ci: configure Dependabot for Cargo and GitHub Actions

Co-authored-by: Dylan M. Taylor <[email protected]>

.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+updates:
+  # Maintain Rust / Cargo dependencies
+  - package-ecosystem: "cargo"
+    directories:
+      - "/"
+      - "/crates/affinity/fuzz"
+      - "/crates/plugins/example"
+    schedule:
+      interval: "daily"
+      time: "06:00"
+      timezone: "America/New_York"
+    # Consolidate updates into a single PR rather than one PR per crate
+    groups:
+      cargo-dependencies:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # Maintain GitHub Actions workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+      time: "06:00"
+      timezone: "America/New_York"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "ci(deps)"

.github/workflows/freebsd.yml

@@ -35,5 +35,5 @@ jobs:
     uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
     with:
       require-craft-fonts: true
-      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
       run-package-check: true

.github/workflows/release.yml

@@ -26,7 +26,8 @@ jobs:
     with:
       app-name: vectorcraft
       app-title: VectorCraft
-      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
+      web-craft-fonts: true
       version: ${{ inputs.version }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}

Cargo.lock

@@ -4536,6 +4536,7 @@ dependencies = [
  "vectorcraft-engine",
  "vectorcraft-text",
  "vectorcraft-ui-egui",
+ "wayland-backend",
  "wayland-client",
  "wayland-protocols",
  "webbrowser",
@@ -4543,6 +4544,7 @@ dependencies = [
  "winit",
  "winresource",
  "winsafe",
+ "zbus",
 ]
 
 [[package]]
@@ -5005,6 +5007,7 @@ dependencies = [
  "js-sys",
  "log",
  "rfd",
+ "serde_json",
  "vectorcraft-engine",
  "vectorcraft-format",
  "vectorcraft-text",

Cargo.toml

@@ -65,7 +65,7 @@ wat = "1.228"
 # Without `text` (glyph runs, through glifo and a second skrifa): the renderer draws the outlines
 # vectorcraft-text gives it. The other default features stay.
 vello_cpu = { version = "0.2", default-features = false, features = ["std", "png", "u8_pipeline", "f32_pipeline"] }
-image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
+image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp", "tga"] }
 # Without `text` and the system fonts (fontdb, harfrust and skrifa, at other versions than ours):
 # SVG import reads `<text>` from the XML itself and never gives usvg a font. A test of the SVG
 # crate turns `text` on.

README.md

@@ -11,11 +11,11 @@
 <h1 align="center">VectorCraft</h1>
 
 <p align="center">
-  <b>Vector illustration; an open-source, clean-room reimplementation of Adobe Illustrator, rebuilt in pure Rust.</b>
+  <b>Vector illustration; an open-source, modern vector art application, built in pure Rust.</b>
 </p>
 
 <p align="center">
-  A fast, open-source, clean-room take on the Adobe Illustrator workflow. It runs natively on
+  A fast, open-source vector illustration workflow. It runs natively on
   macOS, Windows, Linux and FreeBSD, and in the browser via WebAssembly. Built by the ArtCraft team.
 </p>
 
@@ -147,7 +147,7 @@ exposes to agents, and exported by VectorCraft's own renderer. The source files
 
 ## Why VectorCraft
 
-- **Familiar.** Illustrator's layout, tools, menus, panels and shortcuts: the Pen, Direct Selection,
+- **Familiar.** A familiar layout, tools, menus, panels and shortcuts: the Pen, Direct Selection,
   Pathfinder, Smart Guides, Appearance, Swatches, Layers and more. You already know how to use it.
 - **Fast.** Multithreaded SIMD rendering off the UI thread. 20,000 shapes render in about 27 ms at
   full retina resolution while the interface stays at 120 fps.
@@ -224,9 +224,8 @@ VectorCraft is under active development. [**ROADMAP.md**](ROADMAP.md) has the st
 and what's next; [`docs/target-app-parity.md`](docs/target-app-parity.md) the full parity assessment and
 [`docs/gaps.md`](docs/gaps.md) the ranked list of what's missing.
 
-**Where we are (2026-10-10): alpha.** About 88% of Illustrator 2026's menu items, tools, effects and formats exist
-(92.5% of menu items do something), feature depth is ~75%, and we estimate ~65% "ready for real work" for a mainstream illustrator (~62% against
-all of Illustrator): everyday
+**Where we are (2026-10-10): alpha.** About 88% of core menu items, tools, effects and formats exist
+(92.5% of menu items do something), feature depth is ~75%, and we estimate ~65% ready for real work for a mainstream illustrator (~62% across all tracked features): everyday
 vector illustration is close to usable: drawing and path tools,
 Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
 files (SVG, PDF and PDF-compatible `.ai` with PDF/X, legacy version 7 `.ai` keeping layers, groups and type, EPS, DXF, EMF/WMF, raster formats, PSD out and PSD/PSB in as their merged image, Print, Package).
@@ -238,22 +237,22 @@ doesn't write Affinity files. Current `.af` validation includes 33 pinned files,
 and every-board SVG/PDF/PSD export, with fixes for Affinity 3 artboards, source-backed JPEGs and text runs.
 [Scope and limits](crates/affinity/README.md); [source audit and remaining gaps](docs/affinity-validation.md).
 The interface
-speaks English, German, Japanese, Korean, Vietnamese, Traditional and Simplified Chinese, Spanish, French, Hungarian, Italian, Polish, Brazilian Portuguese, Russian, Swedish, Ukrainian, Finnish, Bulgarian, Greek and Czech;
+speaks English, German, Japanese, Korean, Vietnamese, Traditional and Simplified Chinese, Spanish, French, Hungarian, Italian, Polish, Brazilian Portuguese, Russian, Swedish, Ukrainian, Finnish, Bulgarian, Greek, Czech and Georgian;
 [localization-parity.md](docs/localization-parity.md) has the details.
-The scores are self-assessed from our code against Illustrator's public documentation;
+The scores are self-assessed from our code against public documentation;
 [target-app-parity.md](docs/target-app-parity.md#how-this-was-measured-2026-10-10) explains how far to trust them.
 
 **What's missing:**
-- reliable exchange of Illustrator's own `.ai` files (layer structure in real files; Illustrator's editing data isn't written);
+- reliable exchange of .ai files (layer structure in real files; proprietary editing data isn't written);
 - an interaction-fidelity pass covering every tool's modifiers and small behaviours;
 - 3D and Materials beyond the initial live Revolve (Extrude & Bevel, Inflate, Rotate, materials);
-- about half of the Photoshop-style raster effects (24 of 57 still missing; Cutout, Film Grain, Neon Glow and Poster Edges are available under Artistic, Halftone Pattern under Sketch) and the Effect Gallery;
+- about half of the raster effects (24 of 57 still missing; Cutout, Film Grain, Neon Glow and Poster Edges are available under Artistic, Halftone Pattern under Sketch) and the Effect Gallery;
 - CJK composition for vertical type (vertical type itself has initial support, with a Japanese interface);
 - scripting, and the rest of Variables (image and graph kinds, dataset import);
 - generative AI features.
 
 **Where we're going:** next is the interaction-fidelity pass, `.ai` files from real users and start-up stability,
-alongside the raster-effects package; then type, the Illustrator 2026 additions and 3D. The ranked list is in
+alongside the raster-effects package; then type, recent additions and 3D. The ranked list is in
 [`docs/gaps.md`](docs/gaps.md).
 
 **Workspace:** `crates/{geom, color, doc, pathops, text, effects, three-d, trace, brush, render, svg, pdf, eps, cad, metafile, format, tools, engine, ui-egui, mcp, testkit}`
@@ -372,8 +371,6 @@ ArtCraft Team and are not covered by this license. They may be used only unmodif
 part of this repository and VectorCraft, under [`docs/brand/LICENSE-brand.txt`](docs/brand/LICENSE-brand.txt).
 Forks and modified versions must remove them.
 
-<sub>Adobe, Photoshop, Illustrator, Premiere Pro, Lightroom, Acrobat, After Effects and InDesign are trademarks or registered trademarks of Adobe Inc. in the United States and/or other countries. VectorCraft is an independent, open-source project and is not affiliated with, sponsored by or endorsed by Adobe Inc.; these names are used only to describe the workflows it is compatible with.</sub>
-
 <p align="center">
   <a href="https://getartcraft.com/"><img alt="ArtCraft" src="docs/brand/artcraft-mark.svg" width="28"></a><br>
   <sub>Made by the <a href="https://getartcraft.com/">ArtCraft</a> team and community.</sub>

ROADMAP.md

@@ -9,7 +9,7 @@
 
 **Stage: alpha** · next: beta, ~13 points (ready for real work ~62% → ~75%, and reliable `.ai` exchange) and ~170–270 h away
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** minor (about 40 community PRs of 2026-10-18: Word .docx placed as area type, CCITT Group 3 TIFF, Roman Hanging Punctuation, blend spines edited with the Anchor Point tool, shadows and glows in stack order, coloured 3D lights, a Dutch catalog completed; 3D lighting: one to ten colored lights, smooth colored Inflate, legacy white-light appearance preserved; surface batching and restored seam minimum; scores and estimates unchanged; about 145 community PRs of 2026-10-17: image-decode overflow guards, opaque floating panels, MCP export cancel and progress, editable Illustrator EPS import, scoped `doc_inspect`, Dutch, Danish and Indonesian, Simplified Chinese messages, screen-reader names; headline numbers unchanged; about 160 community PRs of 2026-10-15/16: PDF import crash fixes, Dimension tool, legacy `.ai` save, Intertwine, web pen input, Image Trace fixes, `.ai`/EPS/PDF import fidelity, Bulgarian, Greek, Swedish and Finnish catalogs; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** minor (Background Export progress dialog with Cancel, #2564; about 85 community PRs of 2026-10-18: Justification…, Word .docx placed as area type, CCITT Group 3 TIFF, Roman Hanging Punctuation, blend spines edited with the Anchor Point tool, shadows and glows in stack order, coloured 3D lights, a Dutch catalog completed; 3D lighting: one to ten colored lights, smooth colored Inflate, legacy white-light appearance preserved; surface batching and restored seam minimum; scores and estimates unchanged; about 145 community PRs of 2026-10-17: image-decode overflow guards, opaque floating panels, MCP export cancel and progress, editable Illustrator EPS import, scoped `doc_inspect`, Dutch, Danish and Indonesian, Simplified Chinese messages, screen-reader names; headline numbers unchanged; about 160 community PRs of 2026-10-15/16: PDF import crash fixes, Dimension tool, legacy `.ai` save, Intertwine, web pen input, Image Trace fixes, `.ai`/EPS/PDF import fidelity, Bulgarian, Greek, Swedish and Finnish catalogs; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
 
 VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adobe Illustrator workflow. It runs
 on macOS, Windows, Linux, FreeBSD and the web (WASM), and agents can drive all of it over MCP, the CLI and a JSON
@@ -112,8 +112,8 @@ Weights, evidence and the missing items per area: [target-app-parity.md](docs/ta
 | Korean | `ko` | full | 100% |
 | Vietnamese | `vi` | full | 100% |
 
-Also shipped: Traditional Chinese (partial, 80%), Bulgarian, Finnish, Greek, Hungarian, Italian, Polish, Russian, Swedish and Ukrainian (full), Czech (catalog complete; render-site gaps reduced; native review pending).
-No catalog has had a native speaker's review. Details: [localization-parity.md](docs/localization-parity.md).
+Also shipped: Traditional Chinese (partial, 80%), Bulgarian, Finnish, Greek, Hungarian, Italian, Polish, Russian, Swedish, Ukrainian and Georgian (full), Czech (catalog complete; render-site gaps reduced; native review pending).
+The Georgian catalog has had a native speaker's review; no other catalog has. Details: [localization-parity.md](docs/localization-parity.md).
 
