -> String {
+    let open: String = (0..n).map(|i| format!("<g id=\"g{i}\"><rect width=\"5\" height=\"5\"/>")).collect();
+    format!("<svg {SVG_NS} width=\"100\" height=\"100\">{open}<rect width=\"10\" height=\"10\"/>{}</svg>", "</g>".repeat(n))
+}
+
+#[test]
+fn deeply_nested_svg_is_refused_or_merged() {
+    on_a_small_stack(|| {
+        // Within what the reader takes: opened, the groups past the cap merged into the last.
+        let (doc, warnings) = open_deep("deep.svg", nested_svg(40).as_bytes()).expect("40 groups open");
+        assert!(merged(&warnings), "{warnings:?}");
+        assert_eq!(paths_in(&doc), 41, "no art is lost");
+        let (_, warnings) = open_deep("shallow.svg", nested_svg(20).as_bytes()).expect("20 groups open");
+        assert!(!merged(&warnings), "{warnings:?}");
+        // As deep as the reader goes (on a stack of its own): opened and merged the same.
+        let most = vectorcraft_svg::MAX_ELEMENT_DEPTH;
+        let (doc, warnings) = open_deep("deepest.svg", nested_svg(most - 2).as_bytes()).expect("opens at the reader's cap");
+        assert!(merged(&warnings), "{warnings:?}");
+        assert_eq!(paths_in(&doc), most - 1, "no art is lost");
+        // Past it: an error that says why, whatever the depth.
+        for n in [most, 2 * most, 200_000] {
+            let e = vectorcraft_engine::cmd::fileio::load("deep.svg", nested_svg(n).as_bytes()).err().expect("refused").to_string();
+            assert!(e.contains(&format!("nested more than {most} deep")), "{n}: {e}");
+        }
+        // Unnamed groups of one object aren't kept, but usvg walks them all the same.
+        let plain = format!(
+            "<svg {SVG_NS} width=\"9\" height=\"9\">{}<rect width=\"1\" height=\"1\"/>{}</svg>",
+            "<g>".repeat(2 * most),
+            "</g>".repeat(2 * most)
+        );
+        assert!(open_deep("plain.svg", plain.as_bytes()).is_none());
+        // A chain of `<use>`: shallow XML, a deep tree.
+        let links: String = (0..3000).map(|i| format!("<g id=\"u{i}\"><use href=\"#u{}\"/></g>", i + 1)).collect();
+        let chain = format!(
+            "<svg {SVG_NS} width=\"9\" height=\"9\"><defs>{links}<rect id=\"u3000\" width=\"1\" height=\"1\"/></defs><use href=\"#u0\"/></svg>"
+        );
+        assert!(open_deep("chain.svg", chain.as_bytes()).is_none());
+        // Placed and pasted, as opened.
+        let mut s = vectorcraft_engine::Session::new();
+        s.execute("file.new", &json!({"width": 300, "height": 200})).unwrap();
+        for n in [40, 2 * most] {
+            let p = json!({"name": "deep.svg", "dataBase64": vectorcraft_format::base64_encode(nested_svg(n).as_bytes())});
+            let _ = no_panic(s.execute("file.place", &p));
+            let _ = no_panic(s.execute("clipboard.importSvg", &json!({"svg": nested_svg(n)})));
+            let _ = no_panic(s.execute("edit.paste", &json!({})));
+            assert!(!s.doc().unwrap().doc.too_deep(None));
+        }
+    });
+}
+
+/// A page whose content is `content`, with `resources`.
+fn deep_pdf(content: &str, resources: &str) -> Vec<u8> {
+    handmade_pdf(content, resources, "[0 0 100 100]")
+}
+
+/// A stream object with the entries `dict`, its `data` compressed.
+fn packed(dict: &str, data: &str) -> Vec<u8> {
+    let z = deflated(data.as_bytes());
+    // (A length the test gives stands.)
+    let length = if dict.contains("/Length") { String::new() } else { format!(" /Length {}", z.len()) };
+    [format!("<< {dict} /Filter /FlateDecode{length} >>\nstream\n").as_bytes(), &z, b"\nendstream"].concat()
+}
+
+/// A page whose content is `content`, with `resources` and the objects `more` (numbered from 5).
+fn pdf_with(content: &str, resources: &str, more: &[Vec<u8>]) -> Vec<u8> {
+    handmade_pdf_with(content, resources, "[0 0 100 100]", more)
+}
+
+/// Arrays in arrays, and dictionaries in dictionaries, far deeper than any reader goes: as the
+/// operands of content.
+fn nested_operands() -> [String; 2] {
+    let (n, d) = (100_000, 50_000);
+    [format!("BT {}{} TJ ET 0 0 5 5 re f", "[".repeat(n), "]".repeat(n)), format!("/P {}{} DP 0 0 5 5 re f", "<< /A ".repeat(d), ">> ".repeat(d))]
+}
+
+/// A page drawing through the compressed stream that `container` makes of each of
+/// [`nested_operands`] (object 5), one file each.
+fn nested_in(content: &str, resources: &str, container: impl Fn(&str) -> Vec<Vec<u8>>) -> Vec<Vec<u8>> {
+    nested_operands().iter().map(|deep| pdf_with(content, resources, &container(deep))).collect()
+}
+
+const FORM: &str = "/Type /XObject /Subtype /Form /BBox [0 0 100 100]";
+
+/// A Type 3 font (object 5) whose glyph `a` is object 6.
+fn type3_font(resources: &str) -> Vec<u8> {
+    format!(
+        "<< /Type /Font /Subtype /Type3 /FontBBox [0 0 10 10] /FontMatrix [0.1 0 0 0.1 0 0] /CharProcs << /a 6 0 R >> \
+         /Encoding << /Type /Encoding /Differences [97 /a] >> /FirstChar 97 /LastChar 97 /Widths [10] /Resources {resources} >>"
+    )
+    .into_bytes()
+}
+
+/// A page whose box is object 6, kept with object 7 (a number) in a compressed object stream
+/// (object 5, with the entries `stream`): a file with a cross-reference stream, as it must be.
+fn pdf_with_object_stream(boxed: &str, stream: &str) -> Vec<u8> {
+    let content = "0 0 5 5 re f";
+    let inside = format!("{boxed} 77");
+    let index = format!("6 0 7 {} ", boxed.len() + 1);
+    let objs = [
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox 6 0 R /Contents 4 0 R /Resources << >> >>".to_vec(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len() + 1).into_bytes(),
+        packed(&format!("/Type /ObjStm /N 2 /First {} {stream}", index.len()), &format!("{index}{inside}")),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    // One entry an object: its kind, then where it is (an offset, or the stream it is in and its
+    // place there).
+    let mut entries = vec![[0u8, 0, 0, 0, 0, 255, 255]];
+    let at = |kind: u8, a: usize, b: u16| {
+        let (a, b) = ((a as u32).to_be_bytes(), b.to_be_bytes());
+        [kind, a[0], a[1], a[2], a[3], b[0], b[1]]
+    };
+    for (i, o) in objs.iter().enumerate() {
+        entries.push(at(1, out.len(), 0));
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    entries.extend([at(2, 5, 0), at(2, 5, 1), at(1, out.len(), 0)]);
+    let xref = out.len();
+    out.extend_from_slice(format!("8 0 obj\n<< /Type /XRef /Size 9 /Root 1 0 R /W [1 4 2] /Length {} >>\nstream\n", entries.len() * 7).as_bytes());
+    out.extend_from_slice(&entries.concat());
+    out.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+    out
+}
+
+/// `n` objects from object 5 on, each made by `link` of the number of the next, then `last`.
+fn chain(n: usize, link: impl Fn(usize) -> String, last: &str) -> Vec<Vec<u8>> {
+    (0..n).map(|i| link(i + 6).into_bytes()).chain([last.as_bytes().to_vec()]).collect()
+}
+
+/// A page painting with the shading whose function is object 5.
+fn pdf_with_function(more: &[Vec<u8>]) -> Vec<u8> {
+    let shading = "/Shading << /S << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Function 5 0 R >> >>";
+    pdf_with("/S sh", &format!("<< {shading} >>"), more)
+}
+
+/// A page filling in the colour space that is object 5.
+fn pdf_with_color_space(more: &[Vec<u8>]) -> Vec<u8> {
+    pdf_with("/C cs 0 sc 0 0 5 5 re f /C CS 0 SC 0 0 5 5 re S", "<< /ColorSpace << /C 5 0 R >> >>", more)
+}
+
+/// Every hostile PDF here opens as an error or as a document within the cap, on a small stack.
+fn open_each(name: &str, files: impl IntoIterator<Item = Vec<u8>> + Send + 'static) {
+    let name = name.to_string();
+    on_a_small_stack(move || {
+        for (i, bytes) in files.into_iter().enumerate() {
+            open_deep(&format!("{name}-{i}.pdf"), &bytes);
+            // As `.ai` (the PDF part of one) and placed, too.
+            open_deep(&format!("{name}-{i}.ai"), &bytes);
+            let mut s = vectorcraft_engine::Session::new();
+            s.execute("file.new", &json!({"width": 300, "height": 200})).unwrap();
+            let _ = no_panic(s.execute("file.place", &json!({"name": "deep.pdf", "dataBase64": vectorcraft_format::base64_encode(&bytes)})));
+            assert!(!s.doc().unwrap().doc.too_deep(None));
+        }
+    });
+}
+
+// Nesting where only the reader of the decoded data sees it: inside each kind of compressed
+// stream a page draws through.
+
+#[test]
+fn pdf_nesting_inside_a_compressed_form() {
+    open_each("form", nested_in("/F Do", "<< /XObject << /F 5 0 R >> >>", |deep| vec![packed(FORM, deep)]));
+}
+
+#[test]
+fn pdf_nesting_inside_a_compressed_pattern() {
+    let tile = "/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >>";
+    open_each("pattern", nested_in("/Pattern cs /P scn 0 0 50 50 re f", "<< /Pattern << /P 5 0 R >> >>", |deep| vec![packed(tile, deep)]));
+}
+
+#[test]
+fn pdf_nesting_inside_a_compressed_glyph() {
+    let glyph = |deep: &str| vec![type3_font("<< >>"), packed("", &format!("10 0 d0 {deep}"))];
+    open_each("glyph", nested_in("BT /F1 12 Tf 10 10 Td (aa) Tj ET", "<< /Font << /F1 5 0 R >> >>", glyph));
+}
+
+#[test]
+fn pdf_nesting_inside_a_compressed_soft_mask() {
+    let group = format!("{FORM} /Group << /S /Transparency /CS /DeviceGray >>");
+    let state = "<< /ExtGState << /G << /Type /ExtGState /SMask << /S /Luminosity /G 5 0 R >> >> >> >>";
+    open_each("mask", nested_in("/G gs 0 0 50 50 re f", state, move |deep| vec![packed(&group, deep)]));
+}
+
+#[test]
+fn pdf_nesting_inside_a_compressed_annotation() {
+    let annots = "<< >> /Annots [<< /Type /Annot /Subtype /Square /Rect [0 0 50 50] /AP << /N 5 0 R >> >>]";
+    open_each("annotation", nested_in("0 0 5 5 re f", annots, |deep| vec![packed(FORM, deep)]));
+}
+
+#[test]
+fn pdf_nesting_inside_compressed_page_content() {
+    let files = nested_operands().map(|deep| {
+        let mut objs: Vec<Vec<u8>> = ["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 >>"].map(Vec::from).into();
+        objs.push(b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents [4 0 R 4 0 R] /Resources << >> >>".to_vec());
+        objs.push(packed("", &deep));
+        pdf_of(&objs)
+    });
+    open_each("content", files);
+}
+
+#[test]
+fn pdf_nesting_inside_an_object_stream() {
+    let (n, d) = (100_000, 50_000);
+    open_each(
+        "objects",
+        [
+            // A plain one first: the file is read as it should be.
+            pdf_with_object_stream("[0 0 100 100]", ""),
+            pdf_with_object_stream(&format!("{}0 0 100 100{}", "[".repeat(n), "]".repeat(n)), ""),
+            pdf_with_object_stream(&format!("{}{}", "<< /A ".repeat(d), ">> ".repeat(d)), ""),
+            // Its length is an object kept in the stream itself.
+            pdf_with_object_stream("[0 0 100 100]", "/Length 7 0 R"),
+            // It extends itself.
+            pdf_with_object_stream("[0 0 100 100]", "/Extends 5 0 R"),
+        ],
+    );
+    let plain = vectorcraft_engine::cmd::fileio::load("plain.pdf", &pdf_with_object_stream("[0 0 120 80]", "")).expect("an object stream is read");
+    assert_eq!(plain.doc.artboards[0].rect.width(), 120.0);
+}
+
+// What refers to itself, or to the next of its kind without end.
+
+#[test]
+fn pdf_page_trees_that_hold_themselves() {
+    let page = |parent: usize| format!("<< /Type /Page /Parent {parent} 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << >> >>");
+    let content = "<< /Length 13 >>\nstream\n0 0 5 5 re f\nendstream";
+    let own = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [2 0 R 3 0 R 2 0 R] /Count 1 >>".to_string(),
+        page(2),
+        content.to_string(),
+    ];
+    // Thousands of nodes, each holding the next; the page is the last.
+    let n = 30_000;
+    let mut deep = vec!["<< /Type /Catalog /Pages 5 0 R >>".to_string(), "null".to_string(), "null".to_string(), content.to_string()];
+    deep.extend((0..n).map(|i| format!("<< /Type /Pages /Kids [{} 0 R] /Count 1 >>", i + 6)));
+    deep.push(page(n + 4));
+    // Two nodes holding each other.
+    let pair = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [5 0 R] /Count 1 >>".to_string(),
+        page(5),
+        content.to_string(),
+        "<< /Type /Pages /Kids [2 0 R 3 0 R] /Count 1 >>".to_string(),
+    ];
+    let bytes = |objs: &[String]| pdf_of(&objs.iter().map(|o| o.clone().into_bytes()).collect::<Vec<_>>());
+    open_each("pages", [bytes(&own), bytes(&deep), bytes(&pair)]);
+}
+
+#[test]
+fn pdf_functions_that_hold_themselves() {
+    let stitch = |next: usize| format!("<< /FunctionType 3 /Domain [0 1] /Functions [{next} 0 R] /Bounds [] /Encode [0 1] >>");
+    let ramp = "<< /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [0 0 1] /N 1 >>";
+    let calculator = "/FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1]";
+    let n = 100_000;
+    open_each(
+        "functions",
+        [
+            pdf_with_function(&[stitch(5).into_bytes()]),
+            pdf_with_function(&[stitch(6).into_bytes(), stitch(5).into_bytes()]),
+            pdf_with_function(&chain(20_000, stitch, ramp)),
+            // A calculator function of procedures in procedures.
+            pdf_with_function(&[packed(calculator, &format!("{}{}", "{".repeat(n), "}".repeat(n)))]),
+            pdf_with_function(&[packed(calculator, &format!("{{ {} 0 0 0 {} }}", "true {".repeat(n), "} if ".repeat(n)))]),
+        ],
+    );
+}
+
+#[test]
+fn pdf_color_spaces_that_hold_themselves() {
+    let indexed = |next: usize| format!("[/Indexed {next} 0 R 1 <000000ffffff>]");
+    let tint = "<< /FunctionType 2 /Domain [0 1] /C0 [1 1 1] /C1 [0 0 0] /N 1 >>";
+    let profile = |alternate: &str| format!("<< /N 3 /Alternate {alternate} /Length 4 >>\nstream\njunk\nendstream").into_bytes();
+    open_each(
+        "spaces",
+        [
+            pdf_with_color_space(&[indexed(5).into_bytes()]),
+            pdf_with_color_space(&[indexed(6).into_bytes(), indexed(5).into_bytes()]),
+            pdf_with_color_space(&chain(20_000, indexed, "/DeviceRGB")),
+            pdf_with_color_space(&[b"[/Separation /Ink 5 0 R 6 0 R]".to_vec(), tint.as_bytes().to_vec()]),
+            pdf_with_color_space(&[b"[/DeviceN [/Ink] 5 0 R 6 0 R]".to_vec(), tint.as_bytes().to_vec()]),
+            pdf_with_color_space(&[b"[/Pattern 5 0 R]".to_vec()]),
+            pdf_with_color_space(&[b"[/ICCBased 6 0 R]".to_vec(), profile("5 0 R")]),
+            pdf_with_color_space(&[b"[/ICCBased 6 0 R]".to_vec(), profile("[/ICCBased 6 0 R]")]),
+            // As the space of a shading and of an image.
+            pdf_with(
+                "/S sh",
+                "<< /Shading << /S << /ShadingType 2 /ColorSpace 5 0 R /Coords [0 0 9 0] /Function 6 0 R >> >> >>",
+                &[indexed(5).into_bytes(), tint.as_bytes().to_vec()],
+            ),
+            pdf_with(
+                "q 50 0 0 50 0 0 cm /I Do Q",
+                "<< /XObject << /I 6 0 R >> >>",
+                &[
+                    indexed(5).into_bytes(),
+                    b"<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace 5 0 R /Length 1 >>\nstream\n0\nendstream"
+                        .to_vec(),
+                ],
+            ),
+        ],
+    );
+}
+
+#[test]
+fn pdf_art_that_draws_itself() {
+    let own = "<< /XObject << /F 5 0 R >> /Pattern << /P 5 0 R >> /Font << /F1 5 0 R >> /ExtGState << /G << /SMask << /S /Alpha /G 5 0 R >> >> >> >>";
+    let tile = format!("/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources {own}");
+    let group = format!("{FORM} /Group << /S /Transparency >> /Resources {own}");
+    open_each(
+        "itself",
+        [
+            // A form drawing itself twice, a pattern painting its own tile, a glyph showing
+            // itself, and a mask masked by itself.
+            pdf_with("/F Do", own, &[packed(&format!("{FORM} /Resources {own}"), "0 0 5 5 re f /F Do 1 0 0 1 3 3 cm /F Do")]),
+            pdf_with("/Pattern cs /P scn 0 0 50 50 re f", own, &[packed(&tile, "/Pattern cs /P scn 0 0 5 5 re f")]),
+            pdf_with("BT /F1 12 Tf (a) Tj ET", own, &[type3_font(own), packed("", "10 0 d0 0 0 5 5 re f BT /F1 1 Tf (a) Tj ET")]),
+            pdf_with("/G gs 0 0 50 50 re f", own, &[packed(&group, "/G gs 0 0 5 5 re f")]),
+            // An image that is its own mask, and objects that are only a reference to each other.
+            pdf_with("q 50 0 0 50 0 0 cm /F Do Q", own, &[
+                b"<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace /DeviceGray /SMask 5 0 R /Length 1 >>\nstream\n0\nendstream".to_vec(),
+            ]),
+            handmade_pdf_with("0 0 5 5 re f", "5 0 R", "6 0 R", &[b"6 0 R".to_vec(), b"5 0 R".to_vec()]),
+            handmade_pdf_with("0 0 5 5 re f", "<< >>", "[0 0 9 9]", &[b"<< /Length 5 0 R >>\nstream\nx\nendstream".to_vec()]),
+        ],
+    );
+}
+
+/// An EPS whose program is `body`.
+fn deep_eps(body: &str) -> Vec<u8> {
+    format!("%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\n{body}\nshowpage\n%%EOF\n").into_bytes()
+}
+
+/// A test for each file: it opens as an error or as a document within the cap, on a small stack.
+macro_rules! deep_files {
+    ($($test:ident: $name:literal, $bytes:expr;)*) => {$(
+        #[test]
+        fn $test() {
+            on_a_small_stack(|| {
+                open_deep($name, &$bytes);
+            });
+        }
+    )*};
+}
+
+deep_files! {
+    // PDF: clips inside clips (saved states never restored); arrays in arrays as an operand and as
+    // an object; dictionaries in dictionaries as a resource and inline; marked content never ended.
+    pdf_clips_in_clips: "clips.pdf", deep_pdf(&format!("{} 0 0 5 5 re f", "q 0 0 50 50 re W n ".repeat(20_000)), "<< >>");
+    pdf_arrays_in_an_operand: "arrays.pdf", deep_pdf(&format!("BT {}{} TJ ET 0 0 5 5 re f", "[".repeat(100_000), "]".repeat(100_000)), "<< >>");
+    pdf_arrays_in_an_object: "boxes.pdf", handmade_pdf("0 0 5 5 re f", "<< >>", &format!("{}0 0 100 100{}", "[".repeat(100_000), "]".repeat(100_000)));
+    pdf_dictionaries_in_resources: "dicts.pdf", deep_pdf("0 0 5 5 re f", &format!("{}{}", "<< /A ".repeat(50_000), ">> ".repeat(50_000)));
+    pdf_dictionaries_in_content: "inline.pdf", deep_pdf(&format!("/P {}{} DP 0 0 5 5 re f", "<< /A ".repeat(50_000), ">> ".repeat(50_000)), "<< >>");
+    pdf_marked_content_never_ended: "marked.pdf", deep_pdf(&format!("{} 0 0 5 5 re f", "/Span << /MCID 0 >> BDC ".repeat(50_000)), "<< >>");
+    // PostScript: clips inside clips; procedures in procedures; arrays in arrays; a procedure that
+    // calls itself; dictionaries never ended.
+    eps_clips_in_clips: "clips.eps", deep_eps(&format!("{} 0 0 5 5 rectfill", "gsave 0 0 50 50 rectclip ".repeat(20_000)));
+    eps_procedures_in_procedures: "procs.eps", deep_eps(&format!("{}{} 0 0 5 5 rectfill", "{".repeat(100_000), "}".repeat(100_000)));
+    eps_arrays_in_arrays: "arrays.eps", deep_eps(&format!("{}{} pop 0 0 5 5 rectfill", "[".repeat(100_000), "]".repeat(100_000)));
+    eps_a_procedure_calling_itself: "runaway.eps", deep_eps("/f { 0 0 5 5 rectfill f } def f");
+    eps_dictionaries_never_ended: "dicts.eps", deep_eps(&format!("{} 0 0 5 5 rectfill", "1 dict begin ".repeat(100_000)));
+}
+
+#[test]
+fn deeply_nested_dxf_blocks_are_read_within_the_cap() {
+    on_a_small_stack(|| {
+        // Block `B0` inserts `B1`, which inserts `B2`, and so on; the last one holds a line.
+        let pair = |c: i32, v: &str| (c, v.to_string());
+        let mut pairs = vec![pair(0, "SECTION"), pair(2, "BLOCKS")];
+        for i in 0..2_000 {
+            pairs.extend([pair(0, "BLOCK"), pair(2, &format!("B{i}")), pair(10, "0"), pair(20, "0")]);
+            if i + 1 < 2_000 {
+                pairs.extend([pair(0, "INSERT"), pair(2, &format!("B{}", i + 1)), pair(10, "1"), pair(20, "1")]);
+            } else {
+                pairs.extend([pair(0, "LINE"), pair(10, "0"), pair(20, "0"), pair(11, "5"), pair(21, "5")]);
+            }
+            pairs.push(pair(0, "ENDBLK"));
+        }
+        pairs.extend([pair(0, "ENDSEC"), pair(0, "SECTION"), pair(2, "ENTITIES"), pair(0, "INSERT"), pair(2, "B0"), pair(10, "0"), pair(20, "0")]);
+        pairs.extend([pair(0, "LINE"), pair(10, "0"), pair(20, "0"), pair(11, "9"), pair(21, "9"), pair(0, "ENDSEC"), pair(0, "EOF")]);
+        open_deep("blocks.dxf", dxf_text(&pairs).as_bytes()).expect("opens");
+    });
+}
+
+/// A layer holding `levels` groups in one another around a rectangle, each with a second
+/// rectangle beside the next: `levels + 2` deep.
+fn nested_document(levels: usize) -> Document {
+    use vectorcraft_doc::Node;
+    use vectorcraft_testkit::fixtures::DocBuilder;
+    let mut b = DocBuilder::new(100.0, 100.0);
+    let rect =
+        |b: &mut DocBuilder, x: f64| b.rect_node(vectorcraft_geom::Rect::new(x, 0.0, x + 10.0, 10.0), vectorcraft_color::Color::rgb8(200, 0, 0));
+    let mut inner = rect(&mut b, 0.0);
+    for _ in 0..levels {
+        let beside = rect(&mut b, 20.0);
+        inner = Node::group(b.alloc(), vec![std::sync::Arc::new(inner), std::sync::Arc::new(beside)]);
+        inner.opacity = 0.9;
+    }
+    b.add(inner);
+    b.build()
+}
+
+#[test]
+fn a_document_at_the_cap_saves_opens_and_exports() {
+    on_a_small_stack(|| {
+        let doc = nested_document(MAX_DEPTH - 2);
+        assert!(!doc.too_deep(None));
+        let back = vectorcraft_format::load_file(&vectorcraft_format::save_file(&doc)).expect("what can be made opens again");
+        assert!(back.depth_notes.is_empty());
+        assert_eq!(back.doc.layers, doc.layers);
+        survive("at the cap", || Some(doc.clone())).unwrap();
+        // Every format that keeps the nesting reads its own file back within the cap.
+        let mut s = vectorcraft_engine::Session::new();
+        s.add_document(doc, None);
+        for format in ["svg", "pdf", "eps", "ai"] {
+            let r = s.execute("document.export", &json!({"format": format})).unwrap();
+            let bytes = vectorcraft_format::base64_decode(r["dataBase64"].as_str().unwrap()).unwrap();
+            open_deep(&format!("cap.{format}"), &bytes).unwrap_or_else(|| panic!("{format} opens"));
+        }
+        for cmd in ["select.all", "document.inspect", "document.info", "edit.copy", "edit.paste", "object.ungroup", "edit.undo"] {
+            no_panic(s.execute(cmd, &json!({}))).unwrap_or_else(|e| panic!("{cmd}: {e}"));
+        }
+    });
+}
+
+#[test]
+fn a_native_file_nested_too_deep_is_merged_or_refused() {
+    on_a_small_stack(|| {
+        // Saved before the cap by a version that could still open it: opened, the deepest merged.
+        let old = vectorcraft_format::save_file(&nested_document(MAX_DEPTH + 2));
+        let (doc, warnings) = open_deep("old.vectorcraft", &old).expect("opens");
+        assert!(merged(&warnings), "{warnings:?}");
+        assert_eq!(paths_in(&doc), MAX_DEPTH + 3, "no art is lost");
+        // Deeper than any version could open, and a hostile file: an error that says why. Written
+        // by hand: a tree this deep can't be built and saved.
+        let text = String::from_utf8(vectorcraft_format::save(&nested_document(0), false)).unwrap();
+        let (open, close) = ("{\"id\":900000,\"kind\":{\"type\":\"group\",\"children\":[", "]}}");
+        let at = text.find("\"children\":[").expect("the layer's children") + "\"children\":[".len();
+        for levels in [100, 50_000] {
+            let deep = format!("{}{}{},{}", &text[..at], open.repeat(levels), close.repeat(levels), &text[at..]);
+            let e = vectorcraft_engine::cmd::fileio::load("deep.vectorcraft", deep.as_bytes()).err().expect("refused").to_string();
+            assert!(e.contains("nested too deep"), "{levels}: {e}");
+        }
+    });
+}
+
+#[test]
+fn commands_cannot_nest_deeper_than_the_cap() {
+    on_a_small_stack(|| {
+        let mut s = vectorcraft_engine::Session::new();
+        s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+        s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 50, "height": 50})).unwrap();
+        s.execute("select.all", &json!({})).unwrap();
+        let mut grouped = 0;
+        for _ in 0..10_000 {
+            match no_panic(s.execute("object.group", &json!({}))) {
+                Ok(_) => grouped += 1,
+                Err(e) => assert!(e.to_string().contains(vectorcraft_engine::TOO_DEEP), "after {grouped} groups: {e}"),
+            }
+        }
+        // The layer, the groups and the rectangle.
+        assert_eq!(grouped, MAX_DEPTH - 2);
+        assert!(!s.doc().unwrap().doc.too_deep(None));
+        // Other ways down: a clipping mask, a copy pasted, a symbol made of it.
+        for (cmd, p) in [
+            ("object.clippingMask.make", json!({})),
+            ("edit.copy", json!({})),
+            ("edit.pasteInFront", json!({})),
+            ("symbol.new", json!({"name": "deep"})),
+        ] {
+            let _ = no_panic(s.execute(cmd, &p));
+            assert!(!s.doc().unwrap().doc.too_deep(None), "{cmd}");
+        }
+        survive("grouped to the cap", || Some((*s.doc().unwrap().doc).clone())).unwrap();
+    });
+}
+
+/// A document whose one object is an instance of the first of `count` symbols: each symbol's art
+/// is `levels` groups around an instance of the next symbol, the last one of `last`.
+fn symbols_document(count: usize, levels: usize, last: &str) -> Document {
+    use vectorcraft_doc::{Node, NodeKind, Symbol};
+    let instance =
+        |doc: &mut Document, of: String| Node::new(doc.alloc_id(), NodeKind::SymbolInstance { symbol: of, xf: vectorcraft_geom::Affine::IDENTITY });
+    let mut doc = nested_document(1);
+    for i in 0..count {
+        let mut art = instance(&mut doc, if i + 1 < count { format!("s{}", i + 1) } else { last.to_string() });
+        for _ in 0..levels {
+            art = Node::group(doc.alloc_id(), vec![std::sync::Arc::new(art)]);
+        }
+        doc.symbols.push(Symbol { name: format!("s{i}"), art: std::sync::Arc::new(art) });
+    }
+    let first = instance(&mut doc, "s0".into());
+    let layer = doc.layers[0].id;
+    doc.insert(Some(layer), usize::MAX, first).unwrap();
+    doc
+}
+
+/// `doc` saved (as an older version, or a hostile file, could have) and opened again: within the
+/// caps (`kept`: as it was), drawn, exported and edited.
+fn symbols_survive(what: &str, doc: Document, kept: bool) {
+    let (back, warnings) = open_deep("symbols.vectorcraft", &vectorcraft_format::save_file(&doc)).expect("opens");
+    assert_eq!(!warnings.iter().any(|w| w.contains("symbol instances")), kept, "{what}: {warnings:?}");
+    let mut s = vectorcraft_engine::Session::new();
+    s.add_document(back, None);
+    for cmd in [
+        "select.all",
+        "document.inspect",
+        "document.info",
+        "object.expand",
+        "symbol.breakLink",
+        "object.flattenTransparency",
+        "edit.copy",
+        "edit.paste",
+    ] {
+        let _ = no_panic(s.execute(cmd, &json!({})));
+        assert!(!s.doc().unwrap().doc.too_deep(None), "{what}: {cmd}");
+    }
+    for format in ["svg", "pdf", "eps", "png"] {
+        let _ = no_panic(s.execute("document.export", &json!({"format": format})));
+    }
+}
+
+#[test]
+fn a_symbol_holding_itself_opens_without_the_instance() {
+    on_a_small_stack(|| {
+        symbols_survive("a symbol holding itself", symbols_document(1, 1, "s0"), false);
+        symbols_survive("symbols holding one another", symbols_document(3, 2, "s0"), false);
+    });
+}
+
+#[test]
+fn symbols_in_symbols_are_drawn_only_so_deep() {
+    on_a_small_stack(|| {
+        // As deep as symbols draw: each one's art as deep as art goes.
+        symbols_survive("symbols at the cap", symbols_document(3, MAX_DEPTH - 2, "none"), true);
+        symbols_survive("symbols in symbols", symbols_document(40, MAX_DEPTH - 1, "none"), false);
+        // A symbol can't be made to hold itself, or one that holds it, by editing either.
+        let mut s = vectorcraft_engine::Session::new();
+        s.add_document(symbols_document(2, 1, "none"), None);
+        s.execute("select.all", &json!({})).unwrap();
+        for (cmd, p) in [
+            ("symbol.new", json!({"name": "s1"})),
+            ("symbol.update", json!({"name": "s1"})),
+            ("symbol.update", json!({"name": "s0"})),
+            ("symbol.replace", json!({"name": "s1"})),
+        ] {
+            let _ = no_panic(s.execute(cmd, &p));
+            assert!(!s.doc().unwrap().doc.too_deep(None), "{cmd} {p}");
+        }
+    });
+}
+
+#[test]
+fn a_pattern_painting_its_own_tile_opens_without_the_paint() {
+    on_a_small_stack(|| {
+        use vectorcraft_color::Paint;
+        use vectorcraft_doc::{Appearance, PatternDef};
+        let painted = |doc: &mut Document, with: &str| {
+            let fill = Paint::Pattern { pattern: with.into(), xf: vectorcraft_geom::Affine::IDENTITY };
+            let square = vectorcraft_geom::shapes::rectangle(vectorcraft_geom::Rect::new(0.0, 0.0, 20.0, 20.0));
+            vectorcraft_doc::Node::path(doc.alloc_id(), square, Appearance::basic(fill, Paint::None, 0.0))
+        };
+        // One pattern painting its own tile, and two painting each other's.
+        for names in [["p", "p"], ["p", "q"]] {
+            let mut doc = nested_document(1);
+            let (first, second) = (painted(&mut doc, names[1]), painted(&mut doc, names[0]));
+            doc.patterns.push(PatternDef::new(names[0], vec![std::sync::Arc::new(first)]));
+            if names[0] != names[1] {
+                doc.patterns.push(PatternDef::new(names[1], vec![std::sync::Arc::new(second)]));
+            }
+            let on_layer = painted(&mut doc, "p");
+            let layer = doc.layers[0].id;
+            doc.insert(Some(layer), usize::MAX, on_layer).unwrap();
+            symbols_survive("a pattern painting its own tile", doc, false);
+        }
+    });
+}
@@ -121,6 +121,44 @@ fn batch_is_one_undo_step_and_rolls_back_on_error() {
    assert_eq!(s.doc().unwrap().doc.node_count(), 1);
 }

+/// #1697: a failed batch brings back the whole document, not only its art: the file a Save As
+/// step named and the history an Undo step moved; and a batch leaves a drag in progress its own
+/// step.
+#[test]
+fn a_failed_batch_restores_the_file_the_history_and_a_drag_in_progress() {
+    let mut s = fixtures::session();
+    let rect = |x: i32| json!({"command": "shape.rectangle", "params": {"x": x, "y": 0, "width": 10, "height": 10}});
+    let fail = json!({"command": "no.such.command", "params": {}});
+    exec(&mut s, "shape.rectangle", json!({"x": 50, "y": 0, "width": 10, "height": 10}));
+    let before = (doc_json(&s.doc().unwrap().doc), s.doc().unwrap().history.undo.len(), s.doc().unwrap().history.redo.len());
+    let state = |s: &vectorcraft_engine::Session| {
+        let st = s.doc().unwrap();
+        (doc_json(&st.doc), st.history.undo.len(), st.history.redo.len())
+    };
+    // Save As, then a failing step: the document keeps no file and stays modified.
+    let path = vectorcraft_testkit::temp_dir("batch-rollback").join("named.vectorcraft").to_string_lossy().to_string();
+    let save = json!({"command": "file.saveAs", "params": {"path": path}});
+    assert!(s.execute("command.batch", &json!({"commands": [rect(0), save, fail]})).is_err());
+    assert_eq!(state(&s), before);
+    assert_eq!((s.doc().unwrap().path.as_deref(), s.doc().unwrap().is_dirty()), (None, true));
+    // Undo, then a failing step: the art and both history stacks are as before.
+    let undo = json!({"command": "edit.undo", "params": {}});
+    assert!(s.execute("command.batch", &json!({"commands": [undo, fail]})).is_err());
+    assert_eq!(state(&s), before);
+    // A batch during a drag: the drag is kept as a step, the batch is the next one.
+    exec(&mut s, "select.all", json!({}));
+    s.begin_interaction("Move").unwrap();
+    s.preview("object.move", &json!({"dx": 5, "dy": 0})).unwrap();
+    let moved = doc_json(&s.doc().unwrap().doc);
+    exec(&mut s, "command.batch", json!({"commands": [rect(100)]}));
+    assert!(!s.in_interaction());
+    assert_eq!(s.doc().unwrap().history.undo.len(), before.1 + 2);
+    exec(&mut s, "edit.undo", json!({}));
+    assert_eq!(doc_json(&s.doc().unwrap().doc), moved, "undoing the batch leaves the drag's move");
+    exec(&mut s, "edit.undo", json!({}));
+    assert_eq!(doc_json(&s.doc().unwrap().doc), before.0);
+}
+
 #[test]
 fn empty_batch_is_harmless() {
    let mut s = fixtures::session();
@@ -4,7 +4,6 @@
 //! Every operation counts against a budget and procedures nest only so deep, so a looping or
 //! recursing program ends with [`PsError::Limit`] instead of hanging.

-use std::cell::RefCell;
 use std::rc::Rc;

 use vectorcraft_geom::Affine;
@@ -30,6 +29,8 @@ pub(crate) const MAX_GSAVE: usize = 1000;
 const MAX_MEMORY: usize = 1 << 30;

 pub(crate) struct Interp<'a> {
+    /// The list of the arrays and dictionaries made since this started ([`super::obj::track`]).
+    made: u64,
    pub lex: Lexer<'a>,
    pub stack: Vec<Obj>,
    pub dicts: Vec<DictRef>,
@@ -86,7 +87,7 @@ struct SaveMark {
 }

 fn new_dict() -> DictRef {
-    Rc::new(RefCell::new(Dict::new()))
+    DictRef::new(Dict::new())
 }

 /// An encoding vector: 256 `/.notdef` names (type is read as Latin-1 whatever the encoding).
@@ -102,6 +103,7 @@ const CATEGORIES: &str = "Category Generic Font CIDFont CMap FontSet Encoding Fo

 impl<'a> Interp<'a> {
    pub fn new(src: &'a [u8], g: GState, out: Out) -> Self {
+        let made = super::obj::track();
        let system = new_dict();
        {
            let mut d = system.borrow_mut();
@@ -141,6 +143,7 @@ impl<'a> Interp<'a> {
            system.borrow_mut().insert(Key::name(name), Obj::Dict(d.clone()));
        }
        Self {
+            made,
            lex: Lexer::new(src),
            stack: vec![],
            dicts: vec![system.clone(), global.clone(), user.clone()],
@@ -206,6 +209,8 @@ impl<'a> Interp<'a> {
        self.dicts.clear();
        self.stack.clear();
        self.journal.clear();
+        // What the program linked into itself, reachable or not.
+        super::obj::release_tracked(self.made);
    }

    // ---------- the operand stack ----------
@@ -268,5 +268,7 @@ fn finish_with(out: Out, layers: Vec<Arc<Node>>) -> Imported {
        }
    }
    doc.layers = layers;
-    Imported { document: doc, warnings: out.warnings, preview: false }
+    let mut warnings = out.warnings;
+    doc.limit_depth_noting(&mut warnings);
+    Imported { document: doc, warnings, preview: false }
 }
@@ -993,6 +993,7 @@ fn build(data: &[u8], visible: Option<&Document>, page: Page, outlined: bool, tr
        }
        None => unmark(&mut doc.layers, true, &mut vec![]),
    }
+    doc.limit_depth_noting(&mut notes);
    Ok((doc, notes))
 }

@@ -3,7 +3,7 @@
 use std::cell::{Ref, RefCell};
 use std::collections::HashMap;
 use std::hash::{Hash, Hasher};
-use std::rc::Rc;
+use std::rc::{Rc, Weak};

 use super::data::Stream;
 use super::graphics::GState;
@@ -12,7 +12,163 @@ use super::graphics::GState;
 pub(crate) type Dict = HashMap<Key, Obj>;

 /// A shared, mutable dictionary.
-pub(crate) type DictRef = Rc<RefCell<Dict>>;
+#[derive(Clone, Debug)]
+pub(crate) struct DictRef(Rc<RefCell<Dict>>);
+
+impl DictRef {
+    pub fn new(d: Dict) -> Self {
+        let d = Rc::new(RefCell::new(d));
+        note(Made::Dict(Rc::downgrade(&d)));
+        Self(d)
+    }
+}
+
+/// An array or a dictionary a program made.
+enum Made {
+    Array(Weak<RefCell<Vec<Obj>>>),
+    Dict(Weak<RefCell<Dict>>),
+}
+
+/// The arrays and dictionaries made on this thread since [`track`], for [`release_tracked`].
+struct Tracked {
+    owner: u64,
+    made: Vec<Made>,
+    /// The list is cleared of dropped objects when it reaches this length.
+    sweep_at: usize,
+}
+
+const SWEEP_MIN: usize = 4096;
+
+#[cfg(test)]
+thread_local! {
+    /// Tests: the arrays of the list last released on this thread that were still alive after it
+    /// (the ones the interpreter itself still held).
+    pub(crate) static ARRAYS_LEFT: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+thread_local! {
+    static TRACKED: RefCell<Option<Tracked>> = const { RefCell::new(None) };
+}
+
+/// Start listing the arrays and dictionaries made on this thread (an interpreter starting) → the
+/// list's owner, for [`release_tracked`]. A list already there is dropped: its objects are freed
+/// as before this existed, unless they hold each other.
+pub(crate) fn track() -> u64 {
+    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+    let owner = NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    // (Nothing to list on when the thread is ending.)
+    let _ = TRACKED.try_with(|t| t.try_borrow_mut().map(|mut t| *t = Some(Tracked { owner, made: vec![], sweep_at: SWEEP_MIN })));
+    owner
+}
+
+fn note(m: Made) {
+    let _ = TRACKED.try_with(|t| {
+        let Ok(mut t) = t.try_borrow_mut() else { return };
+        let Some(t) = t.as_mut() else { return };
+        if t.made.len() >= t.sweep_at {
+            // Twice what is alive at most, so the list costs a program no more than its objects.
+            t.made.retain(|m| match m {
+                Made::Array(a) => a.strong_count() > 0,
+                Made::Dict(d) => d.strong_count() > 0,
+            });
+            t.sweep_at = (t.made.len() * 2).max(SWEEP_MIN);
+        }
+        t.made.push(m);
+    });
+}
+
+/// Empty every array and dictionary still alive of the list `owner` started (the interpreter is
+/// done with them), so those holding themselves or each other are freed too: reference counts
+/// alone never free `/a 1 array def a 0 a put`, and a program can leave as much of that behind as
+/// it may allocate, on every import (#1714).
+pub(crate) fn release_tracked(owner: u64) {
+    let made = TRACKED.try_with(|t| {
+        let mut t = t.try_borrow_mut().ok()?;
+        t.take_if(|t| t.owner == owner).map(|t| t.made)
+    });
+    let made = made.ok().flatten().unwrap_or_default();
+    #[cfg(test)]
+    let arrays: Vec<_> = made.iter().filter_map(|m| if let Made::Array(a) = m { Some(a.clone()) } else { None }).collect();
+    for m in made {
+        // What it holds is taken out first and dropped with nothing borrowed.
+        match m {
+            Made::Array(a) => {
+                let held = a.upgrade().and_then(|a| a.try_borrow_mut().ok().map(|mut values| std::mem::take(&mut *values)));
+                drop_held(held.unwrap_or_default().into_iter());
+            }
+            Made::Dict(d) => {
+                let held = d.upgrade().and_then(|d| d.try_borrow_mut().ok().map(|mut d| std::mem::take(&mut *d)));
+                drop_held(held.unwrap_or_default().into_values());
+            }
+        }
+    }
+    #[cfg(test)]
+    ARRAYS_LEFT.with(|n| n.set(arrays.iter().filter(|a| a.strong_count() > 0).count()));
+}
+
+impl std::ops::Deref for DictRef {
+    type Target = Rc<RefCell<Dict>>;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl Drop for DictRef {
+    fn drop(&mut self) {
+        if Rc::strong_count(&self.0) == 1
+            && let Ok(mut d) = self.0.try_borrow_mut()
+        {
+            drop_held(d.drain().map(|(_, v)| v));
+        }
+    }
+}
+
+thread_local! {
+    /// What the composite objects being dropped held, waiting for their turn (while any is).
+    static HELD: RefCell<Option<Vec<Obj>>> = const { RefCell::new(None) };
+}
+
+/// Drop what a composite object held, now that nothing else refers to it, without recursion: a
+/// program nests arrays and dictionaries as deep as it likes (`[ exch ]` in a loop), and dropping
+/// them one inside the other overflows the stack. What `held` holds in its turn waits in [`HELD`]
+/// for the outermost drop, which works through it.
+fn drop_held(held: impl Iterator<Item = Obj>) {
+    let holds = |o: &Obj| matches!(o, Obj::Array { .. } | Obj::Dict(_) | Obj::File { .. } | Obj::GState(_));
+    // (Without the list, when the thread is ending: dropped as they come.)
+    let outermost = HELD.try_with(|h| {
+        let Ok(mut h) = h.try_borrow_mut() else { return false };
+        let outermost = h.is_none();
+        h.get_or_insert_with(Vec::new).extend(held.filter(holds));
+        outermost
+    });
+    if !matches!(outermost, Ok(true)) {
+        return;
+    }
+    // Each drop here puts what it held on the list instead of dropping it.
+    while let Ok(Some(next)) = HELD.try_with(|h| h.try_borrow_mut().ok().and_then(|mut h| h.as_mut().and_then(Vec::pop))) {
+        drop(next);
+    }
+    let _ = HELD.try_with(|h| h.try_borrow_mut().map(|mut h| *h = None)); // Nothing to do when the thread is ending.
+}
+
+/// What [`Shared`] values may be: bytes, or objects (which may hold more of themselves).
+pub(crate) trait Held: Sized {
+    /// Drop the values of storage nothing refers to any more.
+    fn release(_values: Vec<Self>) {}
+    /// Storage of these values was made.
+    fn made(_storage: &Rc<RefCell<Vec<Self>>>) {}
+}
+
+impl Held for u8 {}
+
+impl Held for Obj {
+    fn release(values: Vec<Self>) {
+        drop_held(values.into_iter());
+    }
+    fn made(storage: &Rc<RefCell<Vec<Self>>>) {
+        note(Made::Array(Rc::downgrade(storage)));
+    }
+}