 ## Upcoming
 
@@ -134,7 +134,9 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap
 
 | Date | What landed |
 |---|---|
-| 2026-10-18 | About 40 community PRs landed in one batch through the full gate, with our fixes on top. New: Word `.docx` files place as area type with their formatting (#2766), CCITT Group 3 TIFF files open (#2770), Paragraph panel menu › Roman Hanging Punctuation (#2775), the Anchor Point tool edits blend spine points and handles (#2643, fixes #2544), shadows and glows each draw from the art with the effects before them, without the old exponential cost (#2395), one to ten coloured lights in 3D effects (#2706), Artboard Options X and Y with a reference point (#2739), more Contextual Task Bar actions (#2471), Optical Margin Alignment for a whole thread (#2773), History panel Step Backward/Forward and Set History Limit (#2764), Edit › Undo and Redo name the step as the History panel does (#2774), bounding-box handles snap to the grid, pixels and guides (#2715), Ctrl/Cmd+A in the Artboards panel (#2761), Tabs panel menu items (#2742), Import Data Sets defines variables from header cells (#2736), a Linux option to use X11 when a pen is attached (#2717). Fidelity and robustness: variable fonts named by their default weight and fallback glyphs keep bold and italic (#2733, #2732), legacy `.ai` layer names in Windows Latin-1 (#2722), WMF window mapping (#2721), Magic Wand inside isolation (#2720), type values out of range in files are clamped (#2728, #2757), raster effects stay responsive in drags (#2745), exports and Save for Web report undecodable images (#2762, #2737, #2684), Windows-safe exported file names (#2738), a marquee skips a Shaper Group's originals (#2772). Languages: the Dutch catalog completed (#2730). Headline numbers unchanged (estimated). |
+| 2026-10-18 | Exported and saved files can repeat their bytes: PNG, PDF, EPS, legacy `.ai`, packaged zips and `.vectorcraft` saves recorded the wall-clock time they were made in, so the same commands run twice gave different bytes though the pixels matched. `SOURCE_DATE_EPOCH` now stands in for the clock in everything a file records, as the reproducible-builds specification defines it; a date a command is given still wins, and a malformed value is ignored rather than refusing the export. The recovery heartbeat and the seed PDF encryption draws on keep the real clock (#2880). Headline numbers unchanged. |
+| 2026-10-18 | About 85 community PRs landed in two batches through the full gate, with our fixes on top. New: Word `.docx` files place as area type with their formatting (#2766), CCITT Group 3 TIFF files open (#2770), Paragraph panel menu › Roman Hanging Punctuation (#2775), the Anchor Point tool edits blend spine points and handles (#2643, fixes #2544), shadows and glows each draw from the art with the effects before them, without the old exponential cost (#2395), one to ten coloured lights in 3D effects (#2706), Artboard Options X and Y with a reference point (#2739), more Contextual Task Bar actions (#2471), Optical Margin Alignment for a whole thread (#2773), History panel Step Backward/Forward and Set History Limit (#2764), Edit › Undo and Redo name the step as the History panel does (#2774), bounding-box handles snap to the grid, pixels and guides (#2715), Ctrl/Cmd+A in the Artboards panel (#2761), Tabs panel menu items (#2742), Import Data Sets defines variables from header cells (#2736), a Linux option to use X11 when a pen is attached (#2717). Fidelity and robustness: variable fonts named by their default weight and fallback glyphs keep bold and italic (#2733, #2732), legacy `.ai` layer names in Windows Latin-1 (#2722), WMF window mapping (#2721), Magic Wand inside isolation (#2720), type values out of range in files are clamped (#2728, #2757), raster effects stay responsive in drags (#2745), exports and Save for Web report undecodable images (#2762, #2737, #2684), Windows-safe exported file names (#2738), a marquee skips a Shaper Group's originals (#2772). Second batch: an export progress dialog with Cancel on the shared cancel token (#2564), CMYK gradient meshes drawn several times faster within a 16 MB cap (#2802), Paragraph panel menu › Justification… with file values clamped (#2771), Edit › Clear History (#2843), SVG image links keep their spelling (#2837, fixes main's Windows test failures), the Linux save dialog through the XDG portal (#2783), RGB input stored as CMYK in CMYK documents (#2812), legacy `.ai` export of images and radial highlights (#2801, #2807), `.ai` import notes for damaged editing data, page sizes and variable libraries (#2799, #2800, #2842), PDF and `.ai` keep their creation date (#2838), undecodable images left out of PDF exports with a note (#2790), MCP input waits for queue room (#2776), slice, snapping, selection, type and accessibility fixes (#2794–#2797, #2805, #2806, #2809, #2815, #2844–#2846), dropdowns close after a keyboard pick (#2824), plug-in dialogs scroll (#2840). Languages: the Dutch catalog completed (#2730). Headline numbers unchanged (estimated). |
+| 2026-10-17 | Background Export shows a progress dialog: the file being exported, the artboard count and a bar, Cancel (Esc) and Continue in Background. It runs on the shared cancel token of #2546, so a cancelled export writes no file and keeps no half-drawn pattern tile or effect raster; translated in every language with complete menus (#2564). Headline numbers unchanged. |
 | 2026-10-17 | About 145 community PRs landed in six batches, each through the full gate, plus our fixes on top. Crashes and hostile input: an image's RGBA size is checked from its header before decoding, without overflowing, in the renderer, sampling, recoloring and Crop Image (#2442, #2468, #2407), PDF Add Around and huge art are clamped (#2440), graph axis labels past i64, `+` in hex colours and XML ids are handled (#2610, #2470, #2447), Document Raster Effects resolutions open in range (#2579), Batch names stay in their folder (#2504). Regressions: floating panel groups are opaque again while the docked card keeps its rounded corners (#2499), the Wayland pointer returns over panels (#2502). New: MCP cancels long exports, answers while one runs and reports progress (#2546), `doc_inspect` takes ids, kind and paging (#2543), raster export of a page rectangle (#2511), `text.create` returns bounds (#2478), PDF presets and ICC profiles persist (#2547), screen-reader names for widgets (#2611), Expand on Intertwine (#2622, fixes #2540), Duplicate/Copy/Cut of several artboards (#2567), print presets by name (#2607), TSV data sets (#2608), planar TIFF (#2598), Alt-click a swatch onto a gradient stop (#2623), Shift-click ranges in Links, Graphic Styles and Libraries (#2612, #2613, #2618), Space+Shift rotates the view (#2601), Presentation Mode keys (#2583), Small Caps and super/subscript buttons (#2508). Fidelity: editable vector art from Illustrator EPS (#2571), `.ai` Drop Shadow Darkness (#2513), overprint preview with Darken (#2514), Generic CMYK black round-trips (#2503), PNG sRGB chunk (#2519), kerning at a caret (#2518), tab widths in justified area type (#2487), Transform copies keep their own gradients (#2486), smooth Zig Zag (#2475), Live Corners round up to their neighbours (#2484), kerning across style runs (#2554), SVG letter spacing on justified lines (#2574), Dimension tool snapping (#2482), gradient chips (#2495), Transform panel flips and percentages (#2400, #2404). Later the same day: PostScript `.ps` and `.epsf` files open (#2461), EPS images with CCITTFax compression draw (#2445), Illustrator 3 EPS without layers (#2436), `.ai` type opacity and blend modes (#2420), envelope meshes and compound holes in `.ai` (#2410, #2444), CMYK image soft masks in PDF export (#2448), Show Transparency Grid saved with the document (#2488), Save Selection in the Layers panel menu (#2483), Character and Paragraph Reset Panel (#2479, #2438), Cmd/Ctrl+Shift double-click releases a guide (#2467), Shift+Enter keeps a field active (#2431), Shift keeps reshaped handles perpendicular (#2425), emptied type keeps its style (#2464), Smart Blur radius (#2443), freeform gradients recolour (#2397), mesh slivers (#2456), Recolor wheel handles in CMYK (#2454), and six Image Trace fixes (#2387, #2584, #2586–#2589). Fifth batch: Optical Margin Alignment (#2563), Window › Blend panel (#2573), graph column designs (#2406), Live Paint Gap Options (#2424), the SVG Interactivity panel (#2437), RTF placed as area type (#2524), the Touch Type tool (#2469), pattern fills expand into clipped tiles (#2616), Save and Export ask before replacing a file an added extension names (#2619), the Artboard tool's Control bar and Contextual Task Bar (#2559, #2556), Alt-click New Artboard for its options (#2496), Shift-click in Brushes (#2562), the Move dialog remembers the last move (#2542), PDF export uses the document's assigned profiles (#2536), Printer Setup opens the selected printer's preferences on Windows (#2577). Sixth batch: Effect › Artistic › Cutout, Neon Glow and Poster Edges (#2453), View › Rulers › Change to Global / Artboard Rulers (#2416), Symbol Options 9-slice guides (#2512), Create Gradient Mesh on an embedded image (#2538), Rotate View cursors and the Mac trackpad rotation gesture (#2594, #2644), choice parameters as dropdowns in the inline effect editor (#2582), Group Selection picks and moves one path of a compound path (part of #2441), Shift-click ranges in the Artboards panel (#2626), Lock Variables (#2631), a layer dropped under the last row goes to the bottom (#2632), and robustness work: huge selections draw bounded overlays (#2635, #2645, part of #2460), values out of range in presets and files are clamped (#2656), whole-number checks for counts (#2638, #2659), exports warn about overset type (#2628), symbol instances measured by their art (#2614), colour-managed Eyedropper in CMYK documents (#2664). Later: Effect › Rasterize (#2409), variable-font axis sliders in the Character panel (#2710), Image Trace Create Strokes on an exact distance transform with Guo–Hall thinning and a skeleton graph (#2703–#2705), Auto Color keeps rare colours (#2702), large images trace with a warning (#2700), a 1e9 pt input bound on Reshape Segment, Convert Anchor Point and the Pencil (#2709), task-bar Connect, Corner and Smooth for selected anchors (#2697), PDF 0 w strokes import as hairlines (#2696), threading text from theLine truncated
 | 2026-10-16 | Symbol Options › Export Type (Graphic or Movie Clip, default Movie Clip) with Registration; `symbol.options` / `symbol.list` (G5).
 | 2026-10-15 | Cursors: 36 more tool states get cursors of their own. Node editing follows the public manual (Direct Selection's anchor squares, Reshape Segment, Group Selection's plus, the arrow hollow on a snap, the Alt-copy arrowheads), the Anchor Point caret, the Curvature pen and Free Transform's side-shear arrows are drawn; Lasso, the freehand, symbolism and other tools borrow a drawn cursor until theirs is drawn. `crates/tools/src/cursors.toml` lists every cursor for whoever draws them, and `cargo xtask cursors` warns about one missing from it. Scores unchanged. |
@@ -163,6 +165,7 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap
 | 2026-10-12 | A `.ai` file with placed (linked) pictures opens from its editing data, with its guides, sublayers and hidden objects: each picture is a linked image in its place, showing the low-resolution preview the file keeps until its file is found or relinked (#1264). Scores unchanged. |
 | 2026-10-12 | Desktop printing adopts the shared `craft-print` spooler with exact physical sheet sizes. Windows 7 retains its WMI/viewer transport and excludes the shared backend; compatibility CI checks the dependency tree and PE imports. Scores unchanged. |