 /// A dictionary key.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
@@ -72,7 +228,7 @@ impl Obj {
    }

    pub fn dict(d: Dict) -> Self {
-        Self::Dict(Rc::new(RefCell::new(d)))
+        Self::Dict(DictRef::new(d))
    }

    /// The number this is (integers and reals).
@@ -135,15 +291,27 @@ impl Obj {
 /// The values of a string or an array: a run of storage that other strings or arrays may share
 /// (`getinterval` makes a new object over part of the same values, as PostScript does).
 #[derive(Clone, Debug)]
-pub(crate) struct Shared<T> {
+pub(crate) struct Shared<T: Held> {
    buf: Rc<RefCell<Vec<T>>>,
    at: usize,
    len: usize,
 }

-impl<T: Clone> Shared<T> {
+impl<T: Held> Drop for Shared<T> {
+    fn drop(&mut self) {
+        if Rc::strong_count(&self.buf) == 1
+            && let Ok(mut values) = self.buf.try_borrow_mut()
+        {
+            T::release(std::mem::take(&mut *values));
+        }
+    }
+}
+
+impl<T: Clone + Held> Shared<T> {
    pub fn new(v: Vec<T>) -> Self {
-        Self { len: v.len(), buf: Rc::new(RefCell::new(v)), at: 0 }
+        let (len, buf) = (v.len(), Rc::new(RefCell::new(v)));
+        T::made(&buf);
+        Self { len, buf, at: 0 }
    }

    pub fn len(&self) -> usize {
@@ -198,7 +366,7 @@ impl<T: Clone> Shared<T> {
 }

 /// Hashes what [`Shared::same`] compares: the storage and the run of it.
-impl<T> Hash for Shared<T> {
+impl<T: Held> Hash for Shared<T> {
    fn hash<H: Hasher>(&self, state: &mut H) {
        Rc::as_ptr(&self.buf).hash(state);
        (self.at, self.len).hash(state);
@@ -19,6 +19,23 @@ pub(super) fn read(body: &str) -> crate::Imported {
    import(&eps(body)).unwrap()
 }

+/// #1714: arrays and dictionaries a program links into themselves or each other are freed with
+/// the interpreter, also the ones it no longer reaches and when it stops on an error.
+#[test]
+fn arrays_and_dictionaries_holding_themselves_are_freed() {
+    // The arrays still alive once a program's interpreter has released what it made: the ones
+    // the interpreter itself holds, the same for every program here.
+    let left = |program: &str| {
+        let _ = import(&eps(program));
+        crate::import::obj::ARRAYS_LEFT.with(std::cell::Cell::get)
+    };
+    let plain = left("/a 1 array def /b 1 array def a 0 b put");
+    let cycles = "/a 1 array def a 0 a put         /b 1 array def /c 1 array def b 0 c put c 0 b put         /d 1 dict def /e 1 array def d /e e put e 0 d put         1 array dup 0 1 index put pop         /a null def /b null def";
+    for program in [cycles.to_string(), format!("{cycles} 1 0 div"), format!("{cycles} /p {{ p }} def")] {
+        assert_eq!(left(&program), plain, "{program}");
+    }
+}
+
 /// The objects of the document's layer.
 pub(super) fn objects(d: &Document) -> Vec<Arc<Node>> {
    d.layers[0].children().unwrap().clone()
@@ -389,7 +389,7 @@ impl Interp<'_> {
        d.insert(Key::name("FontMatrix"), matrix_obj(Affine::scale(0.001)));
        d.insert(Key::name("FontBBox"), Obj::array(vec![Obj::Int(0), Obj::Int(-250), Obj::Int(1000), Obj::Int(1000)]));
        d.insert(Key::name("Encoding"), Obj::array(vec![Obj::name(".notdef"); 256]));
-        let font = Rc::new(std::cell::RefCell::new(d));
+        let font = DictRef::new(d);
        self.fonts.borrow_mut().insert(key, Obj::Dict(font.clone()));
        Ok(font)
    }
@@ -489,7 +489,7 @@ fn transformed(font: &DictRef, m: Affine) -> DictRef {
    let mut d = font.borrow().clone();
    let fm = d.get(&Key::name("FontMatrix")).and_then(|o| o.items().and_then(|i| matrix_of(&i.borrow()))).unwrap_or(Affine::scale(0.001));
    d.insert(Key::name("FontMatrix"), matrix_obj(m * fm));
-    Rc::new(std::cell::RefCell::new(d))
+    DictRef::new(d)
 }

 /// The character a glyph name stands for (`A`, `space`, `uni20AC`), else a bullet.
@@ -181,13 +181,26 @@ fn push85(s: &mut String, mut v: u32, n: usize) {
    }
 }

-/// ASCII85 `text` (whitespace ignored, up to `~>`) decoded; `None` when it is malformed.
+/// Most bytes [`ascii85_decode`] makes: what one filter or data section may hold.
+pub(crate) const MAX_ASCII85: usize = 1 << 28;
+
+/// ASCII85 `text` (whitespace ignored, up to `~>`) decoded; `None` when it is malformed or longer
+/// than [`MAX_ASCII85`].
 pub(crate) fn ascii85_decode(text: &str) -> Option<Vec<u8>> {
-    let mut out = Vec::with_capacity(text.len() * 4 / 5);
+    ascii85_decode_within(text, MAX_ASCII85)
+}
+
+/// [`ascii85_decode`] of at most `max` bytes: `z` is four bytes for one, so the length of the
+/// text doesn't bound what it becomes (#1715).
+pub(crate) fn ascii85_decode_within(text: &str, max: usize) -> Option<Vec<u8>> {
+    let mut out = Vec::with_capacity((text.len() / 5 * 4).min(max));
    let mut group = [0u8; 5];
    let mut n = 0;
    let mut chars = text.bytes().filter(|b| !b.is_ascii_whitespace()).peekable();
    while let Some(b) = chars.next() {
+        if out.len() > max {
+            return None;
+        }
        match b {
            b'~' => {
                if chars.next() != Some(b'>') {
@@ -201,7 +214,7 @@ pub(crate) fn ascii85_decode(text: &str) -> Option<Vec<u8>> {
                    let v = value85(&padded)?;
                    out.extend(v.to_be_bytes().iter().take(n - 1));
                }
-                return Some(out);
+                return (out.len() <= max).then_some(out);
            }
            b'z' if n == 0 => out.extend([0; 4]),
            b'!'..=b'u' => {
@@ -345,6 +345,11 @@ fn run_length_and_ascii85_round_trip() {
    assert_eq!(ps::ascii85(b"Man "), "9jqo^~>\n");
    assert_eq!(ps::ascii85(&[0, 0, 0, 0]), "z~>\n");
    assert!(ps::ascii85_decode("9jqo^").is_none(), "no end marker");
+    // #1715: the result is bounded while it is made, not by the length of the text.
+    assert_eq!(ps::ascii85_decode_within("zz~>", 8), Some(vec![0; 8]));
+    assert!(ps::ascii85_decode_within("zzz~>", 8).is_none(), "three `z` are 12 bytes");
+    assert!(ps::ascii85_decode_within("zz9jqo^~>", 8).is_none());
+    assert!(ps::ascii85_decode_within(&format!("{}~>", "z".repeat(1 << 16)), 1 << 10).is_none());
    assert!(ps::ascii85_decode("9jqo^v~>").is_none(), "not base 85");
    assert_eq!(ps::num(1.0 / 3.0), "0.3333");
    assert_eq!((ps::num(-0.00001), ps::num(f64::NAN), ps::num(2.5)), ("0".into(), "0".into(), "2.5".into()));
@@ -4,7 +4,10 @@
 //!
 //! Where a folder refuses the temporary file or the rename (some network shares, a file another
 //! program holds open), the new content is first written and flushed elsewhere and only then copied
-//! into the file itself; if that copy fails, the temporary file stays and the error names it.
+//! into the file itself. That copy isn't atomic, so the file as it was is copied and flushed beside
+//! the temporary file first (#1695): if the copy into the file fails or is cut short, both versions
+//! are on disk, and the error names them. Where that copy of the old file can't be made, the file
+//! is left as it was and the save fails.
 //!
 //! On macOS `File::sync_all` is a full flush (`F_FULLFSYNC`), which SMB shares refuse with
 //! `ENOTSUP` while a plain `fsync` works: [`sync_file`] falls back to the plain one there (#1620).
@@ -78,8 +81,10 @@ fn write_atomic_stepping(

 /// The content of `tmp`, which is whole and flushed, copied into `target` itself, and `tmp`
 /// removed: for a folder that `refused` the atomic replacement. When `target` can't be opened for
-/// writing it is untouched: `tmp` is removed and `refused` returned. When the copy fails `target`
-/// is damaged: `tmp` stays and the error says where it is.
+/// writing it is untouched: `tmp` is removed and `refused` returned. When what it holds can't be
+/// copied aside first ([`keep_old`]) it is untouched too: `tmp` stays and the error names it. When
+/// the copy into `target` fails it is damaged: `tmp` and the copy of the old content stay and the
+/// error says where they are.
 fn write_over(tmp: &Path, target: &Path, refused: io::Error) -> io::Result<()> {
    let opened = File::open(tmp).and_then(|from| Ok((from, OpenOptions::new().write(true).create(true).truncate(false).open(target)?)));
    let Ok((mut from, mut to)) = opened else {
@@ -87,18 +92,42 @@ fn write_over(tmp: &Path, target: &Path, refused: io::Error) -> io::Result<()> {
        let _ = std::fs::remove_file(tmp);
        return Err(refused);
    };
+    // Nothing to keep of a file that is new or empty.
+    let old = to.metadata().map_or(true, |m| m.len() > 0).then(|| tmp.with_extension("old"));
+    if let Some(old) = &old
+        && let Err(e) = keep_old(target, old)
+    {
+        // Best effort: a partial copy is of no use.
+        let _ = std::fs::remove_file(old);
+        let why =
+            format!("{refused}, and the file can't be copied aside before it is overwritten ({e}); the new content is kept in {}", tmp.display());
+        return Err(io::Error::new(refused.kind(), why));
+    }
    let copied = to.set_len(0).and_then(|()| io::copy(&mut from, &mut to)).and_then(|_| sync_file(&to));
    drop((from, to));
-    match copied {
-        Ok(()) => {
-            // Best effort: the file is saved, so the copy is no longer needed.
+    match (copied, old) {
+        (Ok(()), old) => {
+            // Best effort: the file is saved, so the copies are no longer needed.
            let _ = std::fs::remove_file(tmp);
+            if let Some(old) = old {
+                let _ = std::fs::remove_file(old);
+            }
            Ok(())
        }
-        Err(e) => Err(io::Error::new(e.kind(), format!("{e} (the new content is kept in {})", tmp.display()))),
+        (Err(e), Some(old)) => {
+            Err(io::Error::new(e.kind(), format!("{e} (the new content is kept in {}, the file as it was in {})", tmp.display(), old.display())))
+        }
+        (Err(e), None) => Err(io::Error::new(e.kind(), format!("{e} (the new content is kept in {})", tmp.display()))),
    }
 }

+/// A flushed copy of `target` as it is, at `old` (for its owner only).
+fn keep_old(target: &Path, old: &Path) -> io::Result<()> {
+    let mut to = create_private(old)?;
+    io::copy(&mut File::open(target)?, &mut to)?;
+    sync_file(&to)
+}
+
 /// A new file for its owner only (Unix): the system's temporary folder is shared.
 fn create_private(path: &Path) -> io::Result<File> {
    let mut options = OpenOptions::new();
@@ -185,8 +214,15 @@ fn plain_fsync(file: &File) -> io::Result<()> {

 fn full_sync(file: &File) -> io::Result<()> {
    #[cfg(test)]
-    if REFUSE_FULL_SYNC.with(std::cell::Cell::get) {
-        return Err(io::Error::from_raw_os_error(ENOTSUP));
+    {
+        if REFUSE_FULL_SYNC.with(std::cell::Cell::get) {
+            return Err(io::Error::from_raw_os_error(ENOTSUP));
+        }
+        match FLUSHES_LEFT.with(std::cell::Cell::get) {
+            Some(0) => return Err(io::Error::other("the connection was lost")),
+            Some(n) => FLUSHES_LEFT.with(|c| c.set(Some(n - 1))),
+            None => {}
+        }
    }
    file.sync_all()
 }
@@ -203,6 +239,8 @@ thread_local! {
    static REFUSE_FULL_SYNC: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
    /// Tests: the plain `fsync` fallback fails too, with this OS error.
    static PLAIN_FSYNC_FAILS: std::cell::Cell<Option<i32>> = const { std::cell::Cell::new(None) };
+    /// Tests: after this many more flushes on this thread, every flush fails.
+    static FLUSHES_LEFT: std::cell::Cell<Option<u32>> = const { std::cell::Cell::new(None) };
    /// Tests: how many plain `fsync` fallbacks were made on this thread.
    static PLAIN_FSYNCS: std::cell::Cell<u32> = const { std::cell::Cell::new(0) };
 }
@@ -363,8 +401,46 @@ mod tests {
        let _ = std::fs::remove_dir_all(&d);
    }

-    /// A refused rename and a copy into the file that fails (here: its flush): the file is damaged,
-    /// so the temporary file with the whole new content stays and the error names it.
+    /// #1695: a refused rename and a copy into the file that fails (here: its flush, after the copy
+    /// of the old content was flushed): the file is damaged, so the temporary file with the whole
+    /// new content and the copy of the old one stay, and the error names both.
+    #[test]
+    fn a_failed_copy_into_the_file_keeps_the_old_content_and_the_new() {
+        let d = dir("no-rename-copy-fails-late");
+        let path = d.join("doc.vectorcraft");
+        std::fs::write(&path, b"original").unwrap();
+        let r = write_atomic_stepping(
+            &path,
+            |f| f.write_all(b"new"),
+            create_new,
+            |_, _| {
+                // One more flush works (the copy of the old content), the next doesn't.
+                FLUSHES_LEFT.with(|c| c.set(Some(1)));
+                denied()
+            },
+        );
+        FLUSHES_LEFT.with(|c| c.set(None));
+        let message = r.unwrap_err().to_string();
+        let mut left = leftovers(&d, "doc.vectorcraft");
+        left.sort();
+        let [old, tmp] = left.as_slice() else { panic!("the old content and the new: {left:?}") };
+        assert!(old.ends_with(".old") && tmp.ends_with(".tmp"), "{left:?}");
+        assert!(message.contains(tmp.as_str()) && message.contains(old.as_str()), "{message}");
+        assert_eq!((std::fs::read(d.join(old)).unwrap(), std::fs::read(d.join(tmp)).unwrap()), (b"original".to_vec(), b"new".to_vec()));
+        // A new file has nothing to keep, and a save that works leaves neither copy.
+        std::fs::remove_file(d.join(old)).unwrap();
+        std::fs::remove_file(d.join(tmp)).unwrap();
+        let fresh = d.join("fresh.vectorcraft");
+        write_atomic_stepping(&fresh, |f| f.write_all(b"new"), create_new, |_, _| denied()).unwrap();
+        write_atomic_stepping(&fresh, |f| f.write_all(b"newer"), create_new, |_, _| denied()).unwrap();
+        assert_eq!(std::fs::read(&fresh).unwrap(), b"newer");
+        assert_eq!(leftovers(&d, "doc.vectorcraft"), ["fresh.vectorcraft"]);
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    /// A refused rename where the old content can't be copied aside (here: no flush works): the
+    /// file is left as it was, the temporary file with the whole new content stays and the error
+    /// names it.
    #[test]
    fn a_failed_copy_into_the_file_keeps_the_temporary_file() {
        let d = dir("no-rename-copy-fails");
@@ -388,6 +464,7 @@ mod tests {
        let [tmp] = left.as_slice() else { panic!("one temporary file: {left:?}") };
        assert!(message.contains(tmp.as_str()), "{message}");
        assert_eq!(std::fs::read(d.join(tmp)).unwrap(), b"new");
+        assert_eq!(std::fs::read(&path).unwrap(), b"original", "not overwritten without a copy of it");
        let _ = std::fs::remove_dir_all(&d);
    }

@@ -482,6 +482,9 @@ pub fn load(bytes: &[u8]) -> Result<Document, FormatError> {
 #[derive(Debug)]
 pub struct NativeFile {
    pub doc: Document,
+    /// What was done to bring the document within the nesting caps
+    /// ([`Document::limit_depth_noting`]: a file saved before them, or a damaged one).
+    pub depth_notes: Vec<String>,
    pub info: FileInfo,
    /// ICC files by profile name (saved with Embed ICC Profiles; undecodable ones are left out).
    pub profiles: BTreeMap<String, Vec<u8>>,
@@ -511,7 +514,11 @@ pub fn load_info(bytes: &[u8]) -> Result<(Document, FileInfo), FormatError> {
 /// [`load`], with everything else the file carries.
 pub fn load_file(bytes: &[u8]) -> Result<NativeFile, FormatError> {
    let file = unpack::Unpacked::new(bytes)?;
-    let f: File = serde_json::from_slice(file.json()).map_err(|e| FormatError::NotVectorcraft(e.to_string()))?;
+    // The JSON reader stops at 128 levels (a document's objects use three each).
+    let f: File = serde_json::from_slice(file.json()).map_err(|e| {
+        let why = if e.to_string().contains("recursion limit") { format!("its objects are nested too deep ({e})") } else { e.to_string() };
+        FormatError::NotVectorcraft(why)
+    })?;
    if f.format != EXTENSION && f.format != LEGACY_EXTENSION {
        return Err(FormatError::NotVectorcraft(format!("format is `{}`", f.format)));
    }
@@ -545,8 +552,10 @@ pub fn load_file(bytes: &[u8]) -> Result<NativeFile, FormatError> {
    // Untrusted: capped, named and pointing at objects the file has.
    doc.tidy_saved_selections();
    doc.tidy_graph_designs();
+    let mut depth_notes = vec![];
+    doc.limit_depth_noting(&mut depth_notes);
    let profiles = f.profiles.into_iter().filter_map(|(name, icc)| Some((name, bytes_of(&icc)?))).collect();
-    Ok(NativeFile { doc, info: FileInfo { version: f.version, legacy: f.format == LEGACY_EXTENSION }, profiles })
+    Ok(NativeFile { doc, depth_notes, info: FileInfo { version: f.version, legacy: f.format == LEGACY_EXTENSION }, profiles })
 }

 /// The members of a native file besides its document (which is skipped, not decoded).
@@ -66,7 +66,8 @@ impl<W: Write> Write for Out<W> {
 const OUT_CHUNK: usize = 64 << 10;

 /// A gzip stream, written as [`flate2::write::GzEncoder`] at the default level writes it (the
-/// same header, and the same bytes for a file without compressed images), except that data which
+/// same header and the same data; the deflate blocks are the same too where flate2 deflates with
+/// miniz_oxide, not with zlib-rs, which writes them by how the data is fed), except that data which
 /// is compressed already ([`Gz::packed`]) is stored as it is: the default level spends a second
 /// or more per photo on it for next to nothing, and makes it slower to unpack. Where the level
 /// changes the deflate blocks so far end with a sync flush and a fresh compressor writes on,
@@ -122,6 +122,11 @@ impl<'a> Unpacked<'a> {
    /// data (entries sharing bytes, only in hand-made files, would copy them once each). Entries
    /// are read in the order of their offsets, each straight into its own buffer.
    pub(crate) fn entries(self, wanted: &[[u64; 2]]) -> Result<Vec<Option<Vec<u8>>>, FormatError> {
+        self.entries_within(wanted, MAX_WORK)
+    }
+
+    /// [`Self::entries`], unpacking at most `work` bytes of a streamed file to find them.
+    fn entries_within(self, wanted: &[[u64; 2]], work: u64) -> Result<Vec<Option<Vec<u8>>>, FormatError> {
        let mut out: Vec<Option<Vec<u8>>> = vec![None; wanted.len()];
        let in_memory = |tail: &[u8], out: &mut Vec<Option<Vec<u8>>>| {
            for (slot, &[offset, len]) in out.iter_mut().zip(wanted) {
@@ -147,7 +152,7 @@ impl<'a> Unpacked<'a> {
                drop(self.json);
                let mut order: Vec<usize> = (0..wanted.len()).collect();
                order.sort_by_key(|&i| wanted.get(i).map_or(0, |w| w[0]));
-                let mut s = Stream { r: Box::new(io::Cursor::new(read).chain(rest)), pos: 0, file, at };
+                let mut s = Stream { r: Box::new(io::Cursor::new(read).chain(rest)), pos: 0, file, at, left: work };
                for i in order {
                    let Some(&[offset, len]) = wanted.get(i) else { continue };
                    if let Some(slot) = out.get_mut(i) {
@@ -155,6 +160,7 @@ impl<'a> Unpacked<'a> {
                    }
                }
                // To the end, so the stream's checksum is verified as before.
+                s.left = MAX_BLOBS;
                s.skip(MAX_BLOBS)?;
            }
        }
@@ -188,12 +194,29 @@ struct Stream<'a> {
    file: &'a [u8],
    /// Where the data after the JSON starts in the unpacked stream.
    at: u64,
+    /// Bytes that may still be unpacked ([`MAX_WORK`] in all): the entries' own, the gaps before
+    /// them, and the stream from its start again for each entry behind the one before.
+    left: u64,
 }

+/// Most bytes unpacked to read a streamed file's entries: the entries and the gaps between them
+/// ([`MAX_BLOBS`] in a file a writer made, where they follow each other), and the JSON once more.
+/// The entries' lengths alone don't bound it: one byte asked for at a far offset unpacks all
+/// that lies before it, and each entry behind the last one starts the stream over (#1699).
+const MAX_WORK: u64 = MAX_BLOBS + MAX_JSON;
+
 impl Stream<'_> {
+    /// Count `n` bytes unpacked against the budget.
+    fn spend(&mut self, n: u64) -> Result<(), FormatError> {
+        self.left = self.left.checked_sub(n).ok_or(FormatError::TooBig)?;
+        Ok(())
+    }
+
    /// Unpack and drop up to `n` bytes → how many there were.
    fn skip(&mut self, n: u64) -> Result<u64, FormatError> {
-        let skipped = io::copy(&mut (&mut self.r).take(n), &mut io::sink()).map_err(damaged)?;
+        // One byte past the budget at most, so going over it is seen without doing the work.
+        let skipped = io::copy(&mut (&mut self.r).take(n.min(self.left.saturating_add(1))), &mut io::sink()).map_err(damaged)?;
+        self.spend(skipped)?;
        self.pos += skipped;
        Ok(skipped)
    }
@@ -204,7 +227,8 @@ impl Stream<'_> {
            // Entries out of order or overlapping (only hand-made files): unpack again from the
            // start.
            let mut dec = GzDecoder::new(self.file);
-            let skipped = io::copy(&mut (&mut dec).take(self.at), &mut io::sink()).map_err(damaged)?;
+            let skipped = io::copy(&mut (&mut dec).take(self.at.min(self.left.saturating_add(1))), &mut io::sink()).map_err(damaged)?;
+            self.spend(skipped)?;
            if skipped < self.at {
                return Ok(None);
            }
@@ -219,7 +243,8 @@ impl Stream<'_> {
        let n = usize::try_from(len).map_err(|_| FormatError::TooBig)?;
        // The length is the file's word: reserve up to a bound, and let real data grow the rest.
        bytes.try_reserve_exact(n.min(RESERVE_MAX)).map_err(|_| FormatError::TooBig)?;
-        let got = (&mut self.r).take(len).read_to_end(&mut bytes).map_err(damaged)?;
+        let got = (&mut self.r).take(len.min(self.left.saturating_add(1))).read_to_end(&mut bytes).map_err(damaged)?;
+        self.spend(got as u64)?;
        self.pos += got as u64;
        Ok((got as u64 == len).then_some(bytes))
    }
@@ -237,6 +262,35 @@ mod tests {
        gz.finish().unwrap()
    }

+    /// #1699: reading a streamed file's entries unpacks a bounded number of bytes, whatever
+    /// their offsets: a far offset and entries behind one another are refused past the budget.
+    #[test]
+    fn a_streamed_files_entries_are_found_within_a_work_budget() {
+        let tail: Vec<u8> = (0..4096u32).map(|i| (i % 251) as u8).collect();
+        let mut file = b"{}".to_vec();
+        file.extend(crate::BLOB_MAGIC);
+        file.extend(&tail);
+        let file = gzip(&file);
+        let read = |wanted: &[[u64; 2]], work: u64| {
+            let u = Unpacked::new(&file).unwrap();
+            assert!(matches!(u.tail, Tail::Stream { .. }), "read as a stream");
+            u.entries_within(wanted, work)
+        };
+        // Entries one after the other: the tail is unpacked once.
+        let parts = read(&[[0, 1000], [1000, 3096]], 4096).unwrap();
+        assert_eq!(parts, vec![Some(tail[..1000].to_vec()), Some(tail[1000..].to_vec())]);
+        // One byte at the far end is the whole tail's work.
+        assert_eq!(read(&[[4095, 1]], 4096).unwrap(), vec![Some(vec![tail[4095]])]);
+        assert!(matches!(read(&[[4095, 1]], 4000), Err(FormatError::TooBig)));
+        // Entries over the same bytes start the stream again each time: counted, then refused.
+        let same = vec![[4000, 96]; 50];
+        assert!(read(&same, 50 * (4096 + 64)).is_ok());
+        assert!(matches!(read(&same, 3 * 4096), Err(FormatError::TooBig)));
+        // An offset past the data is still just missing, and the default budget reads all of it.
+        assert_eq!(read(&[[1 << 40, 1]], 1 << 20).unwrap(), vec![None]);
+        assert_eq!(Unpacked::new(&file).unwrap().entries(&[[0, 4096]]).unwrap(), vec![Some(tail.clone())]);
+    }
+
    #[test]
    fn entries_sharing_bytes_obey_the_limits_in_memory_too() {
        // Each entry within MAX_BLOB, together past MAX_BLOBS: many references to the same bytes.
@@ -1,7 +1,7 @@
 //! Saving and opening as streams: the bytes a save writes are those an in-memory save wrote
-//! before (the same JSON and data after it, unpacked; the same gzip bytes when no image is
-//! compressed already), files written the old way still open, entries are read whatever their
-//! order, and the limits apply per part of the file.
+//! before (the same JSON and data after it, unpacked; the same gzip header), files written the old
+//! way still open, entries are read whatever their order, and the limits apply per part of the
+//! file.
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

@@ -67,13 +67,17 @@ fn compressed_files_unpack_to_the_plain_file() {
    }
 }

+/// The deflate bytes themselves depend on flate2's backend: zlib-rs (which hayro turns on) writes
+/// other blocks for data fed in other pieces than the in-memory save fed it, miniz_oxide didn't.
 #[test]
-fn without_compressed_images_the_gzip_bytes_are_the_old_ones() {
+fn without_compressed_images_the_gzip_stream_is_the_old_one() {
    let mut d = doc_with(&[("scan", "image/tiff", INLINE_MAX * 2), ("icon", "image/png", 100)]);
    d.title = "No photos".into();
    for o in [SaveOptions::default(), SaveOptions { pdf: Some(vec![b'%'; INLINE_MAX]), ..SaveOptions::default() }] {
        let plain = save_with(&d, &o).unwrap();
-        assert_eq!(save_with(&d, &SaveOptions { compress: true, ..o }).unwrap(), gzip(&plain));
+        let (packed, old) = (save_with(&d, &SaveOptions { compress: true, ..o }).unwrap(), gzip(&plain));
+        assert_eq!(packed.get(..10), old.get(..10), "the same header");
+        assert_eq!(gunzip(&packed), plain);
    }
 }

@@ -102,7 +102,9 @@ pub struct Imported {
 /// Read an EMF or WMF file (with or without a placeable header) into a document whose one
 /// artboard is the picture's frame.
 pub fn import(bytes: &[u8]) -> Result<Imported, String> {
-    import::import(bytes)
+    let mut i = import::import(bytes)?;
+    i.document.limit_depth_noting(&mut i.warnings);
+    Ok(i)
 }

 #[cfg(test)]
@@ -23,8 +23,8 @@ image = { workspace = true }
 # CMYK JPEGs (the image crate writes RGB and grey ones only).
 jpeg-encoder = { workspace = true }
 krilla = { workspace = true }
-hayro-syntax = "0.7.2"
-hayro-interpret = { version = "0.7.0", default-features = false, features = ["embed-fonts", "embed-cmaps"] }
+hayro-syntax = "0.8.0"
+hayro-interpret = { version = "0.8.0", default-features = false, features = ["embed-fonts", "embed-cmaps"] }
 log = { workspace = true }
 smallvec = "1"
 serde = { workspace = true }
@@ -3,12 +3,12 @@
 use std::collections::{HashMap, HashSet};
 use std::sync::{Arc, Mutex};

-use hayro_interpret::font::Glyph;
+use hayro_interpret::font::{Glyph, GlyphRun as ShownGlyphs};
 use hayro_interpret::hayro_cmap::BfString;
 use hayro_interpret::pattern::{Pattern, TilingPattern};
 use hayro_interpret::{
-    CacheKey, ClipPath, Context, Device, GlyphDrawMode, Image, ImageData, InterpreterCache, InterpreterSettings, InterpreterWarning, LumaData,
-    MaskType, PathDrawMode, SoftMask, StrokeProps, interpret_page,
+    CacheKey, ClipPath, Context, Device, DrawMode, DrawProps, Image, ImageData, ImageDrawProps, InterpreterCache, InterpreterSettings,
+    InterpreterWarning, LumaData, MaskType, SoftMask, StrokeProps, interpret_page,
 };
 use hayro_syntax::object::Name;
 use kurbo::{Affine, BezPath, PathEl, Rect, Shape};
@@ -147,6 +147,13 @@ pub const PAST_PAGE_NOTE: &str = "art reaching past the page was clipped to it,

 /// Import a PDF, returning the document plus warnings about content that was approximated or skipped.
 pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportReport, PdfError> {
+    // The interpreter draws forms, patterns, glyphs and masks inside one another by recursion, in
+    // large stack frames: it caps that (50 deep), and gets room for the cap whatever thread asks.
+    vectorcraft_doc::depth::with_deep_stack(|| read(bytes, opts))
+}
+
+/// [`import_with_report`] on the thread that asks.
+pub(crate) fn read(bytes: &[u8], opts: &ImportOptions) -> Result<ImportReport, PdfError> {
    let original = crate::pages::open(bytes, opts.password.as_deref())?;
    let picked = crate::pages::picked(opts, original.pages().len())?;
    let mut ocgs = Ocgs::read(&original);
@@ -174,6 +181,9 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
            let msg = match w {
                InterpreterWarning::UnsupportedFont => "a font could not be read; its text was skipped",
                InterpreterWarning::ImageDecodeFailure => "an image could not be decoded and was skipped",
+                // Annotations aren't drawn (`render_annotations` below), and a kind of warning
+                // added later has no message yet.
+                _ => return,
            };
            if let Ok(mut v) = sink2.lock()
                && !v.iter().any(|x| x == msg)
@@ -417,6 +427,7 @@ pub fn import_with_report(bytes: &[u8], opts: &ImportOptions) -> Result<ImportRe
            }
        }
    }
+    doc.limit_depth_noting(&mut warnings);
    Ok(ImportReport { document: doc, warnings, native: crate::editing::editing_in(&pdf), only_text })
 }

@@ -1259,8 +1270,8 @@ impl<'p> Builder<'p> {
    /// before it on the open line was stroked so too, is held with the line instead of ending it
    /// (an editor writes type on a path glyph by glyph, each followed by the stroke added to the
    /// type). `false`: it isn't one.
-    fn hold_glyph_stroke(&mut self, path: &BezPath, transform: Affine, paint: &hayro_interpret::Paint<'_>, draw_mode: &PathDrawMode) -> bool {
-        let PathDrawMode::Stroke(props) = draw_mode else { return false };
+    fn hold_glyph_stroke(&mut self, path: &BezPath, transform: Affine, paint: &hayro_interpret::Paint<'_>, draw_mode: &DrawMode) -> bool {
+        let DrawMode::Stroke(props) = draw_mode else { return false };
        if self.mask.is_some() || self.blend != BlendMode::Normal || matches!(paint, hayro_interpret::Paint::Pattern(_)) {
            return false;
        }
@@ -1352,7 +1363,11 @@ impl<'p> Builder<'p> {
            Some(art) => {
                let [r, g, b, _] = m.background_color().to_rgba().components();
                let backdrop = luminance(&Color::rgb(r, g, b));
-                let inverted = m.transfer_function().is_some_and(|tf| tf.apply(0.0) > tf.apply(1.0));
+                let inverted = m.transfer_function().is_some_and(|tf| {
+                    let mut ends = [0, 255];
+                    tf.apply_to(&mut ends);
+                    ends[0] > ends[1]
+                });
                let id = self.id();
                mask_spec(art, m.mask_type() == MaskType::Alpha, backdrop, inverted, page, |all| Node::group(id, all))
            }
@@ -1681,7 +1696,14 @@ fn resize_alpha(a: &LumaData, w: u32, h: u32) -> Vec<u8> {
    }
 }

-impl<'a> Device<'a> for Builder<'_> {
+/// What the interpreter draws, as the device below gets it.
+impl<'a> Builder<'_> {
+    /// The soft mask and blend mode of what is drawn next.
+    fn set_state(&mut self, mask: Option<SoftMask<'a>>, blend_mode: hayro_interpret::BlendMode) {
+        self.set_soft_mask(mask);
+        self.set_blend_mode(blend_mode);
+    }
+
    fn set_soft_mask(&mut self, mask: Option<SoftMask<'a>>) {
        let spec = mask.map(|m| self.soft_mask(&m));
        let same = match (&spec, &self.mask) {
@@ -1704,7 +1726,7 @@ impl<'a> Device<'a> for Builder<'_> {
        }
    }

-    fn draw_path(&mut self, path: &BezPath, transform: Affine, paint: &hayro_interpret::Paint<'a>, draw_mode: &PathDrawMode) {
+    fn path(&mut self, path: &BezPath, transform: Affine, paint: &hayro_interpret::Paint<'a>, draw_mode: &DrawMode) {
        self.flush_glyphs();
        if self.hold_glyph_stroke(path, transform, paint, draw_mode) {
            self.pending = false;
@@ -1726,19 +1748,19 @@ impl<'a> Device<'a> for Builder<'_> {
            hayro_interpret::Paint::Color(_) => None,
        };
        // Patch and triangle meshes are gradient meshes.
-        if let (PathDrawMode::Fill(_), Some(sp)) = (draw_mode, shading)
+        if let (DrawMode::Fill(_), Some(sp)) = (draw_mode, shading)
            && let Some(meshes) = mesh_shading(sp, &mut self.colors)
        {
            self.draw_meshes(meshes, &bp, sp.opacity);
            return;
        }
        let pd = PathData::from_bezpath(&bp);
-        let stroke = matches!(draw_mode, PathDrawMode::Stroke(_));
+        let stroke = matches!(draw_mode, DrawMode::Stroke(_));
        let (paint, opacity) = self.paint(paint, stroke);
        // A gradient that doesn't extend past its ends paints only between them.
        let width = match draw_mode {
-            PathDrawMode::Stroke(p) => p.line_width as f64 * mean_scale(transform),
-            PathDrawMode::Fill(_) => 0.0,
+            DrawMode::Stroke(p) => p.line_width as f64 * mean_scale(transform),
+            _ => 0.0,
        };
        let band = shading.and_then(|sp| extend_clip(sp, bp.bounding_box().inflate(width, width)));
        let wrap = |b: &mut Self, n: Node| match &band {
@@ -1750,7 +1772,7 @@ impl<'a> Device<'a> for Builder<'_> {
            None => n,
        };
        match draw_mode {
-            PathDrawMode::Fill(rule) => {
+            DrawMode::Fill(rule) => {
                let mut f = FillLayer::new(paint);
                (f.opacity, f.overprint) = (opacity, overprint);
                let mut n = Node::path(self.id(), pd, Appearance { items: vec![AppearanceItem::Fill(f)], ..Default::default() });
@@ -1761,7 +1783,7 @@ impl<'a> Device<'a> for Builder<'_> {
                let n = wrap(self, n);
                self.push_node(n);
            }
-            PathDrawMode::Stroke(props) => {
+            DrawMode::Stroke(props) => {
                let mut st = stroke_layer(paint, opacity, props, mean_scale(transform));
                st.overprint = overprint;
                // Fill-then-stroke of the same path (the `B` operator, or a fill and then a stroke
@@ -1796,6 +1818,71 @@ impl<'a> Device<'a> for Builder<'_> {
                let n = wrap(self, n);
                self.push_node(n);
            }
+            // (`draw_path` gives a fill and a stroke one after the other, and no path is invisible.)
+            DrawMode::FillAndStroke(..) | DrawMode::Invisible => {}
+        }
+    }
+
+    /// One glyph: filled, or stroked with `stroke`.
+    fn glyph(
+        &mut self,
+        glyph: &Glyph<'a>,
+        transform: Affine,
+        glyph_transform: Affine,
+        paint: &hayro_interpret::Paint<'a>,
+        stroke: Option<&StrokeProps>,
+    ) {
+        self.pending = false;
+        match glyph {
+            Glyph::Outline(o) => {
+                let scale = mean_scale(transform);
+                let overprint = self.glyph_overprint(stroke.is_some());
+                if self.type_glyph(o, transform * glyph_transform, scale, paint, stroke, overprint) {
+                    return;
+                }
+                self.flush_text();
+                let mut bp = o.outline();
+                bp.apply_affine(transform * glyph_transform);
+                let (paint, opacity) = self.paint(paint, stroke.is_some());
+                let same = self.glyphs.as_ref().is_some_and(|r| {
+                    r.paint == paint
+                        && r.opacity == opacity
+                        && r.overprint == overprint
+                        && r.stroke.as_ref().map(|s| s.line_width) == stroke.map(|s| s.line_width)
+                        && (r.scale - scale).abs() < 1e-9
+                });
+                if !same {
+                    self.flush_glyphs();
+                    self.glyphs = Some(GlyphRun { path: BezPath::new(), paint, opacity, stroke: stroke.cloned(), scale, overprint });
+                }
+                if let Some(r) = &mut self.glyphs {
+                    r.path.extend(bp.iter());
+                }
+                self.warn("text was converted to outlines");
+            }
+            Glyph::Type3(t3) => {
+                if self.nested >= MAX_NESTED {
+                    return;
+                }
+                self.flush();
+                self.nested += 1;
+                t3.interpret(self, transform, glyph_transform, paint);
+                self.nested -= 1;
+            }
+        }
+    }
+}
+
+impl<'a> Device<'a> for Builder<'_> {
+    fn draw_path(&mut self, path: &BezPath, props: DrawProps<'a>, draw_mode: &DrawMode) {
+        self.set_state(props.soft_mask, props.blend_mode);
+        match draw_mode {
+            DrawMode::Invisible => {}
+            DrawMode::FillAndStroke(rule, stroke) => {
+                self.path(path, props.transform, &props.paint, &DrawMode::Fill(*rule));
+                self.path(path, props.transform, &props.paint, &DrawMode::Stroke(stroke.clone()));
+            }
+            one => self.path(path, props.transform, &props.paint, one),
        }
    }

@@ -1831,60 +1918,22 @@ impl<'a> Device<'a> for Builder<'_> {
        self.blend = BlendMode::Normal;
    }

-    fn draw_glyph(
-        &mut self,
-        glyph: &Glyph<'a>,
-        transform: Affine,
-        glyph_transform: Affine,
-        paint: &hayro_interpret::Paint<'a>,
-        draw_mode: &GlyphDrawMode,
-    ) {
-        self.pending = false;
+    fn draw_glyph_run(&mut self, glyph_run: &ShownGlyphs<'_, 'a>, props: DrawProps<'a>, draw_mode: &DrawMode) {
+        // (A run is filled or stroked: one filled and stroked is given twice.)
        let stroke = match draw_mode {
-            GlyphDrawMode::Invisible => return,
-            GlyphDrawMode::Fill => None,
-            GlyphDrawMode::Stroke(p) => Some(p.clone()),
+            DrawMode::Invisible => return,
+            DrawMode::Fill(_) => None,
+            DrawMode::Stroke(p) | DrawMode::FillAndStroke(_, p) => Some(p),
        };
-        match glyph {
-            Glyph::Outline(o) => {
-                let scale = mean_scale(transform);
-                let overprint = self.glyph_overprint(stroke.is_some());
-                if self.type_glyph(o, transform * glyph_transform, scale, paint, stroke.as_ref(), overprint) {
-                    return;
-                }
-                self.flush_text();
-                let mut bp = o.outline();
-                bp.apply_affine(transform * glyph_transform);
-                let (paint, opacity) = self.paint(paint, stroke.is_some());
-                let same = self.glyphs.as_ref().is_some_and(|r| {
-                    r.paint == paint
-                        && r.opacity == opacity
-                        && r.overprint == overprint
-                        && r.stroke.as_ref().map(|s| s.line_width) == stroke.as_ref().map(|s| s.line_width)
-                        && (r.scale - scale).abs() < 1e-9
-                });
-                if !same {
-                    self.flush_glyphs();
-                    self.glyphs = Some(GlyphRun { path: BezPath::new(), paint, opacity, stroke, scale, overprint });
-                }
-                if let Some(r) = &mut self.glyphs {
-                    r.path.extend(bp.iter());
-                }
-                self.warn("text was converted to outlines");
-            }
-            Glyph::Type3(t3) => {
-                if self.nested >= MAX_NESTED {
-                    return;
-                }
-                self.flush();
-                self.nested += 1;
-                t3.interpret(self, transform, glyph_transform, paint);
-                self.nested -= 1;
-            }
+        for g in glyph_run.glyphs() {
+            self.set_state(props.soft_mask.clone(), props.blend_mode);
+            self.glyph(g, props.transform, g.transform(), &props.paint, stroke);
        }
    }

-    fn draw_image(&mut self, image: Image<'a, '_>, transform: Affine) {
+    fn draw_image(&mut self, image: Image<'a, '_>, props: ImageDrawProps<'a>) {
+        self.set_state(props.soft_mask, props.blend_mode);
+        let transform = props.transform;
        self.flush_glyphs();
        self.flush_text();
        self.pending = false;
@@ -1972,7 +2021,7 @@ impl<'a> Device<'a> for Builder<'_> {
        }
    }

-    fn pop_clip_path(&mut self) {
+    fn pop_clip(&mut self) {
        self.flush();
        self.pending = false;
        self.pop_frame();
@@ -379,7 +379,7 @@ impl<'p> Colors<'p> {
 }

 /// An object written in place (references are visited as objects of their own).
-fn direct(m: MaybeRef<Object<'_>>) -> Option<Object<'_>> {
+pub(crate) fn direct(m: MaybeRef<Object<'_>>) -> Option<Object<'_>> {
    match m {
        MaybeRef::NotRef(o) => Some(o),
        MaybeRef::Ref(_) => None,
@@ -485,7 +485,8 @@ impl Walker<'_, '_> {
                        {
                            self.out.groups.push((g.get::<bool>(b"I").unwrap_or(false), g.get::<bool>(b"K").unwrap_or(false)));
                        }
-                        let inner = Resources::from_parent(d.get::<Dict<'_>>(b"Resources").unwrap_or_default(), res.clone());
+                        // (Its own resources, or without any those of what draws it: as the interpreter reads them.)
+                        let inner = d.get::<Dict<'_>>(b"Resources").map(Resources::new).unwrap_or_else(|| res.clone());
                        self.save();
                        self.walk(TypedIter::new(data.as_ref()), &inner, depth + 1);
                        self.restore();
@@ -34,7 +34,7 @@ pub(crate) fn shading_gradient(sp: &ShadingPattern, colors: &mut Colors<'_>) ->
    let space = colors.shading_space(cs, at(0.0)?.len());
    // RGB to decide which samples are stops; the stops keep the shading's model.
    let sample = |t: f32| -> Option<Color> {
-        let [r, g, b, _] = cs.to_rgba(&at(t)?, 1.0, false).components();
+        let [r, g, b, _] = cs.to_rgba(&at(t)?, 1.0).components();
        Some(Color::rgb(round3(r), round3(g), round3(b)))
    };
    // Sample densely, then drop samples that linear interpolation reproduces.
@@ -147,7 +147,7 @@ fn mesh_color(v: &[f32], function: Option<&ShadingFunction>, sp: &ShadingPattern
    };
    let space = colors.shading_space(&sp.shading.color_space, comps.len());
    colors.native(space, &comps).map(|n| n.color).unwrap_or_else(|| {
-        let [r, g, b, _] = sp.shading.color_space.to_rgba(&comps, 1.0, false).components();
+        let [r, g, b, _] = sp.shading.color_space.to_rgba(&comps, 1.0).components();
        Color::rgb(round3(r), round3(g), round3(b))
    })
 }
@@ -1,12 +1,16 @@
 //! The pages of a PDF to import: opening with a password, the pages picked, the box each page
 //! is cropped to ([`CropTo`]) and [`info`].