 | 2026-10-12 | Graphs: Object › Graph › Design… and Marker… (designs with a preview, New Design, Rename, Delete Design, Paste Design, Select Unused, and markers drawn with a design or None) (#1092); Graph Data opens as a worksheet with Import Data…, column width and decimals (#1138), and takes Transpose, Switch x/y, `|` line breaks in labels and the pie Legend, Position and Sort options (#1115); Graph Type adds Add Drop Shadow and Add Legend Across Top (#1119), widths past 100%, First Row and First Column in Front, and Draw Filled Lines (#1136); graphs keep their label formatting when drawn again (#1137). Align: a Horizontal & Vertical Align Center button (#1073); Align to Key Object makes the topmost selected object the key (#1221), and the palette's key entry reads Cancel Key Object (#1224). Pen: the nearest end wins over snapping, Alt on the last anchor edits it, and Enter, Escape or a tool switch finish a handle preview as one undo step (#821). Direct Selection: a click on an anchor of an already selected path selects that anchor alone (#1237). Make Compound Path keeps the backmost object's paint, and a selected member reads and changes the compound's fill rule (#1225). Shape Builder and Live Paint no longer turn a line's loose end past a crossing into a piece that runs out and back (#1230). Art moved or duplicated with an artboard follows Transform Pattern Tiles (#1219). A click with the Rectangular Grid tool opens its options dialog (#1169). Commands that change nothing (Lock, Hide, Transform Each, Rearrange Artboards and others) add no undo step (#1233). Saving with missing placed files keeps their relink data, and .ai export honours the chosen artboards (#718). SVG export keeps Unicode data-attribute names, and SVG Options refuses an invalid artboard range (#989). CMYK colours given in percent with a component under 1 keep their scale (#1249). Colour Image Trace keeps close dark tones apart (#1247). macOS: the Save sheet has a Format menu (#1235). The Hand and Zoom tools show drawn cursors on every platform (#1238). Czech: the remaining strings are translated, and Pathfinder's Add reads "Sjednotit" (#1226). MCP: a lost reply reports that the edit may have happened instead of replaying it (#1246); `select.key` checks its id and agents can read the key object (#1222). Tests: the command sweeps and import fuzz tests fail on a panic caught by the engine's guard (#1218), and the envelope export test ignores PDF dates and file IDs (#1220). Effect › Artistic › Film Grain (Grain, Highlight Area, Intensity; Photoshop-style filters 29/57) (#1282), and Craquelure, Mosaic Tiles and Stained Glass redraw 25–30% faster with identical pixels (#1265). Direct Selection: clicking a segment selects only that segment, and Delete removes just it (#1300); Shift-click deselects one anchor of a path selected whole (#1263). Pen + Alt converts anchors of paths inside a selected group or compound path (#1306). The Curvature tool shows circular point markers without direction handles (#1284). Snap to Point: pressing near an anchor drags by that anchor, with Smart Guides on or off (#1313). Transform Again repeats the options of the transform it repeats (#1303). Aligning anchors that are already aligned adds no undo step (#1276), and type commands that change nothing record none either (#1316). Simplify keeps the path selected with its new anchors, and its dialog previews and shows the anchor count (#1305). Adding a stroke colour to an unpainted zero-width stroke gives it a visible 1 pt width (#1256). The Eyedropper samples locked objects, template layers and art outside isolation mode (#1260), and shows a pipette cursor (#1288). Fonts named by their full name resolve to the right face (#1267), and Proportional Metrics brings the matching kerning (`apkn`, `vkrn`, `vapk`) (#1291). Artboards: Escape leaves Artboard editing (#1296), Document Setup's Edit Artboards switches to the Artboard tool (#1294), and the Artboard tool starts on the active artboard (#1309). New and imported documents use the Gridline every and Subdivisions preferences (#1314). Send to Current Layer refuses a hidden or locked current layer (#1301), and layer row commands check explicit ids (#1255). Links: Find in Folder… finds missing linked files in a folder and its subfolders and can copy them into the document's folder (#1287). Image Trace traces images over 64 megapixels scaled down instead of refusing them (#1315). DXF export marks closed curves as closed SPLINE entities (#1320). EPS import: closepath respects the path size limit (#1311). The interface is available in Hungarian (#1302), and more Czech labels are translated (#1259). Linux RPMs declare shared-library capabilities (#1290). CI pins every third-party action to a verified commit (#1321). Select menu commands skip hidden and locked art and stay inside the isolated group in isolation mode (#1325). Fill, stroke, gradient and Appearance panel commands that change nothing add no undLine truncated
+| 2026-10-12 | Georgian interface (`ka`, ქართული): the whole catalog, plurals and messages, tested complete; Georgian letters come from an installed font (SF Georgian, Sylfaen, Noto Sans Georgian, DejaVu Sans) from the first frame; Type › Change Case › Title Case and Sentence case leave Georgian lower case instead of turning it into Mtavruli. |
 | 2026-10-11 | Effect › Brush Strokes: Accented Edges, Angled Strokes, Crosshatch, Dark Strokes, Ink Outlines, Spatter, Sprayed Strokes, Sumi-e (G2). Command parameters from agents and files checked before anything changes (paint, place, cuts, dashes, crop, asset ids, anchors, paths, distort; #984–#999); command dialogs keep whole numbers whole, so Create Object Mosaic takes the tiles typed (#1000); stepper arrows take Shift (×10) and Ctrl/Cmd (÷10) like the arrow keys (#991). Exports and Rasterize supersample Art Optimized edges, so shapes meeting edge to edge leave no seam (#983). Character and paragraph styles take leading, kerning, mojikumi and the other attributes left out at their defaults (#1001). Drawing, typing and pasting with no layer shown and unlocked is refused instead of adding art to a hidden or locked layer (#1002). MCP `add_text` gives type on or in a path the colour asked for (#1003). MCP `screenshot` of a connected app renders the artboard asked for (#1004). `vectorcraft-cli run` ends quietly when its reader closes early (#1005). Select › All on Active Artboard selects on the artboard made active, not always the first (#1006). Reverse Gradient keeps off-centre midpoints, mirrored (#1007). A polar grid with no radial dividers draws none (#1008). Use Precise Cursors also covers the Pen's join pointer (#1009). SVGs with one absolute and one unitless root side import at their size, unstretched (#1010). DXF US survey inches, yards and miles open at their size and name (#1011). A file placed into a document with no other links follows its first change even while the app sits idle (#1031). PDF import keeps the style a font name says when the file doesn't embed the font (#1023). Shift selects ruler guides and art together, and Delete removes both (#1022). Open filled paths are hit by their fill on every side, the rotate cursor bows around the corner it is at, the flip icons match their flips, the Color Picker previews on the selection, and Properties › Transform reaches Scale Corners and Scale Strokes & Effects (#1036). Offset Path and the other booleans finish on outlines where the sweep used to loop until memory ran out (linesweeper 0.5, #1028). Floating panel groups stack into sets that move together, collapse to their tabs and dock as extra dock columns that scroll (#1020). Ruler guides live on layers: listed in the Layers panel, shown, hidden, locked, duplicated, merged and deleted with their layer, and moved between layers (#1021). A `.ai` whose editing data uses global process colours (`Xk`/`XK`) or pattern fills keeps its sublayers: the colours come in as global swatches at their tint, the patterns as pattern swatches (#1025). A `.ai` in PostScript form opens through its layers, read from the program itself, also when it names the prolog defining its operators without including it, as Rhino and other CAD apps write it (#1027). A fill or stroke chosen while the Type tool has characters selected colours just those characters (#1063). Scaled type shows its scaled font size, leading, baseline shift and horizontal scale in the Character panel, and a size typed there is the size you get (#1034). Character panel menu › Proportional Metrics sets Japanese and Chinese full-width glyphs on the font's proportional widths in horizontal type (#966). Align, Distribute, Move, Arrange, Lock, Hide, Ungroup and other Object commands that would change nothing no longer record an undo step or mark the document changed (#1060). Spot colours defined in Lab open with their Lab values from `.ai` and PDF files, instead of as wrong RGB colours or their CMYK equivalents (#1032). Build scripts leave a generated source they wouldn't change untouched, so the next build doesn't compile most of the workspace again where file times lose their sub-second part (#1051). A fill colour recolours the gradient mesh point last clicked with the Mesh tool or Direct Selection, and a Mesh tool click on a mesh's point selects that mesh (#1052). The All Tools drawer stays two tools wide instead of filling a wide window (#1054). Text Wrap's Make, Release and Options refuse a list of object ids with a malformed or unknown id instead of skipping it (#1055). A freeform gradient line with a malformed point index is refused instead of being shortened to the indices that are valid (#1056). The Corners dialog (`ui.corners`) refuses a malformed object id or a listed anchor that isn't a corner instead of editing the selection or the other corners (#1057). New View refuses a centre that isn't exactly [x, y] and a rotation that isn't a number, instead of trimming the one and saving the other as 0° (#1058). The command sweeps try junk scale, spacing and artboard values too, which they had skipped since before those bugs were fixed (#1059). EPS and PostScript `arc` and `arcn` with huge angles no longer hang the import, and an arc whose angles are whole turns apart is empty, as the PostScript reference defines it (#1062). Align and DisLine truncated
 | 2026-10-10 | Initial live Revolve (Effect › 3D and Materials, #846, #605), in its own `three-d` crate. Progress docs re-measured and restructured to the craftrules standard (this page, `docs/target-app-parity.md`, `gaps.md`, `ui-parity.md`, the format, hardware, localization, effects and type checklists). Same day: v0.8.0; Effect › Distort, Pixelate and Texture filters (13); German interface; Variables (data merge); Graph Type value axes and tick marks; restart when the first frame never reaches the screen (#964) |
 | 2026-10-09 | Radial Blur, Smart Blur, Unsharp Mask (gap 2 begins); 340 commits, the busiest day |
@@ -183,6 +186,7 @@ The full pre-standard record of what landed is kept in [docs/roadmap.md](docs/ro
 | 2026-10-17 | minor | Colored Inflate: shared membrane normals and smooth RGB vector ramps replace flat polygon bands; channel groups are batched per solid-fill surface. White-light Inflate retains its original polygons, paint composition and seam joins; the 0.05 seam minimum is restored. Scores and hour estimates unchanged. |
 | 2026-10-16 | minor | 3D lighting: one to ten directional lights, a selectable light list, Add Light and Delete Light, independent settings and artboard gestures; ambient applied once and smooth RGB vector export; scores and hour estimates unchanged |
 | 2026-10-16 | minor | 3D lighting: opaque RGB Color for the shared directional light, with neutral ambient, preview/reset controls and smooth vector Revolve shading; scores and hour estimates unchanged |
+| 2026-10-17 | minor | Progress log row for the Background Export progress dialog (#2564); headline numbers unchanged. |
 | 2026-10-14 | minor | G11: open-path anchor Delete removes adjoining segments without bridging the gap; explicit Remove Anchors keeps its reconnect/refit behavior. Scores and hours unchanged. |
 | 2026-10-14 | minor | Document fonts register every explicitly supplied craft-fonts family after the existing Japanese, Arabic and Thai prefix; optional empty input remains supported. Headline scores and estimates are unchanged. |
 | 2026-10-14 | minor | Progress log rows for the later merges of 2026-10-14 (#1630–#1875 as listed there); headline numbers unchanged. |

apps/vectorcraft-cli/src/main.rs

@@ -78,16 +78,20 @@ USAGE:
 
   vectorcraft-cli run [--in FILE] [--cmd ID [--params JSON]]... [--export FILE]... [--scale N]
       Headless batch: open FILE (any readable format) or start a new document, run commands in
-      order, export each FILE in the format its extension picks (see Writable formats). Prints one
-      JSON result per step.
+      order, export each FILE in the format its extension picks (see Writable formats; a .ait FILE
+      is a template, written as file.saveAsTemplate writes it). --scale sizes raster exports
+      (pixels per point, default 1); other formats leave it out. Prints one JSON result per step.
 
   vectorcraft-cli commands
       Print the command catalogue as JSON.
 
   vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text] [--decimals N] [--replace-lossy] [--editing-data] [--ai-version 7|pdf] [--hidden-objects layer|omit|visible] [--transparent-images flatten|omit]
       Open IN (any readable format) and export OUT in the format its extension picks (see Writable
-      formats). --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
+      formats). --scale sizes a raster OUT (pixels per point, default 1); other formats leave it
+      out. --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
       unless one of them is given, EPS the bounds of the art, the other formats the first artboard.
+      A .ait OUT is a template of every artboard, written as file.saveAsTemplate writes it (not with
+      --artboard or --range).
       Live effects are kept, and hidden layers and objects (written hidden in SVG and PSD), with
       SVG's data-* attributes; --outline-text writes SVG text as paths, --decimals sets SVG's coordinate
       precision (1–7, default 3). OUT may not be IN when reading
@@ -259,6 +263,10 @@ fn convert(args: &[String]) -> Result<(), String> {
         }
     }
     let [input, output] = <[String; 2]>::try_from(files).map_err(|_| "convert needs IN and OUT")?;
+    let template = is_template(&output);
+    if template && (artboard.is_some() || range.is_some()) {
+        return Err("a .ait template holds every artboard: --artboard and --range don't apply".into());
+    }
     let mut h = Headless::new();
     let opened = if editing_data {
         let params = json!({"path": input, "editingData": "always"});
@@ -266,16 +274,23 @@ fn convert(args: &[String]) -> Result<(), String> {
     } else {
         h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?
     };
-    // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
-    // PSD).
-    let mut params = json!({"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
-    if let Some(decimals) = decimals {
-        params["decimals"] = json!(decimals);
-    }
+    let (command, mut params) = if template {
+        // Save as Template writes every artboard, with the .ai options.
+        ("file.saveAsTemplate", json!({"path": output, "format": "ait", "outlineText": outline_text, "acknowledgeLoss": replace_lossy}))
+    } else {
+        // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
+        // PSD).
+        let params = json!({"path": output, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
+        let mut params = with_pixel_scale(params, &output, scale);
+        if let Some(decimals) = decimals {
+            params["decimals"] = json!(decimals);
+        }
+        ("document.export", params)
+    };
     for (key, value) in legacy {
         params[key] = json!(value);
     }
-    let mut r = h.call("engine.execute", json!({"command": "document.export", "params": params})).map_err(|e| format!("export {output}: {e}"))?;
+    let mut r = h.call("engine.execute", json!({"command": command, "params": params})).map_err(|e| format!("export {output}: {e}"))?;
     // What reading the input left out (a missing linked file, an unsupported filter…) matters as
     // much as what writing the output did.
     if let (Some(w), Some(out)) = (opened.get("warnings").filter(|w| w.as_array().is_some_and(|a| !a.is_empty())), r.as_object_mut()) {
@@ -285,6 +300,21 @@ fn convert(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
+/// Is `path` a `.ait` template? `file.saveAsTemplate` writes it; exports don't.
+fn is_template(path: &str) -> bool {
+    vectorcraft_engine::cmd::fileio::format_for_name(path).is_some_and(|f| f.id == "ait")
+}
+
+/// The export `params` for `path`, with `--scale` (pixels per point) when its format is raster.
+/// DXF has a `scale` of its own (drawing units per unit), which would resize the drawing and leave
+/// its units unset.
+fn with_pixel_scale(mut params: Value, path: &str, scale: f64) -> Value {
+    if vectorcraft_engine::cmd::fileio::writable_format(None, Some(path)).is_ok_and(|f| f.raster) {
+        params["scale"] = json!(scale);
+    }
+    params
+}
+
 fn info(args: &[String]) -> Result<(), String> {
     let file = args.first().ok_or("info needs a FILE")?;
     let mut h = Headless::new();
@@ -371,7 +401,12 @@ fn run(args: &[String]) -> Result<(), String> {
                 r
             }
             Step::Export(path) => {
-                let r = h.call("app.export", json!({"path": path, "scale": scale})).map_err(|e| format!("export {path}: {e}"))?;
+                let r = if is_template(&path) {
+                    h.call("engine.execute", json!({"command": "file.saveAsTemplate", "params": {"path": path, "format": "ait"}}))
+                } else {
+                    h.call("app.export", with_pixel_scale(json!({"path": path}), &path, scale))
+                };
+                let r = r.map_err(|e| format!("export {path}: {e}"))?;
                 emit(json!({"step": "export", "result": r}))?;
                 r
             }

apps/vectorcraft-cli/tests/cli.rs

@@ -58,6 +58,28 @@ fn run_batch_exports() {
     assert_eq!(last["result"]["artboards"][0]["width"], 200.0);
 }
 