-use hayro_syntax::object::{Dict, Stream};
+use std::collections::HashMap;
+
+use hayro_syntax::object::{Array, Dict, MaybeRef, Name, Object, ObjectIdentifier, Stream, dict_or_stream};
 use hayro_syntax::page::Page;
+use hayro_syntax::xref::XRef;
 use hayro_syntax::{DecryptionError, LoadPdfError, Pdf};
 use kurbo::{Affine, Rect};
 use vectorcraft_doc::setup::MAX_BLEED;

+use crate::import_color::direct;
 use crate::{Choice, CropTo, ImportOptions, PdfError};

 /// What `info` tells about one page.
@@ -33,8 +37,112 @@ pub fn is_postscript(bytes: &[u8]) -> bool {
    bytes.starts_with(b"%!PS") || bytes.starts_with(&[0xC5, 0xD0, 0xD3, 0xC6])
 }

+/// The most functions and colour spaces that may be built on one another (a function stitching
+/// functions together, an indexed space on a space with an alternate). The interpreter (hayro)
+/// builds them by recursion, without a cap of its own: one built on itself, or thousands in a
+/// chain, overflows the stack, which is an abort, not an error. Files have two or three.
+const MAX_LINKS: usize = 16;
+
+/// The deepest the procedures of a calculator function may nest: read by recursion, too.
+const MAX_PROCEDURES: usize = 64;
+
+/// What the function or colour space `o` is built on: the functions a stitching function joins;
+/// the base, alternate and tint of a colour space; the alternate of a colour profile. Nothing for
+/// any other object.
+fn links<'a>(o: &Object<'a>, xref: &'a XRef) -> Vec<MaybeRef<Object<'a>>> {
+    const SPACES: [&[u8]; 6] = [b"Indexed", b"I", b"Separation", b"DeviceN", b"Pattern", b"ICCBased"];
+    if let Object::Array(a) = o {
+        let mut items = a.raw_iter();
+        let kind = match items.next() {
+            Some(MaybeRef::NotRef(Object::Name(n))) => Some(n),
+            Some(MaybeRef::Ref(r)) => xref.get::<Name<'a>>(r.into()),
+            _ => None,
+        };
+        return if kind.is_some_and(|n| SPACES.contains(&n.as_ref())) { items.collect() } else { vec![] };
+    }
+    let Some((d, _)) = dict_or_stream(o) else { return vec![] };
+    let functions = d.get::<Array<'a>>(b"Functions").map(|a| a.raw_iter().collect::<Vec<_>>()).unwrap_or_default();
+    functions.into_iter().chain(d.get_raw::<Object<'a>>(b"Alternate")).collect()
+}
+
+/// How many of its kind the function or colour space `o` is built on, one on the next (0 for any
+/// other object); `None` past `room`, or when it is built on itself. `known`: the objects looked
+/// at so far (`None` while one is being looked at, too). One `None` refuses the file, so that an
+/// object is `None` only for the room there was where it was first met doesn't matter.
+fn built_on<'a>(o: MaybeRef<Object<'a>>, xref: &'a XRef, known: &mut HashMap<ObjectIdentifier, Option<usize>>, room: usize) -> Option<usize> {
+    let (id, o) = match o {
+        MaybeRef::Ref(r) => {
+            let id = ObjectIdentifier::from(r);
+            if let Some(found) = known.get(&id) {
+                return *found;
+            }
+            let Some(o) = xref.get::<Object<'a>>(id) else { return Some(0) };
+            known.insert(id, None);
+            (Some(id), o)
+        }
+        MaybeRef::NotRef(o) => (None, o),
+    };
+    let links = links(&o, xref);
+    let most = match room.checked_sub(1) {
+        _ if links.is_empty() => Some(0),
+        Some(room) => links.into_iter().try_fold(0, |most, on| built_on(on, xref, known, room).map(|n| most.max(n + 1))),
+        None => None,
+    };
+    // (What it is built on may be known already, and deeper than there is room for here.)
+    let most = most.filter(|n| *n <= room);
+    if let Some(id) = id {
+        known.insert(id, most);
+    }
+    most
+}
+
+/// Is `o` a calculator function whose procedures nest deeper than [`MAX_PROCEDURES`]?
+fn procedures_too_deep(o: &Object<'_>) -> bool {
+    let Object::Stream(s) = o else { return false };
+    if s.dict().get::<u8>(b"FunctionType") != Some(4) {
+        return false;
+    }
+    let Ok(program) = s.decoded() else { return false };
+    let mut depth = 0usize;
+    program.iter().any(|c| {
+        match c {
+            b'{' => depth += 1,
+            b'}' => depth = depth.saturating_sub(1),
+            _ => {}
+        }
+        depth > MAX_PROCEDURES
+    })
+}
+
+/// Does `pdf` hold functions or colour spaces built on one another past [`MAX_LINKS`] (or on
+/// themselves), or a calculator function nested past [`MAX_PROCEDURES`]? Every object is looked
+/// at, wherever it is used from: the interpreter builds them from resources, shadings, images,
+/// patterns, masks and graphics states alike.
+fn nests_without_end(pdf: &Pdf) -> bool {
+    let xref = pdf.xref();
+    let mut known = HashMap::new();
+    // The objects of the file, then what each holds directly (64 deep at most: the reader's cap).
+    let mut pending: Vec<Object<'_>> = pdf.objects().into_iter().collect();
+    while let Some(o) = pending.pop() {
+        if procedures_too_deep(&o) || built_on(MaybeRef::NotRef(o.clone()), xref, &mut known, MAX_LINKS).is_none() {
+            return true;
+        }
+        match &o {
+            Object::Array(a) => pending.extend(a.raw_iter().filter_map(direct)),
+            _ => pending.extend(dict_or_stream(&o).into_iter().flat_map(|(d, _)| d.entries()).filter_map(|(_, v)| direct(v))),
+        }
+    }
+    false
+}
+
 /// Read a PDF, decrypting it with `password` (none: the empty user password). The permissions
 /// password opens a file too.
+///
+/// What a hostile file nests or loops is the reader's to refuse (hayro 0.8 reads arrays and
+/// dictionaries 64 deep and no deeper, wherever they are: the file's text, an object stream, the
+/// content of a page, form, pattern or glyph; and follows a page tree or a chain of object streams
+/// once). What it reads beyond that is left out, as an object it can't read. What the interpreter
+/// builds by recursion with no cap is refused here ([`nests_without_end`]).
 pub(crate) fn open(bytes: &[u8], password: Option<&str>) -> Result<Pdf, PdfError> {
    if is_postscript(bytes) {
        return Err(PdfError::PostScript);
@@ -55,6 +163,12 @@ pub(crate) fn open(bytes: &[u8], password: Option<&str>) -> Result<Pdf, PdfError
            LoadPdfError::Decryption(DecryptionError::PasswordProtected) => PdfError::WrongPassword,
            e => PdfError::Parse(format!("{e:?}")),
        })
+        // Twice: looking at every object makes the reader repair a damaged table of objects (once
+        // only), and the objects are other ones after that.
+        .and_then(|pdf| match (0..2).any(|_| nests_without_end(&pdf)) {
+            true => Err(PdfError::Parse("its functions or colour spaces are built on one another without end".into())),
+            false => Ok(pdf),
+        })
 }

 /// The pages and their boxes. An encrypted PDF needs its `password`
@@ -734,3 +734,46 @@ fn opacity_mask_exports_as_luminosity_soft_mask() {
    assert!(text.contains("/SMask"), "soft mask in an ExtGState");
    assert!(text.contains("/Luminosity"));
 }
+
+/// A function or colour space built on itself is refused before the interpreter builds it (by
+/// recursion, with no cap: a stack overflow), and those of real files are read.
+#[test]
+fn functions_and_colour_spaces_built_on_themselves_are_refused() {
+    use vectorcraft_testkit::pdf::{PdfPage, first_extra, pdf_with};
+    let first = first_extra(1);
+    let (me, next) = (format!("{first} 0 R"), format!("{} 0 R", first + 1));
+    let shaded = PdfPage {
+        resources: format!("/Shading << /S << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Function {me} >> >>"),
+        ..PdfPage::new(100.0, 100.0, "/S sh")
+    };
+    let filled = PdfPage { resources: format!("/ColorSpace << /C {me} >>"), ..PdfPage::new(100.0, 100.0, "/C cs 0 sc 0 0 50 50 re f") };
+    let stitch = |on: &str| format!("<< /FunctionType 3 /Domain [0 1] /Functions [{on}] /Bounds [] /Encode [0 1] >>");
+    let indexed = |on: &str| format!("[/Indexed {on} 1 <000000ffffff>]");
+    let ramp = "<< /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [0 0 1] /N 1 >>";
+    // `n` functions, each stitching the next, then a plain one.
+    let chain = |n: usize| (1..=n).map(|i| stitch(&format!("{} 0 R", first + i))).chain([ramp.to_string()]).collect::<Vec<_>>();
+    let calculator =
+        |program: &str| format!("<< /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >>\nstream\n{program}\nendstream", program.len());
+    for (what, page, objects) in [
+        ("a function stitching itself", &shaded, vec![stitch(&me)]),
+        ("two functions stitching each other", &shaded, vec![stitch(&next), stitch(&me)]),
+        ("twenty functions, each stitching the next", &shaded, chain(20)),
+        ("procedures in procedures", &shaded, vec![calculator(&format!("{}{}", "{".repeat(100), "}".repeat(100)))]),
+        ("a colour space on itself", &filled, vec![indexed(&me)]),
+        ("two colour spaces on each other", &filled, vec![indexed(&next), indexed(&me)]),
+    ] {
+        let objects: Vec<&str> = objects.iter().map(String::as_str).collect();
+        let e = import(&pdf_with(std::slice::from_ref(page), &objects, None)).err().map(|e| e.to_string());
+        assert!(e.as_deref().is_some_and(|e| e.contains("built on one another without end")), "{what}: {e:?}");
+    }
+    for (what, page, objects) in [
+        ("a function stitching one", &shaded, vec![stitch(&next), ramp.to_string()]),
+        ("three functions, each stitching the next", &shaded, chain(3)),
+        ("a calculator function", &shaded, vec![calculator("{ dup 1 exch sub 0 }")]),
+        ("an indexed colour space", &filled, vec![indexed("/DeviceRGB")]),
+    ] {
+        let objects: Vec<&str> = objects.iter().map(String::as_str).collect();
+        let d = import(&pdf_with(std::slice::from_ref(page), &objects, None)).unwrap_or_else(|e| panic!("{what}: {e}"));
+        assert!(d.layers.iter().any(|l| l.children().is_some_and(|c| !c.is_empty())), "{what}: its art is read");
+    }
+}
@@ -287,7 +287,7 @@ fn a_sublayer_that_paints_first_brings_its_parent_layer() {
 #[test]
 fn hostile_layer_orders_stay_bounded() {
    // A group listed twice, under itself, and an order nested far deeper than layers go.
-    let deep = format!("{}{{2}}{}", "[".repeat(100), "]".repeat(100));
+    let deep = format!("{}{{2}}{}", "[".repeat(40), "]".repeat(40));
    let order = format!("[{{0}} [{{0}} {{1}}] {{1}} [{{0}}] {deep}]");
    let d = import(&three_groups([&ocg("A", ""), &ocg("B", ""), &ocg("C", "")], &[], &format!("/Order {order}"))).unwrap();
    assert_eq!(names(&d), ["A", "C"], "C, listed too deep, stays a top-level layer");
@@ -317,7 +317,8 @@ fn thousands_of_layers_hidden_ones_included_all_come_in() {
 /// Import `bytes` with the scan's operator limit lowered to `n`.
 fn import_with_max_ops(bytes: &[u8], n: usize) -> ImportReport {
    let old = crate::import_scan::TEST_MAX_OPS.replace(n);
-    let r = import_with_report(bytes, &ImportOptions::default());
+    // (On this thread: the limit is this thread's.)
+    let r = crate::import::read(bytes, &ImportOptions::default());
    crate::import_scan::TEST_MAX_OPS.set(old);
    r.unwrap()
 }
@@ -366,6 +366,29 @@ fn linear_key(view: Affine) -> [u64; 4] {
    [c[0].to_bits(), c[1].to_bits(), c[2].to_bits(), c[3].to_bits()]
 }

+/// The raster a shadow or glow blurred by `blur` device pixels is filtered in, for content
+/// reaching `reach` (device pixels) in a view of `screen` pixels: (left, top, width, height,
+/// scale). It covers what of the reach can show in the view, the blur's spread around it
+/// included, at `scale` raster pixels a device pixel: 1, or less to stay within
+/// [`PIXEL_BUDGET`]. At a high zoom the spread of a wide blur is tens of thousands of pixels a
+/// side, whatever the size of the view (#1706). `None`: nothing to draw.
+fn filter_region(reach: Rect, screen: (u16, u16), blur: f64) -> Option<(f64, f64, u16, u16, f64)> {
+    // 3σ of the Gaussian (σ = blur / 2) in pixels, plus a pixel of antialiasing.
+    let spread = blur.max(0.0) * 1.5 + 2.0;
+    let screen = Rect::new(0.0, 0.0, f64::from(screen.0), f64::from(screen.1)).inflate(spread, spread);
+    let r = reach.inflate(spread, spread).intersect(screen);
+    let (x0, y0) = (r.x0.floor(), r.y0.floor());
+    let (rw, rh) = (r.x1.ceil() - x0, r.y1.ceil() - y0);
+    // (Also false for a reach or a blur that isn't a number.)
+    if !(rw >= 1.0 && rh >= 1.0 && rw.is_finite() && rh.is_finite()) {
+        return None;
+    }
+    let side = f64::from(u16::MAX);
+    let k = (PIXEL_BUDGET / (rw * rh)).sqrt().min(side / rw).min(side / rh).min(1.0);
+    let (w, h) = ((rw * k).floor().clamp(1.0, side), (rh * k).floor().clamp(1.0, side));
+    Some((x0, y0, w as u16, h as u16, k))
+}
+
 /// Draw `image` with its top-left at (`x`, `y`) device pixels, `1 / k` device pixels a pixel.
 fn draw_scaled(ctx: &mut RenderContext, image: std::sync::Arc<vello_cpu::Pixmap>, (x, y): (f64, f64), k: f64) {
    let (w, h) = (image.width() as f64, image.height() as f64);
@@ -509,7 +532,8 @@ impl Drawn {
 /// objects in it ([`Reads::of`]): which parts of [`Inputs`] can change what its rasters show.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub(crate) struct Reads {
-    /// Pattern paints: the pattern definitions.
+    /// Pattern paints: the pattern definitions. Their art can hold anything, so content painted
+    /// with a pattern reads everything else too.
    patterns: bool,
    /// Symbol instances and type with inline graphics: the symbols' art. Symbol art can hold
    /// anything, so content that shows a symbol reads everything else too.
@@ -527,14 +551,25 @@ pub(crate) struct Reads {
 impl Reads {
    /// What the content of `n` reads.
    pub(crate) fn of(n: &Node) -> Self {
+        Self::of_all(std::iter::once(n))
+    }
+
+    /// What the content of `nodes` reads together. A pattern's art can hold anything, as a
+    /// symbol's can, so content painted with a pattern reads everything else too (#1723).
+    pub(crate) fn of_all<'a>(nodes: impl Iterator<Item = &'a Node>) -> Self {
        let mut reads = Self::default();
-        reads.add(n);
-        if reads.symbols {
+        nodes.for_each(|n| reads.add(n));
+        if reads.symbols || reads.patterns {
            return Self { patterns: true, symbols: true, images: true, brushes: true, text: true };
        }
        reads
    }

+    /// Does the content read anything outside its own nodes?
+    pub(crate) fn any(self) -> bool {
+        self != Self::default()
+    }
+
    fn add(&mut self, n: &Node) {
        let pattern = |p: &vectorcraft_color::Paint| matches!(p, vectorcraft_color::Paint::Pattern { .. });
        n.walk(&mut |c| {
@@ -869,10 +904,10 @@ impl Renderer {
                // A symbol's art can change while the instance doesn't: no cached shadows.
                let cache = (cache && !matches!(a.kind, NodeKind::SymbolInstance { .. })).then_some(0);
                let content = Content { node: a, owner: Some(a), cache, reach, outline: region.as_deref().map(|r| (&r.0, r.1)) };
-                self.raster_fx(ctx, f, &content, &rfx, &mut |r, c, fr| r.draw_node(c, fr, &art, true));
+                self.raster_fx(ctx, f, &content, &rfx, &mut |r, c, fr| r.draw_fx_art(c, fr, a, &art));
                ctx.set_transform(Affine::IDENTITY);
            }
-            _ => self.draw_node(ctx, f, &art, true),
+            _ => self.draw_fx_art(ctx, f, a, &art),
        }
        self.made_again = outer;
    }
@@ -939,6 +974,19 @@ impl Renderer {
        art
    }

+    /// Draw `art`, the art [`Self::fx_art`] made for `a`. Type art that `fx_arts` keeps for `a` is
+    /// drawn as `fx_owner`, so [`Self::draw_text`] takes its glyph geometry from `texts`.
+    fn draw_fx_art(&mut self, ctx: &mut RenderContext, f: &Frame, a: &Arc<Node>, art: &Arc<Node>) {
+        let kept =
+            matches!(art.kind, NodeKind::Text(_)) && self.fx_arts.get(&(Arc::as_ptr(a) as usize), self.stamp).is_some_and(|e| Arc::ptr_eq(&e.1, art));
+        if !kept {
+            return self.draw_node(ctx, f, art, true);
+        }
+        let outer = self.fx_owner.replace(art.clone());
+        self.draw_node(ctx, f, art, true);
+        self.fx_owner = outer;
+    }
+
    /// `art` with the colour adjustments inside it applied, then `outer` (its object's own) on
    /// everything ([`effects::adjust`]). Embedded images become recoloured copies, cached with the
    /// decoded images under a key naming the adjustment.
@@ -1352,18 +1400,9 @@ impl Renderer {
        if !f.mt {
            return self.inside_layer(|r| draw(r, ctx, f, composite));
        }
-        // 3σ of the Gaussian (σ = blur / 2) in pixels, plus a pixel of antialiasing.
-        let spread = blur.max(0.0) * 1.5 / f.px + 2.0;
-        let screen = Rect::new(0.0, 0.0, ctx.width() as f64, ctx.height() as f64).inflate(spread, spread);
-        let r = f.view.transform_rect_bbox(reach).inflate(spread, spread).intersect(screen);
-        let (x0, y0) = (r.x0.floor(), r.y0.floor());
-        let (w, h) = ((r.x1.ceil() - x0).min(u16::MAX as f64), (r.y1.ceil() - y0).min(u16::MAX as f64));
-        if w < 1.0 || h < 1.0 {
-            return;
-        }
-        let (w, h) = (w as u16, h as u16);
+        let Some((x0, y0, w, h, k)) = filter_region(f.view.transform_rect_bbox(reach), (ctx.width(), ctx.height()), blur / f.px) else { return };
        let mut off = f.offscreen_context(w, h);
-        let shifted = Frame { mt: false, view: Affine::translate((-x0, -y0)) * f.view, ..*f };
+        let shifted = Frame { mt: false, view: Affine::scale(k) * Affine::translate((-x0, -y0)) * f.view, px: f.px / k, ..*f };
        self.inside_layer(|r| draw(r, &mut off, &shifted, None));
        off.flush();
        let mut pm = vello_cpu::Pixmap::new(w, h);
@@ -1373,7 +1412,12 @@ impl Renderer {
            ctx.set_transform(Affine::IDENTITY);
            ctx.push_layer(None, Some(blend_mode(m)), Some(o), None, None);
        }
-        crate::group::draw_pixmap(ctx, std::sync::Arc::new(pm), (x0, y0));
+        if k < 1.0 {
+            draw_scaled(ctx, std::sync::Arc::new(pm), (x0, y0), k);
+            ctx.set_transform(Affine::IDENTITY);
+        } else {
+            crate::group::draw_pixmap(ctx, std::sync::Arc::new(pm), (x0, y0));
+        }
        if layered {
            ctx.pop_layer();
        }
@@ -1469,9 +1513,28 @@ mod tests {
    use vectorcraft_doc::{Appearance, Document, Effect, Node};
    use vectorcraft_geom::{Affine, Rect, shapes};

-    use super::Drawn;
+    use super::{Drawn, PIXEL_BUDGET, filter_region};
    use crate::{RenderOptions, Rendered, Renderer};

+    /// #1706: the raster a shadow or glow is filtered in stays within the pixel budget however
+    /// far the blur spreads at the zoom (it was up to 65535 pixels a side: 16 GB).
+    #[test]
+    fn a_wide_blur_at_a_high_zoom_is_filtered_within_the_pixel_budget() {
+        // A 100 pt square at 3200 % and at 6400 %, blurred by 1000 pt, in a 1600 × 1000 view.
+        for zoom in [32.0, 64.0] {
+            let reach = Rect::new(0.0, 0.0, 100.0 * zoom, 100.0 * zoom);
+            let (x0, y0, w, h, k) = filter_region(reach, (1600, 1000), 1000.0 * zoom).unwrap();
+            assert!(f64::from(w) * f64::from(h) <= PIXEL_BUDGET, "{w} × {h}");
+            assert!(k < 1.0 && x0 < 0.0 && y0 < 0.0);
+            // It still covers the view and the blur's spread around it, at that scale.
+            assert!(f64::from(w) / k >= 1600.0 + 1500.0 * zoom && f64::from(h) / k >= 1000.0 + 1500.0 * zoom);
+        }
+        // A small blur is filtered at full size, cropped to what can show.
+        assert_eq!(filter_region(Rect::new(10.0, 20.0, 110.0, 70.0), (1600, 1000), 4.0), Some((2.0, 12.0, 116, 66, 1.0)));
+        assert_eq!(filter_region(Rect::new(5000.0, 0.0, 5100.0, 100.0), (1600, 1000), 4.0), None, "off the view");
+        assert_eq!(filter_region(Rect::new(0.0, 0.0, 100.0, 100.0), (1600, 1000), f64::NAN).map(|r| r.4), Some(1.0));
+    }
+
    fn doc_with(r: Rect, fill: Color, effects: Vec<(&str, serde_json::Value)>) -> Document {
        let mut d = Document::new(100.0, 100.0);
        let id = d.alloc_id();
@@ -83,7 +83,8 @@ pub struct RenderOptions {
    pub artboards: bool,
    /// Objects not to draw (e.g. the object being edited by a live drag preview).
    pub hidden: Vec<NodeId>,
-    /// Draw template layers dimmed (50%).
+    /// Draw the layers as their Layer Options show them on screen: Preview off in outline, Dim
+    /// Images fading their images (a template layer's too), a template in Preview in Outline view.
    pub dim_templates: bool,
    /// Soft proof / separations preview (see [`proof`]).
    pub proof: Option<proof::ProofSetup>,
@@ -1088,8 +1089,8 @@ impl Renderer {
            return;
        }
        // Layer Options on screen: a layer whose Preview is off draws in outline, and Dim Images
-        // fades its images (exports and thumbnails, which leave templates out, ignore both).
-        // (A template is dimmed as a whole already.)
+        // fades its images, a template's too (exports and thumbnails, which leave templates out,
+        // ignore both).
        if let NodeKind::Layer { preview, dim_images, template, .. } = &n.kind
            && f.opts.dim_templates
            && !f.opts.skip_templates
@@ -1104,7 +1105,7 @@ impl Renderer {
                let opts = RenderOptions { outline: true, ..f.opts.clone() };
                return self.draw_node(ctx, &Frame { opts: &opts, ..*f }, n, force);
            }
-            if let Some(p) = dim_images.filter(|_| !template) {
+            if let Some(p) = *dim_images {
                let outer = self.dim_images;
                let dim = f32::from(p).clamp(0.0, 100.0) / 100.0;
                self.dim_images = Some(outer.map_or(dim, |o| o.min(dim)));
@@ -1162,8 +1163,7 @@ impl Renderer {
            return self.draw_object_fx(ctx, f, &Arc::new(n.clone()), false);
        }
        let outline = f.opts.outline;
-        let template_dim = matches!(n.kind, NodeKind::Layer { template: true, .. }) && f.opts.dim_templates;
-        let opacity = if template_dim { self.opacity_of(n) * 0.5 } else { self.opacity_of(n) };
+        let opacity = self.opacity_of(n);
        // Whether this container's children knock each other out.
        let knockout = !outline && n.knocks_out(self.knockout);
        let enclosing = std::mem::replace(&mut self.knockout, knockout);
@@ -1602,7 +1602,14 @@ impl Renderer {

    fn draw_text(&mut self, ctx: &mut RenderContext, f: &Frame, n: &Node, t: &TextObject) {
        let t = &*f.doc.inline_resolved(t);
-        let g = text_geom_snapped(t, f.text_snap(t));
+        // Type drawn as `fx_owner` (the node `draw_arc` is drawing, or type art that `fx_arts`
+        // keeps, see `draw_fx_art`) takes its glyph geometry from `texts`, as on the fast path,
+        // except in frames that snap type to pixels.
+        let owner = self.fx_owner.as_ref().filter(|o| std::ptr::eq(&***o, n)).cloned();
+        let g = match (f.text_snap(t), owner) {
+            (None, Some(a)) => self.text_geom_of(&a, t),
+            (snap, _) => Arc::new(text_geom_snapped(t, snap)),
+        };
        self.draw_text_geom(ctx, f, n, t, &g);
    }

@@ -1670,7 +1677,12 @@ impl Renderer {
    }

    /// Cached glyph geometry for a text node (keyed by Arc identity like paths).
+    /// Text `t` that is not the node's own, such as the copy whose inline graphics
+    /// `Document::inline_resolved` sized again, is laid out without the cache.
    fn text_geom_of(&mut self, a: &Arc<Node>, t: &TextObject) -> Arc<TextGeom> {
+        if !matches!(&a.kind, NodeKind::Text(own) if std::ptr::eq(&**own, t)) {
+            return Arc::new(text_geom(t));
+        }
        let fonts = vectorcraft_text::FontDb::global().generation();
        if fonts != self.text_fonts {
            self.texts.clear();
@@ -6,14 +6,16 @@
 //! with the paint transform mapping pixels → pattern space → document. Tiles are cached per
 //! pattern name and raster scale (and ink plane, see [`crate::ink`]) within
 //! [`lru::PATTERN_BUDGET`]. A tile is used while the pattern's definition is the one it was
-//! rasterized from (art `Arc` identity, tile, tile type, overlap): the pattern's "revision".
+//! rasterized from (art `Arc` identity, tile, tile type, overlap): the pattern's "revision", and,
+//! when its art shows more than itself (a symbol, another pattern, an image, type), while what
+//! the document holds of those is what it held then ([`Deps`]).
 //!
 //! Pattern editing mode (`Document::pattern_edit`) draws only the temporary tile layer, with
 //! dimmed copies of it at the neighbouring tile positions and the tile edge.

 use std::cell::RefCell;
 use std::hash::{Hash, Hasher};
-use std::sync::Arc;
+use std::sync::{Arc, Weak};

 use vectorcraft_doc::pattern::{Overlap, PatternDef, TileType};
 use vectorcraft_doc::{Document, Node};
@@ -32,8 +34,46 @@ const MAX_TILE_PX: f64 = 2048.0;
 /// ([`raster_scale`]).
 type TileKey = (String, u64);

+/// What a tile was drawn from besides its pattern's own art, for art that shows more than itself:
+/// the art of every pattern and symbol and the pixels of every image in the document, and the
+/// fonts. Editing a symbol leaves the art of a pattern that shows it as it was, so the art alone
+/// kept the tile from before (#1723). Held weakly: a weak reference keeps the allocation, so no
+/// other value gets one of these addresses while the tile is kept.
+struct Deps {
+    art: Vec<Weak<Node>>,
+    pixels: Vec<Weak<Vec<u8>>>,
+    fonts: u64,
+}
+
+impl Deps {
+    fn art(doc: &Document) -> impl Iterator<Item = &Arc<Node>> {
+        doc.patterns.iter().flat_map(|p| &p.art).chain(doc.symbols.iter().map(|s| &s.art))
+    }
+
+    fn pixels(doc: &Document) -> impl Iterator<Item = &Arc<Vec<u8>>> {
+        doc.images.values().flat_map(|b| std::iter::once(&b.bytes).chain(&b.proxy))
+    }
+
+    fn of(doc: &Document) -> Self {
+        Self {
+            art: Self::art(doc).map(Arc::downgrade).collect(),
+            pixels: Self::pixels(doc).map(Arc::downgrade).collect(),
+            fonts: vectorcraft_text::FontDb::global().generation(),
+        }
+    }
+
+    /// Does `doc` hold what the tile was drawn from?
+    fn current(&self, doc: &Document) -> bool {
+        self.fonts == vectorcraft_text::FontDb::global().generation()
+            && self.art.iter().map(Weak::as_ptr).eq(Self::art(doc).map(Arc::as_ptr))
+            && self.pixels.iter().map(Weak::as_ptr).eq(Self::pixels(doc).map(Arc::as_ptr))
+    }
+}
+
 struct TileEntry {
    art: Vec<Arc<Node>>,
+    /// `None` for art that shows only itself.
+    deps: Option<Deps>,
    params: (Rect, TileType, Overlap),
    sx: f64,
    sy: f64,
@@ -163,7 +203,10 @@ pub(crate) fn set_pattern_paint(ctx: &mut RenderContext, name: &str, xf: Affine,
        let mut c = c.borrow_mut();
        let tiles = &mut c.tiles[ink as usize];
        let t = tiles.tick();
-        tiles.get(&key, t).filter(|e| e.params == params && same_art(&e.art, &def.art)).map(|e| (e.pixmap.clone(), e.sx, e.sy))
+        tiles
+            .get(&key, t)
+            .filter(|e| e.params == params && same_art(&e.art, &def.art) && e.deps.as_ref().is_none_or(|d| d.current(doc)))
+            .map(|e| (e.pixmap.clone(), e.sx, e.sy))
    });
    let (pm, sx, sy) = match hit {
        Some(h) => h,
@@ -176,11 +219,12 @@ pub(crate) fn set_pattern_paint(ctx: &mut RenderContext, name: &str, xf: Affine,
            };
            let pm = Arc::new(pm);
            let (sx, sy) = (w as f64 / pw, h as f64 / ph);
+            let deps = crate::fx::Reads::of_all(def.art.iter().map(|a| &**a)).any().then(|| Deps::of(doc));
            CACHE.with(|c| {
                let mut c = c.borrow_mut();
                let tiles = &mut c.tiles[ink as usize];
                let (t, bytes) = (tiles.tick(), size_of::<TileEntry>() + w as usize * h as usize * 4);
-                tiles.insert(key, TileEntry { art: def.art.clone(), params, sx, sy, pixmap: pm.clone() }, bytes, t);
+                tiles.insert(key, TileEntry { art: def.art.clone(), deps, params, sx, sy, pixmap: pm.clone() }, bytes, t);
            });
            (pm, sx, sy)
        }
@@ -83,6 +83,37 @@ fn type_with_raster_effects_redraws_when_its_font_becomes_available() {
    assert_eq!(after, Renderer::new().render(&d, 300, 150, Affine::IDENTITY, &opts).pixels, "as a new renderer draws it");
 }

+/// Type at 80% opacity, in Multiply and with a drop shadow redraws in a font that becomes
+/// available: the glyph geometry kept for it is laid out again.
+#[test]
+fn translucent_blended_and_shadowed_type_redraws_when_its_font_becomes_available() {
+    const FAMILY: &str = "Blended Serif4";
+    let mut d = Document::new(300.0, 150.0);
+    let l = d.layers[0].id;
+    for i in 0..3 {
+        let style = CharStyle { size: 36.0, font_family: FAMILY.into(), ..Default::default() };
+        let mut n = Node::new(d.alloc_id(), NodeKind::Text(Box::new(TextObject::point(Point::new(10.0, 40.0 + 45.0 * i as f64), "Hamburg", style))));
+        match i {
+            0 => n.opacity = 0.8,
+            1 => n.blend = vectorcraft_color::BlendMode::Multiply,
+            _ => n.appearance.effects.push(vectorcraft_doc::Effect {
+                id: "stylize.dropShadow".into(),
+                params: serde_json::json!({"x": 4, "y": 4, "blur": 1, "opacity": 100}),
+                visible: true,
+            }),
+        }
+        d.insert(Some(l), i, n).unwrap();
+    }
+    let opts = RenderOptions { background: Some([255, 255, 255, 255]), ..Default::default() };
+    let mut r = Renderer::new();
+    let before = r.render(&d, 300, 150, Affine::IDENTITY, &opts).pixels;
+    assert_eq!(r.render(&d, 300, 150, Affine::IDENTITY, &opts).pixels, before, "drawn again from the kept glyph geometry");
+    assert!(vectorcraft_text::FontDb::global().add_font(serif_as(FAMILY)) > 0);
+    let after = r.render(&d, 300, 150, Affine::IDENTITY, &opts).pixels;
+    assert_ne!(before, after, "drawn in the font that arrived");
+    assert_eq!(after, Renderer::new().render(&d, 300, 150, Affine::IDENTITY, &opts).pixels, "as a new renderer draws it");
+}
+
 /// Type with a geometry effect in a symbol's art redraws in a font that becomes available: the art
 /// kept for the instance is placed again when the fonts change.
 #[test]
@@ -67,13 +67,37 @@ fn dim_images_fades_only_the_images() {
    assert_eq!(render(&d, true).pixel(65, 25), [255, 0, 0, 255], "exports are not dimmed");
 }

+/// #1683: a template layer dims its images by its Dim Images percentage and nothing else: with
+/// the option off they show at full strength, and the layer's paths are never faded.
+#[test]
+fn a_template_layer_dims_its_images_by_dim_images() {
+    let template = |dim: Option<u8>| {
+        let d = doc(|k| {
+            if let NodeKind::Layer { template, dim_images, .. } = k {
+                (*template, *dim_images) = (true, dim);
+            }
+        });
+        let img = render(&d, false);
+        (img.pixel(65, 25), img.pixel(25, 25))
+    };
+    let red = [255, 0, 0, 255];
+    assert_eq!(template(None), (red, red), "Dim Images off: as it is");
+    let (image, path) = template(Some(50));
+    assert!(image[0] == 255 && (120..=135).contains(&image[1]) && image[1] == image[2], "half way to white: {image:?}");
+    assert_eq!(path, red, "vector art stays");
+    let (image, _) = template(Some(20));
+    assert!((198..=210).contains(&image[1]) && image[1] == image[2], "a fifth of its strength: {image:?}");
+    assert_eq!(template(Some(100)), (red, red));
+}
+
 /// In Outline view a template layer still draws in Preview, dimmed, so its picture can be traced;
 /// the layer above it draws in outline (#1486).
 #[test]
 fn a_template_layer_stays_in_preview_in_outline_view() {
    let mut d = doc(|k| {
-        if let NodeKind::Layer { template, preview, .. } = k {
-            *template = true;
+        if let NodeKind::Layer { template, preview, dim_images, .. } = k {
+            // As Layer Options makes a template: its images dimmed to 50 %.
+            (*template, *dim_images) = (true, Some(50));
            // Preview off doesn't put a template in outline either.
            *preview = false;
        }
@@ -182,6 +182,122 @@ fn swept_type_entries_give_back_their_bytes() {
    assert_eq!((r.texts.len(), r.texts.bytes()), (0, 0));
 }

+/// [`text_doc`] of three type objects reading `word`: one at 80% opacity, one in Multiply and one
+/// with a drop shadow.
+fn faded_text_doc(word: &str) -> Document {
+    let mut d = text_doc(3, word);
+    let ids: Vec<NodeId> = d.layers[0].children().unwrap().iter().map(|n| n.id).collect();
+    d.node_mut(ids[0]).unwrap().opacity = 0.8;
+    d.node_mut(ids[1]).unwrap().blend = vectorcraft_color::BlendMode::Multiply;
+    d.node_mut(ids[2]).unwrap().appearance.effects.push(drop_shadow());
+    d
+}
+
+/// The glyph geometry `r` keeps for each type object of `d`: under its node, or under the art
+/// drawn for it when it has effects.
+fn kept_glyphs(r: &mut Renderer, d: &Document) -> Vec<Option<Arc<TextGeom>>> {
+    let stamp = r.stamp;
+    text_keys(d)
+        .into_iter()
+        .map(|k| {
+            let k = r.fx_arts.get(&k, stamp).map_or(k, |e| Arc::as_ptr(&e.1) as usize);
+            r.texts.get(&k, stamp).map(|(_, g)| g.clone())
+        })
+        .collect()
+}
+
+/// `f`'s result from a run during which the fonts did not change: other tests add fonts, and the
+/// renderer lays all type out again when the fonts change.
+fn fonts_unchanged<T>(mut f: impl FnMut() -> T) -> T {
+    loop {
+        let fonts = vectorcraft_text::FontDb::global().generation();
+        let t = f();
+        if vectorcraft_text::FontDb::global().generation() == fonts {
+            return t;
+        }
+    }
+}
+
+/// Type at 80% opacity, in Multiply and with a drop shadow keeps its glyph geometry between
+/// frames, as opaque type does: the second frame draws the geometry the first laid out. Frames
+/// that snap type to pixels keep none, and neither does type art that the effect-art cache has no
+/// room for.
+#[test]
+fn translucent_blended_and_shadowed_type_keeps_its_glyph_geometry_between_frames() {
+    let d = faded_text_doc("Kept");
+    let opts = RenderOptions::default();
+    let (first, kept, entries, second, again) = fonts_unchanged(|| {
+        let mut r = Renderer::new();
+        let first = r.render(&d, 400, 400, Affine::IDENTITY, &opts).pixels;
+        let (kept, entries) = (kept_glyphs(&mut r, &d), r.texts.len());
+        let second = r.render(&d, 400, 400, Affine::IDENTITY, &opts).pixels;
+        (first, kept, entries, second, kept_glyphs(&mut r, &d))
+    });
+    assert!(kept.iter().all(Option::is_some) && entries == 3, "{entries} entries");
+    assert!(second == first);
+    let same = kept.iter().zip(&again).all(|pair| matches!(pair, (Some(a), Some(b)) if Arc::ptr_eq(a, b)));
+    assert!(same, "the second frame draws the geometry the first laid out");
+    // Type anti-aliasing snaps the glyphs to pixels.
+    let mut r = Renderer::new();
+    r.render(&d, 400, 400, Affine::IDENTITY, &RenderOptions { anti_alias: AntiAlias::Type, ..Default::default() });
+    assert!(r.texts.is_empty());
+    // With no room for effect art, the shadowed type's art is made in every frame.
+    let frames = fonts_unchanged(|| {
+        let mut r = Renderer::new();
+        r.fx_arts = FrameCache::new(0, 0);
+        (0..2).map(|_| (r.render(&d, 400, 400, Affine::IDENTITY, &opts).pixels == first, r.texts.len())).collect::<Vec<_>>()
+    });
+    assert_eq!(frames, [(true, 2), (true, 2)]);
+}
+
+/// Editing the text of type at 80% opacity, in Multiply or with a drop shadow lays it out again:
+/// the next frame draws what a new renderer draws.
+#[test]
+fn edited_translucent_blended_and_shadowed_type_draws_as_new() {
+    for i in 0..3 {
+        let mut d = faded_text_doc("Kept");
+        let id = d.layers[0].children().unwrap()[i].id;
+        let opts = RenderOptions::default();
+        draws_as_new(&mut d, &opts, &opts, |d| {
+            if let Some(NodeKind::Text(t)) = d.node_mut(id).map(|n| &mut n.kind) {
+                t.runs[0].text = "Edit".into();
+            }
+        });
+    }
+}
+
+/// Type showing an inline graphic, at 80% opacity, in Multiply, with a drop shadow and opaque:
+/// when the symbol's art changes size and the document's inline graphics are not resolved again,
+/// the next frame lays the type out with the new size, as a new renderer does.
+#[test]
+fn type_with_an_inline_graphic_draws_its_symbols_new_size() {
+    use vectorcraft_doc::text::{CharStyle, InlineArt, TextObject, TextRun};
+    for i in 0..4 {
+        let mut d = Document::new(200.0, 100.0);
+        let art = symbol_art(&mut d);
+        d.symbols.push(vectorcraft_doc::Symbol { name: "S".into(), art: Arc::new(art) });
+        let style = CharStyle { size: 24.0, ..Default::default() };
+        let mut t = TextObject::point(vectorcraft_geom::Point::new(10.0, 50.0), "A", style.clone());
+        t.runs.push(TextRun::inline(InlineArt::new("S"), style.clone()));
+        t.runs.push(TextRun::new("B", style));
+        let mut n = Node::new(d.alloc_id(), NodeKind::Text(Box::new(t)));
+        match i {
+            0 => n.opacity = 0.8,
+            1 => n.blend = vectorcraft_color::BlendMode::Multiply,
+            2 => n.appearance.effects.push(drop_shadow()),
+            _ => {}
+        }
+        let mut d = with_art(d, vec![n]);
+        d.resolve_inline_art();
+        // `S` becomes a wide red bar: the inline graphic grows, and the type after it moves.
+        edit_draws_as_new(d, |d| {
+            let bar = vectorcraft_geom::shapes::rectangle(Rect::new(-20.0, -4.0, 20.0, 4.0));
+            let red = vectorcraft_doc::Appearance::basic(Paint::solid(Color::rgb(1.0, 0.0, 0.0)), Paint::None, 0.0);
+            d.symbols[0].art = Arc::new(Node::path(d.alloc_id(), bar, red));
+        });
+    }
+}
+
 /// A symbol's art inside the 20 × 20 square around the origin: a group of a square filled blue
 /// with a 2 pt black stroke and a black line.
 fn symbol_art(d: &mut Document) -> Node {
@@ -824,6 +940,49 @@ fn rasters_draw_pattern_edits() {
    });
 }