+#[test]
+fn scale_sizes_raster_exports_only() {
+    // --scale is pixels per point. DXF has a `scale` of its own (drawing units per mm) that would
+    // resize the drawing and leave its units unset.
+    let svg = tmp("scale.svg");
+    std::fs::write(&svg, r#"<svg xmlns="http://www.w3.org/2000/svg" width="100" height="50"><rect x="10" y="10" width="30" height="20"/></svg>"#)
+        .unwrap();
+    let svg = svg.to_str().unwrap();
+    let (plain, scaled, png) = (tmp("plain.dxf"), tmp("scaled.dxf"), tmp("scaled.png"));
+    let ok = |args: &[&str]| {
+        let out = Command::new(BIN).args(args).output().unwrap();
+        assert!(out.status.success(), "{args:?}: {}", String::from_utf8_lossy(&out.stderr));
+    };
+    ok(&["convert", svg, plain.to_str().unwrap()]);
+    ok(&["convert", svg, scaled.to_str().unwrap(), "--scale", "2"]);
+    assert!(std::fs::read(&scaled).unwrap() == std::fs::read(&plain).unwrap(), "convert --scale 2 changed the DXF");
+    ok(&["run", "--in", svg, "--export", scaled.to_str().unwrap(), "--export", png.to_str().unwrap(), "--scale", "2"]);
+    assert!(std::fs::read(&scaled).unwrap() == std::fs::read(&plain).unwrap(), "run --scale 2 changed the DXF");
+    // 100 pt at scale 2 → 200 px (IHDR width).
+    assert_eq!(std::fs::read(&png).unwrap()[16..20], 200u32.to_be_bytes());
+}
+
 #[test]
 fn run_reports_errors() {
     let out = Command::new(BIN).args(["run", "--cmd", "nope.nothing"]).output().unwrap();

apps/vectorcraft-cli/tests/fileio.rs

@@ -179,3 +179,28 @@ fn convert_writes_legacy_ai_with_its_options() {
     assert!(!bad.status.success());
     assert!(String::from_utf8_lossy(&bad.stderr).contains("hiddenObjects"), "{}", String::from_utf8_lossy(&bad.stderr));
 }
+
+/// convert and `run --export` write a `.ait` as Save as Template does: a PDF-compatible template of
+/// every artboard that opens as a new untitled document.
+#[test]
+fn convert_and_run_write_ait_templates() {
+    let pdf = tmp("template-in.pdf");
+    make(&pdf, 120, 80);
+    let (converted, exported) = (tmp("converted.ait"), tmp("exported.ait"));
+    let r: Value = serde_json::from_str(&ok(&["convert", &pdf, &converted])).unwrap();
+    assert_eq!((&r["format"], &r["path"]), (&Value::from("ait"), &Value::from(converted.as_str())), "{r}");
+    let r: Value = serde_json::from_str(ok(&["run", "--in", &pdf, "--export", &exported]).lines().nth(1).unwrap()).unwrap();
+    assert_eq!(r["result"]["format"], "ait", "{r}");
+    for ait in [&converted, &exported] {
+        assert!(std::fs::read(ait).unwrap().starts_with(b"%PDF"), "{ait}");
+        let opened: Value = serde_json::from_str(ok(&["run", "--in", ait]).lines().next().unwrap()).unwrap();
+        let opened = &opened["result"];
+        assert_eq!((&opened["format"], &opened["restored"]), (&Value::from("ait"), &Value::from(true)), "{opened}");
+        assert!(opened["title"].as_str().is_some_and(|t| t.starts_with("Untitled-")), "{opened}");
+        assert_eq!(info(ait)["artboards"].as_array().unwrap().len(), 2, "{ait}");
+    }
+    // A template holds every artboard: one can't be picked.
+    let one = Command::new(BIN).args(["convert", &pdf, &tmp("one.ait"), "--artboard", "0"]).output().unwrap();
+    assert!(!one.status.success());
+    assert!(String::from_utf8_lossy(&one.stderr).contains("every artboard"), "{}", String::from_utf8_lossy(&one.stderr));
+}

apps/vectorcraft-web/Cargo.toml

@@ -26,6 +26,7 @@ log = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
 rfd = { workspace = true }
 wasm-bindgen = "0.2"
+serde_json = { workspace = true }
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
 web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "PointerEvent", "TouchEvent", "AddEventListenerOptions", "DomRect", "DragEvent", "Storage", "Navigator", "RequestInit", "Response", "AbortController", "AbortSignal"] }

apps/vectorcraft-web/src/api.rs

@@ -0,0 +1,184 @@
+//! `window.vectorcraft`: the control channel for the page, as promises.
+//!
+//! The same JSON methods as the desktop control server (`docs/control-protocol.md`), so an agent
+//! driving VectorCraft in a browser tab (or an `<iframe>` in another app) uses the same commands as
+//! the CLI and the MCP server:
+//!
+//! ```js
+//! await vectorcraft.execute("object.rectangle", {x: 0, y: 0, width: 100, height: 50})  // engine command → its result
+//! await vectorcraft.request("ui.inspect")                      // control method → its result
+//! await vectorcraft.commands()                                 // command list
+//! const {base64} = await vectorcraft.screenshot()              // the canvas as PNG (base64)
+//! await vectorcraft.openFile("logo.svg", bytes)               // opened as a dropped file is
+//! vectorcraft.captureDownloads(true)                           // saves stay in the page…
+//! vectorcraft.files(); await vectorcraft.readFile("logo.png")  // …to be read back
+//! ```
+//!
+//! Results resolve with the method's `result`; errors reject with an `Error`.
+
+use std::cell::{Cell, RefCell};
+use std::sync::mpsc::{Receiver, Sender, TryRecvError};
+
+use serde_json::{Value, json};
+use vectorcraft_ui_egui::ControlRequest;
+use wasm_bindgen::prelude::*;
+
+use crate::saved_files::SavedFiles;
+
+use crate::web::Inbox;
+
+type Waiting = (Receiver<Value>, js_sys::Function, js_sys::Function);
+
+thread_local! {
+    static TX: RefCell<Option<Sender<ControlRequest>>> = const { RefCell::new(None) };
+    static WAITING: RefCell<Vec<Waiting>> = const { RefCell::new(Vec::new()) };
+    static CTX: RefCell<Option<egui::Context>> = const { RefCell::new(None) };
+    static INBOX: RefCell<Option<Inbox>> = const { RefCell::new(None) };
+    static CAPTURE: Cell<bool> = const { Cell::new(false) };
+    static SAVED: RefCell<SavedFiles> = RefCell::new(SavedFiles::default());
+}
+
+/// Wire the page's requests to the app: control requests go to `tx`, opened files to `inbox`.
+/// After a graphics restart the app keeps its channel: `tx` is `None` and only the context changes.
+pub fn connect(tx: Option<Sender<ControlRequest>>, inbox: Inbox, ctx: egui::Context) {
+    if let Some(tx) = tx {
+        TX.with(|t| *t.borrow_mut() = Some(tx));
+    }
+    INBOX.with(|i| *i.borrow_mut() = Some(inbox));
+    CTX.with(|c| *c.borrow_mut() = Some(ctx));
+}
+
+fn repaint() {
+    CTX.with(|c| {
+        if let Some(ctx) = c.borrow().as_ref() {
+            ctx.request_repaint();
+        }
+    });
+}
+
+/// Keep a save instead of downloading it, when the page asked for that. True when kept.
+pub fn capture(path: &str, bytes: &[u8]) -> bool {
+    if !CAPTURE.with(Cell::get) {
+        return false;
+    }
+    SAVED.with(|s| s.borrow_mut().keep(path, bytes));
+    true
+}
+
+fn to_js(v: &Value) -> JsValue {
+    js_sys::JSON::parse(&v.to_string()).unwrap_or(JsValue::NULL)
+}
+
+fn from_js(v: &JsValue) -> Value {
+    if v.is_undefined() || v.is_null() {
+        return json!({});
+    }
+    js_sys::JSON::stringify(v).ok().and_then(|s| s.as_string()).and_then(|s| serde_json::from_str(&s).ok()).unwrap_or(json!({}))
+}
+
+/// Settle the promises of answered requests (called every frame).
+pub fn poll_replies() {
+    WAITING.with(|w| {
+        w.borrow_mut().retain(|(rx, resolve, reject)| match rx.try_recv() {
+            Ok(v) => {
+                if v.get("ok").and_then(Value::as_bool) == Some(true) {
+                    let _ = resolve.call1(&JsValue::NULL, &to_js(v.get("result").unwrap_or(&Value::Null)));
+                } else {
+                    let msg = v.get("error").and_then(Value::as_str).unwrap_or("error").to_string();
+                    let _ = reject.call1(&JsValue::NULL, &js_sys::Error::new(&msg));
+                }
+                false
+            }
+            Err(TryRecvError::Empty) => true,
+            Err(TryRecvError::Disconnected) => {
+                let _ = reject.call1(&JsValue::NULL, &js_sys::Error::new("request dropped"));
+                false
+            }
+        });
+    });
+}
+
+fn request(method: &str, params: Value) -> js_sys::Promise {
+    let method = method.to_string();
+    let p = js_sys::Promise::new(&mut |resolve, reject| {
+        let (req, rx) = ControlRequest::new(method.clone(), params.clone());
+        let sent = TX.with(|t| t.borrow().as_ref().is_some_and(|tx| tx.send(req).is_ok()));
+        if sent {
+            WAITING.with(|w| w.borrow_mut().push((rx, resolve, reject)));
+        } else {
+            let _ = reject.call1(&JsValue::NULL, &js_sys::Error::new("VectorCraft is not running yet"));
+        }
+    });
+    repaint();
+    p
+}
+
+fn set_fn(obj: &js_sys::Object, name: &str, f: JsValue) -> Result<(), JsValue> {
+    js_sys::Reflect::set(obj, &name.into(), &f).map(|_| ())
+}
+
+/// Install `window.vectorcraft`.
+pub fn install() -> Result<(), JsValue> {
+    let obj = js_sys::Object::new();
+    set_fn(
+        &obj,
+        "request",
+        Closure::<dyn Fn(String, JsValue) -> js_sys::Promise>::new(|method: String, params: JsValue| request(&method, from_js(&params)))
+            .into_js_value(),
+    )?;
+    set_fn(
+        &obj,
+        "execute",
+        Closure::<dyn Fn(String, JsValue) -> js_sys::Promise>::new(|command: String, params: JsValue| {
+            request("engine.execute", json!({"command": command, "params": from_js(&params)}))
+        })
+        .into_js_value(),
+    )?;
+    set_fn(&obj, "commands", Closure::<dyn Fn() -> js_sys::Promise>::new(|| request("engine.commands", json!({}))).into_js_value())?;
+    set_fn(&obj, "inspect", Closure::<dyn Fn() -> js_sys::Promise>::new(|| request("ui.inspect", json!({}))).into_js_value())?;
+    set_fn(
+        &obj,
+        "screenshot",
+        Closure::<dyn Fn(JsValue) -> js_sys::Promise>::new(|params: JsValue| request("ui.screenshot", from_js(&params))).into_js_value(),
+    )?;
+    set_fn(
+        &obj,
+        "openFile",
+        Closure::<dyn Fn(String, js_sys::Uint8Array) -> JsValue>::new(|name: String, bytes: js_sys::Uint8Array| {
+            let queued = INBOX.with(|i| {
+                i.borrow().as_ref().is_some_and(|inbox| {
+                    inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes.to_vec()));
+                    true
+                })
+            });
+            repaint();
+            JsValue::from_bool(queued)
+        })
+        .into_js_value(),
+    )?;
+    set_fn(&obj, "captureDownloads", Closure::<dyn Fn(bool)>::new(|on: bool| CAPTURE.with(|c| c.set(on))).into_js_value())?;
+    set_fn(
+        &obj,
+        "files",
+        Closure::<dyn Fn() -> JsValue>::new(|| {
+            SAVED.with(|s| to_js(&Value::Array(s.borrow().list().map(|(n, size)| json!({"path": n, "size": size})).collect())))
+        })
+        .into_js_value(),
+    )?;
+    set_fn(
+        &obj,
+        "readFile",
+        Closure::<dyn Fn(String) -> Result<JsValue, JsValue>>::new(|name: String| {
+            SAVED.with(|s| {
+                s.borrow()
+                    .get(&name)
+                    .map(|b| js_sys::Uint8Array::from(b).into())
+                    .ok_or_else(|| js_sys::Error::new(&format!("{name}: not found")).into())
+            })
+        })
+        .into_js_value(),
+    )?;
+    let w = web_sys::window().ok_or("no window")?;
+    js_sys::Reflect::set(&w, &"vectorcraft".into(), &obj)?;
+    Ok(())
+}

apps/vectorcraft-web/src/main.rs

@@ -16,12 +16,16 @@
 //! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?lang=es` (any
 //! language code) stands in for the browser's languages when the interface language is Automatic.
 
+#[cfg(target_arch = "wasm32")]
+mod api;
 #[cfg(target_arch = "wasm32")]
 mod fonts;
 #[cfg(target_arch = "wasm32")]
 mod locks;
 #[cfg(any(target_arch = "wasm32", test))]
 mod pencil;
+#[cfg(any(target_arch = "wasm32", test))]
+mod saved_files;
 #[cfg(target_arch = "wasm32")]
 mod web;
 

apps/vectorcraft-web/src/saved_files.rs

@@ -0,0 +1,70 @@
+//! What the page keeps of the app's saves (`api.rs`): `readFile` reads them back.
+
+/// Saved files kept (the oldest go first).
+pub const MAX_SAVED: usize = 16;
+
+/// The last component of a `/` or `\` path.
+fn file_name(path: &str) -> &str {
+    path.rsplit(['/', '\\']).next().filter(|n| !n.is_empty()).unwrap_or(path)
+}
+
+/// Files by name, newest last: saving a name again replaces it.
+#[derive(Default)]
+pub struct SavedFiles(Vec<(String, Vec<u8>)>);
+
+impl SavedFiles {
+    /// Keep `bytes` under the last component of `path`.
+    pub fn keep(&mut self, path: &str, bytes: &[u8]) {
+        let name = file_name(path).to_string();
+        self.0.retain(|(n, _)| *n != name);
+        self.0.push((name, bytes.to_vec()));
+        let extra = self.0.len().saturating_sub(MAX_SAVED);
+        self.0.drain(..extra);
+    }
+
+    /// A kept file by its name, or by a path ending in it.
+    pub fn get(&self, name: &str) -> Option<&[u8]> {
+        let wanted = file_name(name);
+        self.0.iter().find(|(n, _)| n == wanted).map(|(_, b)| b.as_slice())
+    }
+
+    /// `(name, size)` of each kept file, oldest first.
+    pub fn list(&self) -> impl Iterator<Item = (&str, usize)> {
+        self.0.iter().map(|(n, b)| (n.as_str(), b.len()))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn keeps_by_name_replaces_and_reads_back_by_path() {
+        let mut s = SavedFiles::default();
+        s.keep("exports/poster.png", b"one");
+        s.keep(r"C:\out\poster.png", b"two");
+        s.keep("notes.txt", b"three");
+        assert_eq!(s.list().collect::<Vec<_>>(), vec![("poster.png", 3), ("notes.txt", 5)]);
+        assert_eq!(s.get("poster.png"), Some(&b"two"[..]));
+        assert_eq!(s.get("/exports/poster.png"), Some(&b"two"[..]));
+        assert_eq!(s.get("missing.png"), None);
+    }
+
+    #[test]
+    fn drops_the_oldest_past_the_cap() {
+        let mut s = SavedFiles::default();
+        for i in 0..MAX_SAVED + 3 {
+            s.keep(&format!("f{i}.png"), &[0]);
+        }
+        assert_eq!(s.list().count(), MAX_SAVED);
+        assert_eq!(s.get("f0.png"), None);
+        assert!(s.get(&format!("f{}.png", MAX_SAVED + 2)).is_some());
+    }
+
+    #[test]
+    fn a_trailing_separator_keeps_the_whole_name() {
+        let mut s = SavedFiles::default();
+        s.keep("odd/", b"x");
+        assert_eq!(s.get("odd/"), Some(&b"x"[..]));
+    }
+}

apps/vectorcraft-web/src/web.rs

@@ -19,7 +19,7 @@ use wasm_bindgen::JsCast as _;
 use crate::locks::WebLocks;
 use crate::pencil::SharedPointers;
 
-type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
+pub(crate) type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
 
 /// Where the pointer was over the canvas during the last file drag (CSS px from its top-left) and
 /// whether Shift was held: where dropped files land.
@@ -122,9 +122,18 @@ async fn run(host: Host, canvas: web_sys::HtmlCanvasElement, moving: Option<Movi
                         // The old services asked the old context for frames.
                         app.services = services;
                         app.status("The graphics were lost and have been restarted");
+                        crate::api::connect(None, host.inbox.clone(), ctx.clone());
                         app
                     }
-                    None => VectorcraftApp::new(Session::new(), services),
+                    None => {
+                        // `window.vectorcraft`: the page's control channel (crate::api).
+                        let (control_tx, control_rx) = std::sync::mpsc::channel();
+                        crate::api::connect(Some(control_tx), host.inbox.clone(), ctx.clone());
+                        if let Err(e) = crate::api::install() {
+                            log::error!("vectorcraft-web: couldn't install window.vectorcraft: {}", js_err(e));
+                        }
+                        VectorcraftApp::new(Session::new(), services).with_control(control_rx)
+                    }
                 };
                 Ok(Box::new(WebShell { app: Some(app), host, canvas: page, loss }))
             }),
@@ -386,6 +395,7 @@ impl eframe::App for WebShell {
             }
         }
         app.logic(ctx);
+        crate::api::poll_replies();
     }
 
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
@@ -399,6 +409,7 @@ impl eframe::App for WebShell {
         if let Some(app) = &mut self.app {
             app.ui(ui);
         }
+        crate::api::poll_replies();
     }
 }
 
@@ -544,6 +555,9 @@ impl RecoveryStore for BrowserStore {
 
 /// Trigger a browser download of `bytes` named after the last component of `path`.
 fn download(path: &str, bytes: &[u8]) -> Result<(), String> {
+    if crate::api::capture(path, bytes) {
+        return Ok(());
+    }
     let js = |e: wasm_bindgen::JsValue| format!("{e:?}");
     let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "vectorcraft".into());
     let window = web_sys::window().ok_or("no window")?;

apps/vectorcraft/Cargo.toml

@@ -75,7 +75,17 @@ pollster = "1"
 # Asks the Wayland compositor which GPU it draws with (linux-dmabuf feedback, src/compositor_gpu.rs),
 # so Automatic draws on that one. Both are already in the build through winit.
 wayland-client = "0.31"
-wayland-protocols = { version = "0.32", features = ["client"] }
+wayland-protocols = { version = "0.32", features = ["client", "unstable"] }
+# The save dialog's parent window on Wayland (src/portal_save.rs): an xdg-foreign handle (in
+# wayland-protocols' `unstable` set) made on the window's own connection. MIT, already in the build
+# through winit and rfd.
+wayland-backend = { version = "0.3", features = ["client_system"] }
+
+# The save dialog's file type (src/portal_save.rs, #2679): the desktop portal over D-Bus, on the
+# systems where rfd shows the portal's dialog. MIT, already in the build through accesskit. Pinned
+# exactly: review the diff before bumping.
+[target.'cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))'.dependencies]
+zbus = "=5.19.0"
 
 [build-dependencies]
 # Icon + VERSIONINFO for vectorcraft.exe; build.rs only uses it when targeting Windows.
@@ -84,3 +94,5 @@ winresource = "0.1"
 [dev-dependencies]
 # Bound socket buffers in real loopback transport deadline regressions.
 socket2 = { workspace = true }
+# src/portal_save.rs's tests build and read the portal's D-Bus values on every system.
+zbus = "=5.19.0"

apps/vectorcraft/src/main.rs

@@ -43,6 +43,8 @@ mod mac_screen_color;
 mod mac_window;
 #[cfg(target_os = "macos")]
 mod open_documents;
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd", test))]
+mod portal_save;
 mod prefs_dir;
 mod printing;
 #[cfg(all(windows, not(target_vendor = "win7")))]
@@ -359,10 +361,20 @@ fn make_folder(request: &PickRequest) {
     }
 }
 
-/// Show `dialog` for `request` (on the calling thread, until it closes) → the paths picked.
+/// Show `dialog` for `request` (on the calling thread, until it closes) → the paths picked. On
+/// Linux and the BSDs a save dialog with two or more file types is the desktop portal's, over
+/// `parent`, and its answer also names the file type picked ([`portal_save`]); `dialog` shows when
+/// the portal can't.
 #[cfg(not(target_os = "macos"))]
-fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest) -> Vec<String> {
+#[cfg_attr(windows, allow(unused_variables))]
+fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest, parent: &Parent) -> Vec<String> {
     make_folder(request);
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    if let PickRequest::Save(pick) = request
+        && let Some(answer) = portal_save::pick(pick, parent.as_deref())
+    {
+        return answer;
+    }
     let paths = match request {
         PickRequest::Open(_) => dialog.pick_file().into_iter().collect(),
         PickRequest::OpenMany => dialog.pick_files().unwrap_or_default(),
@@ -375,7 +387,7 @@ fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest) -> Vec<String> {
 /// Show the dialog for `request` over `parent` now → the paths picked.
 #[cfg(not(target_os = "macos"))]
 fn pick_now(request: PickRequest, parent: &Parent) -> Vec<String> {
-    show_dialog(file_dialog(&request, parent), &request)
+    show_dialog(file_dialog(&request, parent), &request, parent)
 }
 