+/// #1723: a pattern's tile is drawn again when what its art shows changes while the art itself
+/// doesn't: a symbol an instance in it shows, or another pattern it is painted with. So is a
+/// raster effect on an object painted with such a pattern.
+#[test]
+fn pattern_tiles_draw_edits_to_what_their_art_shows() {
+    let _fonts = fonts_steady();
+    use vectorcraft_doc::pattern::{PatternDef, pattern_paint};
+    use vectorcraft_geom::shapes::rectangle;
+    let tile = |name: &str, art: Node| {
+        let mut def = PatternDef::new(name, vec![Arc::new(art)]);
+        def.tile = Rect::new(0.0, 0.0, 20.0, 20.0);
+        def
+    };
+    // Pattern `Stamps` shows symbol `S`; pattern `Outer` is a square painted with pattern `Checks`.
+    let doc = |pattern: &str, effects: Vec<vectorcraft_doc::Effect>| {
+        let mut d = Document::new(200.0, 100.0);
+        let art = symbol_art(&mut d);
+        d.symbols.push(vectorcraft_doc::Symbol { name: "S".into(), art: Arc::new(art) });
+        let shown = Node::new(d.alloc_id(), NodeKind::SymbolInstance { symbol: "S".into(), xf: Affine::translate((10.0, 10.0)) });
+        d.patterns.push(tile("Stamps", shown));
+        d.patterns.push(checks(Color::rgb(1.0, 0.0, 0.0)));
+        let square = filled(&mut d, rectangle(Rect::new(0.0, 0.0, 20.0, 20.0)), pattern_paint("Checks"), vec![]);
+        d.patterns.push(tile("Outer", square));
+        let painted = filled(&mut d, rectangle(Rect::new(10.0, 10.0, 190.0, 90.0)), pattern_paint(pattern), effects);
+        with_art(d, vec![painted])
+    };
+    let new_symbol = |d: &mut Document| {
+        let red = vectorcraft_doc::Appearance::basic(Paint::solid(Color::rgb(1.0, 0.0, 0.0)), Paint::None, 0.0);
+        let bar = Node::path(d.alloc_id(), rectangle(Rect::new(-8.0, -2.0, 8.0, 2.0)), red);
+        d.symbols[0].art = Arc::new(bar);
+    };
+    let new_checks = |d: &mut Document| {
+        if let Some(def) = d.pattern_mut("Checks") {
+            def.art = checks(Color::rgb(0.0, 0.0, 1.0)).art;
+        }
+    };
+    let blur = || vec![effect("blur.gaussian", serde_json::json!({"radius": 2.0}))];
+    edit_draws_as_new(doc("Stamps", vec![]), new_symbol);
+    edit_draws_as_new(doc("Stamps", blur()), new_symbol);
+    edit_draws_as_new(doc("Outer", vec![]), new_checks);
+    edit_draws_as_new(doc("Outer", blur()), new_checks);
+}
+
 /// Raster effects are made again when a symbol shown inside another symbol changes (a group's drop
 /// shadow around an instance of the other symbol), when a brush definition changes (a brushed
 /// stroke's drop shadow), and when an image's pixels change under the same key, as when a linked
@@ -18,10 +18,13 @@ use crate::{ImportOptions, SvgError, fnv1a};
 use css::XNode;
 use text::TextSlots;

+pub use depth::MAX_ELEMENT_DEPTH;
+pub(crate) use depth::xml_too_deep;
 pub(crate) use fx::BLEND;

 mod css;
 mod css_transform;
+mod depth;
 mod files;
 mod fx;
 mod spread;
@@ -29,11 +32,30 @@ mod symbol_units;
 mod text;
 mod vector_effect;

+/// The XML of `svg`.
+fn parse(svg: &str) -> Result<roxmltree::Document<'_>, SvgError> {
+    roxmltree::Document::parse_with_options(svg, roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() })
+        .map_err(|e| SvgError::Parse(e.to_string()))
+}
+
 pub(crate) fn import(svg: &str, opts: &ImportOptions) -> Result<(Document, Vec<String>), SvgError> {
-    let (svg, found) = prepass(svg, opts);
+    // Before anything reads the tree: the XML reader, usvg, and what is made of its tree, all by
+    // recursion.
+    let too_deep = || SvgError::TooDeep(depth::MAX_ELEMENT_DEPTH);
+    if depth::xml_too_deep(svg) {
+        return Err(too_deep());
+    }
+    let xml = parse(svg)?;
+    if depth::too_deep(&xml) {
+        return Err(too_deep());
+    }
+    let (svg, found) = prepass(svg, &xml, opts);
+    // The prepass's edits are in the text: the XML is read again only when it made any.
+    let xml = match &svg {
+        Cow::Borrowed(_) => xml,
+        Cow::Owned(edited) => parse(edited)?,
+    };
    let svg = svg.as_ref();
-    let xml = roxmltree::Document::parse_with_options(svg, roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() })
-        .map_err(|e| SvgError::Parse(e.to_string()))?;
    let units = RootUnits::of(xml.root_element());
    let root_name = root_layer_name(xml.root_element());
    let mut warnings = found.warnings;
@@ -165,6 +187,7 @@ pub(crate) fn import(svg: &str, opts: &ImportOptions) -> Result<(Document, Vec<S
            promote_sublayers(Arc::make_mut(l), &im.sublayer_groups);
        }
    }
+    im.doc.limit_depth_noting(&mut im.warnings);
    Ok((im.doc, im.warnings))
 }

@@ -554,7 +577,7 @@ impl Edits {
 /// * linked files are read ([`files`]);
 /// * percentage lengths in a `<symbol>` with a `viewBox` become numbers ([`symbol_units`]);
 /// * what style sheet rules with a `:not()` set goes in `style` attributes ([`not_rules`]).
-fn prepass<'s>(svg: &'s str, opts: &ImportOptions) -> (Cow<'s, str>, Found) {
+fn prepass<'s>(svg: &'s str, xml: &roxmltree::Document, opts: &ImportOptions) -> (Cow<'s, str>, Found) {
    let mut found = Found::default();
    // (`:` for prefixed elements such as `<svg:image>`.)
    let css_transform = has_css_transform(svg);
@@ -565,9 +588,6 @@ fn prepass<'s>(svg: &'s str, opts: &ImportOptions) -> (Cow<'s, str>, Found) {
    {
        return (svg.into(), found);
    }
-    let Ok(xml) = roxmltree::Document::parse_with_options(svg, roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() }) else {
-        return (svg.into(), found);
-    };
    let mut edits = Edits::default();
    let elements = || xml.descendants().filter(|n| n.is_element());
    for a in elements().filter(|n| n.tag_name().name() == "a") {
@@ -592,24 +612,24 @@ fn prepass<'s>(svg: &'s str, opts: &ImportOptions) -> (Cow<'s, str>, Found) {
    }
    let (display, non_scaling) = (svg.contains("display"), svg.contains(vector_effect::NON_SCALING));
    if display || non_scaling || not {
-        let css = css::Styles::new(&xml);
+        let css = css::Styles::new(xml);
        // First: an undisplayed object shown for usvg is shown after these.
        if not && css.has_not_rules() {
-            not_rules(svg, &xml, &css, &mut edits);
+            not_rules(svg, xml, &css, &mut edits);
        }
        if display {
-            hidden_objects(svg, &xml, &css, &mut edits, &mut found.hidden);
+            hidden_objects(svg, xml, &css, &mut edits, &mut found.hidden);
        }
        if non_scaling {
-            vector_effect::find(svg, &xml, &css, &mut edits, &mut found.non_scaling, &mut found.warnings);
+            vector_effect::find(svg, xml, &css, &mut edits, &mut found.non_scaling, &mut found.warnings);
        }
    }
-    found.files = files::Files::read(svg, &xml, opts, &mut edits, &mut found.warnings);
+    found.files = files::Files::read(svg, xml, opts, &mut edits, &mut found.warnings);
    if !symbols.is_empty() && svg.contains('%') {
-        edits.list.extend(symbol_units::rewrites(&xml));
+        edits.list.extend(symbol_units::rewrites(xml));
    }
    if css_transform {
-        edits.list.extend(css_transform::rewrites(svg, &xml));
+        edits.list.extend(css_transform::rewrites(svg, xml));
    }
    (edits.apply(svg), found)
 }
@@ -17,7 +17,7 @@ pub(super) type XNode<'a, 'i> = roxmltree::Node<'a, 'i>;

 /// `name: value` declarations of a block or `style` attribute, with their `!important` flag. The
 /// `font` shorthand becomes its longhands, as usvg reads it for the rest of the drawing (#1557).
-fn parse_decls(s: &str) -> Vec<(String, String, bool)> {
+pub(super) fn parse_decls(s: &str) -> Vec<(String, String, bool)> {
    s.split(';')
        .filter_map(|d| {
            let (k, v) = d.split_once(':')?;
@@ -214,7 +214,13 @@ impl Selector {
    }

    fn matches(&self, n: XNode) -> bool {
-        fn go(parts: &[(Compound, bool)], n: XNode) -> bool {
+        // The result of matching a selector suffix from a node depends only on the suffix and
+        // the node, so memoize it: without this, every descendant step retries every matching
+        // ancestor and a selector whose leftmost compound never matches makes the search
+        // enumerate ancestor combinations (#1703). A suffix of `parts` is identified by its
+        // length, so (suffix length, node id) is a complete key and the visited states are
+        // bounded by parts × ancestors.
+        fn go(parts: &[(Compound, bool)], n: XNode, memo: &mut HashMap<(usize, roxmltree::NodeId), bool>) -> bool {
            let Some(((c, child), rest)) = parts.split_first() else { return true };
            if !c.matches(n) {
                return false;
@@ -222,13 +228,19 @@ impl Selector {
            if rest.is_empty() {
                return true;
            }
-            if *child {
-                n.parent_element().is_some_and(|p| go(rest, p))
-            } else {
-                n.ancestors().skip(1).filter(|a| a.is_element()).any(|a| go(rest, a))
+            let key = (rest.len(), n.id());
+            if let Some(&hit) = memo.get(&key) {
+                return hit;
            }
+            let hit = if *child {
+                n.parent_element().is_some_and(|p| go(rest, p, memo))
+            } else {
+                n.ancestors().skip(1).filter(|a| a.is_element()).any(|a| go(rest, a, memo))
+            };
+            memo.insert(key, hit);
+            hit
        }
-        go(&self.parts, n)
+        go(&self.parts, n, &mut HashMap::new())
    }
 }

@@ -371,8 +383,13 @@ impl Styles {
        Self { rules, index, cache: RefCell::default() }
    }

+    /// Do the document's style sheets have any rules?
+    pub(super) fn has_rules(&self) -> bool {
+        !self.rules.is_empty()
+    }
+
    /// Properties set on `n` by rules and its `style` attribute, after the cascade.
-    fn declared(&self, n: XNode) -> Rc<HashMap<String, String>> {
+    pub(super) fn declared(&self, n: XNode) -> Rc<HashMap<String, String>> {
        if let Some(m) = self.cache.borrow().get(&n.id()) {
            return m.clone();
        }
@@ -484,6 +501,36 @@ mod tests {
        );
    }

+    #[test]
+    fn descendant_matching_does_not_backtrack_combinatorially() {
+        // Many nested groups share class `a` and the first rule stacks eight descendant
+        // `.a` compounds under a leftmost class that matches nothing: an unmemoized
+        // matcher enumerates ancestor combinations for it and effectively never
+        // finishes (#1703). With suffix states memoized this returns at once, and the
+        // matching descendant and mixed child/descendant rules still apply.
+        let depth = 48;
+        let mut svg = String::from(
+            r#"<svg xmlns="http://www.w3.org/2000/svg"><style>
+            .missing .a .a .a .a .a .a .a .a text { fill: #111 }
+            .a .a .a text { fill: #222 }
+            .a > .a text { stroke: blue }
+            </style>"#,
+        );
+        for _ in 0..depth {
+            svg.push_str(r#"<g class="a">"#);
+        }
+        svg.push_str(r#"<text id="t">x</text>"#);
+        for _ in 0..depth {
+            svg.push_str("</g>");
+        }
+        svg.push_str("</svg>");
+        with_doc(&svg, |doc, st| {
+            let t = by_id(doc, "t");
+            assert_eq!(st.own(t, "fill").as_deref(), Some("#222"), "descendant rule matches, the .missing one does not");
+            assert_eq!(st.own(t, "stroke").as_deref(), Some("blue"), "mixed child/descendant rule matches");
+        });
+    }
+
    #[test]
    fn presentation_attributes_lose_to_rules() {
        with_doc(
@@ -0,0 +1,264 @@
+//! How deep an SVG's elements nest, found in the XML before usvg runs: usvg converts the tree by
+//! recursion, a few stack frames an element, so a file nested deeply enough overflows the stack
+//! (an abort, not an error). Such a file is refused: its nesting can't be merged before usvg has
+//! read it, and usvg is what can't read it.
+//!
+//! What counts is the tree usvg walks, not the XML alone: a `<use>` holds a copy of what it
+//! refers to, and a clip path, mask, pattern, marker or filter is converted where it is used
+//! (`clip-path: url(#a)` on an element of a clip path makes a chain as deep as there are clip
+//! paths). So each element's depth is the deepest of what it holds and what it refers to.
+
+use std::collections::HashMap;
+use std::collections::hash_map::Entry;
+
+use usvg::roxmltree;
+
+use super::css::{Styles, XNode, parse_decls};
+
+/// The deepest an SVG's elements may nest, references followed. Far beyond what drawing apps
+/// write, and deeper than a document's objects may nest ([`vectorcraft_doc::MAX_DEPTH`]: wrappers
+/// that hold one object aren't kept, and what is still deeper is merged into the group around
+/// it). usvg uses about 15 kB of stack for each level: the importer runs on a thread with 16 MB
+/// ([`vectorcraft_doc::depth::with_deep_stack`]), except on the web, where there is the one
+/// 1 MB stack.
+pub const MAX_ELEMENT_DEPTH: usize = if cfg!(target_arch = "wasm32") { 48 } else { 256 };
+
+/// Properties whose value an element's descendants use too: the paint server they name is
+/// converted at each descendant, under everything between.
+const INHERITED: [&str; 6] = ["fill", "stroke", "marker", "marker-start", "marker-mid", "marker-end"];
+
+/// The ids of the `url(#id)` references in a property value.
+fn urls(value: &str) -> impl Iterator<Item = &str> {
+    value.split("url(").skip(1).filter_map(|rest| {
+        let id = rest.trim_start().trim_start_matches(['"', '\'']).strip_prefix('#')?;
+        id.split([')', '"', '\'']).next().map(str::trim).filter(|id| !id.is_empty())
+    })
+}
+
+/// The elements `n` refers to, each with whether `n`'s descendants use it too.
+fn references<'a, 'i>(n: XNode<'a, 'i>, ids: &HashMap<&str, XNode<'a, 'i>>, css: &Styles, out: &mut Vec<(XNode<'a, 'i>, bool)>) {
+    let add = |out: &mut Vec<(XNode<'a, 'i>, bool)>, name: &str, value: &str| {
+        let inherited = INHERITED.contains(&name);
+        out.extend(urls(value).filter_map(|id| ids.get(id)).map(|t| (*t, inherited)));
+    };
+    for a in n.attributes() {
+        match a.name() {
+            "href" => out.extend(a.value().trim().strip_prefix('#').and_then(|id| ids.get(id)).map(|t| (*t, false))),
+            // Read with the style sheets' rules below.
+            "style" if css.has_rules() => {}
+            "style" => parse_decls(a.value()).iter().for_each(|(k, v, _)| add(out, k, v)),
+            name => add(out, name, a.value()),
+        }
+    }
+    if css.has_rules() {
+        css.declared(n).iter().for_each(|(k, v)| add(out, k, v));
+    }
+}
+
+/// Do the elements of the XML text `svg` nest deeper than [`MAX_ELEMENT_DEPTH`]? Read from the
+/// text, before any XML reader: roxmltree (ours and usvg's) reads elements by recursion too. Tags
+/// are counted as the text has them; markup in the values of a document type's entities counts
+/// ten times (how deep entities may refer to one another), on top of the deepest element.
+pub(crate) fn xml_too_deep(svg: &str) -> bool {
+    let b = svg.as_bytes();
+    let find =
+        |from: usize, what: &[u8]| b.get(from..).and_then(|rest| rest.windows(what.len()).position(|w| w == what)).map(|at| from + at + what.len());
+    // The end of the tag starting at `from` (past its `>`), and whether it closes itself.
+    let tag_end = |from: usize| {
+        let mut quote = None;
+        for (i, c) in b.iter().enumerate().skip(from) {
+            match (quote, c) {
+                (None, b'"' | b'\'') => quote = Some(*c),
+                (Some(q), c) if q == *c => quote = None,
+                (None, b'>') => return (i + 1, b.get(i.wrapping_sub(1)) == Some(&b'/')),
+                _ => {}
+            }
+        }
+        (b.len(), false)
+    };
+    // (now, deepest) of the elements, and of the markup inside the document type.
+    let (mut elements, mut entities) = ((0usize, 0usize), (0usize, 0usize));
+    let mut doctype_end = 0;
+    let mut i = 0;
+    while let Some(at) = b.get(i..).and_then(|rest| rest.iter().position(|c| *c == b'<')).map(|at| i + at) {
+        let rest = b.get(at..).unwrap_or_default();
+        let depth = if at < doctype_end { &mut entities } else { &mut elements };
+        i = if rest.starts_with(b"<!--") {
+            find(at, b"-->").unwrap_or(b.len())
+        } else if rest.starts_with(b"<![CDATA[") {
+            find(at, b"]]>").unwrap_or(b.len())
+        } else if rest.starts_with(b"<?") {
+            find(at, b"?>").unwrap_or(b.len())
+        } else if rest.starts_with(b"<!DOCTYPE") {
+            // Up to the `>` that ends it: after its internal subset (`[` … `]`) when it has one.
+            let plain = tag_end(at).0;
+            let subset = b.get(at..plain).is_some_and(|head| head.contains(&b'['));
+            doctype_end = if subset { find(at, b"]>").unwrap_or(b.len()) } else { plain };
+            at + 2
+        } else if rest.starts_with(b"<!") {
+            // A declaration of the document type: the markup in its value is counted as it comes.
+            at + 2
+        } else if rest.starts_with(b"</") {
+            depth.0 = depth.0.saturating_sub(1);
+            tag_end(at).0
+        } else if at < doctype_end {
+            // In an entity's value, itself in quotes: up to the tag's `>`.
+            let end = find(at, b">").unwrap_or(b.len());
+            depth.1 = depth.1.max(depth.0 + 1);
+            depth.0 += usize::from(b.get(end.wrapping_sub(2)) != Some(&b'/'));
+            end
+        } else {
+            let (end, empty) = tag_end(at);
+            depth.1 = depth.1.max(depth.0 + 1);
+            depth.0 += usize::from(!empty);
+            end
+        };
+        if elements.1 + 10 * entities.1 > MAX_ELEMENT_DEPTH {
+            return true;
+        }
+    }
+    false
+}
+
+/// Does anything in `xml` nest deeper than [`MAX_ELEMENT_DEPTH`], references followed? Without
+/// recursion.
+pub(super) fn too_deep(xml: &roxmltree::Document) -> bool {
+    let elements = || xml.descendants().filter(|n| n.is_element());
+    let ids: HashMap<&str, XNode> = elements().filter_map(|n| Some((n.attribute("id")?, n))).collect();
+    let css = Styles::new(xml);
+    // How deep each element's own tree goes, itself included; 0 while it is being worked out: a
+    // reference back to it then is a loop, which usvg leaves out.
+    let mut heights: HashMap<roxmltree::NodeId, usize> = HashMap::new();
+    enum Step<'a, 'i> {
+        Enter(XNode<'a, 'i>),
+        Leave(XNode<'a, 'i>, Vec<(XNode<'a, 'i>, bool)>),
+    }
+    let mut stack = vec![Step::Enter(xml.root_element())];
+    while let Some(step) = stack.pop() {
+        match step {
+            Step::Enter(n) => {
+                match heights.entry(n.id()) {
+                    Entry::Occupied(_) => continue,
+                    Entry::Vacant(v) => v.insert(0),
+                };
+                let mut refs = vec![];
+                references(n, &ids, &css, &mut refs);
+                let targets: Vec<XNode> = refs.iter().map(|(t, _)| *t).collect();
+                stack.push(Step::Leave(n, refs));
+                stack.extend(n.children().filter(|c| c.is_element()).chain(targets).map(Step::Enter));
+            }
+            Step::Leave(n, refs) => {
+                let of = |n: XNode| heights.get(&n.id()).copied().unwrap_or(0);
+                let held = n.children().filter(|c| c.is_element()).map(of).max().unwrap_or(0);
+                let used = |inherited: bool| refs.iter().filter(|(_, i)| *i == inherited).map(|(t, _)| of(*t)).max().unwrap_or(0);
+                let height = 1 + held.max(used(false)) + used(true);
+                if height > MAX_ELEMENT_DEPTH {
+                    return true;
+                }
+                heights.insert(n.id(), height);
+            }
+        }
+    }
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn deep(svg: &str) -> bool {
+        too_deep(&roxmltree::Document::parse(svg).unwrap())
+    }
+
+    fn svg(body: &str) -> String {
+        format!(r#"<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="10" height="10">{body}</svg>"#)
+    }
+
+    /// `n` groups in one another around a rectangle.
+    fn groups(n: usize) -> String {
+        format!("{}<rect width='1' height='1'/>{}", "<g>".repeat(n), "</g>".repeat(n))
+    }
+
+    #[test]
+    fn elements_nest_up_to_the_cap() {
+        // The root, the groups and the rectangle.
+        let (at, past) = (svg(&groups(MAX_ELEMENT_DEPTH - 2)), svg(&groups(MAX_ELEMENT_DEPTH - 1)));
+        assert!(!deep(&at) && !xml_too_deep(&at));
+        assert!(deep(&past) && xml_too_deep(&past));
+        assert!(xml_too_deep(&svg(&groups(200_000))), "any depth is measured");
+    }
+
+    #[test]
+    fn the_text_is_measured_as_xml_reads_it() {
+        let many = r#"<g a='>' b="<g>"><rect/></g>"#.repeat(500);
+        assert!(!xml_too_deep(&svg(&many)), "side by side, with `>` and tags in attribute values");
+        let hidden = format!("<!-- {0} --><![CDATA[{0}]]><?pi {0}?>", "<g>".repeat(500));
+        assert!(!xml_too_deep(&svg(&hidden)), "comments, character data and instructions hold no elements");
+        assert!(xml_too_deep(&format!("<svg>{}", "<g>".repeat(MAX_ELEMENT_DEPTH))), "never closed");
+        assert!(!xml_too_deep(&format!("{}<svg/>", "</g>".repeat(2 * MAX_ELEMENT_DEPTH))), "ends without beginnings");
+        // Entities: namespaces as drawing apps declare them, and markup that would be read ten deep.
+        let names = r#"<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [ <!ENTITY ns_svg "http://www.w3.org/2000/svg"> ]>"#;
+        assert!(!xml_too_deep(&format!("{names}{}", svg(&groups(30)))));
+        let tenth = MAX_ELEMENT_DEPTH / 10 + 1;
+        let bomb = format!("<!DOCTYPE svg [ <!ENTITY a \"{}&a;{}\"> ]>", "<g>".repeat(tenth), "</g>".repeat(tenth));
+        assert!(xml_too_deep(&format!("{bomb}<svg>&a;</svg>")));
+        assert!(!xml_too_deep(""));
+    }
+
+    #[test]
+    fn a_chain_of_uses_is_as_deep_as_what_it_copies() {
+        let chain = |n: usize| {
+            let defs: String = (0..n).map(|i| format!("<g id='g{i}'><use xlink:href='#g{}'/></g>", i + 1)).collect();
+            svg(&format!("<defs>{defs}<rect id='g{n}' width='1' height='1'/></defs><use href='#g0'/>"))
+        };
+        assert!(!deep(&chain(10)));
+        assert!(deep(&chain(MAX_ELEMENT_DEPTH / 2)), "two elements a link");
+        assert!(deep(&chain(5000)));
+    }
+
+    #[test]
+    fn chains_of_clips_masks_and_patterns_count_by_attribute_style_and_style_sheet() {
+        let by_attribute = |n: usize| -> String {
+            (0..n).map(|i| format!("<clipPath id='c{i}' clip-path='url(#c{})'><rect width='1' height='1'/></clipPath>", i + 1)).collect()
+        };
+        let by_style = |n: usize| -> String {
+            (0..n).map(|i| format!("<mask id='c{i}' style='mask: url( \"#c{}\" )'><rect width='1' height='1'/></mask>", i + 1)).collect()
+        };
+        let by_sheet = |n: usize| -> String {
+            let rules: String = (0..n).map(|i| format!(".p{i} {{ fill: url(#c{}) }}", i + 1)).collect();
+            let patterns: String = (0..n)
+                .map(|i| format!("<pattern id='c{i}' width='1' height='1'><g class='p{i}'><rect width='1' height='1'/></g></pattern>"))
+                .collect();
+            format!("<style>{rules}</style>{patterns}")
+        };
+        for chain in [&by_attribute as &dyn Fn(usize) -> String, &by_style, &by_sheet] {
+            let file =
+                |n| svg(&format!("<defs>{}</defs><rect width='5' height='5' fill='url(#c0)' clip-path='url(#c0)' mask='url(#c0)'/>", chain(n)));
+            assert!(!deep(&file(5)));
+            assert!(deep(&file(MAX_ELEMENT_DEPTH)));
+        }
+    }
+
+    #[test]
+    fn many_paint_servers_used_side_by_side_are_not_a_chain() {
+        // As drawing apps write gradients: a class each, used by objects that aren't inside one another.
+        let rules: String = (0..300).map(|i| format!(".c{i}{{fill:url(#g{i})}}")).collect();
+        let defs: String = (0..300).map(|i| format!("<linearGradient id='g{i}'><stop class='c{i}' offset='0'/></linearGradient>")).collect();
+        let art: String = (0..300).map(|i| format!("<g class='c{i}'><rect class='c{i}' width='1' height='1'/></g>")).collect();
+        assert!(!deep(&svg(&format!("<style>{rules}</style><defs>{defs}</defs>{art}"))));
+    }
+
+    #[test]
+    fn a_loop_of_references_is_not_deep() {
+        assert!(!deep(&svg("<g id='a'><use href='#b'/></g><g id='b'><use href='#a'/></g><clipPath id='c' clip-path='url(#c)'/>")));
+    }
+
+    #[test]
+    fn an_inherited_paint_is_converted_under_everything_between() {
+        // Neither the pattern nor the art is too deep; the pattern under the art's last object is.
+        let half = MAX_ELEMENT_DEPTH / 2;
+        let pattern = format!("<pattern id='p' width='1' height='1'>{}</pattern>", groups(half));
+        assert!(!deep(&svg(&format!("<defs>{pattern}</defs><g fill='url(#p)'>{}</g>", groups(half / 2)))));
+        assert!(deep(&svg(&format!("<defs>{pattern}</defs><g fill='url(#p)'>{}</g>", groups(half)))));
+    }
+}
@@ -203,12 +203,16 @@ impl Files {
        ImageHrefResolver {
            resolve_data: Box::new(move |mime, bytes, opts| {
                if mime == "image/svg+xml" {
+                    if nested_too_deep(&bytes) {
+                        return None;
+                    }
                    self.note_text(&bytes);
                }
                data(mime, bytes, opts)
            }),
            resolve_string: Box::new(move |h, opts| match self.sources.get(h).or_else(|| self.sources.get(h.trim()))? {
                Source::Raster(kind, bytes) => Some(kind(bytes.clone())),
+                Source::Svg(bytes) if nested_too_deep(bytes) => None,
                Source::Svg(bytes) => {
                    self.note_text(bytes);
                    usvg::Tree::from_data_nested(bytes, opts).ok().map(ImageKind::SVG)
@@ -218,6 +222,12 @@ impl Files {
    }
 }

+/// Is the SVG image `bytes` nested too deep for usvg to read (as the SVG holding it would be)?
+/// It is then left out, as an image usvg can't read.
+fn nested_too_deep(bytes: &[u8]) -> bool {
+    crate::text_of(bytes).is_ok_and(|text| super::xml_too_deep(&text))
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -312,6 +312,9 @@ pub struct LinkedImage {
 pub enum SvgError {
    #[error("SVG parse error: {0}")]
    Parse(String),
+    /// Its elements nest (references followed) deeper than the reader goes.
+    #[error("the SVG's elements are nested more than {0} deep")]
+    TooDeep(usize),
 }

 /// Export a document as an SVG string (linked images are not returned: see [`export_full`]).
@@ -347,7 +350,8 @@ pub struct Editing {

 /// The native document an SVG carries, if any, and whether the SVG was edited since.
 pub fn editing(svg: &str) -> Option<Editing> {
-    if !svg.contains(EDITING_NS) {
+    // (An SVG nested too deep for the XML reader carries none: it isn't one of ours.)
+    if !svg.contains(EDITING_NS) || import::xml_too_deep(svg) {
        return None;
    }
    let opts = usvg::roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() };
@@ -500,14 +504,18 @@ pub fn import_with_report(svg: &str) -> Result<(Document, Vec<String>), SvgError
    import_with(svg, &ImportOptions::default())
 }

+pub use import::MAX_ELEMENT_DEPTH;
+
 /// Import an SVG document reading the files it links to as `opts` says, also returning warnings.
 pub fn import_with(svg: &str, opts: &ImportOptions) -> Result<(Document, Vec<String>), SvgError> {
-    import::import(svg, opts)
+    // usvg converts the tree by recursion, in large stack frames: the nesting it is given is
+    // capped (`import::depth`), and it gets room for that cap whatever thread asks.
+    vectorcraft_doc::depth::with_deep_stack(|| import::import(svg, opts))
 }

 /// Reads a linked file: its bytes and the link to it (absolute path, size, time and hash), or
 /// `None` when there is no readable file at the (absolute) path.
-pub type ReadFile<'a> = &'a dyn Fn(&str) -> Option<(Vec<u8>, vectorcraft_doc::LinkInfo)>;
+pub type ReadFile<'a> = &'a (dyn Fn(&str) -> Option<(Vec<u8>, vectorcraft_doc::LinkInfo)> + Sync);

 /// How [`import_with`] reads the files an SVG's `<image>` elements link to.
 ///
@@ -320,6 +320,10 @@ type Catalog = HashMap<String, CatalogFamily>;
 /// The installed faces' (family, style) by normalized PostScript name ([`norm`]).
 type PostScriptNames = HashMap<String, (String, String)>;

+/// Maps the family and style [`FontDb::canonical`] was asked for to its answer, for names that
+/// are neither a loaded nor an installed family.
+type CanonicalNames = HashMap<(String, String), (String, String)>;
+
 /// Process-wide font database.
 pub struct FontDb {
    faces: RwLock<Vec<Arc<FontFace>>>,
@@ -332,6 +336,9 @@ pub struct FontDb {
    font_paths: FontPaths,
    /// The installed fonts' other names (localized, legacy, full, PostScript) by normalized name.
    aliases: RwLock<HashMap<String, Vec<Alias>>>,
+    /// Keeps [`FontDb::canonical`]'s answers for names other than the loaded and installed
+    /// families until fonts are added or rescanned.
+    canonical_cache: Mutex<CanonicalNames>,
    /// Set once the font folders have been scanned. Lookups by family name wait for the first
    /// scan, so what they find never depends on what ran before them.
    #[cfg(not(target_arch = "wasm32"))]
@@ -455,6 +462,9 @@ const SYSTEM_FALLBACKS: &[&str] = &[

 static NEXT_ID: AtomicU32 = AtomicU32::new(1);
 const OUTLINE_CACHE_MAX: usize = 50_000;
+/// How many answers [`FontDb::canonical`] keeps at most. When it has kept that many, it clears
+/// them before it keeps the next one.
+const CANONICAL_CACHE_MAX: usize = 4_096;

 fn name(font: &skrifa::FontRef<'_>, ids: &[StringId]) -> Option<String> {
    ids.iter().find_map(|id| font.localized_strings(*id).english_or_first().map(|s| s.to_string()).filter(|s| !s.is_empty()))
@@ -717,6 +727,8 @@ struct Alias {
 impl Alias {
    /// The aliases of a face `family` / `style` with `keys`, by normalized name.
    fn of(family: &str, style: &str, keys: &FaceKeys) -> Vec<(String, Alias)> {
+        #[cfg(test)]
+        ALIAS_LISTS.with(|c| c.set(c.get() + 1));
        let mut v: Vec<(String, Alias)> =
            keys.families.iter().map(|k| (k.clone(), Alias { family: family.to_string(), style: None, paired: None })).collect();
        v.extend(
@@ -734,6 +746,18 @@ impl Alias {
    }
 }

+#[cfg(test)]
+thread_local! {
+    /// Tests: counts the faces whose aliases ([`Alias::of`]) were listed on this thread.
+    static ALIAS_LISTS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+}
+
+/// Tests: returns how many faces' aliases were listed on this thread.
+#[cfg(test)]
+pub(crate) fn alias_lists() -> u64 {
+    ALIAS_LISTS.with(std::cell::Cell::get)
+}
+
 /// How a requested family and style resolved ([`FontDb::resolve`]).
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum FontMatch {
@@ -1467,6 +1491,7 @@ impl FontDb {
            postscript: RwLock::new(PostScriptNames::new()),
            font_paths,
            aliases: RwLock::new(HashMap::new()),
+            canonical_cache: Mutex::new(CanonicalNames::new()),
            #[cfg(not(target_arch = "wasm32"))]
            cataloged: std::sync::OnceLock::new(),
            #[cfg(not(target_arch = "wasm32"))]
@@ -1509,9 +1534,11 @@ impl FontDb {
        self.catalog.read().unwrap_or_else(|e| e.into_inner())
    }

-    /// Fonts were added or the catalog changed: cached family lists are stale.
+    /// Fonts were added or the catalog changed: cached family lists and [`FontDb::canonical`]'s
+    /// answers are stale.
    fn changed(&self) {
        *self.family_cache.lock().unwrap_or_else(|e| e.into_inner()) = None;
+        self.canonical_cache.lock().unwrap_or_else(|e| e.into_inner()).clear();
        self.generation.fetch_add(1, Ordering::Relaxed);
    }

@@ -1764,6 +1791,24 @@ impl FontDb {
        if self.is_loaded(family) || self.read_catalog().contains_key(&family.to_ascii_lowercase()) {
            return (family.to_string(), style.to_string());
        }
+        // The lock is held until the answer is kept, and [`FontDb::changed`] waits for it: an
+        // answer found from the fonts before a change is cleared by that change.
+        let mut cache = self.canonical_cache.lock().unwrap_or_else(|e| e.into_inner());
+        let key = (family.to_string(), style.to_string());
+        if let Some(answer) = cache.get(&key) {
+            return answer.clone();
+        }
+        let answer = self.canonical_alias(family, style);
+        if cache.len() >= CANONICAL_CACHE_MAX {
+            cache.clear();
+        }
+        cache.insert(key, answer.clone());
+        answer
+    }
+
+    /// Finds [`FontDb::canonical`]'s answer for a name that is neither a loaded nor an installed
+    /// family among the loaded faces' and the installed fonts' other names.
+    fn canonical_alias(&self, family: &str, style: &str) -> (String, String) {
        let key = norm(family);
        let mut found: Vec<Alias> =
            self.read_faces().iter().flat_map(|f| Alias::of(&f.family, &f.style, &f.keys)).filter(|(k, _)| *k == key).map(|(_, a)| a).collect();
@@ -2230,6 +2275,19 @@ mod alias_tests {
        assert!(db.find_postscript("NoSuchFont-Regular").is_none());
        assert!(db.has_family("SourceSans3-Regular"));
    }
+
+    /// The database keeps at most [`CANONICAL_CACHE_MAX`] answers, and names asked for past that
+    /// many still get the same answers.
+    #[test]
+    fn the_answers_kept_for_names_are_capped() {
+        let db = FontDb::with_font_dirs(vec![]);
+        for i in 0..=CANONICAL_CACHE_MAX {
+            let name = format!("No Such Family {i}");
+            assert_eq!(db.canonical(&name, "Regular"), (name.clone(), "Regular".into()));
+        }
+        assert!(db.canonical_cache.lock().unwrap().len() <= CANONICAL_CACHE_MAX);
+        assert_eq!(db.canonical("SourceSans3-Semibold", "Regular"), ("Source Sans 3".into(), "Semibold".into()));
+    }
 }

 #[cfg(test)]
@@ -663,3 +663,91 @@ fn a_full_name_does_not_override_an_installed_family() {
    let (face, matched) = db.resolve("Alias Script Italic", "Regular").unwrap();
    assert_eq!((face.family.as_str(), face.style.as_str(), matched), ("Alias Script Italic", "Regular", FontMatch::Exact));
 }
+
+/// When type is set in a font that isn't installed, layout searches the loaded faces' names for the
+/// font's name once until fonts are added.
+#[test]
+fn a_missing_fonts_name_is_looked_up_once_until_fonts_are_added() {
+    use crate::fontdb::alias_lists;
+    let db = FontDb::with_font_dirs(vec![]);
+    // One lookup lists the names of every loaded face.
+    let before = alias_lists();
+    assert_eq!(db.canonical("Gone Sans", "Bold"), ("Gone Sans".to_string(), "Bold".to_string()));
+    let one_lookup = alias_lists() - before;
+    let style = vectorcraft_doc::CharStyle { font_family: "Gone Sans".into(), ..Default::default() };
+    let t = TextObject::point(kurbo::Point::ZERO, &vec!["Set in a font that is not installed."; 20].join("\n"), style);
+    let before = alias_lists();
+    for _ in 0..2 {
+        assert_eq!(layout(&db, &t).lines.len(), 20);
+    }
+    assert_eq!(alias_lists() - before, one_lookup, "two layouts of 20 paragraphs list the faces' names once");
+    // A font added since has the name as its full name.
+    assert_eq!(db.add_font(named(&[(3, EN, 1, "Found Sans"), (3, EN, 2, "Bold"), (3, EN, 4, "Gone Sans"), (3, EN, 6, "FoundSans-Bold")])), 1);
+    let l = layout(&db, &t);
+    assert!(!l.glyphs.is_empty() && l.glyphs.iter().all(|g| db.face_by_id(g.font_id).is_some_and(|f| f.family == "Found Sans")));
+}
+
+/// Until an installed font has a name, `canonical` returns the name and the style asked for each
+/// time; once a rescan finds the font, the name gives the font's family.
+#[test]
+fn a_name_asked_for_before_its_font_is_installed_finds_it_after_a_rescan() {
+    let dir = std::env::temp_dir().join(format!("vc-sysfonts-{}-asked-before", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let db = FontDb::with_font_dirs(vec![dir.clone()]);
+    let answer = |family: &str, style: &str| (family.to_string(), style.to_string());
+    for _ in 0..2 {
+        for style in ["Regular", "Bold"] {
+            assert_eq!(db.canonical("Later Three W3", style), answer("Later Three W3", style));
+            assert_eq!(db.canonical("後の三", style), answer("後の三", style));
+        }
+    }
+    // The name table is laid out like Hiragino Sans W3's, with a legacy family paired with its
+    // legacy style.
+    let three = named(&[
+        (1, 0, 1, "Later Three"),
+        (1, 0, 2, "W3"),
+        (3, EN, 1, "Later Three W3"),
+        (3, EN, 2, "Regular"),
+        (3, EN, 6, "LThree-W3"),
+        (3, EN, 16, "Later Three"),
+        (3, EN, 17, "W3"),
+        (3, JA, 16, "後の三"),
+        (3, JA, 17, "W3"),
+    ]);
+    std::fs::write(dir.join("LaterThree.ttf"), three).unwrap();
+    assert_eq!(db.load_system_fonts(), 1);
+    for _ in 0..2 {
+        assert_eq!(db.canonical("Later Three W3", "Regular"), answer("Later Three", "W3"));
+        assert_eq!(db.canonical("Later Three W3", "Bold"), answer("Later Three", "Bold"));
+        assert_eq!(db.canonical("後の三", "Bold"), answer("Later Three", "Bold"));
+    }
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+/// Times the layout of a story of 1,000 paragraphs set in a font that is not installed, with 0, 100
+/// and 400 fonts added to the bundled ones. Run with
+/// `cargo test --release -p vectorcraft-text --lib missing_font_story_layout_timing -- --ignored --nocapture`.
+#[test]
+#[ignore = "manual timing probe; wall-clock performance depends on machine load"]
+fn missing_font_story_layout_timing() {
+    let text = vec!["Type set in a font that is not installed on this computer."; 1000].join("\n");
+    let style = vectorcraft_doc::CharStyle { font_family: "No Such Font".into(), ..Default::default() };
+    let t = TextObject::point(kurbo::Point::ZERO, &text, style);
+    for extra in [0, 100, 400] {
+        let db = FontDb::with_font_dirs(vec![]);
+        for i in 0..extra {
+            let (family, full, postscript) = (format!("Loaded Sans {i}"), format!("Loaded Sans {i} Regular"), format!("LoadedSans{i}-Regular"));
+            assert_eq!(db.add_font(named(&[(3, EN, 1, &family), (3, EN, 2, "Regular"), (3, EN, 4, &full), (3, EN, 6, &postscript)])), 1);
+        }
+        let mut ms = vec![];
+        for _ in 0..7 {
+            let start = std::time::Instant::now();
+            let l = layout(&db, &t);
+            ms.push(start.elapsed().as_secs_f64() * 1000.0);
+            assert_eq!(l.lines.len(), 1000);
+        }
+        ms.sort_by(f64::total_cmp);
+        println!("{extra} fonts added, {} families loaded: median {:.1} ms; samples {ms:.1?}", db.family_list().len(), ms[3]);
+    }
+}
@@ -9,7 +9,7 @@
 //! Visibility is a painter's algorithm, as for Revolve: faces of a closed solid that face away
 //! from the viewer are left out, the rest are drawn back to front.