 /// macOS shows no dialog in line: its modal loop would run inside winit's event handler, and an
@@ -431,11 +443,12 @@ fn start_pick(request: PickRequest, parent: &Parent, ui: &egui::Context) -> Opti
     let dialog = file_dialog(&request, parent);
     let (tx, rx) = std::sync::mpsc::channel();
     let ui = ui.clone();
+    let parent = parent.clone();
     std::thread::Builder::new()
         .name("file-dialog".into())
         .spawn(move || {
             // The app gone meanwhile has no use for the answer.
-            let _ = tx.send(show_dialog(dialog, &request));
+            let _ = tx.send(show_dialog(dialog, &request, &parent));
             ui.request_repaint();
         })
         .ok()?;

apps/vectorcraft/src/portal_save.rs

@@ -0,0 +1,529 @@
+//! Linux and the BSDs: the save dialog of a save with two or more file types (Save, Save As, Save a
+//! Copy, Save as Template; #2679), asked of the XDG desktop portal here
+//! (<https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.FileChooser.html>).
+//! rfd 0.17 sends no `current_filter` with `SaveFile` and reads only `uris` from the answer
+//! (PolyMeilex/rfd#341), and the GTK file chooser behind the portal keeps the typed name when the
+//! user picks another file type, so the type picked was lost. This call sends the first file type as
+//! `current_filter`, reads the one picked back, and answers its first extension after the path
+//! ([`vectorcraft_ui_egui::picks::PickAnswer`]); the app gives the name that type's extension.
+//! rfd shows the dialog when the portal can't (no session bus, no file chooser), with zenity as its
+//! own fallback. PhotoCraft's `portal_save.rs` (storytold/photocraft#6151) makes the same call.
+//!
+//! The dialog's parent is the window: `x11:<window id>` on X11, and on Wayland (Linux) a handle
+//! from the compositor's xdg-foreign protocol, as rfd names it (its `window_identifier`).
+
+use std::collections::HashMap;
+
+use vectorcraft_ui_egui::FilePick;
+use zbus::zvariant::{OwnedValue, Value};
+
+/// A file type in the dialog: its label and its extensions without the dot.
+type Filter = (String, Vec<String>);
+
+/// A save dialog to show.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+struct SaveRequest {
+    /// The portal's identifier of the parent window, or empty.
+    parent: String,
+    /// The suggested name; empty for none.
+    name: String,
+    folder: Option<String>,
+    /// The file types, labeled in the interface's language; the dialog starts on the first.
+    filters: Vec<Filter>,
+}
+
+impl SaveRequest {
+    /// The dialog for `pick` over the window `parent` names.
+    fn new(pick: &FilePick, parent: String) -> Self {
+        let lang = vectorcraft_ui_egui::i18n::current();
+        let filters = pick
+            .filters
+            .iter()
+            .map(|(label, exts)| {
+                (vectorcraft_ui_egui::i18n::tr_ctx(lang, "file-filter", label).to_string(), exts.iter().map(|e| e.to_string()).collect())
+            })
+            .collect();
+        Self { parent, name: pick.name.clone(), folder: pick.folder.clone(), filters }
+    }
+}
+
+/// What the dialog answered: the path, as typed, and the label of the file type picked.
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct Saved {
+    path: String,
+    filter: Option<String>,
+}
+
+/// `filter` as the portal takes it: its label and a `*.ext` pattern for each extension (`*` for
+/// every file), as rfd sends them.
+fn wire(filter: &Filter) -> (String, Vec<(u32, String)>) {
+    let globs = filter.1.iter().map(|e| (0, if e.is_empty() || e == "*" { "*".to_string() } else { format!("*.{e}") })).collect();
+    (filter.0.clone(), globs)
+}
+
+/// The `SaveFile` options for `request`, answering on `token`.
+fn options<'a>(request: &'a SaveRequest, token: &'a str) -> HashMap<&'static str, Value<'a>> {
+    let mut o = HashMap::from([("handle_token", Value::from(token))]);
+    if !request.name.is_empty() {
+        o.insert("current_name", Value::from(request.name.as_str()));
+    }
+    if let Some(folder) = &request.folder {
+        // A byte string ending in NUL, as the portal specifies.
+        let mut bytes = folder.as_bytes().to_vec();
+        bytes.push(0);
+        o.insert("current_folder", Value::from(bytes));
+    }
+    if let Some(first) = request.filters.first() {
+        o.insert("filters", Value::from(request.filters.iter().map(wire).collect::<Vec<_>>()));
+        o.insert("current_filter", Value::from(wire(first)));
+    }
+    o
+}
+
+/// The portal's `Response`: code 0 with the first of its `uris` and the label of its
+/// `current_filter`. Any other code ends the dialog without a file (1 is Cancel, 2 a dialog closed
+/// some other way), as rfd reads it.
+fn answer(code: u32, results: &HashMap<String, OwnedValue>) -> Result<Option<Saved>, String> {
+    if code != 0 {
+        return Ok(None);
+    }
+    let uris: Vec<String> = results
+        .get("uris")
+        .ok_or("no file in the portal's answer")?
+        .try_clone()
+        .map_err(|e| e.to_string())?
+        .try_into()
+        .map_err(|e: zbus::zvariant::Error| e.to_string())?;
+    let uri = uris.first().ok_or("no file in the portal's answer")?;
+    let path = file_uri_path(uri).ok_or_else(|| format!("not a local file: {uri}"))?;
+    let filter = results.get("current_filter").and_then(|v| {
+        let (label, _globs): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+        Some(label)
+    });
+    Ok(Some(Saved { path, filter }))
+}
+
+/// `file:///home/me/A%20b.svg` → `/home/me/A b.svg`; `None` for a file elsewhere (`file://host/`)
+/// or another scheme.
+fn file_uri_path(uri: &str) -> Option<String> {
+    let rest = uri.strip_prefix("file://")?;
+    let rest = rest.strip_prefix("localhost").unwrap_or(rest);
+    if !rest.starts_with('/') {
+        return None;
+    }
+    let mut out = Vec::with_capacity(rest.len());
+    let mut rest = rest.as_bytes();
+    while let Some((&b, tail)) = rest.split_first() {
+        let hex = tail.get(..2).filter(|h| b == b'%' && h.iter().all(u8::is_ascii_hexdigit));
+        match hex.and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u8::from_str_radix(h, 16).ok()) {
+            Some(decoded) => {
+                out.push(decoded);
+                rest = tail.get(2..).unwrap_or_default();
+            }
+            None => {
+                out.push(b);
+                rest = tail;
+            }
+        }
+    }
+    // `show_dialog` makes rfd's path a string with `to_string_lossy` too.
+    Some(String::from_utf8_lossy(&out).into_owned())
+}
+
+/// `saved` as the answer of the save dialog for `request`: the path, then the first extension of
+/// the file type picked, found by its label. Empty when the dialog was canceled.
+fn pick_answer(saved: Option<Saved>, request: &SaveRequest) -> Vec<String> {
+    let Some(saved) = saved else { return Vec::new() };
+    let picked = saved.filter.and_then(|label| request.filters.iter().find(|(l, _)| *l == label)).and_then(|(_, exts)| exts.first().cloned());
+    std::iter::once(saved.path).chain(picked).collect()
+}
+
+/// The portal's identifier of an X11 window.
+fn x11_parent(window: impl std::fmt::LowerHex) -> String {
+    format!("x11:{window:x}")
+}
+
+/// Show the portal's save dialog for `pick` over `window` and wait for it → the answer (see the
+/// module's comment). `None` when `pick` offers fewer than two file types, or the portal couldn't
+/// show the dialog; rfd shows it then.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+pub fn pick(pick: &FilePick, window: Option<&winit::window::Window>) -> Option<Vec<String>> {
+    if pick.filters.len() < 2 {
+        return None;
+    }
+    // The export stays until the dialog has answered: the handle is valid while it lives.
+    let (parent, _export) = window.map(parent).unwrap_or_default();
+    let request = SaveRequest::new(pick, parent);
+    let saved = zbus::blocking::Connection::session().map_err(|e| e.to_string()).and_then(|conn| save_file(&conn, &request));
+    match saved {
+        Ok(saved) => Some(pick_answer(saved, &request)),
+        Err(e) => {
+            log::info!("the portal's save dialog failed ({e}): rfd shows it");
+            None
+        }
+    }
+}
+
+/// Ask the portal on `conn` for the save dialog of `request` and wait for its answer.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+fn save_file(conn: &zbus::blocking::Connection, request: &SaveRequest) -> Result<Option<Saved>, String> {
+    use std::sync::atomic::{AtomicU32, Ordering};
+
+    use zbus::blocking::Proxy;
+    use zbus::zvariant::OwnedObjectPath;
+
+    const DESKTOP: &str = "org.freedesktop.portal.Desktop";
+    const REQUEST: &str = "org.freedesktop.portal.Request";
+    static NEXT: AtomicU32 = AtomicU32::new(0);
+    let sender = conn.unique_name().ok_or("no name on the session bus")?.as_str().trim_start_matches(':').replace('.', "_");
+    let token = format!("vectorcraft_save_{}_{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed));
+    let path = format!("/org/freedesktop/portal/desktop/request/{sender}/{token}");
+    // Listen before asking, so that an answer that comes at once is not missed.
+    let mut replies = Proxy::new(conn, DESKTOP, path.as_str(), REQUEST).and_then(|p| p.receive_signal("Response")).map_err(|e| e.to_string())?;
+    let chooser = Proxy::new(conn, DESKTOP, "/org/freedesktop/portal/desktop", "org.freedesktop.portal.FileChooser").map_err(|e| e.to_string())?;
+    // The title is empty, as rfd sends it for a save.
+    let handle: OwnedObjectPath = chooser.call("SaveFile", &(request.parent.as_str(), "", options(request, &token))).map_err(|e| e.to_string())?;
+    // A portal older than version 0.9 ignores `handle_token` and answers on the request path it
+    // returns.
+    let reply = if handle.as_str() == path {
+        replies.next()
+    } else {
+        Proxy::new(conn, DESKTOP, handle.as_str(), REQUEST).and_then(|p| p.receive_signal("Response")).map_err(|e| e.to_string())?.next()
+    }