-use vectorcraft_geom::{BezPath, ParamCurve, PathData, Point, Rect};
+use vectorcraft_geom::{BezPath, FillRule, ParamCurve, PathData, Point, Rect};

 use crate::{MAX_FACES, Revolve, V3, eye_distance, perspective_scale};

@@ -290,7 +290,11 @@ fn pieces(c: vectorcraft_geom::CubicBez, tolerance: f64) -> u32 {
 /// outlines run one way and holes the other, so nonzero winding fills them as the art is. Curves
 /// are followed within a tolerance of 1/2000 of `size` (at least 0.05 pt), so small curves take
 /// few points and large ones more; more than `limit` points in all is refused.
-fn rings(path: &PathData, size: f64, limit: usize) -> Result<Vec<Vec<Point>>, String> {
+///
+/// Under the nonzero `rule` an outline with filled art on both sides is no edge of the shape and
+/// is left out: a contour inside another that runs the same way doesn't cut a hole, as it would
+/// if nesting alone decided (#1724).
+fn rings(path: &PathData, rule: FillRule, size: f64, limit: usize) -> Result<Vec<Vec<Point>>, String> {
    let tolerance = (size / 2000.0).max(0.05);
    let mut count = 0;
    let mut out = vec![];
@@ -325,6 +329,18 @@ fn rings(path: &PathData, size: f64, limit: usize) -> Result<Vec<Vec<Point>>, St
            out.push(ring);
        }
    }
+    if rule == FillRule::NonZero {
+        let turn = |r: &[Point]| if signed_area(r) > 0.0 { 1 } else { -1 };
+        let mut edge = Vec::with_capacity(out.len());
+        for (i, r) in out.iter().enumerate() {
+            let p = r.first().copied().unwrap_or_default();
+            // The winding number just outside the ring, and just inside it.
+            let outside: i32 = out.iter().enumerate().filter(|(j, o)| *j != i && contains(o, p)).map(|(_, o)| turn(o)).sum();
+            edge.push((outside != 0) != (outside + turn(r) != 0));
+        }
+        let mut edge = edge.into_iter();
+        out.retain(|_| edge.next().unwrap_or(true));
+    }
    // A ring inside an odd number of others is a hole.
    let holes: Vec<bool> = out
        .iter()
@@ -634,14 +650,14 @@ fn steps(o: &Extrude) -> Vec<Step> {

 /// Extrude & Bevel: the shape's outline extruded backwards, with optional twist, taper, bevels
 /// and caps.
-pub fn extrude(path: &PathData, bounds: Rect, options: Extrude, view: View) -> Result<Vec<Facet>, String> {
+pub fn extrude(path: &PathData, rule: FillRule, bounds: Rect, options: Extrude, view: View) -> Result<Vec<Facet>, String> {
    check_bounds(bounds)?;
    let o = options.sanitized();
    // No depth: the flat shape, seen from either side.
    if o.depth <= 0.0 {
-        return plane(path, bounds, view);
+        return plane(path, rule, bounds, view);
    }
-    let rings = rings(path, bounds.width().max(bounds.height()), MAX_SOLID_POINTS)?;
+    let rings = rings(path, rule, bounds.width().max(bounds.height()), MAX_SOLID_POINTS)?;
    let camera = Camera::new(view, bounds, o.depth);
    let mut b = Builder { camera: &camera, closed: o.cap, facets: vec![] };
    let steps = steps(&o);
@@ -675,9 +691,9 @@ pub fn extrude(path: &PathData, bounds: Rect, options: Extrude, view: View) -> R

 /// Rotate: the flat art turned in 3D about the centre of `bounds` (which may be larger than the
 /// shape's own, so that every part of one object turns about the same point).
-pub fn plane(path: &PathData, bounds: Rect, view: View) -> Result<Vec<Facet>, String> {
+pub fn plane(path: &PathData, rule: FillRule, bounds: Rect, view: View) -> Result<Vec<Facet>, String> {
    check_bounds(bounds)?;
-    let rings = rings(path, bounds.width().max(bounds.height()), MAX_PLANE_POINTS)?;
+    let rings = rings(path, rule, bounds.width().max(bounds.height()), MAX_PLANE_POINTS)?;
    let camera = Camera::new(view, bounds, 0.0);
    let mut b = Builder { camera: &camera, closed: false, facets: vec![] };
    let contours: Vec<Vec<V3>> = rings.iter().map(|r| r.iter().map(|p| camera.place(*p, 0.0)).collect()).collect();
@@ -997,18 +1013,18 @@ fn material(outline: &PathData, cell: Rect) -> Option<Vec<Vec<Point>>> {
        &[Point::new(cell.x0, cell.y0), Point::new(cell.x1, cell.y0), Point::new(cell.x1, cell.y1), Point::new(cell.x0, cell.y1)],
        true,
    ));
-    let rule = vectorcraft_geom::FillRule::NonZero;
+    let rule = FillRule::NonZero;
    let part =
        vectorcraft_pathops::try_boolean(&r, rule, outline, rule, vectorcraft_pathops::BoolOp::Intersect, vectorcraft_pathops::DEFAULT_PRECISION)
            .ok()?;
-    rings(&part, cell.width(), MAX_PLANE_POINTS).ok()
+    rings(&part, rule, cell.width(), MAX_PLANE_POINTS).ok()
 }

 /// Inflate: the shape puffed out like a cushion, its edge kept where the art's outline is.
-pub fn inflate(path: &PathData, bounds: Rect, options: Inflate, view: View) -> Result<Vec<Facet>, String> {
+pub fn inflate(path: &PathData, rule: FillRule, bounds: Rect, options: Inflate, view: View) -> Result<Vec<Facet>, String> {
    check_bounds(bounds)?;
    let o = options.sanitized();
-    let rings = rings(path, bounds.width().max(bounds.height()), MAX_SOLID_POINTS)?;
+    let rings = rings(path, rule, bounds.width().max(bounds.height()), MAX_SOLID_POINTS)?;
    if rings.is_empty() {
        return Ok(vec![]);
    }
@@ -1,4 +1,4 @@
-use vectorcraft_geom::{BezPath, PathData, Point, Rect};
+use vectorcraft_geom::{BezPath, FillRule, PathData, Point, Rect};

 use super::*;

@@ -41,7 +41,7 @@ fn close(a: f64, b: f64, tol: f64) -> bool {
 #[test]
 fn seen_straight_on_an_extrusion_is_its_front_face_exactly_where_the_art_is() {
    let (p, b) = shape(&square(10.0, 20.0, 100.0));
-    let f = extrude(&p, b, Extrude::default(), front()).unwrap();
+    let f = extrude(&p, FillRule::EvenOdd, b, Extrude::default(), front()).unwrap();
    assert_eq!(f.len(), 1, "the walls and back face away: only the front cap shows");
    assert_eq!(f[0].contours.len(), 1);
    assert_eq!(extent(&f), Rect::new(10.0, 20.0, 110.0, 120.0));
@@ -51,7 +51,7 @@ fn seen_straight_on_an_extrusion_is_its_front_face_exactly_where_the_art_is() {
 fn turned_about_y_the_front_foreshortens_and_one_side_wall_shows() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
    let o = Extrude { depth: 40.0, ..Extrude::default() };
-    let f = extrude(&p, b, o, View { rotation_y: 30.0, ..front() }).unwrap();
+    let f = extrude(&p, FillRule::EvenOdd, b, o, View { rotation_y: 30.0, ..front() }).unwrap();
    // Orthographic: the silhouette is the front's width times cos 30° plus the depth times sin 30°.
    let w = extent(&f).width();
    assert!(close(w, 100.0 * 30f64.to_radians().cos() + 40.0 * 30f64.to_radians().sin(), 1e-6), "{w}");
@@ -66,10 +66,10 @@ fn turned_about_y_the_front_foreshortens_and_one_side_wall_shows() {
 fn no_depth_is_the_flat_shape_and_no_cap_shows_the_inside() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
    let v = View { rotation_x: 20.0, rotation_y: 30.0, ..front() };
-    let flat = extrude(&p, b, Extrude { depth: 0.0, ..Extrude::default() }, v).unwrap();
-    assert_eq!(flat, plane(&p, b, v).unwrap());
-    let solid = extrude(&p, b, Extrude::default(), v).unwrap();
-    let hollow = extrude(&p, b, Extrude { cap: false, ..Extrude::default() }, v).unwrap();
+    let flat = extrude(&p, FillRule::EvenOdd, b, Extrude { depth: 0.0, ..Extrude::default() }, v).unwrap();
+    assert_eq!(flat, plane(&p, FillRule::EvenOdd, b, v).unwrap());
+    let solid = extrude(&p, FillRule::EvenOdd, b, Extrude::default(), v).unwrap();
+    let hollow = extrude(&p, FillRule::EvenOdd, b, Extrude { cap: false, ..Extrude::default() }, v).unwrap();
    // Solid: front, right and top faces. Hollow: all four walls (two seen from inside), no caps.
    assert_eq!(solid.len(), 3);
    assert_eq!(hollow.len(), 4);
@@ -81,10 +81,10 @@ fn taper_shrinks_the_back_and_twist_turns_it() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
    let side = View { rotation_y: 90.0, ..front() };
    let o = Extrude { depth: 60.0, cap: false, ..Extrude::default() };
-    let straight = extent(&extrude(&p, b, o, side).unwrap());
+    let straight = extent(&extrude(&p, FillRule::EvenOdd, b, o, side).unwrap());
    assert!(close(straight.height(), 100.0, 1e-6) && close(straight.width(), 60.0, 1e-6));
    // Seen from the side, a 50 % taper keeps the front's full height and halves the back's.
-    let tapered = extrude(&p, b, Extrude { taper: 0.5, ..o }, side).unwrap();
+    let tapered = extrude(&p, FillRule::EvenOdd, b, Extrude { taper: 0.5, ..o }, side).unwrap();
    let back: Vec<Point> = tapered.iter().flat_map(|f| f.contours.iter().flatten().copied()).filter(|q| close(q.x, straight.x0, 1e-6)).collect();
    let (lo, hi) = back.iter().fold((f64::INFINITY, f64::NEG_INFINITY), |(lo, hi), q| (lo.min(q.y), hi.max(q.y)));
    let at_front: Vec<Point> = tapered.iter().flat_map(|f| f.contours.iter().flatten().copied()).filter(|q| close(q.x, straight.x1, 1e-6)).collect();
@@ -93,11 +93,11 @@ fn taper_shrinks_the_back_and_twist_turns_it() {
    assert!(close(front_h, 100.0, 1e-6) && close(back_h, 50.0, 1e-6), "front {front_h}, back {back_h}");
    // Seen from behind, a 45° twist shows the back cap turned into a diamond.
    let back = View { rotation_y: 180.0, ..front() };
-    let twisted = extrude(&p, b, Extrude { twist: 45.0, cap: true, ..o }, back).unwrap();
+    let twisted = extrude(&p, FillRule::EvenOdd, b, Extrude { twist: 45.0, cap: true, ..o }, back).unwrap();
    assert_eq!(twisted.len(), 1, "only the back cap faces the viewer");
    assert!(close(extent(&twisted).width(), 100.0 * 2f64.sqrt(), 1e-6), "{:?}", extent(&twisted));
    // Its walls are cut into slices that follow the turn.
-    let open = extrude(&p, b, Extrude { twist: 45.0, ..o }, View { rotation_x: -20.0, rotation_y: 30.0, ..front() }).unwrap();
+    let open = extrude(&p, FillRule::EvenOdd, b, Extrude { twist: 45.0, ..o }, View { rotation_x: -20.0, rotation_y: 30.0, ..front() }).unwrap();
    assert!(open.len() > 2 * 8, "{}", open.len());
 }

@@ -105,13 +105,13 @@ fn taper_shrinks_the_back_and_twist_turns_it() {
 fn a_bevel_inside_shrinks_the_cap_and_outside_grows_the_walls() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
    let bevel = Bevel { width: 10.0, height: 10.0, ..Bevel::default() };
-    let inside = extrude(&p, b, Extrude { bevel: Some(Bevel { inside: true, ..bevel }), ..Extrude::default() }, front()).unwrap();
+    let inside = extrude(&p, FillRule::EvenOdd, b, Extrude { bevel: Some(Bevel { inside: true, ..bevel }), ..Extrude::default() }, front()).unwrap();
    // Straight on: the cap inset by the width, and the chamfer around it filling the outline.
    let cap = inside.iter().find(|f| close(signed_area(&f.contours[0]).abs(), 80.0 * 80.0, 1e-6));
    assert!(cap.is_some(), "an 80 × 80 cap");
    assert_eq!(extent(&inside), Rect::new(0.0, 0.0, 100.0, 100.0));
    assert!(close(area(&inside), 100.0 * 100.0, 1e-6));
-    let outside = extrude(&p, b, Extrude { bevel: Some(bevel), ..Extrude::default() }, front()).unwrap();
+    let outside = extrude(&p, FillRule::EvenOdd, b, Extrude { bevel: Some(bevel), ..Extrude::default() }, front()).unwrap();
    assert_eq!(extent(&outside), Rect::new(-10.0, -10.0, 110.0, 110.0), "the walls stand 10 pt outside the art");
    assert!(outside.iter().any(|f| close(signed_area(&f.contours[0]).abs(), 100.0 * 100.0, 1e-6)), "the cap is the art");
    // The chamfer's faces lean towards the light differently from the cap.
@@ -123,12 +123,16 @@ fn bevel_shapes_repeats_and_both_sides_change_the_surface() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
    let v = View { rotation_x: -20.0, rotation_y: 30.0, ..front() };
    let base = Bevel { width: 12.0, height: 12.0, ..Bevel::default() };
-    let classic = extrude(&p, b, Extrude { bevel: Some(base), ..Extrude::default() }, v).unwrap();
+    let classic = extrude(&p, FillRule::EvenOdd, b, Extrude { bevel: Some(base), ..Extrude::default() }, v).unwrap();
    for shape in BevelShape::ALL.into_iter().skip(1) {
-        assert_ne!(classic, extrude(&p, b, Extrude { bevel: Some(Bevel { shape, ..base }), ..Extrude::default() }, v).unwrap(), "{shape:?}");
+        assert_ne!(
+            classic,
+            extrude(&p, FillRule::EvenOdd, b, Extrude { bevel: Some(Bevel { shape, ..base }), ..Extrude::default() }, v).unwrap(),
+            "{shape:?}"
+        );
    }
    for bevel in [Bevel { repeat: 3, ..base }, Bevel { repeat: 3, space: 0.3, ..base }, Bevel { both_sides: true, ..base }] {
-        assert_ne!(classic, extrude(&p, b, Extrude { bevel: Some(bevel), ..Extrude::default() }, v).unwrap(), "{bevel:?}");
+        assert_ne!(classic, extrude(&p, FillRule::EvenOdd, b, Extrude { bevel: Some(bevel), ..Extrude::default() }, v).unwrap(), "{bevel:?}");
    }
    // The step shape keeps its corners: half the width at half the height.
    assert_eq!(BevelShape::Step.at(0.5), (0.5, 0.5));
@@ -147,11 +151,11 @@ fn holes_stay_holes_in_the_caps_and_get_walls_of_their_own() {
    // The hole drawn the same way round as the outline: even-odd nesting still makes it a hole.
    b.extend(square(30.0, 30.0, 40.0));
    let (p, r) = shape(&b);
-    let f = extrude(&p, r, Extrude::default(), front()).unwrap();
+    let f = extrude(&p, FillRule::EvenOdd, r, Extrude::default(), front()).unwrap();
    assert_eq!(f.len(), 1);
    assert_eq!(f[0].contours.len(), 2);
    assert!(close(area(&f), 100.0 * 100.0 - 40.0 * 40.0, 1e-6));
-    let turned = extrude(&p, r, Extrude::default(), View { rotation_y: 40.0, ..front() }).unwrap();
+    let turned = extrude(&p, FillRule::EvenOdd, r, Extrude::default(), View { rotation_y: 40.0, ..front() }).unwrap();
    // Front cap, the outline's right wall and the hole's left wall (seen through the hole).
    assert_eq!(turned.len(), 3);
 }
@@ -159,15 +163,15 @@ fn holes_stay_holes_in_the_caps_and_get_walls_of_their_own() {
 #[test]
 fn a_plane_turns_about_the_given_centre() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
-    let f = plane(&p, b, View { rotation_y: 60.0, ..front() }).unwrap();
+    let f = plane(&p, FillRule::EvenOdd, b, View { rotation_y: 60.0, ..front() }).unwrap();
    assert_eq!(f.len(), 1);
    let e = extent(&f);
    assert!(close(e.width(), 50.0, 1e-6) && close(e.center().x, 50.0, 1e-9));
    // Turned about the centre of a larger box, the square moves as well as narrowing.
-    let wide = plane(&p, Rect::new(0.0, 0.0, 300.0, 100.0), View { rotation_y: 60.0, ..front() }).unwrap();
+    let wide = plane(&p, FillRule::EvenOdd, Rect::new(0.0, 0.0, 300.0, 100.0), View { rotation_y: 60.0, ..front() }).unwrap();
    assert!(close(extent(&wide).x0, 150.0 - 150.0 * 0.5, 1e-6));
    // Its back shows when turned past 90°: a plane is two-sided.
-    assert_eq!(plane(&p, b, View { rotation_y: 150.0, ..front() }).unwrap().len(), 1);
+    assert_eq!(plane(&p, FillRule::EvenOdd, b, View { rotation_y: 150.0, ..front() }).unwrap().len(), 1);
 }

 #[test]
@@ -175,7 +179,7 @@ fn inflate_covers_the_shape_and_puffs_by_the_volume() {
    let mut c = BezPath::new();
    c.extend(vectorcraft_geom::kurbo::Shape::path_elements(&vectorcraft_geom::kurbo::Circle::new((100.0, 100.0), 50.0), 0.01));
    let (p, b) = shape(&c);
-    let f = inflate(&p, b, Inflate::default(), front()).unwrap();
+    let f = inflate(&p, FillRule::EvenOdd, b, Inflate::default(), front()).unwrap();
    // Straight on, the cushion covers the circle (sampled as a polygon) and nothing else.
    assert!(close(area(&f), std::f64::consts::PI * 50.0 * 50.0, 60.0), "{}", area(&f));
    assert!(extent(&f).x0 >= 50.0 - 1e-6 && extent(&f).x1 <= 150.0 + 1e-6);
@@ -184,7 +188,7 @@ fn inflate_covers_the_shape_and_puffs_by_the_volume() {
    assert!(hi - lo > 0.3, "{lo}..{hi}");
    // From the side: 50 % volume rounds a disc into a half sphere on a flat back.
    let side = View { rotation_y: 90.0, ..front() };
-    let thick = |o: Inflate| extent(&inflate(&p, b, o, side).unwrap()).width();
+    let thick = |o: Inflate| extent(&inflate(&p, FillRule::EvenOdd, b, o, side).unwrap()).width();
    assert!(close(thick(Inflate::default()), 50.0, 2.0), "{}", thick(Inflate::default()));
    assert!(close(thick(Inflate { both_sides: true, ..Inflate::default() }), 100.0, 4.0));
    assert!(close(thick(Inflate { depth: 30.0, ..Inflate::default() }), 80.0, 2.0));
@@ -197,7 +201,7 @@ fn inflate_leaves_holes_open() {
    let mut b = square(0.0, 0.0, 100.0);
    b.extend(square(30.0, 30.0, 40.0));
    let (p, r) = shape(&b);
-    let f = inflate(&p, r, Inflate::default(), front()).unwrap();
+    let f = inflate(&p, FillRule::EvenOdd, r, Inflate::default(), front()).unwrap();
    assert!(close(area(&f), 100.0 * 100.0 - 40.0 * 40.0, 1e-3), "{}", area(&f));
 }

@@ -205,9 +209,9 @@ fn inflate_leaves_holes_open() {
 fn malformed_and_degenerate_input_is_bounded() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
    for r in [Rect::new(f64::NAN, 0.0, 1.0, 1.0), Rect::new(0.0, 0.0, 1e9, 1.0)] {
-        assert!(extrude(&p, r, Extrude::default(), front()).is_err());
-        assert!(inflate(&p, r, Inflate::default(), front()).is_err());
-        assert!(plane(&p, r, front()).is_err());
+        assert!(extrude(&p, FillRule::EvenOdd, r, Extrude::default(), front()).is_err());
+        assert!(inflate(&p, FillRule::EvenOdd, r, Inflate::default(), front()).is_err());
+        assert!(plane(&p, FillRule::EvenOdd, r, front()).is_err());
    }
    let wild = Extrude {
        depth: f64::INFINITY,
@@ -216,18 +220,24 @@ fn malformed_and_degenerate_input_is_bounded() {
        cap: true,
        bevel: Some(Bevel { width: f64::NAN, height: 1e12, repeat: usize::MAX, space: 7.0, ..Bevel::default() }),
    };
-    let f = extrude(&p, b, wild, View { rotation_x: f64::NAN, perspective: 900.0, ..front() }).unwrap();
+    let f = extrude(&p, FillRule::EvenOdd, b, wild, View { rotation_x: f64::NAN, perspective: 900.0, ..front() }).unwrap();
    assert!(f.iter().flat_map(|f| f.contours.iter().flatten()).all(|q| q.x.is_finite() && q.y.is_finite()));
    assert!(
-        inflate(&p, b, Inflate { depth: -5.0, volume: f64::NAN, both_sides: true, twist: f64::INFINITY, taper: f64::NAN, cap: true }, front())
-            .is_ok()
+        inflate(
+            &p,
+            FillRule::EvenOdd,
+            b,
+            Inflate { depth: -5.0, volume: f64::NAN, both_sides: true, twist: f64::INFINITY, taper: f64::NAN, cap: true },
+            front()
+        )
+        .is_ok()
    );
-    assert!(extrude(&PathData::default(), b, Extrude::default(), front()).unwrap().is_empty());
+    assert!(extrude(&PathData::default(), FillRule::EvenOdd, b, Extrude::default(), front()).unwrap().is_empty());
    // A line has no area to extrude.
    let mut line = BezPath::new();
    line.move_to((0.0, 0.0));
    line.line_to((100.0, 0.0));
-    assert!(extrude(&PathData::from_bezpath(&line), b, Extrude::default(), front()).unwrap().is_empty());
+    assert!(extrude(&PathData::from_bezpath(&line), FillRule::EvenOdd, b, Extrude::default(), front()).unwrap().is_empty());
    // Too many anchors: refused, not truncated.
    let mut many = BezPath::new();
    many.move_to((0.0, 0.0));
@@ -235,15 +245,15 @@ fn malformed_and_degenerate_input_is_bounded() {
        many.line_to((f64::from(i), f64::from(i % 7)));
    }
    many.close_path();
-    assert!(extrude(&PathData::from_bezpath(&many), b, Extrude::default(), front()).is_err());
+    assert!(extrude(&PathData::from_bezpath(&many), FillRule::EvenOdd, b, Extrude::default(), front()).is_err());
 }

 #[test]
 fn perspective_makes_the_near_face_larger() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
    let o = Extrude { depth: 100.0, ..Extrude::default() };
-    let flat = extent(&extrude(&p, b, o, front()).unwrap());
-    let deep = extent(&extrude(&p, b, o, View { perspective: 30.0, ..front() }).unwrap());
+    let flat = extent(&extrude(&p, FillRule::EvenOdd, b, o, front()).unwrap());
+    let deep = extent(&extrude(&p, FillRule::EvenOdd, b, o, View { perspective: 30.0, ..front() }).unwrap());
    assert!(deep.width() > flat.width() + 1.0);
    assert!(close(deep.center().x, flat.center().x, 1e-6));
 }
@@ -257,7 +267,7 @@ fn a_wider_perspective_brings_the_eye_nearer() {
    let mut last = 100.0;
    for angle in [20.0, 60.0, 110.0, 160.0] {
        // The front face alone shows: its width is the cube's on the page.
-        let width = extent(&extrude(&p, b, o, View { perspective: angle, ..front() }).unwrap()).width();
+        let width = extent(&extrude(&p, FillRule::EvenOdd, b, o, View { perspective: angle, ..front() }).unwrap()).width();
        assert!(width > last, "{angle}°: {width} after {last}");
        last = width;
    }
@@ -274,10 +284,10 @@ fn the_inflate_membrane_matches_known_solutions() {
    let mut c = BezPath::new();
    c.extend(vectorcraft_geom::kurbo::Shape::path_elements(&vectorcraft_geom::kurbo::Circle::new((100.0, 100.0), 50.0), 0.01));
    let (p, b) = shape(&c);
-    let disc = Membrane::solve(&rings(&p, 100.0, MAX_SOLID_POINTS).unwrap(), b.origin(), b.width() / 48.0, 49, 49);
+    let disc = Membrane::solve(&rings(&p, FillRule::EvenOdd, 100.0, MAX_SOLID_POINTS).unwrap(), b.origin(), b.width() / 48.0, 49, 49);
    assert!(close(disc.peak, 50.0 * 50.0 / 4.0, 625.0 * 0.02), "{}", disc.peak);
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
-    let sq = Membrane::solve(&rings(&p, 100.0, MAX_SOLID_POINTS).unwrap(), b.origin(), 100.0 / 48.0, 49, 49);
+    let sq = Membrane::solve(&rings(&p, FillRule::EvenOdd, 100.0, MAX_SOLID_POINTS).unwrap(), b.origin(), 100.0 / 48.0, 49, 49);
    assert!(close(sq.peak, 0.07367 * 100.0 * 100.0, 736.7 * 0.02), "{}", sq.peak);
    // Smooth across the middle: no crease where a distance-to-the-edge height would have one
    // (the diagonals). The second difference along a diagonal stays small and even.
@@ -303,10 +313,10 @@ fn inflate_cells_across_a_hole_edge_are_cut_to_the_shape() {
    b.close_path();
    let (p, r) = shape(&b);
    let v = View { rotation_x: -21.88, rotation_y: -23.4, rotation_z: 9.06, ..front() };
-    let f = inflate(&p, r, Inflate::default(), v).unwrap();
+    let f = inflate(&p, FillRule::EvenOdd, r, Inflate::default(), v).unwrap();
    assert!(f.iter().all(|f| f.contours.len() == 1), "every facet is one piece of the surface");
    // Straight on, the facets still cover exactly the shape.
-    let flat = inflate(&p, r, Inflate::default(), front()).unwrap();
+    let flat = inflate(&p, FillRule::EvenOdd, r, Inflate::default(), front()).unwrap();
    assert!(close(area(&flat), 220.0 * 220.0 - 100.0 * 90.0, 1e-3), "{}", area(&flat));
 }

@@ -332,19 +342,19 @@ fn bumps(count: usize) -> (PathData, Rect) {
 fn small_curves_take_few_points_and_rotate_takes_large_outlines() {
    // 300 curves were 4,800 points at sixteen each, over the old limit of 1,024.
    let (p, r) = bumps(300);
-    assert!(extrude(&p, r, Extrude::default(), front()).is_ok());
-    assert!(inflate(&p, r, Inflate { volume: 20.0, ..Inflate::default() }, front()).is_ok());
-    assert!(plane(&p, r, front()).is_ok());
+    assert!(extrude(&p, FillRule::EvenOdd, r, Extrude::default(), front()).is_ok());
+    assert!(inflate(&p, FillRule::EvenOdd, r, Inflate { volume: 20.0, ..Inflate::default() }, front()).is_ok());
+    assert!(plane(&p, FillRule::EvenOdd, r, front()).is_ok());
    // 4,000 curves: too many for a solid, not for Rotate.
    let (p, r) = bumps(4000);
-    assert!(extrude(&p, r, Extrude::default(), front()).unwrap_err().contains("too complex"));
-    assert_eq!(plane(&p, r, front()).unwrap().len(), 1);
+    assert!(extrude(&p, FillRule::EvenOdd, r, Extrude::default(), front()).unwrap_err().contains("too complex"));
+    assert_eq!(plane(&p, FillRule::EvenOdd, r, front()).unwrap().len(), 1);
    // Each piece stays within the tolerance of the curve: a circle's chords sag at most 0.05 pt
    // here (1/2000 of its 100 pt size is less).
    let mut c = BezPath::new();
    c.extend(vectorcraft_geom::kurbo::Shape::path_elements(&vectorcraft_geom::kurbo::Circle::new((50.0, 50.0), 50.0), 0.01));
    let (p, r) = shape(&c);
-    let ring = &rings(&p, 100.0, MAX_SOLID_POINTS).unwrap()[0];
+    let ring = &rings(&p, FillRule::EvenOdd, 100.0, MAX_SOLID_POINTS).unwrap()[0];
    for (a, b) in ring.iter().zip(ring.iter().cycle().skip(1)) {
        let mid = a.midpoint(*b);
        assert!(50.0 - mid.distance(Point::new(50.0, 50.0)) <= 0.05 + 1e-3, "{a:?} {b:?}");
@@ -352,7 +362,7 @@ fn small_curves_take_few_points_and_rotate_takes_large_outlines() {
    assert!(r.width() > 0.0);
    // A small bump takes a few points; a large curve more than sixteen where it needs them.
    let (p, r) = bumps(300);
-    let small = rings(&p, r.width().max(r.height()), MAX_SOLID_POINTS).unwrap()[0].len();
+    let small = rings(&p, FillRule::EvenOdd, r.width().max(r.height()), MAX_SOLID_POINTS).unwrap()[0].len();
    assert!(small <= 300 * 4 + 3, "{small} points for 300 bumps");
    assert!(ring.len() > 4 * 16, "a 100 pt circle within 0.05 pt: {}", ring.len());
 }
@@ -362,7 +372,7 @@ fn small_curves_take_few_points_and_rotate_takes_large_outlines() {
 #[test]
 fn the_edge_index_finds_the_nearest_edge() {
    let (p, r) = bumps(200);
-    let rings = rings(&p, r.width(), MAX_SOLID_POINTS).unwrap();
+    let rings = rings(&p, FillRule::EvenOdd, r.width(), MAX_SOLID_POINTS).unwrap();
    let edges = Edges::new(&rings);
    for k in 0..400 {
        let t = f64::from(k);
@@ -376,7 +386,7 @@ fn the_edge_index_finds_the_nearest_edge() {
 /// straight ahead: the search doesn't stop before it has looked there.
 #[test]
 fn the_edge_index_looks_along_the_side_from_outside() {
-    let ring = |b: BezPath| rings(&shape(&b).0, 64.0, MAX_SOLID_POINTS).unwrap().remove(0);
+    let ring = |b: BezPath| rings(&shape(&b).0, FillRule::EvenOdd, 64.0, MAX_SOLID_POINTS).unwrap().remove(0);
    // Straight ahead of the point, a little further up its side, and the far corner (a 64 pt grid).
    let rings = vec![ring(square(2.5, 0.0, 1.0)), ring(square(0.0, 4.2, 0.8)), ring(square(63.0, 63.0, 1.0))];
    let edges = Edges::new(&rings);
@@ -390,7 +400,7 @@ fn the_edge_index_looks_along_the_side_from_outside() {
 fn twist_holds_between_0_and_360_degrees() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
    let v = View { rotation_x: -20.0, rotation_y: 30.0, ..front() };
-    let at = |twist: f64| extrude(&p, b, Extrude { twist, ..Extrude::default() }, v).unwrap();
+    let at = |twist: f64| extrude(&p, FillRule::EvenOdd, b, Extrude { twist, ..Extrude::default() }, v).unwrap();
    assert_eq!(at(-45.0), at(0.0));
    assert_eq!(at(500.0), at(360.0));
    assert_ne!(at(45.0), at(0.0));
@@ -408,11 +418,11 @@ fn twisted_walls_face_the_way_they_turn() {
        for (x, y) in [(-20.0, 30.0), (0.0, 90.0), (30.0, -60.0), (-45.0, 150.0)] {
            let v = View { rotation_x: x, rotation_y: y, ..front() };
            let o = Extrude { twist, ..Extrude::default() };
-            let got = extrude(&p, b, o, v).unwrap();
+            let got = extrude(&p, FillRule::EvenOdd, b, o, v).unwrap();
            // Expected: walls (and caps) whose outward normal faces the viewer.
            let o = o.sanitized();
            let camera = Camera::new(v, b, o.depth);
-            let ring = &rings(&p, b.width().max(b.height()), MAX_SOLID_POINTS).unwrap()[0];
+            let ring = &rings(&p, FillRule::EvenOdd, b.width().max(b.height()), MAX_SOLID_POINTS).unwrap()[0];
            let slices = ((twist / 6.0).ceil() as usize).clamp(8, 64);
            let z = |t: f64| o.depth / 2.0 - o.depth * t;
            let mut expected = 0;
@@ -456,7 +466,7 @@ fn inflate_twists_tapers_and_opens_its_back() {
    let o = Inflate { depth: 60.0, volume: 0.0, ..Inflate::default() };
    // From the side, a flat (0 % volume) cushion is the extrusion: front 100 high, the back 50
    // at a 50 % taper.
-    let tapered = inflate(&p, b, Inflate { taper: 0.5, ..o }, side).unwrap();
+    let tapered = inflate(&p, FillRule::EvenOdd, b, Inflate { taper: 0.5, ..o }, side).unwrap();
    let e = extent(&tapered);
    assert!(close(e.width(), 60.0, 1e-6) && close(e.height(), 100.0, 1e-6), "{e:?}");
    let back: Vec<Point> = tapered.iter().flat_map(|f| f.contours.iter().flatten().copied()).filter(|q| close(q.x, e.x0, 1e-6)).collect();
@@ -464,18 +474,19 @@ fn inflate_twists_tapers_and_opens_its_back() {
    assert!(close(hi - lo, 50.0, 1e-6), "back {}", hi - lo);
    // From behind, a 45° twist shows the flat back as a diamond.
    let behind = View { rotation_y: 180.0, ..front() };
-    let twisted = inflate(&p, b, Inflate { twist: 45.0, ..o }, behind).unwrap();
+    let twisted = inflate(&p, FillRule::EvenOdd, b, Inflate { twist: 45.0, ..o }, behind).unwrap();
    assert!(close(extent(&twisted).width(), 100.0 * 2f64.sqrt(), 1e-6), "{:?}", extent(&twisted));
    // Hollow: no back; from behind the inside of the inflated front shows instead of a flat face.
-    let solid = inflate(&p, b, Inflate { volume: 50.0, ..o }, behind).unwrap();
+    let solid = inflate(&p, FillRule::EvenOdd, b, Inflate { volume: 50.0, ..o }, behind).unwrap();
    assert_eq!(solid.len(), 1, "the flat back alone");
-    let hollow = inflate(&p, b, Inflate { volume: 50.0, cap: false, ..o }, behind).unwrap();
+    let hollow = inflate(&p, FillRule::EvenOdd, b, Inflate { volume: 50.0, cap: false, ..o }, behind).unwrap();
    assert!(hollow.len() > 100 && hollow.iter().all(|f| f.contours.len() == 1 && f.contours[0].len() < 12));
    // With both sides puffed, the back puff is scaled with the taper: lower and smaller.
-    let both = |taper: f64| extent(&inflate(&p, b, Inflate { both_sides: true, volume: 50.0, taper, depth: 0.0, ..o }, side).unwrap());
+    let both =
+        |taper: f64| extent(&inflate(&p, FillRule::EvenOdd, b, Inflate { both_sides: true, volume: 50.0, taper, depth: 0.0, ..o }, side).unwrap());
    assert!(both(0.5).width() < both(1.0).width() && both(0.5).height() <= both(1.0).height() + 1e-6);
    // Out of range values hold at the documented ends.
-    let at = |i: Inflate| inflate(&p, b, i, View { rotation_x: -20.0, rotation_y: 30.0, ..front() }).unwrap();
+    let at = |i: Inflate| inflate(&p, FillRule::EvenOdd, b, i, View { rotation_x: -20.0, rotation_y: 30.0, ..front() }).unwrap();
    assert_eq!(at(Inflate { twist: -30.0, ..o }), at(o));
    assert_eq!(at(Inflate { taper: 0.0, ..o }), at(Inflate { taper: 0.01, ..o }));
 }
@@ -487,10 +498,43 @@ fn a_flat_twisted_inflate_matches_the_extrusion() {
    let (p, b) = shape(&square(0.0, 0.0, 100.0));
    for (x, y) in [(-20.0, 30.0), (0.0, 90.0), (30.0, -60.0), (-45.0, 150.0), (60.0, 200.0)] {
        let v = View { rotation_x: x, rotation_y: y, ..front() };
-        let e = extent(&extrude(&p, b, Extrude { depth: 60.0, twist: 120.0, taper: 0.6, ..Extrude::default() }, v).unwrap());
-        let i = extent(&inflate(&p, b, Inflate { depth: 60.0, twist: 120.0, taper: 0.6, volume: 0.0, ..Inflate::default() }, v).unwrap());
+        let e = extent(&extrude(&p, FillRule::EvenOdd, b, Extrude { depth: 60.0, twist: 120.0, taper: 0.6, ..Extrude::default() }, v).unwrap());
+        let i = extent(
+            &inflate(&p, FillRule::EvenOdd, b, Inflate { depth: 60.0, twist: 120.0, taper: 0.6, volume: 0.0, ..Inflate::default() }, v).unwrap(),
+        );
        for (a, c) in [(e.x0, i.x0), (e.y0, i.y0), (e.x1, i.x1), (e.y1, i.y1)] {
            assert!(close(a, c, 1e-6), "view ({x}, {y}): extrusion {e:?}, inflate {i:?}");
        }
    }
 }
+
+/// #1724: under the nonzero rule a contour inside another that runs the same way cuts no hole
+/// (the middle is filled, as the art is drawn); one running the other way does, and so does
+/// either under the even-odd rule.
+#[test]
+fn nonzero_shapes_keep_the_middle_a_same_way_contour_encloses() {
+    let rect = |r: Rect, clockwise: bool| {
+        let mut pts = vec![Point::new(r.x0, r.y0), Point::new(r.x1, r.y0), Point::new(r.x1, r.y1), Point::new(r.x0, r.y1)];
+        if clockwise {
+            pts.reverse();
+        }
+        vectorcraft_geom::SubPath::polyline(&pts, true)
+    };
+    let (outer, inner) = (Rect::new(0.0, 0.0, 100.0, 100.0), Rect::new(25.0, 25.0, 75.0, 75.0));
+    let nested = |inner_clockwise: bool| PathData::new(vec![rect(outer, false), rect(inner, inner_clockwise)]);
+    let flat = |p: &PathData, rule: FillRule| area(&plane(p, rule, outer, front()).unwrap());
+    let (solid, holed) = (100.0 * 100.0, 100.0 * 100.0 - 50.0 * 50.0);
+    assert!(close(flat(&nested(false), FillRule::NonZero), solid, 1e-6), "the same way round: filled");
+    assert!(close(flat(&nested(true), FillRule::NonZero), holed, 1e-6), "the other way round: a hole");
+    assert!(close(flat(&nested(false), FillRule::EvenOdd), holed, 1e-6));
+    assert!(close(flat(&nested(true), FillRule::EvenOdd), holed, 1e-6));
+    // A third contour inside the hole is an island again, whichever way it runs.
+    let island = |clockwise: bool| PathData::new(vec![rect(outer, false), rect(inner, true), rect(Rect::new(40.0, 40.0, 60.0, 60.0), clockwise)]);
+    for clockwise in [false, true] {
+        assert!(close(flat(&island(clockwise), FillRule::NonZero), holed + 20.0 * 20.0, 1e-6), "{clockwise}");
+    }
+    // Extrude's caps and Inflate follow the same outline.
+    let caps = |p: &PathData| area(&extrude(p, FillRule::NonZero, outer, Extrude::default(), front()).unwrap());
+    assert!(caps(&nested(false)) > caps(&nested(true)) + 1000.0);
+    assert!(inflate(&nested(false), FillRule::NonZero, outer, Inflate::default(), front()).is_ok());
+}
@@ -730,7 +730,8 @@ impl Tool for DirectSelectionTool {
                }
                sel.retain(|(id, _)| cx.doc.is_editable(*id));
                let items: Vec<Value> = sel.iter().map(|(id, v)| json!({"id": id.0, "anchors": anchors_json(v)})).collect();
-                vec![Action::Exec("select.anchorsMany".into(), json!({"items": items, "mode": if toggle { "toggle" } else { "set" }}))]
+                let art = Action::Exec("select.anchorsMany".into(), json!({"items": items, "mode": if toggle { "toggle" } else { "set" }}));
+                std::iter::once(art).chain(crate::rulerguide::marquee_select(cx, r)).collect()
            }
            _ => vec![],
        }
@@ -1100,6 +1101,26 @@ mod tests {
        assert_eq!(a, vec![Action::Exec("select.anchorsMany".into(), json!({"items": [{"id": id.0, "anchors": [[0, 1]]}], "mode": "set"}))]);
    }

+    #[test]
+    fn marquee_selects_ruler_guides() {
+        let (mut d, id) = doc_with_rect();
+        d.guides.push(vectorcraft_doc::Guide::new(false, 80.0));
+        let s = Selection::default();
+        let p = paint();
+        let cx = cx(&d, &s, &p);
+        let mut t = DirectSelectionTool::new(false);
+        t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 150.0, 50.0));
+        t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 250.0, 150.0));
+        let a = t.pointer(&cx, &PointerEvent::new(PointerKind::Up, 250.0, 150.0));
+        assert_eq!(
+            a,
+            vec![
+                Action::Exec("select.anchorsMany".into(), json!({"items": [{"id": id.0, "anchors": [[0, 1]]}], "mode": "set"})),
+                Action::Exec("guide.select".into(), json!({"indexes": [0], "toggle": true})),
+            ]
+        );
+    }
+
    /// A path inside an inner group, a sibling path outside it, and the groups' ids.
    /// The inside path is the rectangle at (100, 100); the outside one at (300, 300).
    fn nested_group_doc() -> (vectorcraft_doc::Document, NodeId, NodeId, NodeId, NodeId) {
@@ -2,14 +2,15 @@
 //! made where it is released over the canvas: with the Artboard tool, an artboard guide of the
 //! active artboard. For the selection tools ([`GuideEdit`]), a press on a guide selects it (Shift
 //! adds it to the selected guides or, released without a drag, takes it out); dragging moves the
-//! selected guides (Alt copies them). A dragged guide snaps ([`GuideSnap`]): with Shift to the
+//! selected guides (Alt copies them), and a marquee selects the guides it crosses along with the
+//! art ([`marquee_select`]). A dragged guide snaps ([`GuideSnap`]): with Shift to the
 //! ruler's ticks, else to whole pixels, the grid, with Smart Guides the art's and the artboards'
 //! edges, centres and anchors, or with Snap to Point the anchors. Dropped off the canvas onto its
 //! ruler, a moved guide is deleted. Hidden or locked guides (View › Guides), and guides on a hidden
 //! or locked layer, can't be picked.

 use serde_json::json;
-use vectorcraft_geom::Point;
+use vectorcraft_geom::{Point, Rect};

 use crate::guides::Targets;
 use crate::{Action, Cursor, Overlay, PointerEvent, PointerKind, ToolContext};
@@ -32,6 +33,35 @@ pub fn guide_at(cx: &ToolContext, p: Point) -> Option<usize> {
        .map(|(i, _)| i)
 }

+/// What a selection tool's marquee `r` does to the ruler guides, after its action selecting the
+/// art: the guides it crosses join the selection (with a Shift marquee, the selected ones leave
+/// it, as with a Shift-click on a guide).
+pub fn marquee_select(cx: &ToolContext, r: Rect) -> Option<Action> {
+    let guides = guides_in_rect(cx, r);
+    (!guides.is_empty()).then(|| Action::Exec("guide.select".into(), json!({ "indexes": guides, "toggle": true })))
+}
+
+/// The editable ruler guides intersecting marquee rectangle `r`.
+fn guides_in_rect(cx: &ToolContext, r: Rect) -> Vec<usize> {
+    if !cx.guides {
+        return vec![];
+    }
+    cx.doc
+        .guides
+        .iter()
+        .enumerate()
+        .filter(|(_, g)| cx.doc.guide_editable(g))
+        .filter(|(_, g)| {
+            if g.vertical {
+                r.min_x() <= g.pos && g.pos <= r.max_x() && cx.doc.guide_span(g).is_none_or(|(y0, y1)| r.max_y() >= y0 && r.min_y() <= y1)
+            } else {
+                r.min_y() <= g.pos && g.pos <= r.max_y() && cx.doc.guide_span(g).is_none_or(|(x0, x1)| r.max_x() >= x0 && r.min_x() <= x1)
+            }
+        })
+        .map(|(i, _)| i)
+        .collect()
+}
+
 /// The pointer for a guide: it moves sideways if vertical, up and down if horizontal.
 fn guide_cursor(vertical: bool) -> Cursor {
    if vertical { Cursor::ResizeH } else { Cursor::ResizeV }
@@ -459,7 +459,8 @@ impl Tool for SelectionTool {
                    return if toggle { vec![] } else { vec![Action::Exec("select.none".into(), json!({}))] };
                }
                let ids: Vec<NodeId> = marquee(cx.doc, r, cx.isolation, false);
-                vec![Action::Exec(if toggle { "select.toggle" } else { "select.set" }.into(), json!({ "ids": json_ids(&ids) }))]
+                let art = Action::Exec(if toggle { "select.toggle" } else { "select.set" }.into(), json!({ "ids": json_ids(&ids) }));
+                std::iter::once(art).chain(crate::rulerguide::marquee_select(cx, r)).collect()
            }
            _ => vec![],
        }
@@ -993,6 +994,58 @@ mod tests {
        assert!(t.pointer(&cx, &ev(PointerKind::Up, 50.0, 50.0).with_mods(shift)).is_empty());
    }

+    #[test]
+    fn marquee_selects_ruler_guides() {
+        let (mut d, id) = doc_with_rect();
+        d.guides.push(vectorcraft_doc::Guide::new(false, 80.0));
+        let s = Selection::default();
+        let p = paint();
+        let cx = cx(&d, &s, &p);
+        let mut t = SelectionTool::default();
+        t.pointer(&cx, &ev(PointerKind::Down, 50.0, 50.0));
+        t.pointer(&cx, &ev(PointerKind::Drag, 120.0, 120.0));
+        let a = t.pointer(&cx, &ev(PointerKind::Up, 120.0, 120.0));
+        assert_eq!(
+            a,
+            vec![
+                Action::Exec("select.set".into(), json!({"ids": [id.0]})),
+                Action::Exec("guide.select".into(), json!({"indexes": [0], "toggle": true})),
+            ]
+        );
+    }
+
+    #[test]
+    fn marquee_selects_only_guide() {
+        let (mut d, _) = doc_with_rect();
+        d.guides.push(vectorcraft_doc::Guide::new(true, 20.0));
+        let s = Selection::default();
+        let p = paint();
+        let cx = cx(&d, &s, &p);
+        let mut t = SelectionTool::default();
+        t.pointer(&cx, &ev(PointerKind::Down, 10.0, 10.0));
+        t.pointer(&cx, &ev(PointerKind::Drag, 30.0, 30.0));
+        let a = t.pointer(&cx, &ev(PointerKind::Up, 30.0, 30.0));
+        assert_eq!(
+            a,
+            vec![Action::Exec("select.set".into(), json!({"ids": []})), Action::Exec("guide.select".into(), json!({"indexes": [0], "toggle": true})),]
+        );
+    }
+
+    #[test]
+    fn marquee_ignores_locked_guides() {
+        let (mut d, id) = doc_with_rect();
+        d.guides.push(vectorcraft_doc::Guide::new(false, 80.0));
+        let s = Selection::default();
+        let p = paint();
+        let mut cx_locked = cx(&d, &s, &p);
+        cx_locked.guides = false;
+        let mut t = SelectionTool::default();
+        t.pointer(&cx_locked, &ev(PointerKind::Down, 50.0, 50.0));
+        t.pointer(&cx_locked, &ev(PointerKind::Drag, 120.0, 120.0));
+        let a = t.pointer(&cx_locked, &ev(PointerKind::Up, 120.0, 120.0));
+        assert_eq!(a, vec![Action::Exec("select.set".into(), json!({"ids": [id.0]}))]);
+    }
+
    #[test]
    fn handle_drag_scales() {
        let (d, id) = doc_with_rect();
@@ -36,6 +36,8 @@ pub(crate) struct Line {
    /// Stroke width in pixels.
    pub width: f64,
    pub pixels: usize,
+    /// Its ends are cut square (the ink is as long beside the line's middle as along it), not round.
+    pub square: bool,
 }

 /// The lines of colour `label` in `labels` (`w` × `h`, row-major) no wider than `max_width`
@@ -374,22 +376,48 @@ fn trace_line(comp: &[usize], w: usize, max_width: f64, img: &Raster, ink: [f64;
    // wide as its pixels make it).
    widths.sort_by(f64::total_cmp);
    let width = widths.get(widths.len() / 2).copied().unwrap_or(coarse).clamp(0.25, max_width.max(1.0));
-    // Each end goes where the ink ends, less the half width its round cap adds.
+    // Each end goes where the ink ends, less the half width its cap adds. The cap is square when
+    // the ends wide enough to tell are, taken together: the ink reaches as far a third of the width to either side
+    // of the line's middle as along it, where a round end stops short by a seventh of the width.
+    let (mut short_by, mut told) = (0.0, 0);
    for r in runs.iter_mut().filter(|r| !r.closed && r.pts.len() >= 2) {
        for k in 0..2 {
            if r.ends[k].is_some_and(|e| meet[e] > 1) {
                continue;
            }
            let n = r.pts.len();
-            let (tip, inner) = if k == 0 { (r.pts[0], r.pts[3.min(n - 1)]) } else { (r.pts[n - 1], r.pts[n - 1 - 3.min(n - 1)]) };
-            let d = tip - inner;
+            let at = |i: usize| if k == 0 { i.min(n - 1) } else { n - 1 - i.min(n - 1) };
+            // The last points of a wide line's skeleton turn towards a corner of its end: the end
+            // lies where the line was going a width back, and they are put on that line.
+            let back = (width.round() as usize + 2).max(3);
+            let (tip, inner) = (r.pts[at(0)], r.pts[at(back)]);
+            // (Only an end that has left that line: over so few pixels the line's direction is known
+            // to a few degrees at best, less without anti-aliasing, and an end already on it is
+            // better left where it is.)
+            let before = inner - r.pts[at(2 * back)];
+            let wide = width >= 3.0 && n > 2 * back && before.cross(tip - inner).abs() > (0.25 * width).max(1.0) * before.hypot();
+            let d = if wide { before } else { tip - inner };
            if d.hypot() < 1e-9 {
                continue;
            }
-            let more = ink.beyond(tip, d / d.hypot()) - width / 2.0;
-            if more.abs() > 0.05 && more > -1.0 {
-                let to = tip + d / d.hypot() * more;
-                if k == 0 { r.pts[0] = to } else { r.pts[n - 1] = to }
+            let along = d / d.hypot();
+            let on_line = |p: Point| inner + along * (p - inner).dot(along).max(0.0);
+            if wide {
+                for i in 0..back {
+                    r.pts[at(i)] = on_line(r.pts[at(i)]);
+                }
+            }
+            let tip = on_line(tip);
+            let reach = ink.beyond(tip, along);
+            if width >= 3.0 {
+                let aside = kurbo::Vec2::new(-along.y, along.x) * (0.35 * width);
+                let short = reach - (ink.beyond(tip + aside, along) + ink.beyond(tip - aside, along)) / 2.0;
+                short_by += short / width;
+                told += 1;
+            }
+            let more = reach - width / 2.0;
+            if more.abs() > 0.05 && more > 1.0 - (tip - inner).hypot() {
+                r.pts[at(0)] = tip + along * more;
            }
        }
    }
@@ -409,7 +437,7 @@ fn trace_line(comp: &[usize], w: usize, max_width: f64, img: &Raster, ink: [f64;
    if subs.is_empty() {
        return None;
    }
-    Some(Line { path: PathData::new(subs), width, pixels: comp.len() })
+    Some(Line { path: PathData::new(subs), width, pixels: comp.len(), square: told > 0 && short_by / f64::from(told) < 0.07 })
 }

 /// What the image says of a line's ink.
@@ -188,7 +188,7 @@ pub(crate) fn fit_loop(
    across: &dyn Fn(Crack) -> (f64, u32),
    junction_at: &dyn Fn(i32, i32) -> Option<Point>,
    style: &Style,
-) -> Option<SubPath> {
+) -> Option<(SubPath, bool)> {
    let pieces = subpixel::outline(l, w, h, across, junction_at);
    let mut segs: Vec<Cubic> = Vec::new();
    for piece in &pieces {
@@ -206,7 +206,7 @@ pub(crate) fn fit_loop(
            segs.extend(fit_piece(&piece.pts, &style, true));
        }
    }
-    subpath(&segs, true)
+    Some((subpath(&segs, true)?, pieces.iter().any(|p| p.hard)))
 }

 /// A chain of cubics as a subpath: closed (its end joins its start) or open. A straight piece has
@@ -25,6 +25,8 @@ const MAX_STOPS: usize = 6;
 const MIN_SPACING: f64 = 0.08;
 /// How far (levels) the stops may be from the colours along the gradient.
 const STOP_TOLERANCE: f64 = 2.0;
+/// How far (levels) a pixel beside a gradient may be from the gradient's colour there and join it.
+const GROW: f64 = 10.0;

 /// A linear gradient a traced path is filled with.
 #[derive(Clone, Debug, PartialEq)]
@@ -52,6 +54,12 @@ impl TracedGradient {
    }
 }

+/// The pixels beside pixel `i` of a `w` × `h` image.
+fn beside(i: usize, w: usize, h: usize) -> impl Iterator<Item = usize> {
+    let (x, y) = (i % w, i / w);
+    [(x > 0).then(|| i - 1), (x + 1 < w).then(|| i + 1), (y > 0).then(|| i - w), (y + 1 < h).then(|| i + w)].into_iter().flatten()
+}
+
 /// The gradients of `img`: for each pixel the gradient it is part of (an index into the list, or
 /// `u32::MAX`), and the list.
 pub(crate) fn detect(img: &Raster) -> (Vec<u32>, Vec<TracedGradient>) {
@@ -103,11 +111,8 @@ pub(crate) fn detect(img: &Raster) -> (Vec<u32>, Vec<TracedGradient>) {
    let mut depth = vec![0u16; w * h];
    let mut found = vec![];
    let (mut members, mut stack) = (vec![], vec![]);
-    for seed in 0..w * h {
-        if seen.get(seed).copied().unwrap_or(true) || !smooth.get(seed).copied().unwrap_or(false) {
-            continue;
-        }
-        // The connected smooth pixels from here.
+    // The connected smooth pixels from `seed` that `seen` has not: into `members`.
+    let mut flood = |seed: usize, seen: &mut [bool], members: &mut Vec<usize>| {
        members.clear();
        stack.push(seed);
        if let Some(s) = seen.get_mut(seed) {
@@ -115,8 +120,7 @@ pub(crate) fn detect(img: &Raster) -> (Vec<u32>, Vec<TracedGradient>) {
        }
        while let Some(i) = stack.pop() {
            members.push(i);
-            let (x, y) = (i % w, i / w);
-            for j in [(x > 0).then(|| i - 1), (x + 1 < w).then(|| i + 1), (y > 0).then(|| i - w), (y + 1 < h).then(|| i + w)].into_iter().flatten() {
+            for j in beside(i, w, h) {
                if smooth.get(j).copied().unwrap_or(false) && !seen.get(j).copied().unwrap_or(true) {
                    if let Some(s) = seen.get_mut(j) {
                        *s = true;
@@ -125,7 +129,26 @@ pub(crate) fn detect(img: &Raster) -> (Vec<u32>, Vec<TracedGradient>) {
                }
            }
        }
-        if members.len() < MIN_PIXELS || found.len() >= 1000 {
+    };
+    // The areas, largest first: a gradient that noise or a soft rim broke into several is found in
+    // its largest piece and grown over the rest.
+    let mut areas: Vec<(usize, usize)> = vec![];
+    for seed in 0..w * h {
+        if !seen.get(seed).copied().unwrap_or(true) && smooth.get(seed).copied().unwrap_or(false) {
+            flood(seed, &mut seen, &mut members);
+            if members.len() >= MIN_PIXELS {
+                areas.push((members.len(), seed));
+            }
+        }
+    }
+    areas.sort_unstable_by(|a, b| b.cmp(a));
+    seen.fill(false);
+    for (_, seed) in areas {
+        if seen.get(seed).copied().unwrap_or(true) || found.len() >= 1000 {
+            continue;
+        }
+        flood(seed, &mut seen, &mut members);
+        if members.len() < MIN_PIXELS {
            continue;
        }
        // The gradient is read from the area's inside, where there is one: the pixels at its rim
@@ -135,16 +158,12 @@ pub(crate) fn detect(img: &Raster) -> (Vec<u32>, Vec<TracedGradient>) {
        let rim = far as usize + 2;
        let unknown = u16::MAX;
        members.iter().for_each(|&i| depth[i] = unknown);
-        let beside = |i: usize| {
-            let (x, y) = (i % w, i / w);
-            [(x > 0).then(|| i - 1), (x + 1 < w).then(|| i + 1), (y > 0).then(|| i - w), (y + 1 < h).then(|| i + w)].into_iter().flatten()
-        };
-        let mut front: Vec<usize> = members.iter().copied().filter(|&i| beside(i).any(|j| depth.get(j).copied() == Some(0))).collect();
+        let mut front: Vec<usize> = members.iter().copied().filter(|&i| beside(i, w, h).any(|j| depth.get(j).copied() == Some(0))).collect();
        front.iter().for_each(|&i| depth[i] = 1);
        for d in 2..=rim as u16 {
            let mut next = vec![];
            for &i in &front {
-                for j in beside(i) {
+                for j in beside(i, w, h) {
                    if let Some(slot) = depth.get_mut(j).filter(|s| **s == unknown) {
                        *slot = d;
                        next.push(j);
@@ -156,12 +175,27 @@ pub(crate) fn detect(img: &Raster) -> (Vec<u32>, Vec<TracedGradient>) {
        let inside: Vec<usize> = members.iter().copied().filter(|&i| depth.get(i).copied() == Some(unknown)).collect();
        let fitted = fit(img, w, if inside.len() >= MIN_PIXELS { &inside } else { &members }, &members, rim);
        members.iter().for_each(|&i| depth[i] = 0);
-        if let Some((g, part)) = fitted {
+        if let Some((g, mut part)) = fitted {
            for &i in &part {
                if let Some(o) = of.get_mut(i) {
                    *o = found.len() as u32;
                }
            }
+            // Grown over every pixel next to it that has its colour there: the pixels noise put a
+            // little off, a soft rim, the pieces noise cut off it.
+            while let Some(i) = part.pop() {
+                for j in beside(i, w, h) {
+                    let near = px(j).is_some_and(|c| {
+                        let own = g.color_at(Point::new((j % w) as f64 + 0.5, (j / w) as f64 + 0.5));
+                        (0..3).all(|k| (f64::from(c[k]) - own[k]).abs() <= GROW)
+                    });
+                    if near && of.get(j).copied() == Some(u32::MAX) {
+                        of[j] = found.len() as u32;
+                        seen[j] = true;
+                        part.push(j);
+                    }
+                }
+            }
            found.push(g);
        }
    }
@@ -77,8 +77,8 @@ fn inside_or_near(p: Point, o: &Outer) -> bool {
 /// path whose outer contour holds all of its own. The path that covers the whole `w` × `h` image
 /// (the paper) is nobody's parent: everything would be inside it.
 ///
-/// Drawing each path followed by those inside it paints the picture `paths` paints in its own
-/// order: where the paths can overlap (`stacked`), a path only gets a parent below it, and only
+/// Drawing each path together with those inside it (in their own order) paints the picture
+/// `paths` paints in its own order: where the paths can overlap (`stacked`), a path only gets a parent below it, and only
 /// if no path that would then come after it instead of before it shares any of its box.
 pub(crate) fn parents(paths: &[TracedPath], w: usize, h: usize, stacked: bool) -> Vec<Option<usize>> {
    let outers: Vec<Option<Outer>> = paths.iter().map(outer).collect();
@@ -158,7 +158,7 @@ mod tests {

    fn disc(c: (f64, f64), r: f64, color: u8) -> TracedPath {
        let path = PathData::from_bezpath(&kurbo::Shape::to_path(&kurbo::Circle::new(c, r), 0.01));
-        TracedPath { path, color: [color; 3], pixels: 1, stroke: None, shape: None, gradient: None }
+        TracedPath { path, color: [color; 3], pixels: 1, stroke: None, shape: None, gradient: None, square_caps: false }
    }

    #[test]
@@ -430,6 +430,14 @@ pub fn presets() -> Vec<(&'static str, TraceParams)> {
    PRESET_NAMES.iter().filter_map(|n| Some((*n, preset(n)?))).collect()
 }

+/// The enhanced version of built-in preset `name`: the preset with the options the enhanced
+/// presets have built in: Auto Grouping in all of them, Shapes in all but High Fidelity Photo.
+/// Gradients stay an option to turn on. Flat Logo, a preset of our own, has none.
+pub fn enhanced_preset(name: &str) -> Option<TraceParams> {
+    let p = preset(name).filter(|p| p.mode != Mode::Logo)?;
+    Some(TraceParams { auto_grouping: true, shapes: !name.eq_ignore_ascii_case("High Fidelity Photo"), ..p })
+}
+
 /// One traced shape: an outer contour plus its holes, filled with `color`, or (with `stroke`)
 /// lines stroked with it.
 #[derive(Clone, Debug, PartialEq)]
@@ -446,6 +454,9 @@ pub struct TracedPath {
    pub shape: Option<TracedShape>,
    /// Gradients: the linear gradient the path is filled with (`color` is its middle colour).
    pub gradient: Option<TracedGradient>,
+    /// Create Strokes: the stroke's ends are square (a cap that goes half the width past the
+    /// path's end, cut straight), as the line's ink is; otherwise round.
+    pub square_caps: bool,
 }

 /// The traced result, bottom-most path first.
@@ -455,7 +466,8 @@ pub struct TraceResult {
    /// Colours actually used.
    pub palette: Vec<[u8; 3]>,
    /// Auto Grouping: for each of `paths`, the path it lies inside, if any (empty without the
-    /// option). Each path drawn before those inside it paints what `paths` paints in its order.
+    /// option). Each path drawn together with those inside it, in the order they have here, paints
+    /// what `paths` paints in its order.
    pub parents: Vec<Option<usize>>,
 }

@@ -810,6 +822,36 @@ impl Layers<'_> {
        shift
    }

+    /// Whether the pixels inside `l` (a loop along pixel edges) all have one label.
+    fn one_colour_within(&self, l: &Loop) -> bool {
+        let mut first = None;
+        let (y0, y1) = l.pts.iter().fold((i32::MAX, i32::MIN), |m, p| (m.0.min(p.1), m.1.max(p.1)));
+        for y in y0..y1 {
+            // The loop's upright edges that pass this row of pixels, left to right: the pixels
+            // between the first and the second are inside, and so on.
+            let mut xs: Vec<i32> = l
+                .pts
+                .iter()
+                .zip(l.pts.iter().cycle().skip(1))
+                .filter(|(a, b)| a.0 == b.0 && a.1.min(b.1) <= y && y < a.1.max(b.1))
+                .map(|(a, _)| a.0)
+                .collect();
+            xs.sort_unstable();
+            for pair in xs.as_chunks::<2>().0 {
+                for x in pair[0]..pair[1] {
+                    let label = usize::try_from(y)
+                        .ok()
+                        .zip(usize::try_from(x).ok())
+                        .and_then(|(y, x)| self.q.labels.get(y * self.w + x).copied().filter(|_| x < self.w));
+                    if label.is_none() || *first.get_or_insert(label) != label {
+                        return false;
+                    }
+                }
+            }
+        }
+        first.is_some()
+    }
+
    /// The paths of layer `r` (palette entry `ci`), or `None` once the anchors made pass the
    /// maximum.
    fn layer(&self, r: usize, ci: usize) -> Option<Vec<TracedPath>> {
@@ -846,14 +888,14 @@ impl Layers<'_> {
        let area_stroke = (params.strokes && !params.fills).then_some(1.0);
        let min_hole = params.noise.max(1) as i64;
        let mut paths = vec![];
-        let mut add = |path: PathData, pixels: usize, stroke: Option<f64>, shape: Option<TracedShape>| {
+        let mut add = |path: PathData, pixels: usize, stroke: Option<f64>, shape: Option<TracedShape>, square_caps: bool| {
            let n = path.anchor_count();
            if self.anchors.fetch_add(n, Ordering::Relaxed).saturating_add(n) > self.max_anchors {
                return false;
            }
            // (A gradient fills; a stroked line of it is its middle colour.)
            let gradient = self.gradients.get(ci).cloned().flatten().filter(|_| stroke.is_none());
-            paths.push(TracedPath { path, color, pixels, stroke, shape, gradient });
+            paths.push(TracedPath { path, color, pixels, stroke, shape, gradient, square_caps });
            true
        };
        let mut comps = trace_mask(&mask, bw, bh);
@@ -866,27 +908,55 @@ impl Layers<'_> {
            }
        }
        for comp in comps {
-            let fit = |l: &Loop| fit::fit_loop(l, w, h, &|c| (self.shift(c), self.neighbour(c)), &|x, y| self.junction(x, y), &self.style);
+            // (`hard`: some of the outline has no anti-aliasing, and is known less exactly.)
+            let hard = std::cell::Cell::new(false);
+            let fit = |l: &Loop| {
+                let (sp, is_hard) = fit::fit_loop(l, w, h, &|c| (self.shift(c), self.neighbour(c)), &|x, y| self.junction(x, y), &self.style)?;
+                hard.set(hard.get() || is_hard);
+                Some(sp)
+            };
            let Some(outer) = fit(&comp.outer) else { continue };
            let mut subs = vec![outer];
            for hole in &comp.holes {
                if hole.area2.abs() / 2 < min_hole && params.noise > 0 {
                    continue;
                }
-                subs.extend(fit(hole));
+                let Some(mut sp) = fit(hole) else { continue };
+                // Shapes: a hole that is a shape is that shape, as what fills it is (the two are
+                // one outline: they stay one). Only where one colour fills it: the parts of
+                // several are not that shape, and would no longer meet it.
+                if params.shapes
+                    && area_stroke.is_none()
+                    && self.one_colour_within(hole)
+                    && let Some(exact) = shapes::recognise(&sp, hard.get()).and_then(|shape| shape.path().subpaths.into_iter().next())
+                {
+                    // (Which way round each goes: by the area of the polygon through points along it.)
+                    let turn = |sp: &vectorcraft_geom::SubPath| {
+                        use vectorcraft_geom::ParamCurve;
+                        let pts: Vec<_> =
+                            (0..sp.segment_count()).flat_map(|i| (0..6).map(move |k| sp.segment(i).eval(f64::from(k) / 6.0).to_vec2())).collect();
+                        pts.iter().zip(pts.iter().cycle().skip(1)).map(|(a, b)| a.cross(*b)).sum::<f64>()
+                    };
+                    let mut exact = exact;
+                    if (turn(&exact) < 0.0) != (turn(&sp) < 0.0) {
+                        exact.reverse();
+                    }
+                    sp = exact;
+                }
+                subs.push(sp);
            }
            // Shapes: a filled outline without holes that is a shape becomes that shape.
            let shape = match subs.as_slice() {
-                [only] if params.shapes && area_stroke.is_none() => shapes::recognise(only),
+                [only] if params.shapes && area_stroke.is_none() => shapes::recognise(only, hard.get()),
                _ => None,
            };
            let path = shape.map_or_else(|| PathData::new(subs), |s| s.path());
-            if !add(path, comp.pixels, area_stroke, shape) {
+            if !add(path, comp.pixels, area_stroke, shape, false) {
                return None;
            }
        }
        for line in lines {
-            if !add(line.path, line.pixels, Some(line.width), None) {
+            if !add(line.path, line.pixels, Some(line.width), None, line.square) {
                return None;
            }
        }
@@ -493,6 +493,7 @@ pub(crate) fn trace_logo(img: &Raster, params: &TraceParams, max_anchors: usize)
            stroke: None,
            shape: None,
            gradient: None,
+            square_caps: false,
        });
    }
    Ok(out)
@@ -37,13 +37,18 @@ impl TracedShape {
    }
 }

+/// How near (px) a sharp corner the outline may fall short of it, and by how much more than
+/// elsewhere: anti-aliasing and blur take that much off a corner.
+const CORNER: f64 = 3.0;
+const CORNER_SLACK: f64 = 0.75;
+
 /// How far a point may lie from the shape: half a pixel, and for large shapes 0.2% of their size.
 fn tolerance(size: f64) -> f64 {
    (0.002 * size).max(0.5)
 }

 /// The shape the closed outline `sp` is, if it is one (and at least 6 px across).
-pub(crate) fn recognise(sp: &SubPath) -> Option<TracedShape> {
+pub(crate) fn recognise(sp: &SubPath, hard: bool) -> Option<TracedShape> {
    if !sp.closed || sp.anchors.len() < 2 {
        return None;
    }
@@ -83,7 +88,8 @@ pub(crate) fn recognise(sp: &SubPath) -> Option<TracedShape> {
    // The direction of the longer axis (none when the shape is as wide every way).
    let axis = if spread < 0.01 * mean { 0.0 } else { 0.5 * (2.0 * sxy).atan2(sxx - syy) };
    let size = 4.0 * major.sqrt();
-    let tol = tolerance(size);
+    // (An outline without anti-aliasing is only known to about half a pixel.)
+    let tol = tolerance(size) * if hard { 1.5 } else { 1.0 };
    if size < 6.0 || !size.is_finite() {
        return None;
    }
@@ -110,64 +116,107 @@ pub(crate) fn recognise(sp: &SubPath) -> Option<TracedShape> {
        }
    }

-    // A rectangle, along its longest straight side (a square has no longer axis to go by).
+    // A rectangle. Its sides run along its longest straight side if it has one, else along the
+    // longer axis of its area (a blurred one may have no side that is straight), or the pixels.
+    let quarter = std::f64::consts::FRAC_PI_2;
+    let folded = |a: f64| a - quarter * (a / quarter).round();
    let side = (0..sp.segment_count())
        .filter(|&i| sp.segment_is_line(i))
        .map(|i| sp.segment(i))
-        .max_by(|a, b| a.p0.distance(a.p3).total_cmp(&b.p0.distance(b.p3)));
-    if let Some(side) = side {
-        let d = side.p3 - side.p0;
-        // Turned by under 45° either way: a rectangle is the same a quarter turn on.
-        let quarter = std::f64::consts::FRAC_PI_2;
-        let angle = d.y.atan2(d.x);
-        let angle = angle - quarter * (angle / quarter).round();
+        .max_by(|a, b| a.p0.distance(a.p3).total_cmp(&b.p0.distance(b.p3)))
+        .map(|s| folded((s.p3 - s.p0).y.atan2((s.p3 - s.p0).x)));
+    for angle in side.into_iter().chain([folded(axis), 0.0]) {
        let xy: Vec<(f64, f64)> = pts.iter().map(|&p| local(p, angle)).collect();
        let (hw, hh) = xy.iter().fold((0.0f64, 0.0f64), |m, p| (m.0.max(p.0.abs()), m.1.max(p.1.abs())));
-        // Square corners first; else rounded ones, which take (4 − π) r² off the area.
-        let rounded = ((4.0 * hw * hh - area) / (4.0 - std::f64::consts::PI)).max(0.0).sqrt().min(hw.min(hh));
-        for radius in [0.0, rounded] {
-            let off = xy.iter().map(|&(x, y)| {
-                // Distance to the rounded rectangle's edge.
+        // (Its half sizes: where its sides lie on average, not where their farthest points do.)
+        let side = |far: f64, upright: bool, other: f64| {
+            let on: Vec<f64> = xy
+                .iter()
+                .map(|p| if upright { (p.0, p.1) } else { (p.1, p.0) })
+                .filter(|&(a, b)| a.abs() >= far - 0.5 && b.abs() <= other - CORNER)
+                .map(|(a, _)| a.abs())
+                .collect();
+            if on.len() >= 4 { on.iter().sum::<f64>() / on.len() as f64 } else { far }
+        };
+        let (hw, hh) = (side(hw, true, hh), side(hh, false, hw));
+        if hw <= 2.0 || hh <= 2.0 {
+            continue;
+        }
+        // How far the outline is from the rectangle with corners of `radius`, at worst; the points
+        // by its corners `slack` nearer than they are.
+        let off = |radius: f64, slack: f64| {
+            let each = xy.iter().map(|&(x, y)| {
                let (qx, qy) = (x.abs() - hw + radius, y.abs() - hh + radius);
-                (qx.max(0.0).hypot(qy.max(0.0)) + qx.max(qy).min(0.0) - radius).abs()
+                let d = (qx.max(0.0).hypot(qy.max(0.0)) + qx.max(qy).min(0.0) - radius).abs();
+                if x.abs() > hw - CORNER && y.abs() > hh - CORNER { (d - slack).max(0.0) } else { d }
            });
-            if hw > 2.0 && hh > 2.0 && (radius == 0.0 || radius >= 0.75) && off.fold(0.0, f64::max) <= tol {
-                return Some(TracedShape::Rectangle { center: c, width: 2.0 * hw, height: 2.0 * hh, radius, rotation: angle.to_degrees() });
-            }
+            each.fold(0.0, f64::max)
+        };
+        let rectangle = |radius: f64| TracedShape::Rectangle { center: c, width: 2.0 * hw, height: 2.0 * hh, radius, rotation: angle.to_degrees() };
+        // Square corners (anti-aliasing and blur take a little off a corner: that is no radius).
+        // (Not of a thin bar: it is all corners, and would pass for a rectangle whatever it is.)
+        if off(0.0, if hw.min(hh) >= 2.0 * CORNER { CORNER_SLACK } else { 0.0 }) <= tol {
+            return Some(rectangle(0.0));
+        }
+        // Rounded ones: the radius that fits best, near the one the area says ((4 − π) r² is missing).
+        let by_area = ((4.0 * hw * hh - area) / (4.0 - std::f64::consts::PI)).max(0.0).sqrt();
+        let radii = (0..=40).map(|k| by_area + (f64::from(k) - 20.0) * 0.15).filter(|r| (CORNER..=hw.min(hh)).contains(r));
+        if let Some((_, radius)) = radii.map(|r| (off(r, 0.0), r)).min_by(|a, b| a.0.total_cmp(&b.0)).filter(|best| best.0 <= tol) {
+            return Some(rectangle(radius));
        }
    }

-    // A regular polygon: its corners evenly round the middle, its sides straight between them.
-    let sides = sp.anchors.len();
-    if (3..=12).contains(&sides) {
-        let radius = sp.anchors.iter().map(|a| a.p.distance(c)).sum::<f64>() / sides as f64;
-        let first = sp.anchors.first()?.p - c;
-        let rotation = (first.y.atan2(first.x).to_degrees() + 90.0).rem_euclid(360.0 / sides as f64);
-        let shape = TracedShape::Polygon { center: c, radius, sides: sides as u32, rotation };
-        let ideal: Vec<Point> = shape.path().subpaths.first()?.anchors.iter().map(|a| a.p).collect();
-        // Every corner of the polygon has one of the outline's on it, and every point of the
-        // outline lies on one of the polygon's sides.
-        let cornered = ideal.iter().all(|q| sp.anchors.iter().any(|a| q.distance(a.p) <= 1.5 * tol));
-        let on_a_side = |p: Point| {
-            (0..ideal.len()).any(|i| {
-                let (a, b) = (ideal[i], ideal[(i + 1) % ideal.len()]);
-                let t = ((p - a).dot(b - a) / (b - a).hypot2()).clamp(0.0, 1.0);
-                p.distance(a + (b - a) * t) <= tol
-            })
+    // A regular polygon: going round it, its outline is nearest its middle once a side and farthest
+    // once a corner. The sides are as many as that happens most strongly for, the corners where
+    // it is farthest, the size what the area says.
+    let polar: Vec<(f64, f64)> = pts.iter().map(|&p| ((p - c).hypot(), (p - c).y.atan2((p - c).x))).collect();
+    let weights: Vec<f64> = (0..n).map(|i| (polar[(i + 1) % n].1 - polar[i].1).sin().abs()).collect();
+    let mean = polar.iter().zip(&weights).map(|(p, w)| p.0 * w).sum::<f64>() / weights.iter().sum::<f64>().max(1e-9);
+    let wave = |sides: u32| {
+        polar.iter().zip(&weights).fold((0.0, 0.0), |m, (p, w)| {
+            (m.0 + (p.0 - mean) * w * (f64::from(sides) * p.1).cos(), m.1 + (p.0 - mean) * w * (f64::from(sides) * p.1).sin())
+        })
+    };
+    let sides = (3..=12u32).max_by(|&a, &b| wave(a).0.hypot(wave(a).1).total_cmp(&wave(b).0.hypot(wave(b).1)))?;
+    let (re, im) = wave(sides);
+    let corner = im.atan2(re) / f64::from(sides);
+    // (More exactly: by the outline's own corners, where it has them there.)
+    let step = 2.0 * std::f64::consts::PI / f64::from(sides);
+    let turns: Vec<f64> = sp
+        .anchors
+        .iter()
+        .map(|a| ((a.p - c).y.atan2((a.p - c).x) - corner, (a.p - c).hypot()))
+        .map(|(d, far)| (d - step * (d / step).round(), far))
+        .filter(|&(d, far)| (d * far).abs() <= CORNER && far > 0.9 * mean)
+        .map(|(d, _)| d)
+        .collect();
+    let corner = corner + turns.iter().sum::<f64>() / turns.len().max(1) as f64;
+    let radius = (2.0 * area / (f64::from(sides) * (2.0 * std::f64::consts::PI / f64::from(sides)).sin())).sqrt();
+    let rotation = (corner.to_degrees() + 90.0).rem_euclid(360.0 / f64::from(sides));
+    let shape = TracedShape::Polygon { center: c, radius, sides, rotation };
+    let ideal: Vec<Point> = shape.path().subpaths.first()?.anchors.iter().map(|a| a.p).collect();
+    // Every point of the outline lies on one of the polygon's sides (by its corners, nearly).
+    let side_length = 2.0 * radius * (std::f64::consts::PI / f64::from(sides)).sin();
+    let on_a_side = |p: Point| {
+        let slack = if side_length >= 4.0 * CORNER && ideal.iter().any(|q| q.distance(p) <= CORNER) { CORNER_SLACK } else { 0.0 };
+        (0..ideal.len()).any(|i| {
+            let (a, b) = (ideal[i], ideal[(i + 1) % ideal.len()]);
+            let t = ((p - a).dot(b - a) / (b - a).hypot2()).clamp(0.0, 1.0);
+            p.distance(a + (b - a) * t) <= tol + slack
+        })
+    };
+    if radius > 3.0 && pts.iter().all(|&p| on_a_side(p)) {
+        // Four equal sides are a square: a rectangle, its sides half a right angle from its corners.
+        let side = radius * std::f64::consts::SQRT_2;
+        let turned = (rotation + 45.0).rem_euclid(90.0);
+        let square = TracedShape::Rectangle {
+            center: c,
+            width: side,
+            height: side,
+            radius: 0.0,
+            rotation: if turned > 45.0 { turned - 90.0 } else { turned },
        };
-        if cornered && pts.iter().all(|&p| on_a_side(p)) {
-            // Four equal sides are a square: a rectangle, its sides half a right angle from its corners.
-            let side = radius * std::f64::consts::SQRT_2;
-            let turned = (rotation + 45.0).rem_euclid(90.0);
-            let square = TracedShape::Rectangle {
-                center: c,
-                width: side,
-                height: side,
-                radius: 0.0,
-                rotation: if turned > 45.0 { turned - 90.0 } else { turned },
-            };
-            return Some(if sides == 4 { square } else { shape });
-        }
+        return Some(if sides == 4 { square } else { shape });
    }
    None
 }
@@ -177,7 +226,7 @@ mod tests {
    use super::*;

    fn is(shape: TracedShape) -> Option<TracedShape> {
-        recognise(shape.path().subpaths.first().unwrap())
+        recognise(shape.path().subpaths.first().unwrap(), false)
    }

    #[test]
@@ -221,20 +270,20 @@ mod tests {
    fn what_only_resembles_a_shape_is_none() {
        // A star, an L, a rectangle with one corner cut, an egg.
        let star = shapes::star(Point::new(50.0, 50.0), 30.0, 12.0, 5, 0.0);
-        assert_eq!(recognise(&star.subpaths[0]), None);
+        assert_eq!(recognise(&star.subpaths[0], false), None);
        let poly = |pts: &[(f64, f64)]| SubPath::polyline(&pts.iter().map(|&p| Point::from(p)).collect::<Vec<_>>(), true);
-        assert_eq!(recognise(&poly(&[(0.0, 0.0), (40.0, 0.0), (40.0, 15.0), (15.0, 15.0), (15.0, 40.0), (0.0, 40.0)])), None);
-        assert_eq!(recognise(&poly(&[(0.0, 0.0), (40.0, 0.0), (40.0, 22.0), (34.0, 30.0), (0.0, 30.0)])), None);
+        assert_eq!(recognise(&poly(&[(0.0, 0.0), (40.0, 0.0), (40.0, 15.0), (15.0, 15.0), (15.0, 40.0), (0.0, 40.0)]), false), None);
+        assert_eq!(recognise(&poly(&[(0.0, 0.0), (40.0, 0.0), (40.0, 22.0), (34.0, 30.0), (0.0, 30.0)]), false), None);
        let mut egg = shapes::ellipse(Rect::new(10.0, 10.0, 70.0, 50.0));
        egg.subpaths[0].anchors[2].p.x += 4.0;
-        assert_eq!(recognise(&egg.subpaths[0]), None);
+        assert_eq!(recognise(&egg.subpaths[0], false), None);
        // Too small to say, open, or not a number.
        assert_eq!(is(TracedShape::Ellipse { center: Point::new(5.0, 5.0), rx: 2.0, ry: 2.0, rotation: 0.0 }), None);
        let mut open = shapes::rectangle(Rect::new(0.0, 0.0, 30.0, 20.0)).subpaths[0].clone();
        open.closed = false;
-        assert_eq!(recognise(&open), None);
+        assert_eq!(recognise(&open, false), None);
        let mut bad = shapes::rectangle(Rect::new(0.0, 0.0, 30.0, 20.0)).subpaths[0].clone();
        bad.anchors[1].p.x = f64::NAN;
-        assert_eq!(recognise(&bad), None);
+        assert_eq!(recognise(&bad, false), None);
    }
 }
@@ -1265,3 +1265,33 @@ fn a_long_line_two_degrees_askew_is_not_levelled() {
    // 200 px at 2° rises 7 px: levelled, the bar would be 8 px tall, not 15.
    assert!(b.height() > 13.0, "{b:?}");
 }
+
+/// Create Strokes: a line cut square at its ends is stroked with square caps, a line with round
+/// ends with round ones, and either ends where its ink does.
+#[test]
+fn stroke_caps_are_square_or_round_as_the_ink_is() {
+    let line = |square: bool| {
+        let img = Raster::from_fn(140, 40, |x, y| {
+            // Anti-aliased by 4 × 4 samples: a bar 8 px thick from x = 20 to 110.
+            let mut inside = 0;
+            for sy in 0..4 {
+                for sx in 0..4 {
+                    let (px, py) = (f64::from(x) + (f64::from(sx) + 0.5) / 4.0, f64::from(y) + (f64::from(sy) + 0.5) / 4.0);
+                    let d = if square { (py - 20.3).abs().max((px - 65.0).abs() - 41.0) } else { (px.clamp(24.0, 106.0) - px).hypot(py - 20.3) };
+                    inside += u32::from(d <= 4.0);
+                }
+            }
+            let v = (255 - inside * 255 / 16) as u8;
+            [v, v, v, 255]
+        });
+        let res = trace(&img, &crate::preset("Outline").unwrap());
+        let [only] = res.paths.as_slice() else { panic!("{:?}", res.paths) };
+        let (a, b) = (only.path.subpaths[0].anchors[0].p, only.path.subpaths[0].anchors.last().unwrap().p);
+        // Either cap goes half the width past the path's end: the path runs from 24 to 106.
+        assert!((a.x.min(b.x) - 24.0).abs() < 0.6 && (a.x.max(b.x) - 106.0).abs() < 0.6, "{a:?} {b:?}");
+        assert!((only.stroke.unwrap() - 8.0).abs() < 0.4);
+        only.square_caps
+    };
+    assert!(line(true));
+    assert!(!line(false));
+}
@@ -64,6 +64,7 @@ static ALLOC: Counting = Counting;

 /// Whether `input` is what `preset` is meant for.
 fn target(preset: &str, input: &Input) -> bool {
+    let preset = preset.strip_suffix(", enhanced").unwrap_or(preset);
    let classes: &[Class] = match preset {
        "High Fidelity Photo"
        | "Low Fidelity Photo"
@@ -147,6 +148,7 @@ fn svg_trace(svg: &str) -> TraceResult {
            stroke: None,
            shape: None,
            gradient: None,
+            square_caps: false,
        })
    });
    TraceResult { paths: paths.collect(), palette: vec![[0; 3]], ..Default::default() }
@@ -185,12 +187,12 @@ fn stat(runs: &[&Metrics], field: impl Fn(&Metrics) -> f64, max: bool, digits: u
    if x.is_finite() { format!("{:.digits$}", x + 0.0) } else { "all".into() }
 }

-const HEADER: &str = "| ΔE | edge ΔE | off mean | off max | missed max | paths | anchors | × art | lines % | upright % | corners % | kinks | odd colours | odd px | gap px | overlap px | specks | outside px | centre off | width off | anchors a stroke | shapes % | grouped % | gradient paths | found % | angle off | ramp off |\n|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|\n";
+const HEADER: &str = "| ΔE | edge ΔE | off mean | off max | missed max | paths | anchors | × art | lines % | upright % | corners % | kinks | odd colours | odd px | gap px | overlap px | specks | outside px | centre off | width off | anchors a stroke | shapes % | false shapes | grouped % | gradient paths | found % | angle off | ramp off |\n|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|--:|\n";

 fn row(runs: &[&Run]) -> String {
    let m: Vec<&Metrics> = runs.iter().filter_map(|r| r.metrics.as_ref()).collect();
    if m.is_empty() {
-        return format!("| refused |{}", " |".repeat(26));
+        return format!("| refused |{}", " |".repeat(27));
    }
    let cells = [
        stat(&m, |m| m.delta, false, 2),
@@ -215,6 +217,7 @@ fn row(runs: &[&Run]) -> String {
        stat(&m, |m| m.width_off, false, 2),
        stat(&m, |m| m.stroke_anchors, false, 1),
        stat(&m, |m| m.shapes, false, 0),
+        stat(&m, |m| m.false_shapes, false, 2),
        stat(&m, |m| m.grouped, false, 0),
        stat(&m, |m| m.gradients, false, 1),
        stat(&m, |m| m.ramp_found, false, 0),
@@ -264,6 +267,11 @@ fn report() -> String {
    ] {
        presets.push((name, TraceParams { gradients, ..vectorcraft_trace::preset(base).unwrap() }));
    }
+    // Each preset's enhanced version, on that preset's own inputs.
+    for name in vectorcraft_trace::PRESET_NAMES {
+        let enhanced: &'static str = Box::leak(format!("{name}, enhanced").into_boxed_str());
+        presets.extend(vectorcraft_trace::enhanced_preset(name).map(|p| (enhanced, p)));
+    }
    let inputs = inputs();
    let drawn = draw_all(&inputs);
    let one_colour = |d: &&Drawing| matches!(d.0.class, Class::Shape | Class::Poly | Class::Lines | Class::Askew | Class::Plain);
@@ -59,7 +59,10 @@ pub fn fidelity(src: &Raster, out: &Raster) -> (f64, f64) {
 fn painted(tp: &TracedPath) -> BezPath {
    let bez = tp.path.to_bezpath();
    match tp.stroke {
-        Some(width) => kurbo::stroke(bez, &Stroke::new(width), &StrokeOpts::default(), 0.05),
+        Some(width) => {
+            let cap = if tp.square_caps { kurbo::Cap::Square } else { kurbo::Cap::Round };
+            kurbo::stroke(bez, &Stroke::new(width).with_caps(cap), &StrokeOpts::default(), 0.05)
+        }
        None => bez,
    }
 }
@@ -194,6 +197,8 @@ pub struct Metrics {
    pub stroke_anchors: f64,
    /// Share (%) of the art's plain shapes that came out as a shape lying within 0.6 px of it.
    pub shapes: f64,
+    /// Shapes: paths made a shape that lie more than 0.6 px off the art.
+    pub false_shapes: f64,
    /// Auto Grouping: share (%) of the paths that lie inside another.
    pub grouped: f64,
    /// Gradients: paths filled with one; and where the input is a known gradient, whether one was
@@ -209,21 +214,25 @@ pub struct Metrics {
    pub outside: f64,
 }

-/// The order a grouped result is painted in: each path, then those inside it.
+/// The order a grouped result is painted in: each path together with those inside it, in the
+/// order they were traced in (as the app builds its groups).
 fn draw_order(res: &TraceResult) -> Vec<usize> {
+    fn draw(i: usize, inside: &[Vec<usize>], order: &mut Vec<usize>) {
+        let below = inside[i].partition_point(|&c| c < i);
+        inside[i][..below].iter().for_each(|&c| draw(c, inside, order));
+        order.push(i);
+        inside[i][below..].iter().for_each(|&c| draw(c, inside, order));
+    }
    let mut inside = vec![vec![]; res.paths.len()];
-    let mut stack = vec![];
-    for i in (0..res.paths.len()).rev() {
+    let mut roots = vec![];
+    for i in 0..res.paths.len() {
        match res.parents.get(i).copied().flatten() {
-            Some(p) => inside[p].insert(0, i),
-            None => stack.push(i),
+            Some(p) => inside[p].push(i),
+            None => roots.push(i),
        }
    }
    let mut order = vec![];
-    while let Some(i) = stack.pop() {
-        order.push(i);
-        stack.extend(inside[i].iter().rev());
-    }
+    roots.into_iter().for_each(|i| draw(i, &inside, &mut order));
    order
 }

@@ -231,7 +240,7 @@ fn draw_order(res: &TraceResult) -> Vec<usize> {
 pub fn measure(input: &Input, variant: Variant, size: u32, src: &Raster, params: &TraceParams, res: &TraceResult) -> Metrics {
    let n = size as usize;
    let shapes: Vec<(BezPath, [u8; 3])> = res.paths.iter().map(|tp| (painted(tp), tp.color)).collect();
-    // Painted as the result is grouped: each path, then those inside it.
+    // Painted as the result is grouped.
    let drawn: Vec<(BezPath, [u8; 3], Option<&TracedGradient>)> =
        draw_order(res).into_iter().map(|i| (shapes[i].0.clone(), shapes[i].1, res.paths[i].gradient.as_ref())).collect();
    let (delta_mean, edge_delta) = fidelity(src, &render_painted(&drawn, [255; 3], n, n));
@@ -271,11 +280,16 @@ pub fn measure(input: &Input, variant: Variant, size: u32, src: &Raster, params:

    let nan = f64::NAN;
    let (mut geo_mean, mut geo_max, mut miss_max, mut corners, mut kinks, mut slivers, mut sliver_area) = (nan, nan, nan, nan, nan, nan, nan);
+    let mut false_shapes = if params.shapes { 0.0 } else { nan };
    if !matches!(input.class, Class::Tone | Class::Ramp) {
        let truth_shapes = input.scaled(size);
        let truth = Outline::new(truth_shapes.iter().map(|(p, _)| p), None);
        let traced = Outline::new(shapes.iter().map(|(p, _)| p), Some(f64::from(size)));
        (geo_mean, geo_max) = traced.distance_to(&truth);
+        // Shapes that are not the art's: a path made a shape that strays more than 0.6 px from it.
+        false_shapes =
+            res.paths.iter().filter(|tp| tp.shape.is_some() && Outline::new([&tp.path.to_bezpath()], None).distance_to(&truth).1 > 0.6).count()
+                as f64;
        miss_max = truth.distance_to(&traced).1;

        let true_corners = input.scaled_corners(size);
@@ -378,6 +392,7 @@ pub fn measure(input: &Input, variant: Variant, size: u32, src: &Raster, params:
        ramp_angle,
        ramp_off,
        shapes: shapes_found,
+        false_shapes,
        centre_off,
        width_off,
        stroke_anchors,
@@ -345,14 +345,7 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
        match k.pixel {
            // Document pixels: placed over the document rect they cover, turning with the view.
            Some([x0, y0, x1, y1]) => {
-                let q = xf.quad(Rect::new(x0 as f64, y0 as f64, x1 as f64, y1 as f64));
-                let mut mesh = egui::Mesh::with_texture(tex.id());
-                for (pos, uv) in q.into_iter().zip([pos2(0.0, 0.0), pos2(1.0, 0.0), pos2(1.0, 1.0), pos2(0.0, 1.0)]) {
-                    mesh.vertices.push(egui::epaint::Vertex { pos, uv, color: Color32::WHITE });
-                }
-                mesh.add_triangle(0, 1, 2);
-                mesh.add_triangle(0, 2, 3);
-                painter.add(Shape::mesh(mesh));
+                textured_quad(&painter, tex.id(), &xf.quad(Rect::new(x0 as f64, y0 as f64, x1 as f64, y1 as f64)), (1.0, 1.0));
            }
            None if (k.rot - v.rotation).abs() < 1e-9 => {
                // Reproject the last frame if it was rendered for a different view.
@@ -361,7 +354,14 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
                let b = xf.to_screen(old.to_doc(rect.max));
                painter.image(tex.id(), egui::Rect::from_min_max(a, b), egui::Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
            }
-            None => {}
+            // The view turned after the last frame was rendered, and the worker renders the frame at
+            // the new angle. Until it arrives, the last frame is drawn turned into this view: each
+            // corner goes where this view puts the document point that the corner showed.
+            None => {
+                let old = Xf { rect, zoom: k.zoom, center: Point::new(k.cx, k.cy), rot: k.rot.to_radians() };
+                let q = [rect.left_top(), rect.right_top(), rect.right_bottom(), rect.left_bottom()].map(|c| xf.to_screen(old.to_doc(c)));
+                textured_quad(&painter, tex.id(), &q, (1.0, 1.0));
+            }
        }
    }
    if let Some(look) = grid_look.filter(|_| !grids_in_back) {
@@ -986,10 +986,15 @@ pub(crate) const TRANSPARENCY_GRID: &str = "transparency grid";
 /// The transparency grid over the artboard `ab` (screen corners `quad`): one textured quad whose
 /// cells stay `cell` screen points at every zoom and turn with a rotated view.
 fn checker(p: &egui::Painter, quad: &[Pos2], ab: Rect, zoom: f64, tex: egui::TextureId, cell: f32) {
-    let mut mesh = egui::Mesh::with_texture(tex);
    // Two cells per texture repeat.
    let per = (2.0 * cell as f64 / zoom).max(1e-9);
-    let (u, v) = ((ab.width() / per) as f32, (ab.height() / per) as f32);
+    textured_quad(p, tex, quad, ((ab.width() / per) as f32, (ab.height() / per) as f32));
+}
+
+/// One quad drawn with `tex`: its corners `quad` (from the top left, clockwise) show the texture
+/// from (0, 0) to (`u`, `v`).
+fn textured_quad(p: &egui::Painter, tex: egui::TextureId, quad: &[Pos2], (u, v): (f32, f32)) {
+    let mut mesh = egui::Mesh::with_texture(tex);
    for (pos, uv) in quad.iter().zip([pos2(0.0, 0.0), pos2(u, 0.0), pos2(u, v), pos2(0.0, v)]) {
        mesh.vertices.push(egui::epaint::Vertex { pos: *pos, uv, color: Color32::WHITE });
    }
@@ -1518,25 +1523,86 @@ fn curve_point(p: &egui::Painter, c: Pos2, color: Color32, filled: bool, size: f
 }

 /// Type → Show Hidden Characters: spaces as dots, ¶ at paragraph ends, # at the end of a story.
-fn hidden_chars_overlay(app: &VectorcraftApp, p: &egui::Painter, xf: &Xf) {
+/// The marks of each text object are kept from one frame to the next ([`HiddenChars`]).
+fn hidden_chars_overlay(app: &mut VectorcraftApp, p: &egui::Painter, xf: &Xf) {
    let Some(st) = app.session.active() else { return };
    let clip = p.clip_rect();
    let color = Color32::from_rgb(0x4f, 0x9d, 0xff);
    let font = egui::FontId::proportional(((10.0 * xf.zoom) as f32).clamp(7.0, 18.0));
-    st.doc.walk(|n| {
+    let kept = &mut app.canvas.hidden_chars;
+    // `last` holds the marks of the last frame that showed them. The marks of the objects this
+    // frame doesn't draw are dropped at the end.
+    let mut last = std::mem::take(&mut kept.marks);
+    // The inputs are read before any layout: when fonts load during this frame, the next frame
+    // lays all type out again.
+    let inputs = (vectorcraft_text::FontDb::global().generation(), vectorcraft_text::hyphenation_exceptions());
+    if kept.inputs != inputs {
+        last.clear();
+        kept.inputs = inputs;
+    }
+    // `walk` visits each node's `Arc` in the order `Document::walk` visits the nodes (depth first,
+    // in paint order).
+    fn walk(nodes: &[std::sync::Arc<Node>], f: &mut impl FnMut(&std::sync::Arc<Node>)) {
+        for n in nodes {
+            f(n);
+            if let Some(children) = n.children() {
+                walk(children, f);
+            }
+        }
+    }
+    walk(&st.doc.layers, &mut |n| {
        let NodeKind::Text(tx) = &n.kind else { return };
        if !n.visible || n.geometric_bounds().is_none_or(|b| !xf.rect_to_screen(b).intersects(clip)) {
            return;
        }
+        let marks = match last.remove(&n.id) {
+            Some((was, marks)) if std::sync::Arc::ptr_eq(&was, n) => marks,
+            _ => std::sync::Arc::new(HiddenMarks::of(tx)),
+        };
+        for &at in &marks.spaces {
+            p.circle_filled(xf.to_screen(at), 1.2, color);
+        }
+        for &(at, glyph) in &marks.ends {
+            p.text(xf.to_screen(at), egui::Align2::LEFT_BOTTOM, glyph, font.clone(), color);
+        }
+        kept.marks.insert(n.id, (n.clone(), marks));
+    });
+}
+
+/// The Show Hidden Characters marks of the text objects drawn in the last frame that showed them
+/// ([`crate::CanvasCache::hidden_chars`]). Each is kept with the object it was laid out from: an
+/// edited object is a new `Arc` and is laid out again, and all type is laid out again when the
+/// fonts or the hyphenation exceptions change.
+#[derive(Default)]
+pub struct HiddenChars {
+    /// The fonts' generation ([`vectorcraft_text::FontDb::generation`]) and the hyphenation
+    /// exceptions the marks were laid out with.
+    inputs: (u64, String),
+    /// Each text object drawn, by id: the node it was laid out from and its marks.
+    marks: std::collections::HashMap<vectorcraft_doc::NodeId, (std::sync::Arc<Node>, std::sync::Arc<HiddenMarks>)>,
+}
+
+/// One text object's marks in document space: a dot over each space, and ¶ or # after the lines
+/// that end a paragraph or the story. Type on a path has none.
+#[derive(Default)]
+struct HiddenMarks {
+    spaces: Vec<Point>,
+    ends: Vec<(Point, &'static str)>,
+}
+
+impl HiddenMarks {
+    /// Lay out `tx` and place its marks.
+    fn of(tx: &vectorcraft_doc::TextObject) -> Self {
+        let mut marks = Self::default();
        let lay = vectorcraft_text::layout(vectorcraft_text::FontDb::global(), tx);
        if lay.on_path {
-            return;
+            return marks;
        }
        let text = tx.plain_text();
-        let to = |q: Point| xf.to_screen(tx.xf * q);
+        let to = |q: Point| tx.xf * q;
        for g in &lay.glyphs {
            if text.get(g.byte..).is_some_and(|s| s.starts_with(' ')) {
-                p.circle_filled(to(Point::new(g.origin.x + g.advance / 2.0, g.origin.y - 3.0)), 1.2, color);
+                marks.spaces.push(to(Point::new(g.origin.x + g.advance / 2.0, g.origin.y - 3.0)));
            }
        }
        for (i, line) in lay.lines.iter().enumerate() {
@@ -1550,10 +1616,11 @@ fn hidden_chars_overlay(app: &VectorcraftApp, p: &egui::Painter, xf: &Xf) {
                ("", false)
            };
            if at {
-                p.text(to(Point::new(line.x1 + 1.0, line.baseline)), egui::Align2::LEFT_BOTTOM, glyph, font.clone(), color);
+                marks.ends.push((to(Point::new(line.x1 + 1.0, line.baseline)), glyph));
            }
        }
-    });
+        marks
+    }
 }

 /// Text threads of the selected frames: a line from each frame's out port (bottom right) to the
@@ -3150,6 +3217,74 @@ mod tests {
        assert!(!app.canvas.moved);
    }

+    /// When the view turns while the worker renders the frame at the new angle (Reset Rotate View on
+    /// a heavy document), the canvas draws the last frame turned until that frame arrives: each
+    /// corner goes where the new view puts the document point that the corner showed. The new frame
+    /// is then drawn unturned. In Pixel Preview the last frame's pixels stay over the document rect
+    /// they cover.
+    #[test]
+    fn a_turned_view_draws_the_last_frame_turned_until_its_own_arrives() {
+        let mut app = VectorcraftApp::new(Session::new(), Default::default());
+        app.session.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+        app.session.execute("shape.rectangle", &json!({"x": 100, "y": 50, "width": 200, "height": 200})).unwrap();
+        app.canvas.worker_started = true; // render on this thread
+        let ctx = egui::Context::default();
+        shapes(&mut app, &ctx); // the first frame fits the view to the artboard
+        app.view_mut().unwrap().rotation = 30.0;
+        shapes(&mut app, &ctx);
+        let rect = app.canvas_rect.unwrap();
+        let old = Xf::new(rect, app.view().unwrap());
+        // `art` runs one frame and finds the mesh that draws the art's texture.
+        let art = |app: &mut VectorcraftApp| {
+            let s = shapes(app, &ctx);
+            let tex = app.canvas.texture.as_ref().unwrap().id();
+            s.into_iter().find_map(|s| match s {
+                Shape::Mesh(m) if m.texture_id == tex => Some(m),
+                _ => None,
+            })
+        };
+        // With a worker and a last frame that took 50 ms, the next frame renders on the worker.
+        app.canvas.worker = crate::render_worker::Worker::spawn(ctx.clone());
+        app.canvas.last_ms = 50.0;
+        app.run("view.rotateReset", json!({})).unwrap();
+        let mesh = art(&mut app).expect("the last frame, turned");
+        assert!(app.canvas.worker.as_ref().and_then(|w| w.pending.as_ref()).is_some_and(|k| k.rot == 0.0), "sent to the worker");
+        let new = Xf::new(rect, app.view().unwrap());
+        let corners = [rect.left_top(), rect.right_top(), rect.right_bottom(), rect.left_bottom()];
+        assert_eq!(mesh.vertices.len(), 4);
+        for ((v, corner), uv) in mesh.vertices.iter().zip(corners).zip([pos2(0.0, 0.0), pos2(1.0, 0.0), pos2(1.0, 1.0), pos2(0.0, 1.0)]) {
+            let at = new.to_screen(old.to_doc(corner));
+            assert!((v.pos - at).length() < 0.01 && v.uv == uv, "{v:?}: texture corner {uv:?} at {at:?}");
+        }
+        // The point where the last frame drew the rectangle's top-left corner lands where the new view puts that corner.
+        let p = Point::new(100.0, 50.0);
+        let uv = (old.to_screen(p) - rect.min) / rect.size();
+        let [a, b, _, d] = [0, 1, 2, 3].map(|i| mesh.vertices[i].pos);
+        assert!((a + (b - a) * uv.x + (d - a) * uv.y - new.to_screen(p)).length() < 0.01, "the rectangle's corner");
+        // The worker's frame at 0° then covers the canvas unturned.
+        let until = std::time::Instant::now() + std::time::Duration::from_secs(60);
+        while app.canvas.key.as_ref().is_some_and(|k| k.rot != 0.0) && std::time::Instant::now() < until {
+            std::thread::sleep(std::time::Duration::from_millis(5));
+            shapes(&mut app, &ctx);
+        }
+        assert!(app.canvas.key.as_ref().is_some_and(|k| k.rot == 0.0), "the worker's frame arrives");
+        let b = art(&mut app).expect("the worker's frame").calc_bounds();
+        assert!((b.min - rect.min).length() < 0.01 && (b.max - rect.max).length() < 0.01, "{b:?} over {rect:?}");
+        // In Pixel Preview the last frame's pixels are drawn over the document rect they cover.
+        app.canvas.worker = None;
+        app.ui.view.pixel_preview = true;
+        app.view_mut().unwrap().zoom = 8.0;
+        shapes(&mut app, &ctx);
+        let [x0, y0, ..] = app.canvas.key.as_ref().and_then(|k| k.pixel).expect("the pixels rendered");
+        app.canvas.worker = crate::render_worker::Worker::spawn(ctx.clone());
+        app.canvas.last_ms = 50.0;
+        app.view_mut().unwrap().rotation = 30.0;
+        let mesh = art(&mut app).expect("the last frame's pixels");
+        let at = Xf::new(rect, app.view().unwrap()).to_screen(Point::new(x0 as f64, y0 as f64));
+        assert!((mesh.vertices[0].pos - at).length() < 0.01, "{:?} at {at:?}", mesh.vertices[0].pos);
+        app.canvas.worker = None;
+    }
+
    /// File Handling › Display Bitmaps as Anti-aliased Images in Pixel Preview (#394): off, Pixel
    /// Preview draws images with each pixel taking its nearest image pixel; on, smoothly, as the
    /// canvas always does out of Pixel Preview.
@@ -3545,6 +3680,89 @@ mod tests {
        assert!(widget(&mut app).is_empty(), "no bounding box, no widget");
    }

+    /// The shapes Type → Show Hidden Characters draws in one frame, seen through `xf`.
+    fn hidden_chars(app: &mut VectorcraftApp, ctx: &egui::Context, xf: &Xf) -> Vec<Shape> {
+        let raw = egui::RawInput { screen_rect: Some(xf.rect), ..Default::default() };
+        let mut out = ctx.run_ui(raw, |ui| hidden_chars_overlay(app, ui.painter(), xf));
+        out.textures_delta.clear();
+        out.shapes.into_iter().map(|c| c.shape).collect()
+    }
+
+    /// Show Hidden Characters lays out type once: a frame keeps the marks of the frame before, and
+    /// after an edit only the object edited is laid out again.
+    #[test]
+    fn show_hidden_characters_lays_out_only_type_that_changed() {
+        let mut app = VectorcraftApp::new(Session::new(), Default::default());
+        app.session.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+        let ids: Vec<_> = (0..3)
+            .map(|i| app.session.execute("text.create", &json!({"x": 20, "y": 40 + 80 * i, "text": "a b\nc d"})).unwrap()["id"].as_u64().unwrap())
+            .map(vectorcraft_doc::NodeId)
+            .collect();
+        let ctx = egui::Context::default();
+        let xf = Xf { rect: egui::Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0)), zoom: 1.0, center: Point::new(200.0, 150.0), rot: 0.0 };
+        // `frame` draws one frame and returns each object's marks and whether that frame found the
+        // fonts and hyphenation exceptions of the frame before.
+        let frame = |app: &mut VectorcraftApp| {
+            let inputs = app.canvas.hidden_chars.inputs.clone();
+            hidden_chars(app, &ctx, &xf);
+            let kept = &app.canvas.hidden_chars;
+            (kept.inputs == inputs, ids.iter().map(|id| kept.marks[id].1.clone()).collect::<Vec<_>>())
+        };
+        // `frames` draws a frame, runs `edit` and draws the next frame. Tests running alongside add
+        // fonts and set hyphenation exceptions, which lays all type out again: `frames` draws both
+        // frames again until neither the fonts nor the exceptions changed in between.
+        let frames = |app: &mut VectorcraftApp, edit: &dyn Fn(&mut VectorcraftApp)| {
+            (0..100)
+                .find_map(|_| {
+                    let (_, before) = frame(app);
+                    edit(app);
+                    let (same, after) = frame(app);
+                    same.then_some((before, after))
+                })
+                .unwrap()
+        };
+        let same = |a: &std::sync::Arc<HiddenMarks>, b: &std::sync::Arc<HiddenMarks>| std::sync::Arc::ptr_eq(a, b);
+        let (before, after) = frames(&mut app, &|_| {});
+        assert!(before.iter().zip(&after).all(|(a, b)| same(a, b)), "a frame lays out no type");
+        let (before, after) = frames(&mut app, &|app| {
+            app.session.execute("text.setText", &json!({"id": ids[1].0, "text": "a b c"})).unwrap();
+        });
+        assert!(!same(&before[1], &after[1]), "the edited object is laid out again");
+        assert!(same(&before[0], &after[0]) && same(&before[2], &after[2]), "the others are not");
+    }
+
+    /// The marks Show Hidden Characters keeps follow the type: after an edit, a zoom and a font
+    /// that arrives, a frame draws what a new overlay draws, and the marks moved.
+    #[test]
+    fn show_hidden_characters_follows_edits_zooms_and_fonts() {
+        let mut app = VectorcraftApp::new(Session::new(), Default::default());
+        app.session.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+        // The type is set in Bold of a family that is not installed and whose name starts with a
+        // dot; the font menus do not list such names. Source Sans 3 Bold stands in for it until the
+        // family arrives below with a Regular face only.
+        let text = json!({"x": 20, "y": 60, "text": "one two\nthree four", "font": ".Hidden Marks", "style": "Bold"});
+        let id = app.session.execute("text.create", &text).unwrap()["id"].clone();
+        let ctx = egui::Context::default();
+        let mut xf = Xf { rect: egui::Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0)), zoom: 1.0, center: Point::new(200.0, 150.0), rot: 0.0 };
+        // `drawn` draws a frame with what the overlay kept and checks it against a new overlay.
+        let drawn = |app: &mut VectorcraftApp, xf: &Xf| {
+            let kept = hidden_chars(app, &ctx, xf);
+            app.canvas.hidden_chars = Default::default();
+            assert_eq!(hidden_chars(app, &ctx, xf), kept, "as a new overlay draws them");
+            kept
+        };
+        let start = drawn(&mut app, &xf);
+        assert!(start.len() > 2, "{start:?}");
+        app.session.execute("text.setText", &json!({"id": id, "text": "one two three\nfour"})).unwrap();
+        let edited = drawn(&mut app, &xf);
+        assert_ne!(edited, start, "the edit moved the marks");
+        xf.zoom = 2.0;
+        let zoomed = drawn(&mut app, &xf);
+        assert_ne!(zoomed, edited, "zoomed in");
+        assert!(vectorcraft_text::FontDb::global().add_font(vectorcraft_testkit::fonts::renamed(".Hidden Marks")) > 0, "the family is new");
+        assert_ne!(drawn(&mut app, &xf), zoomed, "set in the family that arrived");
+    }
+
    /// General › Zoom with Mouse Wheel (#394), through the control channel's `ui.wheel`: off,
    /// the wheel scrolls and Cmd-wheel zooms; on, the wheel zooms about the pointer, Shift-wheel
    /// scrolls up and down and Cmd/Ctrl-wheel sideways. Alt-wheel (Option on the Mac) and a
@@ -24,6 +24,8 @@
 //! - `app.export {path?, format?, …document.export options}`: encoded by the engine, written through
 //!   the host; the document keeps its path. No path → `{dataBase64, format, bytes}` (as headless)

+use std::sync::Arc;
+use std::sync::atomic::{AtomicU8, Ordering};
 use std::sync::mpsc::Sender;

 use serde_json::{Value, json};
@@ -32,18 +34,72 @@ use vectorcraft_tools::{Mods, PointerEvent, PointerKind};
 use crate::VectorcraftApp;
 use crate::canvas::Xf;

+/// Synthetic pointer input advances one event per frame: keep gestures and backlog modest.
+pub(crate) const MAX_DRAG_STEPS: u64 = 256;
+pub(crate) const MAX_CLICK_COUNT: u64 = 16;
+pub(crate) const MAX_SYNTHETIC_EVENTS: usize = 1024;
+pub(crate) const MAX_CONTROL_REQUESTS_PER_FRAME: usize = 64;
+
+fn input_count(p: &Value, key: &str, default: u64, max: u64) -> Result<usize, String> {
+    let n = match p.get(key) {
+        None => default,
+        Some(v) => v.as_u64().ok_or_else(|| format!("`{key}` must be a non-negative integer"))?,
+    };
+    if n > max {
+        return Err(format!("`{key}` must be at most {max}"));
+    }
+    // Preserve legacy zero behaviour: both a zero count and zero steps still perform once.
+    usize::try_from(n.max(1)).map_err(|_| format!("`{key}` is out of range"))
+}
+
+fn reserve_synthetic(app: &mut VectorcraftApp, additional: usize) -> Result<(), String> {
+    if additional > MAX_SYNTHETIC_EVENTS.saturating_sub(app.synthetic.len()) {
+        return Err(format!("synthetic input queue limit ({MAX_SYNTHETIC_EVENTS} events); retry after pending input drains"));
+    }
+    app.synthetic.try_reserve(additional).map_err(|e| format!("cannot reserve synthetic input: {e}"))
+}
+
 pub type ControlResponse = Value;

 pub struct ControlRequest {
    pub method: String,
    pub params: Value,
    pub reply: Sender<ControlResponse>,
+    state: Arc<AtomicU8>,
+}
+
+/// A request's state: waiting to run, taken by the app ([`ControlRequest::claim`]), or given up
+/// by its caller before that ([`Ticket::give_up`]). It leaves `QUEUED` once, one way or the other.
+const QUEUED: u8 = 0;
+const STARTED: u8 = 1;
+const GIVEN_UP: u8 = 2;
+
+/// The caller's side of a queued [`ControlRequest`].
+pub struct Ticket(Arc<AtomicU8>);
+
+impl Ticket {
+    /// Stop waiting for the request → `true` when it had not started, and so never runs: a caller
+    /// told "timeout" can then retry without the edit being applied twice, or applied later when
+    /// nobody expects it (#1725). `false`: the app is running it (or has); its outcome is unknown.
+    pub fn give_up(&self) -> bool {
+        self.0.compare_exchange(QUEUED, GIVEN_UP, Ordering::SeqCst, Ordering::SeqCst).is_ok()
+    }
 }

 impl ControlRequest {
    pub fn new(method: impl Into<String>, params: Value) -> (Self, std::sync::mpsc::Receiver<ControlResponse>) {
        let (tx, rx) = std::sync::mpsc::channel();
-        (Self { method: method.into(), params, reply: tx }, rx)
+        (Self { method: method.into(), params, reply: tx, state: Arc::new(AtomicU8::new(QUEUED)) }, rx)
+    }
+
+    /// The caller's handle on this request, to give it up with.
+    pub fn ticket(&self) -> Ticket {
+        Ticket(self.state.clone())
+    }
+
+    /// Take the request to run it → `false` when its caller gave it up meanwhile (don't run it).
+    pub fn claim(&self) -> bool {
+        self.state.compare_exchange(QUEUED, STARTED, Ordering::SeqCst, Ordering::SeqCst).is_ok()
    }
 }

@@ -193,6 +249,9 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlReques
        }
        "ui.key" => {
            let Some(k) = s("key").and_then(key_from) else { return err("unknown or missing `key`") };
+            if let Err(e) = reserve_synthetic(app, 2 + usize::from(s("text").is_some())) {
+                return err(e);
+            }
            let m = modifiers(p);
            app.synthetic.push(egui::Event::Key { key: k, physical_key: None, pressed: true, repeat: false, modifiers: m });
            // Typed text comes with the press, so it shares the key's frame and modifiers.
@@ -204,12 +263,34 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlReques
            ok(Value::Null)
        }
        "ui.move" => {
+            if let Err(e) = reserve_synthetic(app, 1) {
+                return err(e);
+            }
            let pos = egui::pos2(p.get("x").and_then(Value::as_f64).unwrap_or(0.0) as f32, p.get("y").and_then(Value::as_f64).unwrap_or(0.0) as f32);
            app.synthetic.push(egui::Event::PointerMoved(pos));
            ctx.request_repaint();
            ok(Value::Null)
        }
        "ui.click" | "ui.drag" => {
+            // Validate the entire expansion before appending even the initial move/press.
+            let steps = if req.method == "ui.drag" {
+                match input_count(p, "steps", 8, MAX_DRAG_STEPS) {
+                    Ok(n) => n,
+                    Err(e) => return err(e),
+                }
+            } else {
+                0
+            };
+            let count = match input_count(p, "count", 1, MAX_CLICK_COUNT) {
+                Ok(n) => n,
+                Err(e) => return err(e),
+            };
+            let Some(events) = count.checked_mul(2).and_then(|n| n.checked_add(steps)).and_then(|n| n.checked_add(1)) else {
+                return err("synthetic input event count is out of range");
+            };
+            if let Err(e) = reserve_synthetic(app, events) {
+                return err(e);
+            }
            // Screen-space (egui points) pointer input through egui itself: reaches every widget.
            let f = |k: &str| p.get(k).and_then(Value::as_f64).unwrap_or(0.0) as f32;
            let button = match s("button") {
@@ -222,14 +303,12 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlReques
            app.synthetic.push(egui::Event::PointerMoved(a));
            app.synthetic.push(egui::Event::PointerButton { pos: a, button, pressed: true, modifiers });
            if req.method == "ui.drag" {
-                let steps = p.get("steps").and_then(Value::as_u64).unwrap_or(8).max(1);
                for i in 1..=steps {
                    let t = i as f32 / steps as f32;
                    app.synthetic.push(egui::Event::PointerMoved(a + (end - a) * t));
                }
            }
            app.synthetic.push(egui::Event::PointerButton { pos: end, button, pressed: false, modifiers });
-            let count = p.get("count").and_then(Value::as_u64).unwrap_or(1);
            for _ in 1..count {
                app.synthetic.push(egui::Event::PointerButton { pos: end, button, pressed: true, modifiers });
                app.synthetic.push(egui::Event::PointerButton { pos: end, button, pressed: false, modifiers });
@@ -238,6 +317,9 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlReques
            ok(Value::Null)
        }
        "ui.wheel" => {
+            if let Err(e) = reserve_synthetic(app, 2) {
+                return err(e);
+            }
            // Mouse wheel notches over screen point (x, y): `dy` up (+) or down, `dx` sideways
            // (`unit: "point"` for trackpad-like points), with modifiers as `ui.click` takes them.
            let f = |k: &str| p.get(k).and_then(Value::as_f64).unwrap_or(0.0) as f32;
@@ -250,6 +332,9 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlReques
            ok(Value::Null)
        }
        "ui.text" => {
+            if let Err(e) = reserve_synthetic(app, 1) {
+                return err(e);
+            }
            app.synthetic.push(egui::Event::Text(s("text").unwrap_or("").to_string()));
            ctx.request_repaint();
            ok(Value::Null)
@@ -410,6 +495,126 @@ mod tests {
    use super::{ControlRequest, Outcome, handle};
    use crate::{Services, VectorcraftApp};

+    fn input_request(app: &mut VectorcraftApp, method: &str, params: Value) -> Value {
+        let (req, _) = ControlRequest::new(method, params);
+        let Outcome::Done(r) = handle(app, &egui::Context::default(), &req) else { panic!("expected immediate reply") };
+        r
+    }
+
+    #[test]
+    fn control_input_rejects_excessive_counts_before_mutation() {
+        // Only modest over-limit values on the baseline: never exercise an unbounded loop.
+        for (method, params) in
+            [("ui.click", json!({"count": 17})), ("ui.drag", json!({"steps": 257})), ("ui.drag", json!({"steps": 2, "count": 17}))]
+        {
+            let mut app = VectorcraftApp::new(Session::new(), Services::default());
+            app.synthetic.push(egui::Event::Text("already queued".into()));
+            let before = format!("{:?}", app.synthetic);
+            let r = input_request(&mut app, method, params);
+            assert_eq!(r["ok"], false, "oversized input must be rejected: {r}");
+            assert_eq!(format!("{:?}", app.synthetic), before, "rejection must preserve the entire queue");
+        }
+    }
+
+    #[test]
+    fn control_input_respects_existing_queue_budget() {
+        let mut app = VectorcraftApp::new(Session::new(), Services::default());
+        app.synthetic = vec![egui::Event::PointerMoved(egui::pos2(1.0, 2.0)); 1023];
+        let before = format!("{:?}", app.synthetic);
+        let r = input_request(&mut app, "ui.click", json!({}));
+        assert_eq!(r["ok"], false, "a whole click must fit before any part is appended");
+        assert_eq!(format!("{:?}", app.synthetic), before);
+    }
+
+    #[test]
+    fn control_input_yields_control_channel_after_frame_budget() {
+        let (tx, rx) = std::sync::mpsc::channel();
+        let mut app = VectorcraftApp::new(Session::new(), Services::default()).with_control(rx);
+        let mut replies = vec![];
+        for _ in 0..65 {
+            let (req, reply) = ControlRequest::new("ui.move", json!({"x": 1, "y": 2}));
+            tx.send(req).unwrap();
+            replies.push(reply);
+        }
+        app.drain_control(&egui::Context::default());
+        assert_eq!(replies.iter().filter(|r| r.try_recv().is_ok()).count(), 64);
+        assert_eq!(app.synthetic.len(), 64);
+        app.drain_control(&egui::Context::default());
+        assert_eq!(replies.last().unwrap().try_recv().unwrap()["ok"], true);
+        assert_eq!(app.synthetic.len(), 65);
+    }
+
+    #[test]
+    fn control_input_rejects_invalid_and_extreme_counts() {
+        for value in [json!(u64::MAX), json!(-1), json!(1.5), json!("2"), Value::Null] {
+            for (method, key) in [("ui.click", "count"), ("ui.drag", "count"), ("ui.drag", "steps")] {
+                let mut app = VectorcraftApp::new(Session::new(), Services::default());
+                app.synthetic.push(egui::Event::Text("pending".into()));
+                let before = format!("{:?}", app.synthetic);
+                let mut params = json!({});
+                params[key] = value.clone();
+                let r = input_request(&mut app, method, params);
+                assert_eq!(r["ok"], false, "{method}/{key}: {r}");
+                assert!(r["error"].as_str().unwrap().contains(key));
+                assert_eq!(format!("{:?}", app.synthetic), before);
+            }
+        }
+    }
+
+    #[test]
+    fn control_input_accepts_boundary_gestures_and_preserves_event_order() {
+        let mut app = VectorcraftApp::new(Session::new(), Services::default());
+        let r = input_request(
+            &mut app,
+            "ui.drag",
+            json!({"x": 2, "y": 3, "toX": 20, "toY": 30,
+            "steps": 256, "count": 16, "button": "right", "shift": true}),
+        );
+        assert_eq!(r["ok"], true);
+        assert_eq!(app.synthetic.len(), 289);
+        assert!(matches!(app.synthetic.first(), Some(egui::Event::PointerMoved(p)) if *p == egui::pos2(2.0, 3.0)));
+        assert!(
+            matches!(app.synthetic.get(1), Some(egui::Event::PointerButton { pressed: true, button: egui::PointerButton::Secondary, modifiers, .. }) if modifiers.shift)
+        );
+        assert!(matches!(app.synthetic.get(257), Some(egui::Event::PointerMoved(p)) if *p == egui::pos2(20.0, 30.0)));
+        assert!(matches!(app.synthetic.get(258), Some(egui::Event::PointerButton { pressed: false, .. })));
+        assert!(matches!(app.synthetic.last(), Some(egui::Event::PointerButton { pressed: false, pos, .. }) if *pos == egui::pos2(20.0, 30.0)));
+        for (method, params, events) in [
+            ("ui.click", json!({}), 3),
+            ("ui.click", json!({"count": 2}), 5),
+            ("ui.drag", json!({}), 11),
+            ("ui.drag", json!({"steps": 0, "count": 0}), 4),
+        ] {
+            app.synthetic.clear();
+            assert_eq!(input_request(&mut app, method, params)["ok"], true);
+            assert_eq!(app.synthetic.len(), events);
+        }
+        app.synthetic = vec![egui::Event::PointerMoved(egui::pos2(0.0, 0.0)); 1021];
+        assert_eq!(input_request(&mut app, "ui.click", json!({}))["ok"], true);
+        assert_eq!(app.synthetic.len(), 1024, "the exact queue boundary is permitted");
+    }
+
+    #[test]
+    fn control_input_budget_covers_every_synthetic_method() {
+        for (method, params) in [
+            ("ui.key", json!({"key": "Enter", "text": "x"})),
+            ("ui.move", json!({})),
+            ("ui.wheel", json!({"dy": 1})),
+            ("ui.text", json!({"text": "hello"})),
+            ("ui.click", json!({})),
+            ("ui.drag", json!({"steps": 1})),
+        ] {
+            let mut app = VectorcraftApp::new(Session::new(), Services::default());
+            app.synthetic = vec![egui::Event::PointerMoved(egui::pos2(1.0, 2.0)); 1024];
+            let before = format!("{:?}", app.synthetic);
+            let r = input_request(&mut app, method, params);
+            assert_eq!(r["ok"], false, "{method}: {r}");
+            assert_eq!(format!("{:?}", app.synthetic), before);
+            app.synthetic.clear();
+            assert_eq!(input_request(&mut app, method, json!({"key": "Enter", "steps": 1}))["ok"], true, "queue space becomes usable after draining");
+        }
+    }
+
    /// #1004: `ui.render` (the MCP `screenshot` of a connected app) renders the artboard asked
    /// for, at the scale asked for; the first without one.
    #[test]
@@ -41,10 +41,27 @@ pub const MESSAGE: &str = "message";

 pub(super) const MESSAGE_SPEC: DialogSpec = DialogSpec { ok: None, ..SPEC };

+/// Most messages kept for later while a dialog is open ([`tell`]).
+const MAX_WAITING: usize = 16;
+
 /// Tell the user `message` (with an optional `detail` line), both in the UI language, in a dialog
-/// they close.
+/// they close. While another dialog is open (the message comes from work in the background) it
+/// waits its turn instead of replacing it: neither what the user was doing there nor the message
+/// is lost.
 pub fn tell(app: &mut VectorcraftApp, message: &str, detail: &str) {
-    app.ui.dialog = Some(Dialog::new(MESSAGE, json!({"message": message, "detail": detail})));
+    let d = Dialog::new(MESSAGE, json!({"message": message, "detail": detail}));
+    if app.ui.dialog.is_none() {
+        app.ui.dialog = Some(d);
+    } else if app.ui.told.len() < MAX_WAITING && !app.ui.dialog.iter().chain(&app.ui.told).any(|t| t.kind == MESSAGE && t.fields == d.fields) {
+        app.ui.told.push(d);
+    }
+}
+
+/// Show the next message that waited for a dialog to close (each frame).
+pub(super) fn show_waiting(app: &mut VectorcraftApp) {
+    if app.ui.dialog.is_none() && !app.ui.told.is_empty() {
+        app.ui.dialog = Some(app.ui.told.remove(0));
+    }
 }

 /// Closes before running, so a dialog the command opens stays open.
@@ -366,6 +366,7 @@ pub(crate) fn settle(app: &mut VectorcraftApp) {
 pub fn show(app: &mut VectorcraftApp, ctx: &egui::Context) {
    about::show(app, ctx);
    settle(app);
+    confirm::show_waiting(app);
    // The kind of dialog shown last frame: a different one (or none) means this one just opened, and
    // its first field is to take the keyboard focus (`focus_id`, until a field takes it).
    let (shown_id, focus_id) = (egui::Id::new("dialog-shown"), egui::Id::new("dialog-focus-pending"));
@@ -268,7 +268,10 @@ mod tests {
        let written = Written::default();
        let w = written.clone();
        let services = Services {
-            download: Some(Box::new(move |name: &str, b: &[u8]| w.borrow_mut().push((name.to_string(), b.to_vec())))),
+            download: Some(Box::new(move |name: &str, b: &[u8]| {
+                w.borrow_mut().push((name.to_string(), b.to_vec()));
+                Ok(())
+            })),
            ..Default::default()
        };
        (with_art(services), written)
@@ -95,7 +95,10 @@ fn the_web_downloads_a_zip() {
    let mut app = saved(&dir);
    let got: Rc<RefCell<Vec<(String, usize)>>> = Rc::default();
    let g = got.clone();
-    app.services.download = Some(Box::new(move |name: &str, b: &[u8]| g.borrow_mut().push((name.to_string(), b.len()))));
+    app.services.download = Some(Box::new(move |name: &str, b: &[u8]| {
+        g.borrow_mut().push((name.to_string(), b.len()));
+        Ok(())
+    }));
    app.run("ui.packageDialog", json!({})).unwrap();
    assert!(!frame(&mut app).contains("Location:"), "no folder to choose");
    confirm(&mut app).unwrap();
@@ -124,7 +127,7 @@ fn fonts_left_out_of_the_package_are_named() {
    assert!(detail.contains(gone) && !detail.contains("Source Sans 3"), "{detail}");
    // The web's download says so too.
    app.ui.dialog = None;
-    app.services.download = Some(Box::new(|_: &str, _: &[u8]| {}));
+    app.services.download = Some(Box::new(|_: &str, _: &[u8]| Ok(())));
    app.run("ui.packageDialog", json!({})).unwrap();
    confirm(&mut app).unwrap();
    assert!(app.ui.status.contains(gone), "{}", app.ui.status);
@@ -24,7 +24,10 @@ fn app(dir: &std::path::Path, web: bool) -> (VectorcraftApp, Log) {
        ..Default::default()
    };
    if web {
-        services.download = Some(Box::new(move |name: &str, b: &[u8]| l2.borrow_mut().push(format!("download {name} {}", b.len()))));
+        services.download = Some(Box::new(move |name: &str, b: &[u8]| {
+            l2.borrow_mut().push(format!("download {name} {}", b.len()));
+            Ok(())
+        }));
    }
    let mut app = VectorcraftApp::new(Session::new(), services);
    app.run("file.new", json!({"width": 60, "height": 40})).unwrap();
@@ -21,7 +21,10 @@ fn app(web: bool) -> (VectorcraftApp, Log, [u64; 2]) {
    let l = log.clone();
    let mut services = Services::default();
    if web {
-        services.download = Some(Box::new(move |name: &str, bytes: &[u8]| l.borrow_mut().push((name.to_string(), bytes.to_vec()))));
+        services.download = Some(Box::new(move |name: &str, bytes: &[u8]| {
+            l.borrow_mut().push((name.to_string(), bytes.to_vec()));
+            Ok(())
+        }));
    } else {
        services.reveal = Some(Box::new(move |path: &str| {
            l.borrow_mut().push((path.to_string(), vec![]));
@@ -21,7 +21,10 @@ fn app(artboards: usize, web: bool) -> (VectorcraftApp, Log) {
    let l = log.clone();
    let mut services = Services::default();
    if web {
-        services.download = Some(Box::new(move |name: &str, bytes: &[u8]| l.borrow_mut().push((name.to_string(), bytes.to_vec()))));
+        services.download = Some(Box::new(move |name: &str, bytes: &[u8]| {
+            l.borrow_mut().push((name.to_string(), bytes.to_vec()));
+            Ok(())
+        }));
    } else {
        services.reveal = Some(Box::new(move |path: &str| {
            l.borrow_mut().push((path.to_string(), vec![]));
@@ -24,11 +24,11 @@ use crate::state::{ToolbarCategory, ToolbarEdits};
 use crate::theme::Tokens;
 use crate::{VectorcraftApp, icons, widgets};

-/// A tool's cell in the drawer: its icon and name.
-const CELL: egui::Vec2 = vec2(176.0, 28.0);
-const ICON: f32 = 20.0;
-/// The drawer's width: two cells, the gap between them and room for the scroll bar.
-const WIDTH: f32 = 2.0 * CELL.x + 24.0;
+/// A tool's row in the drawer: its icon, name and shortcut.
+const ROW: f32 = 26.0;
+const ICON: f32 = 18.0;
+/// The drawer's width: one column of rows, framed in groups, and room for the scroll bar.
+const WIDTH: f32 = 268.0;
 /// Gap between the toolbar and the drawer, and the drawer's least distance from the window's edges.
 const GAP: f32 = 4.0;
 /// Size of the tool following the pointer while it is dragged.
@@ -244,6 +244,19 @@ pub(crate) fn command(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<R
                Ok(())
            })
        })(),
+        "toolbar.show" => (|| {
+            let on = crate::menus::opt_bool(p, "on")?;
+            if let Some(name) = p.get("control").filter(|v| !v.is_null()) {
+                let name = name.as_str().ok_or("control must be fillStroke, coloring, drawMode or screenMode")?;
+                let flag = app
+                    .ui
+                    .toolbar_show
+                    .get_mut(name)
+                    .ok_or_else(|| format!("unknown control `{name}`: fillStroke, coloring, drawMode or screenMode"))?;
+                *flag = on.unwrap_or(!*flag);
+            }
+            Ok(app.ui.toolbar_show.json())
+        })(),
        "toolbar.reset" => {
            *current(&mut app.ui.toolbar_edits, app.ui.toolbar_advanced) = None;
            Ok(slots_json(app))
@@ -362,6 +375,30 @@ fn sections() -> &'static [(&'static str, Vec<&'static ToolInfo>)] {
    })
 }

+/// A heading of the drawer and the flyout groups listed under it.
+type Heading = (&'static str, Vec<&'static [ToolInfo]>);
+
+/// The headings in order, each with the flyout groups listed under it (a group under the heading
+/// most of its tools have, the first tool's on a tie), each in its tools' order: what the drawer
+/// frames together.
+fn groups() -> &'static [Heading] {
+    static GROUPS: OnceLock<Vec<Heading>> = OnceLock::new();
+    GROUPS.get_or_init(|| {
+        let mut out: Vec<Heading> = sections().iter().map(|(cat, _)| (*cat, vec![])).collect();
+        for g in TOOL_GROUPS {
+            let Some(first) = g.first() else { continue };
+            let count = |h: &str| g.iter().filter(|t| heading(t.id) == h).count();
+            let h = g.iter().map(|t| heading(t.id)).fold(heading(first.id), |best, h| if count(h) > count(best) { h } else { best });
+            match out.iter_mut().find(|(c, _)| *c == h) {
+                Some((_, gs)) => gs.push(g),
+                None => out.push((h, vec![g])),
+            }
+        }
+        out.retain(|(_, gs)| !gs.is_empty());
+        out
+    })
+}
+
 /// The All Tools drawer beside the toolbar, its top by the ••• button (higher when that would put
 /// it past the window's bottom), while `tools_drawer` is on.
 pub(crate) fn drawer(app: &mut VectorcraftApp, ctx: &egui::Context) {
@@ -374,7 +411,10 @@ pub(crate) fn drawer(app: &mut VectorcraftApp, ctx: &egui::Context) {
    let id = drawer_id();
    let size = ctx.memory(|m| m.area_rect(id)).map_or(vec2(WIDTH, 200.0), |r| r.size());
    let x = (bar.right() + GAP).min(screen.right() - size.x - GAP).max(screen.left());
-    let y = button.top().min(screen.bottom() - size.y - GAP).max(screen.top() + GAP);
+    // Never above the toolbar's top: higher up are the window's title bar (and on macOS its
+    // buttons) and the bars under it.
+    let top = bar.top().max(screen.top() + GAP);
+    let y = button.top().min(screen.bottom() - size.y - GAP).max(top);
    let in_toolbar: BTreeSet<&str> = crate::toolbar::slots(app).into_iter().flat_map(|(_, s)| s).collect();
    let active = app.session.tool_id();
    let dragged = DragAndDrop::payload::<ToolDrag>(ctx).map(|d| *d);
@@ -383,29 +423,69 @@ pub(crate) fn drawer(app: &mut VectorcraftApp, ctx: &egui::Context) {
    let removing = dragged.is_some_and(|d| d.from_toolbar) && ctx.memory(|m| m.area_rect(id)).is_some_and(over);
    let mut picked = None;
    let mut reset = false;
+    let mut advanced = None;
+    let mut show_toggle = None;
    let resp = egui::Area::new(id).order(egui::Order::Foreground).fixed_pos(pos2(x, y)).show(ctx, |ui| {
        crate::toolbar::flyout_frame(&t, removing).inner_margin(egui::Margin::same(8)).show(ui, |ui| {
-            ui.set_width(WIDTH.min(screen.width() - 2.0 * GAP - 16.0).max(CELL.x));
+            let width = WIDTH.min(screen.width() - 2.0 * GAP - 16.0).max(160.0);
+            ui.set_width(width);
+            // All Tools, and the drawer's flyout menu: Reset, and the Basic or Advanced toolbar.
            ui.horizontal(|ui| {
                ui.label(egui::RichText::new(tl!("All Tools")).size(13.0).color(t.text_strong));
-                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| reset = widgets::flat_button(ui, "Reset", 64.0).clicked());
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    let (r, menu) = ui.allocate_exact_size(vec2(18.0, 18.0), Sense::click());
+                    icons::paint(ui, "menu", r.shrink(1.0), if menu.hovered() { t.text_strong } else { t.text_dim });
+                    menu.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Drawer menu")));
+                    let menu = menu.on_hover_text(tl!("Drawer menu"));
+                    egui::Popup::menu(&menu).id(menu_id()).show(|ui| {
+                        ui.set_min_width(160.0);
+                        if widgets::menu_item(ui, "Reset", true, false) {
+                            reset = true;
+                        }
+                        ui.separator();
+                        for (label, adv) in [("Basic", false), ("Advanced", true)] {
+                            if widgets::menu_item(ui, label, true, app.ui.toolbar_advanced == adv) {
+                                advanced = Some(adv);
+                            }
+                        }
+                    });
+                });
            });
            ui.add_space(4.0);
            // As tall as its tools, up to the window's height (it scrolls then); the Area's size
            // from the last frame mustn't cap it.
-            let room = (screen.height() - 2.0 * GAP - 68.0).max(120.0);
+            let room = (screen.bottom() - top - GAP - 104.0).max(120.0);
            egui::ScrollArea::vertical().max_height(room).min_scrolled_height(room).auto_shrink([false, true]).show(ui, |ui| {
-                for (cat, tools) in sections() {
-                    widgets::subheader(ui, tl!(cat));
-                    ui.horizontal_wrapped(|ui| {
-                        ui.spacing_mut().item_spacing = vec2(4.0, 2.0);
-                        for tool in tools {
-                            if cell(ui, &t, tool, tool.id == active, in_toolbar.contains(tool.id)) {
-                                picked = Some(tool.id);
-                            }
-                        }
-                    });
+                ui.spacing_mut().item_spacing = vec2(0.0, 0.0);
+                let inner = ui.available_width() - 10.0;
+                for (cat, gs) in groups() {
                    ui.add_space(6.0);
+                    ui.label(egui::RichText::new(format!("{}:", tl!(cat))).size(12.0).color(t.text_strong));
+                    ui.add_space(4.0);
+                    for g in gs {
+                        // A flyout group: its tools framed together, as one toolbar button holds them.
+                        egui::Frame::NONE.stroke(Stroke::new(1.0, t.divider)).corner_radius(2.0).show(ui, |ui| {
+                            ui.set_width(inner);
+                            for tool in g.iter() {
+                                if row(ui, &t, tool, tool.id == active, in_toolbar.contains(tool.id)) {
+                                    picked = Some(tool.id);
+                                }
+                            }
+                        });
+                        ui.add_space(5.0);
+                    }
+                }
+            });
+            // Show: the controls under the toolbar's tools.
+            ui.add_space(4.0);
+            ui.separator();
+            ui.horizontal(|ui| {
+                ui.label(egui::RichText::new(tl!("Show:")).size(12.0).color(t.text));
+                ui.add_space(4.0);
+                for (name, label, icon) in crate::state::ToolbarShow::CONTROLS {
+                    if show_button(ui, &t, name, label, icon, app.ui.toolbar_show.get(name)) {
+                        show_toggle = Some(name);
+                    }
                }
            });
        });
@@ -423,10 +503,21 @@ pub(crate) fn drawer(app: &mut VectorcraftApp, ctx: &egui::Context) {
    if reset && let Err(e) = app.run("toolbar.reset", json!({})) {
        app.ui.status = e;
    }
+    // Basic or Advanced: the menu item of the other toolbar switches to it.
+    if advanced.is_some_and(|a| a != app.ui.toolbar_advanced)
+        && let Err(e) = app.run("window.toolbarAdvanced", json!({}))
+    {
+        app.ui.status = e;
+    }
+    if let Some(name) = show_toggle
+        && let Err(e) = app.run("toolbar.show", json!({ "control": name }))
+    {
+        app.ui.status = e;
+    }
    if let Some(id) = picked {
        app.select_tool(id);
        app.ui.tools_drawer = false;
-    } else if resp.response.clicked_elsewhere() && !pointer.is_some_and(|p| bar.contains(p)) {
+    } else if resp.response.clicked_elsewhere() && !pointer.is_some_and(|p| bar.contains(p)) && !egui::Popup::is_id_open(ctx, menu_id()) {
        // A click in the toolbar (picking a tool, or the ••• button that toggles the drawer) leaves
        // it open.
        app.ui.tools_drawer = false;
@@ -434,19 +525,68 @@ pub(crate) fn drawer(app: &mut VectorcraftApp, ctx: &egui::Context) {
    ghost(ctx, &t);
 }

-/// A tool's cell in the drawer: icon and name, dimmed when the tool is in the toolbar already (it
-/// can't be dragged in again). Returns whether it was clicked.
-fn cell(ui: &mut Ui, t: &Tokens, tool: &'static ToolInfo, on: bool, dimmed: bool) -> bool {
-    let (rect, resp) = ui.allocate_exact_size(CELL, if dimmed { Sense::click() } else { Sense::click_and_drag() });
+/// A Show section toggle: lit while its control shows under the toolbar's tools. Fill and Stroke
+/// and Coloring are drawn as small copies of those controls, the modes with their buttons' icons.
+fn show_button(ui: &mut Ui, t: &Tokens, name: &str, label: &str, icon: &str, on: bool) -> bool {
+    let (r, resp) = ui.allocate_exact_size(vec2(26.0, 26.0), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, on, tl!(label)));
+    let p = ui.painter();
+    if on {
+        p.rect_filled(r, 3.0, t.tool_active);
+    } else if resp.hovered() {
+        p.rect_filled(r, 3.0, t.hover);
+    }
+    let ink = if on { t.text_strong } else { t.icon };
+    let c = r.center();
+    match name {
+        "fillStroke" => {
+            // The proxy: a filled square in front of a stroked one.
+            let back = Rect::from_center_size(c + vec2(3.0, 3.0), vec2(10.0, 10.0));
+            p.rect_stroke(back, 0.0, Stroke::new(2.0, ink), StrokeKind::Inside);
+            p.rect_filled(Rect::from_center_size(c - vec2(3.0, 3.0), vec2(10.0, 10.0)), 0.0, ink);
+        }
+        "coloring" => {
+            // Color, Gradient and None.
+            for (k, x) in [-6.5f32, 0.0, 6.5].into_iter().enumerate() {
+                let chip = Rect::from_center_size(c + vec2(x, 0.0), vec2(5.5, 9.0));
+                match k {
+                    0 => {
+                        p.rect_filled(chip, 0.0, ink);
+                    }
+                    1 => {
+                        p.rect_filled(chip, 0.0, ink.gamma_multiply(0.5));
+                    }
+                    _ => {
+                        p.rect_stroke(chip, 0.0, Stroke::new(1.0, ink), StrokeKind::Inside);
+                        p.line_segment([chip.left_bottom(), chip.right_top()], Stroke::new(1.0, ink));
+                    }
+                }
+            }
+        }
+        _ => icons::paint(ui, icon, r.shrink(5.0), ink),
+    }
+    resp.on_hover_text(tl!(label)).clicked()
+}
+
+/// The drawer's flyout menu.
+fn menu_id() -> egui::Id {
+    egui::Id::new("tools-drawer-menu")
+}
+
+/// A tool's row in the drawer: icon, name and shortcut, dimmed when the tool is in the toolbar
+/// already (it can't be dragged in again). Returns whether it was clicked.
+fn row(ui: &mut Ui, t: &Tokens, tool: &'static ToolInfo, on: bool, dimmed: bool) -> bool {
+    let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), ROW), if dimmed { Sense::click() } else { Sense::click_and_drag() });
    if !dimmed {
        resp.dnd_set_drag_payload(ToolDrag { tool: tool.id, from_toolbar: false });
    }
+    let fill = rect.shrink(1.0);
    if on {
-        ui.painter().rect_filled(rect, 3.0, t.selection);
+        ui.painter().rect_filled(fill, 2.0, t.selection);
    } else if resp.hovered() {
-        ui.painter().rect_filled(rect, 3.0, t.hover);
+        ui.painter().rect_filled(fill, 2.0, t.hover);
    }
-    // The active tool's cell is lit, dimmed or not.
+    // The active tool's row is lit, dimmed or not.
    let color = if on {
        t.text_strong
    } else if dimmed {
@@ -454,12 +594,31 @@ fn cell(ui: &mut Ui, t: &Tokens, tool: &'static ToolInfo, on: bool, dimmed: bool
    } else {
        t.text
    };
-    let icon = Rect::from_center_size(rect.left_center() + vec2(6.0 + ICON / 2.0, 0.0), vec2(ICON, ICON));
+    let icon = Rect::from_center_size(rect.left_center() + vec2(8.0 + ICON / 2.0, 0.0), vec2(ICON, ICON));
    icons::paint(ui, icons::tool_icon(tool.icon), icon, if dimmed || on { color } else { t.icon });
-    let name = tl!(tool.label);
-    let name = if crate::i18n::current() == crate::i18n::Lang::EN { name.trim_end_matches(" Tool") } else { name };
-    let text_at = pos2(icon.right() + 8.0, rect.center().y);
-    ui.painter().with_clip_rect(rect).text(text_at, egui::Align2::LEFT_CENTER, name, egui::FontId::proportional(12.0), color);
+    let painter = ui.painter().with_clip_rect(rect);
+    let shortcut = crate::shortcut_editor::tool_shortcut(tool.id);
+    let keys_w = shortcut.as_ref().map_or(0.0, |k| {
+        let keys = if on {
+            t.text_strong
+        } else if dimmed {
+            t.text_disabled
+        } else {
+            t.text_dim
+        };
+        let g = painter.layout_no_wrap(k.to_string(), egui::FontId::proportional(11.5), keys);
+        let w = g.size().x;
+        painter.galley(pos2(rect.right() - 10.0 - w, rect.center().y - g.size().y / 2.0), g, keys);
+        w + 12.0
+    });
+    let text_at = pos2(icon.right() + 10.0, rect.center().y);
+    painter.with_clip_rect(Rect::from_min_max(rect.min, pos2(rect.right() - 10.0 - keys_w, rect.bottom()))).text(
+        text_at,
+        egui::Align2::LEFT_CENTER,
+        tl!(tool.label),
+        egui::FontId::proportional(12.5),
+        color,
+    );
    resp.on_hover_text(crate::toolbar::tip(tool)).clicked()
 }

@@ -483,7 +642,7 @@ mod tests {
    use super::*;

    /// Tall enough for the whole Basic toolbar and the whole drawer.
-    const SCREEN: egui::Vec2 = vec2(1000.0, 2400.0);
+    const SCREEN: egui::Vec2 = vec2(1000.0, 4000.0);
    /// A toolbar tool button.
    const BUTTON: egui::Vec2 = vec2(36.0, 29.0);

@@ -561,7 +720,7 @@ mod tests {
        ctx.memory(|m| m.areas().visible_last_frame(&egui::LayerId::new(egui::Order::Foreground, drawer_id())))
    }

-    /// A point inside the drawer's cell of the tool named `name` (as the drawer shows it), and the
+    /// A point inside the drawer's row of the tool named `name` (as the drawer shows it), and the
    /// colour of its name.
    fn cell_at(shown: &[(String, Pos2, Color32)], drawer: Rect, name: &str) -> (Pos2, Color32) {
        shown
@@ -571,6 +730,40 @@ mod tests {
            .unwrap_or_else(|| panic!("no {name} in the drawer {drawer:?}"))
    }

+    /// The drawer frames each flyout group whole, under the heading most of its tools have: every
+    /// tool once, the Pencil's group (led by the Shaper) under Draw.
+    #[test]
+    fn the_drawer_frames_every_flyout_group_once() {
+        let listed: Vec<&str> = groups().iter().flat_map(|(_, gs)| gs.iter().flat_map(|g| g.iter().map(|t| t.id))).collect();
+        let all: Vec<&str> = TOOL_GROUPS.iter().flat_map(|g| g.iter().map(|t| t.id)).collect();
+        assert_eq!(listed.len(), all.len());
+        assert!(all.iter().all(|id| listed.contains(id)));
+        let under = |id: &str| groups().iter().find(|(_, gs)| gs.iter().any(|g| g.iter().any(|t| t.id == id))).map(|(c, _)| *c);
+        assert_eq!(under("pencil"), Some("Draw"));
+        assert_eq!(under("shaper"), Some("Draw"), "framed with the Pencil");
+        assert_eq!(under("rectangle"), Some("Shapes"));
+    }
+
+    /// The Show section's controls (#1736): each shows (true), hides (false) or toggles, saved with
+    /// the preferences; an unknown control is an error naming them.
+    #[test]
+    fn toolbar_show_turns_the_controls_under_the_tools_on_and_off() {
+        let mut app = app();
+        let all_on = json!({"fillStroke": true, "coloring": true, "drawMode": true, "screenMode": true});
+        assert_eq!(app.run("toolbar.show", json!({})).unwrap(), all_on);
+        assert_eq!(app.run("toolbar.show", json!({"control": "coloring"})).unwrap()["coloring"], json!(false));
+        assert_eq!(app.run("toolbar.show", json!({"control": "screenMode", "on": false})).unwrap()["screenMode"], json!(false));
+        assert!(!app.ui.toolbar_show.coloring && !app.ui.toolbar_show.screen_mode && app.ui.toolbar_show.fill_stroke);
+        let err = app.run("toolbar.show", json!({"control": "swatches"})).unwrap_err();
+        assert!(err.contains("swatches") && err.contains("fillStroke"), "{err}");
+        // Saved with the preferences; older preferences show them all.
+        let saved = serde_json::to_value(&app.ui).unwrap();
+        assert_eq!(serde_json::from_value::<crate::state::UiState>(saved).unwrap().toolbar_show, app.ui.toolbar_show);
+        let mut old = serde_json::to_value(&app.ui).unwrap();
+        old.as_object_mut().unwrap().remove("toolbar_show");
+        assert_eq!(serde_json::from_value::<crate::state::UiState>(old).unwrap().toolbar_show, crate::state::ToolbarShow::default());
+    }
+
    /// Every tool is listed once, under a heading; the Basic toolbar's groups come first, in its order.
    #[test]
    fn every_tool_is_listed_once_under_a_heading() {
@@ -698,8 +891,9 @@ mod tests {
        let bar = ctx.data(|d| d.get_temp::<Rect>(toolbar_id())).unwrap();
        assert!((drawer.left() - bar.right() - GAP).abs() < 1.0, "beside the toolbar: {drawer:?} {bar:?}");
        assert!((drawer.top() - edit.top()).abs() < 1.0 || drawer.bottom() >= SCREEN.y - GAP - 1.0, "by the button: {drawer:?} {edit:?}");
+        assert!(drawer.top() >= bar.top() - 0.5, "never above the toolbar (the title bar's there): {drawer:?} {bar:?}");
        assert!(drawer.y_range().contains(edit.center().y), "by the button: {drawer:?} {edit:?}");
-        assert!(drawer.width() < 3.0 * CELL.x, "two tools wide: {drawer:?}");
+        assert!(drawer.width() < WIDTH + 24.0, "one row of tools wide: {drawer:?}");
        // A click on a toolbar tool picks it and leaves the drawer open.
        let tools = crate::toolbar::tests::widget_rects(&ctx, BUTTON);
        let ellipse = tools[slot_of(&app, "ellipse").unwrap()].center();
@@ -724,7 +918,7 @@ mod tests {
        app.run("window.editToolbar", json!({})).unwrap();
        frame(&mut app, &ctx, 7.0, vec![]);
        let shown = frame(&mut app, &ctx, 7.1, vec![]);
-        let (at, _) = cell_at(&shown, drawer_rect(&ctx).unwrap(), "Artboard");
+        let (at, _) = cell_at(&shown, drawer_rect(&ctx).unwrap(), "Artboard Tool");
        click(&mut app, &ctx, 8.0, at);
        assert!(!app.ui.tools_drawer && app.session.tool_id() == "artboard");
    }
@@ -739,13 +933,13 @@ mod tests {
        let shown = frame(&mut app, &ctx, 0.1, vec![]);
        let drawer = drawer_rect(&ctx).unwrap();
        let dim = Tokens::get(&ctx).text_disabled;
-        assert_eq!(cell_at(&shown, drawer, "Ellipse").1, dim);
-        assert_ne!(cell_at(&shown, drawer, "Artboard").1, dim);
+        assert_eq!(cell_at(&shown, drawer, "Ellipse Tool").1, dim);
+        assert_ne!(cell_at(&shown, drawer, "Artboard Tool").1, dim);
        app.run("toolbar.addTool", json!({"tool": "artboard"})).unwrap();
        app.run("toolbar.removeTool", json!({"tool": "ellipse"})).unwrap();
        let shown = frame(&mut app, &ctx, 0.2, vec![]);
-        assert_ne!(cell_at(&shown, drawer, "Ellipse").1, dim);
-        assert_eq!(cell_at(&shown, drawer, "Artboard").1, dim);
+        assert_ne!(cell_at(&shown, drawer, "Ellipse Tool").1, dim);
+        assert_eq!(cell_at(&shown, drawer, "Artboard Tool").1, dim);
    }

    /// #1018: tools drag from the drawer onto the toolbar (between two tools, or onto one to join
@@ -761,19 +955,24 @@ mod tests {
        let drawer = drawer_rect(&ctx).unwrap();
        let tools = crate::toolbar::tests::widget_rects(&ctx, BUTTON);
        // Onto the divider under the Selection tool: its own slot, second.
-        let (artboard, _) = cell_at(&shown, drawer, "Artboard");
+        let (artboard, _) = cell_at(&shown, drawer, "Artboard Tool");
        drag(&mut app, &ctx, 1.0, artboard, tools[0].center_bottom() - vec2(0.0, 3.0));
        assert_eq!(&slots(&app)[..2], [&["selection"][..], &["artboard"]]);
        assert!(app.ui.tools_drawer, "the drawer stays open");
        // Onto the middle of the Ellipse tool: into its group.
        let tools = crate::toolbar::tests::widget_rects(&ctx, BUTTON);
        let ellipse = slot_of(&app, "ellipse").unwrap();
-        let (slice, _) = cell_at(&shown, drawer, "Slice");
+        // The drawer moves with the ••• button the new slot pushed down: read it again.
+        let shown = frame(&mut app, &ctx, 1.9, vec![]);
+        let drawer = drawer_rect(&ctx).unwrap();
+        let (slice, _) = cell_at(&shown, drawer, "Slice Tool");
        drag(&mut app, &ctx, 2.0, slice, tools[ellipse].center());
        assert_eq!(slots(&app)[ellipse], ["ellipse", "slice"]);
        // A dimmed tool (in the toolbar already) doesn't drag.
        let before = slots(&app);
-        let (rectangle, _) = cell_at(&shown, drawer, "Rectangle");
+        let shown = frame(&mut app, &ctx, 2.9, vec![]);
+        let drawer = drawer_rect(&ctx).unwrap();
+        let (rectangle, _) = cell_at(&shown, drawer, "Rectangle Tool");
        drag(&mut app, &ctx, 3.0, rectangle, tools[0].center_bottom() - vec2(0.0, 3.0));
        assert_eq!(slots(&app), before);
        // From the toolbar into the drawer: out of the toolbar.
@@ -1428,6 +1428,7 @@ lighting	Light	Světlo
 	Black and White	Černobílé
 	Corners	Rohy
 	Auto Grouping	Automatické seskupení
+	Enhanced	Vylepšené
 	Ignore Color	Ignorovat barvu
 	Ignore White	Ignorovat bílou
 	Palette:	Paleta:
@@ -3507,6 +3508,8 @@ effect	Regular	Pravidelný
 	Serif / Mincho	Patkové / mincho
 	Changes made since it was last saved will be lost.	Změny provedené od posledního uložení budou ztraceny.
 	Can't open “{name}”.	„{name}“ nelze otevřít.
+	Can't save “{name}”.	„{name}“ nelze uložit.
+	Can't export “{name}”.	„{name}“ nelze exportovat.
 	Downloaded {what}	Staženo: {what}
 	Exported {count} file(s) to {folder}	Exportováno souborů: {count} do {folder}
 	Exported {what}	Exportováno: {what}
@@ -4098,6 +4101,8 @@ imageTrace	Outline	Obrys
@msg	recovery copy `{file}`: {e}	kopie pro obnovení `{file}`: {e}
@msg	resolutions must be between 1 and 2400 ppi	rozlišení musí být mezi 1 a 2400 ppi
@msg	result would exceed the canvas (coordinates out of range)	výsledek by přesáhl plátno (souřadnice mimo rozsah)
+@msg	objects can't be nested more than 32 deep	objekty nelze vnořit hlouběji než do 32 úrovní
+@msg	the SVG's elements are nested more than {0} deep	prvky SVG jsou vnořeny hlouběji než do {0} úrovní
@msg	scale must be a number from {_1} to {_2}, not {_3}	měřítko musí být číslo od {_1} do {_2}, ne {_3}
@msg	scale must be a number from {_1} to {_2}, not {s}	měřítko musí být číslo od {_1} do {_2}, ne {s}
@msg	select (or target) objects whose appearance isn't basic	vyberte (nebo zacilte) objekty, jejichž vzhled není základní
@@ -4744,6 +4749,14 @@ mark-style	Japanese	Japonské
@msg	unknown parameter `{key}`; the command takes: {keys}	neznámý parametr `{key}`; příkaz přijímá: {keys}
 	Load EPS into Clipboard	Načíst EPS do schránky
@msg	an image of {w} × {h} pixels is too large to draw	obraz o velikosti {w} × {h} obrazových bodů je příliš velký na vykreslení
+	Fill and Stroke Controls	Ovládací prvky výplně a tahu
+	Coloring Controls	Ovládací prvky barev
+	Draw Mode Controls	Ovládací prvky režimu kreslení
+	Screen Mode Controls	Ovládací prvky režimu zobrazení
+	Drawer menu	Nabídka zásuvky
+	Toolbar: Show Controls	Panel nástrojů: Zobrazit ovládací prvky
+@msg	control must be fillStroke, coloring, drawMode or screenMode	control musí být fillStroke, coloring, drawMode nebo screenMode
+@msg	unknown control `{name}`: fillStroke, coloring, drawMode or screenMode	neznámý ovládací prvek `{name}`: fillStroke, coloring, drawMode nebo screenMode
@msg	give a fraction `t` from 0 to 1	zadejte hodnotu `t` od 0 do 1
@msg	give the path `id`	zadejte `id` cesty
@msg	invalid stroke widths	neplatné šířky tahu
@@ -754,6 +754,8 @@
 	Do Not Move	Nicht verschieben
 	Do you want to save the changes you made to “{name}”?	Möchten Sie die Änderungen an „{name}“ speichern?
 	Can't open “{name}”.	„{name}“ kann nicht geöffnet werden.
+	Can't save “{name}”.	„{name}“ kann nicht gespeichert werden.
+	Can't export “{name}”.	„{name}“ kann nicht exportiert werden.
 	Document	Dokument
 	Document Color Mode	Dokumentfarbmodus
 	Document Info	Dokumentinformationen
@@ -1283,6 +1285,7 @@
 	Ignore	Ignorieren
 	Ignore Artboards (all the art as one page)	Zeichenflächen ignorieren (gesamte Grafik als eine Seite)
 	Auto Grouping	Automatisch gruppieren
+	Enhanced	Erweitert
 	Ignore Color	Farbe ignorieren
 	Ignore White	Weiß ignorieren
 	Palette:	Palette:
@@ -3704,6 +3707,8 @@ theme	Appearance	Erscheinungsbild
@msg	recovery copy `{file}`: {e}	Wiederherstellungskopie `{file}`: {e}
@msg	resolutions must be between 1 and 2400 ppi	Auflösungen müssen zwischen 1 und 2400 ppi liegen
@msg	result would exceed the canvas (coordinates out of range)	das Ergebnis würde die Arbeitsfläche überschreiten (Koordinaten außerhalb des Bereichs)
+@msg	objects can't be nested more than 32 deep	Objekte können nicht tiefer als 32 Ebenen verschachtelt werden
+@msg	the SVG's elements are nested more than {0} deep	die Elemente der SVG-Datei sind tiefer als {0} Ebenen verschachtelt
@msg	scale must be a number from {_1} to {_2}, not {_3}	scale muss eine Zahl von {_1} bis {_2} sein, nicht {_3}
@msg	scale must be a number from {_1} to {_2}, not {s}	scale muss eine Zahl von {_1} bis {_2} sein, nicht {s}
@msg	select (or target) objects whose appearance isn't basic	wählen Sie Objekte aus (oder als Ziel), deren Aussehen nicht einfach ist
@@ -4268,6 +4273,15 @@ theme	Appearance	Erscheinungsbild
@msg	unknown parameter `{key}`; the command takes: {keys}	unbekannter Parameter `{key}`; der Befehl akzeptiert: {keys}
 	Load EPS into Clipboard	EPS in die Zwischenablage laden
@msg	an image of {w} × {h} pixels is too large to draw	ein Bild mit {w} × {h} Pixeln ist zu groß, um gezeichnet zu werden
+	Basic	Basis
+	Fill and Stroke Controls	Steuerelemente für Fläche und Kontur
+	Coloring Controls	Steuerelemente für Farbe
+	Draw Mode Controls	Steuerelemente für Zeichenmodus
+	Screen Mode Controls	Steuerelemente für Bildschirmmodus
+	Drawer menu	Menü der Werkzeugschublade
+	Toolbar: Show Controls	Werkzeugleiste: Steuerelemente einblenden
+@msg	control must be fillStroke, coloring, drawMode or screenMode	control muss fillStroke, coloring, drawMode oder screenMode sein
+@msg	unknown control `{name}`: fillStroke, coloring, drawMode or screenMode	unbekanntes Steuerelement `{name}`: fillStroke, coloring, drawMode oder screenMode
@msg	give a fraction `t` from 0 to 1	geben Sie einen Wert `t` von 0 bis 1 an
@msg	give the path `id`	geben Sie die `id` des Pfads an
@msg	invalid stroke widths	ungültige Konturbreiten
@@ -768,6 +768,8 @@
 	Do Not Move	No mover
 	Do you want to save the changes you made to “{name}”?	¿Quieres guardar los cambios hechos en “{name}”?
 	Can't open “{name}”.	No se puede abrir «{name}».
+	Can't save “{name}”.	No se puede guardar «{name}».
+	Can't export “{name}”.	No se puede exportar «{name}».
 	Document	Documento
 	Document Color Mode	Modo de color del documento
 	Document Info	Información del documento
@@ -1301,6 +1303,7 @@
 	Ignore	Ignorar
 	Ignore Artboards (all the art as one page)	Ignorar mesas de trabajo (toda la ilustración como una página)
 	Auto Grouping	Agrupación automática
+	Enhanced	Mejorado
 	Ignore Color	Ignorar color
 	Ignore White	Ignorar blanco
 	Palette:	Paleta:
@@ -3803,6 +3806,8 @@ axis	Both	Ambos
@msg	recovery copy `{file}`: {e}	copia de recuperación `{file}`: {e}
@msg	resolutions must be between 1 and 2400 ppi	las resoluciones deben estar entre 1 y 2400 ppi
@msg	result would exceed the canvas (coordinates out of range)	el resultado excedería el lienzo (coordenadas fuera de rango)
+@msg	objects can't be nested more than 32 deep	los objetos no pueden anidarse a más de 32 niveles
+@msg	the SVG's elements are nested more than {0} deep	los elementos del SVG están anidados a más de {0} niveles
@msg	scale must be a number from {_1} to {_2}, not {_3}	la escala debe ser un número de {_1} a {_2}, no {_3}
@msg	scale must be a number from {_1} to {_2}, not {s}	la escala debe ser un número de {_1} a {_2}, no {s}
@msg	select (or target) objects whose appearance isn't basic	selecciona (o apunta a) objetos cuya apariencia no sea básica
@@ -4685,6 +4690,14 @@ mark-style	Japanese	Japonesas
@msg	unknown parameter `{key}`; the command takes: {keys}	parámetro desconocido `{key}`; el comando acepta: {keys}
 	Load EPS into Clipboard	Cargar EPS en el portapapeles
@msg	an image of {w} × {h} pixels is too large to draw	una imagen de {w} × {h} píxeles es demasiado grande para dibujarse
+	Fill and Stroke Controls	Controles de relleno y trazo
+	Coloring Controls	Controles de color
+	Draw Mode Controls	Controles de modo de dibujo
+	Screen Mode Controls	Controles de modo de pantalla
+	Drawer menu	Menú del cajón
+	Toolbar: Show Controls	Barra de herramientas: Mostrar controles
+@msg	control must be fillStroke, coloring, drawMode or screenMode	control debe ser fillStroke, coloring, drawMode o screenMode
+@msg	unknown control `{name}`: fillStroke, coloring, drawMode or screenMode	control desconocido `{name}`: fillStroke, coloring, drawMode o screenMode
@msg	give a fraction `t` from 0 to 1	indica un valor `t` de 0 a 1
@msg	give the path `id`	indica el `id` del trazado
@msg	invalid stroke widths	anchuras de trazo no válidas
@@ -770,6 +770,8 @@
 	Do Not Move	Ne pas déplacer
 	Do you want to save the changes you made to “{name}”?	Voulez-vous enregistrer les modifications apportées à « {name} » ?
 	Can't open “{name}”.	Impossible d’ouvrir « {name} ».
+	Can't save “{name}”.	Impossible d’enregistrer « {name} ».
+	Can't export “{name}”.	Impossible d’exporter « {name} ».
 	Document	Document
 	Document Color Mode	Mode colorimétrique du document
 	Document Info	Informations sur le document
@@ -1300,6 +1302,7 @@
 	Ignore	Ignorer
 	Ignore Artboards (all the art as one page)	Ignorer les plans de travail (toute l’illustration sur une page)
 	Auto Grouping	Groupement automatique
+	Enhanced	Amélioré
 	Ignore Color	Ignorer la couleur
 	Ignore White	Ignorer le blanc
 	Palette:	Palette :
@@ -3800,6 +3803,8 @@ axis	Both	Les deux
@msg	recovery copy `{file}`: {e}	copie de récupération `{file}` : {e}
@msg	resolutions must be between 1 and 2400 ppi	les résolutions doivent être comprises entre 1 et 2400 ppp
@msg	result would exceed the canvas (coordinates out of range)	le résultat dépasserait la zone de travail (coordonnées hors limites)
+@msg	objects can't be nested more than 32 deep	les objets ne peuvent pas être imbriqués sur plus de 32 niveaux
+@msg	the SVG's elements are nested more than {0} deep	les éléments du SVG sont imbriqués sur plus de {0} niveaux
@msg	scale must be a number from {_1} to {_2}, not {_3}	l’échelle doit être un nombre compris entre {_1} et {_2}, pas {_3}
@msg	scale must be a number from {_1} to {_2}, not {s}	l’échelle doit être un nombre compris entre {_1} et {_2}, pas {s}
@msg	select (or target) objects whose appearance isn't basic	sélectionnez (ou ciblez) des objets dont l’aspect n’est pas basique
@@ -4744,6 +4749,14 @@ mark-style	Japanese	Japonais
 theme	Appearance	Apparence
 	Load EPS into Clipboard	Charger un EPS dans le presse-papiers
@msg	an image of {w} × {h} pixels is too large to draw	une image de {w} × {h} pixels est trop grande pour être dessinée
+	Fill and Stroke Controls	Commandes de fond et de contour
+	Coloring Controls	Commandes de couleur
+	Draw Mode Controls	Commandes de mode de dessin
+	Screen Mode Controls	Commandes de mode d'affichage
+	Drawer menu	Menu du tiroir
+	Toolbar: Show Controls	Barre d’outils : Afficher les commandes
+@msg	control must be fillStroke, coloring, drawMode or screenMode	control doit être fillStroke, coloring, drawMode ou screenMode
+@msg	unknown control `{name}`: fillStroke, coloring, drawMode or screenMode	commande inconnue `{name}` : fillStroke, coloring, drawMode ou screenMode
@msg	give a fraction `t` from 0 to 1	indiquez une valeur `t` comprise entre 0 et 1
@msg	give the path `id`	indiquez l’`id` du tracé
@msg	invalid stroke widths	largeurs de contour non valides
@@ -485,6 +485,8 @@
 	Calligraphic	Kalligrafikus
 	Calligraphic Brush Options	Kalligrafikus ecset beállításai
 	Can't open “{name}”.	Nem nyitható meg: „{name}”.
+	Can't save “{name}”.	Nem menthető: „{name}”.
+	Can't export “{name}”.	Nem exportálható: „{name}”.
 	Can't print these settings: see the Summary	Ezekkel a beállításokkal nem lehet nyomtatni: lásd az Összegzést
 	Cancel	Mégse
 	Cancel Key Object	Kulcsobjektum megszüntetése
@@ -1662,6 +1664,7 @@
 	Ignore	Kihagy
 	Ignore Artboards (all the art as one page)	Rajztáblák figyelmen kívül hagyása (az összes grafika egy oldalon)
 	Auto Grouping	Automatikus csoportosítás
+	Enhanced	Továbbfejlesztett
 	Ignore Color	Szín figyelmen kívül hagyása
 	Ignore White	Fehér figyelmen kívül hagyása
 	Image	Kép
@@ -4440,6 +4443,8 @@ imageTrace	Outline	Körvonal
@msg	resolutions must be between 1 and 2400 ppi	a felbontás 1 és 2400 ppi között lehet
@msg	Restored {_1} recovered document(s): save them to keep them	Helyreállított dokumentumok: {_1}; mentsd őket, ha meg akarod tartani
@msg	result would exceed the canvas (coordinates out of range)	az eredmény túllépné a vásznat (a koordináták tartományon kívül esnek)
+@msg	objects can't be nested more than 32 deep	az objektumok legfeljebb 32 szint mélyen ágyazhatók egymásba
+@msg	the SVG's elements are nested more than {0} deep	az SVG elemei több mint {0} szint mélyen vannak egymásba ágyazva
@msg	Save for Web: the image is empty	Mentés webre: a kép üres
@msg	Save writes {_1}, not {_2}: use document.export for other formats	a Mentés ezt írja: {_1}, ezt nem: {_2}; más formátumhoz használd a document.export parancsot
@msg	saved panel layout is invalid; reset the workspace first	a mentett panelelrendezés érvénytelen; előbb állítsd vissza a munkaterületet
@@ -4711,6 +4716,14 @@ imageTrace	Outline	Körvonal
@msg	unknown parameter `{key}`; the command takes: {keys}	ismeretlen paraméter: `{key}`; a parancs ezeket fogadja el: {keys}
 	Load EPS into Clipboard	EPS betöltése a vágólapra
@msg	an image of {w} × {h} pixels is too large to draw	egy {w} × {h} pixeles kép túl nagy a kirajzoláshoz
+	Fill and Stroke Controls	Kitöltés és körvonal vezérlői
+	Coloring Controls	Színezés vezérlői
+	Draw Mode Controls	Rajzolási mód vezérlői
+	Screen Mode Controls	Képernyőmód vezérlői
+	Drawer menu	Fiók menüje
+	Toolbar: Show Controls	Eszköztár: Vezérlők megjelenítése
+@msg	control must be fillStroke, coloring, drawMode or screenMode	a control értéke fillStroke, coloring, drawMode vagy screenMode lehet
+@msg	unknown control `{name}`: fillStroke, coloring, drawMode or screenMode	ismeretlen vezérlő: `{name}`; fillStroke, coloring, drawMode vagy screenMode
@msg	give a fraction `t` from 0 to 1	add meg a `t` értékét 0 és 1 között
@msg	give the path `id`	add meg az útvonal `id` értékét
@msg	invalid stroke widths	érvénytelen körvonalszélességek
@@ -768,6 +768,8 @@
 	Do Not Move	Non spostare
 	Do you want to save the changes you made to “{name}”?	Vuoi salvare le modifiche apportate a “{name}”?
 	Can't open “{name}”.	Impossibile aprire «{name}».
+	Can't save “{name}”.	Impossibile salvare «{name}».
+	Can't export “{name}”.	Impossibile esportare «{name}».
 	Document	Documento
 	Document Color Mode	Metodo colore documento
 	Document Info	Informazioni documento
@@ -1300,6 +1302,7 @@
 	Ignore	Ignora
 	Ignore Artboards (all the art as one page)	Ignora tavole da disegno (tutta la grafica come una sola pagina)
 	Auto Grouping	Raggruppamento automatico
+	Enhanced	Avanzato
 	Ignore Color	Ignora colore
 	Ignore White	Ignora bianco
 	Palette:	Palette:
@@ -3803,6 +3806,8 @@ axis	Both	Entrambi
@msg	recovery copy `{file}`: {e}	copia di recupero `{file}`: {e}
@msg	resolutions must be between 1 and 2400 ppi	le risoluzioni devono essere comprese tra 1 e 2400 ppi
@msg	result would exceed the canvas (coordinates out of range)	il risultato supererebbe l'area di disegno (coordinate fuori intervallo)
+@msg	objects can't be nested more than 32 deep	gli oggetti non possono essere nidificati oltre 32 livelli
+@msg	the SVG's elements are nested more than {0} deep	gli elementi dell'SVG sono nidificati oltre {0} livelli
@msg	scale must be a number from {_1} to {_2}, not {_3}	la scala deve essere un numero da {_1} a {_2}, non {_3}
@msg	scale must be a number from {_1} to {_2}, not {s}	la scala deve essere un numero da {_1} a {_2}, non {s}
@msg	select (or target) objects whose appearance isn't basic	seleziona (o imposta come destinazione) oggetti con un aspetto non di base
@@ -4313,6 +4318,15 @@ lighting	Light	Luce
@msg	unknown parameter `{key}`; the command takes: {keys}	parametro sconosciuto `{key}`; il comando accetta: {keys}
 	Load EPS into Clipboard	Carica EPS negli appunti
@msg	an image of {w} × {h} pixels is too large to draw	un'immagine di {w} × {h} pixel è troppo grande per essere disegnata
+	Basic	Base
+	Fill and Stroke Controls	Controlli di riempimento e traccia
+	Coloring Controls	Controlli colore
+	Draw Mode Controls	Controlli modalità di disegno
+	Screen Mode Controls	Controlli modalità schermo
+	Drawer menu	Menu del cassetto
+	Toolbar: Show Controls	Barra degli strumenti: Mostra controlli
+@msg	control must be fillStroke, coloring, drawMode or screenMode	control deve essere fillStroke, coloring, drawMode o screenMode
+@msg	unknown control `{name}`: fillStroke, coloring, drawMode or screenMode	controllo sconosciuto `{name}`: fillStroke, coloring, drawMode o screenMode
@msg	give a fraction `t` from 0 to 1	specifica un valore `t` da 0 a 1
@msg	give the path `id`	specifica l'`id` del tracciato
@msg	invalid stroke widths	larghezze della traccia non valide
@@ -1223,6 +1223,8 @@
 	Divide Vertically Into	垂直方向に分割
 	Do you want to save the changes you made to “{name}”?	「{name}」への変更を保存しますか？
 	Can't open “{name}”.	「{name}」を開けません。
+	Can't save “{name}”.	「{name}」を保存できません。
+	Can't export “{name}”.	「{name}」を書き出せません。
 	Document	ドキュメント
 	Document Ink Options	ドキュメントのインキオプション
 	Document JSON	ドキュメント JSON
@@ -1539,6 +1541,7 @@
 	Ignore	無視
 	Ignore Artboards (all the art as one page)	アートボードを無視 (すべてのアートを 1 ページとして扱う)
 	Auto Grouping	自動グループ化
+	Enhanced	拡張
 	Ignore Color	カラーを無視
 	Ignore White	白を無視
 	Palette:	パレット:
@@ -3729,6 +3732,8 @@ theme	Appearance	外観
@msg	no interaction in progress	進行中の操作がありません
@msg	no such object {0}	オブジェクト {0} が見つかりません
@msg	result would exceed the canvas (coordinates out of range)	結果がカンバスの範囲を超えます (座標が範囲外です)
+@msg	objects can't be nested more than 32 deep	オブジェクトは 32 階層より深く入れ子にできません
+@msg	the SVG's elements are nested more than {0} deep	SVG の要素が {0} 階層より深く入れ子になっています
@msg	unknown command `{0}`	`{0}` は不明なコマンドです
@msg	`{what}` closes nothing	`{what}` に対応する開始部分がありません
@msg	`{what}` closes something it didn't open	`{what}` が対応しない開始部分を閉じています
@@ -4307,6 +4312,15 @@ lighting	Light	ライト
@msg	unknown parameter `{key}`; the command takes: {keys}	`{key}` は不明なパラメーターです。このコマンドで使えるパラメーター: {keys}
 	Load EPS into Clipboard	EPS をクリップボードに読み込む
@msg	an image of {w} × {h} pixels is too large to draw	{w} × {h} ピクセルの画像は大きすぎて描画できません
+	Basic	基本
+	Fill and Stroke Controls	塗りと線のコントロール
+	Coloring Controls	カラーのコントロール
+	Draw Mode Controls	描画モードのコントロール
+	Screen Mode Controls	スクリーンモードのコントロール
+	Drawer menu	ドロワーメニュー
+	Toolbar: Show Controls	ツールバー: コントロールを表示
+@msg	control must be fillStroke, coloring, drawMode or screenMode	control は fillStroke、coloring、drawMode、screenMode のいずれかです
+@msg	unknown control `{name}`: fillStroke, coloring, drawMode or screenMode	不明なコントロール `{name}`：fillStroke、coloring、drawMode、screenMode のいずれかです
@msg	give a fraction `t` from 0 to 1	0 から 1 までの値 `t` を指定してください
@msg	give the path `id`	パスの `id` を指定してください
@msg	invalid stroke widths	線幅が無効です