+    .ok_or("the save dialog closed without an answer")?;
+    let (code, results): (u32, HashMap<String, OwnedValue>) = reply.body().deserialize().map_err(|e| e.to_string())?;
+    answer(code, &results)
+}
+
+/// The portal's identifier of `window` when it is an X11 window.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+fn x11_window(window: &winit::window::Window) -> Option<String> {
+    use winit::raw_window_handle::{HasWindowHandle as _, RawWindowHandle};
+    match window.window_handle().ok()?.as_raw() {
+        RawWindowHandle::Xlib(h) => Some(x11_parent(h.window)),
+        RawWindowHandle::Xcb(h) => Some(x11_parent(h.window.get())),
+        _ => None,
+    }
+}
+
+/// The portal's identifier of `window`, and on Wayland the export that keeps it valid; empty when
+/// the window has neither an X11 id nor a Wayland handle.
+#[cfg(target_os = "linux")]
+fn parent(window: &winit::window::Window) -> (String, Option<wayland::Export>) {
+    if let Some(id) = x11_window(window) {
+        return (id, None);
+    }
+    match wayland::export(window) {
+        Some(export) => (format!("wayland:{}", export.handle), Some(export)),
+        None => (String::new(), None),
+    }
+}
+
+/// The portal's identifier of `window`: its X11 id, else empty (no Wayland export is made off
+/// Linux).
+#[cfg(any(target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+fn parent(window: &winit::window::Window) -> (String, Option<()>) {
+    (x11_window(window).unwrap_or_default(), None)
+}
+
+/// The Wayland window's handle for the portal: an xdg-foreign v2 export of its surface
+/// (<https://wayland.app/protocols/xdg-foreign-unstable-v2>), made as rfd's `window_identifier`
+/// makes it.
+#[cfg(target_os = "linux")]
+mod wayland {
+    use wayland_client::globals::{GlobalListContents, registry_queue_init};
+    use wayland_client::protocol::wl_registry::{self, WlRegistry};
+    use wayland_client::protocol::wl_surface::WlSurface;
+    use wayland_client::{Connection, Dispatch, Proxy, QueueHandle};
+    use wayland_protocols::xdg::foreign::zv2::client::zxdg_exported_v2::{self, ZxdgExportedV2};
+    use wayland_protocols::xdg::foreign::zv2::client::zxdg_exporter_v2::{self, ZxdgExporterV2};
+
+    /// A window exported for the portal: `handle` names it until this is dropped.
+    pub struct Export {
+        pub handle: String,
+        exported: ZxdgExportedV2,
+        conn: Connection,
+    }
+
+    impl Drop for Export {
+        fn drop(&mut self) {
+            self.exported.destroy();
+            let _ = self.conn.flush();
+        }
+    }
+
+    /// The events the export waits for.
+    #[derive(Default)]
+    struct State {
+        handle: Option<String>,
+    }
+
+    impl Dispatch<WlRegistry, GlobalListContents> for State {
+        fn event(_: &mut Self, _: &WlRegistry, _: wl_registry::Event, _: &GlobalListContents, _: &Connection, _: &QueueHandle<Self>) {}
+    }
+
+    impl Dispatch<ZxdgExporterV2, ()> for State {
+        fn event(_: &mut Self, _: &ZxdgExporterV2, _: zxdg_exporter_v2::Event, _: &(), _: &Connection, _: &QueueHandle<Self>) {}
+    }
+
+    impl Dispatch<ZxdgExportedV2, ()> for State {
+        fn event(state: &mut Self, _: &ZxdgExportedV2, event: zxdg_exported_v2::Event, _: &(), _: &Connection, _: &QueueHandle<Self>) {
+            if let zxdg_exported_v2::Event::Handle { handle } = event {
+                state.handle = Some(handle);
+            }
+        }
+    }
+
+    /// Export `window`'s surface on the window's own Wayland connection, with an event queue of its
+    /// own → `None` when the compositor has no xdg-foreign v2 or answers no handle.
+    pub fn export(window: &winit::window::Window) -> Option<Export> {
+        let (conn, surface) = surface(window)?;
+        let (globals, mut queue) = registry_queue_init::<State>(&conn).ok()?;
+        let qh = queue.handle();
+        let exporter: ZxdgExporterV2 = globals.bind(&qh, 1..=1, ()).ok()?;
+        let exported = exporter.export_toplevel(&surface, &qh, ());
+        let mut state = State::default();
+        let answered = queue.roundtrip(&mut state);
+        exporter.destroy();
+        match (answered, state.handle) {
+            (Ok(_), Some(handle)) => Some(Export { handle, exported, conn }),
+            _ => {
+                exported.destroy();
+                let _ = conn.flush();
+                log::info!("the compositor gave no xdg-foreign handle: the save dialog has no parent window");
+                None
+            }
+        }
+    }
+
+    /// `window`'s Wayland connection and surface, from its raw handles.
+    #[allow(unsafe_code)]
+    fn surface(window: &winit::window::Window) -> Option<(Connection, WlSurface)> {
+        use wayland_backend::sys::client::{Backend, ObjectId};
+        use winit::raw_window_handle::{HasDisplayHandle as _, HasWindowHandle as _, RawDisplayHandle, RawWindowHandle};
+        let (RawWindowHandle::Wayland(w), RawDisplayHandle::Wayland(d)) =
+            (window.window_handle().ok()?.as_raw(), window.display_handle().ok()?.as_raw())
+        else {
+            return None;
+        };
+        // SAFETY: the display is winit's open `wl_display`, which outlives `window` (the caller
+        // holds it until the export is dropped); a backend made from a foreign display does not
+        // close it when dropped.
+        let backend = unsafe { Backend::from_foreign_display(d.display.as_ptr().cast()) };
+        let conn = Connection::from_backend(backend);
+        // SAFETY: the pointer is the window's live `wl_surface` proxy on that display.
+        let id = unsafe { ObjectId::from_ptr(WlSurface::interface(), w.surface.as_ptr().cast()) }.ok()?;
+        let surface = WlSurface::from_id(&conn, id).ok()?;
+        Some((conn, surface))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn request() -> SaveRequest {
+        let pick = FilePick {
+            name: "Untitled-1.vectorcraft".into(),
+            folder: Some("/home/me/Art".into()),
+            filters: vec![("VectorCraft", &["vectorcraft"]), ("SVG", &["svg"]), ("PDF-compatible .ai", &["ai"])],
+        };
+        SaveRequest::new(&pick, "x11:3a0000f".into())
+    }
+
+    /// The dialog starts on the first file type (the document's format) and shows the suggested
+    /// name in its folder.
+    #[test]
+    fn the_request_names_the_file_type_the_dialog_starts_on() {
+        let request = request();
+        let o = options(&request, "t1");
+        assert_eq!(o.get("current_filter"), Some(&Value::from(("VectorCraft".to_string(), vec![(0u32, "*.vectorcraft".to_string())]))));
+        let filters = vec![
+            ("VectorCraft".to_string(), vec![(0u32, "*.vectorcraft".to_string())]),
+            ("SVG".to_string(), vec![(0u32, "*.svg".to_string())]),
+            ("PDF-compatible .ai".to_string(), vec![(0u32, "*.ai".to_string())]),
+        ];
+        assert_eq!(o.get("filters"), Some(&Value::from(filters)));
+        assert_eq!(o.get("current_name"), Some(&Value::from("Untitled-1.vectorcraft")));
+        assert_eq!(o.get("current_folder"), Some(&Value::from(b"/home/me/Art\0".to_vec())));
+        assert_eq!(o.get("handle_token"), Some(&Value::from("t1")));
+        let bare = SaveRequest { name: String::new(), folder: None, filters: Vec::new(), ..request };
+        let o = options(&bare, "t2");
+        assert_eq!(o.keys().copied().collect::<Vec<_>>(), ["handle_token"]);
+    }
+
+    /// The portal's answer as a D-Bus dictionary: `uris` and `current_filter`.
+    fn results(uri: &str, filter: Option<&str>) -> HashMap<String, OwnedValue> {
+        let mut r = HashMap::new();
+        r.insert("uris".to_string(), OwnedValue::try_from(Value::from(vec![uri.to_string()])).unwrap());
+        if let Some(label) = filter {
+            let picked = Value::from((label.to_string(), vec![(0u32, "*.ai".to_string())]));
+            r.insert("current_filter".to_string(), OwnedValue::try_from(picked).unwrap());
+        }
+        r
+    }
+
+    /// The file type picked comes back with the path as typed, and its first extension follows
+    /// the path in the answer.
+    #[test]
+    fn the_answer_carries_the_file_type_picked() {
+        let request = request();
+        let saved = answer(0, &results("file:///home/me/Art/poster", Some("PDF-compatible .ai"))).unwrap();
+        assert_eq!(saved, Some(Saved { path: "/home/me/Art/poster".into(), filter: Some("PDF-compatible .ai".into()) }));
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster", "ai"]);
+        // A portal that names no file type, or one the dialog did not offer: the path alone.
+        let saved = answer(0, &results("file:///home/me/Art/poster.svg", None)).unwrap();
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster.svg"]);
+        let saved = answer(0, &results("file:///home/me/Art/poster", Some("PNG"))).unwrap();
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster"]);
+    }
+
+    /// Cancel (1) and a dialog closed another way (2) answer no file; an answer without a local file
+    /// is an error, and rfd shows the dialog instead.
+    #[test]
+    fn a_canceled_dialog_answers_no_file() {
+        let request = request();
+        for code in [1, 2] {
+            assert_eq!(answer(code, &HashMap::new()), Ok(None));
+            assert!(pick_answer(None, &request).is_empty());
+        }
+        assert!(answer(0, &HashMap::new()).is_err());
+        assert!(answer(0, &results("sftp://host/poster.svg", Some("SVG"))).is_err());
+    }
+
+    #[test]
+    fn file_uris_become_local_paths() {
+        assert_eq!(file_uri_path("file:///home/me/Untitled-1.vectorcraft").as_deref(), Some("/home/me/Untitled-1.vectorcraft"));
+        assert_eq!(file_uri_path("file:///home/me/A%20b%C3%A9.svg").as_deref(), Some("/home/me/A bé.svg"));
+        assert_eq!(file_uri_path("file://localhost/tmp/x.pdf").as_deref(), Some("/tmp/x.pdf"));
+        // A `%` without two hex digits after it stays as it is.
+        assert_eq!(file_uri_path("file:///tmp/100%+1%2").as_deref(), Some("/tmp/100%+1%2"));
+        assert_eq!(file_uri_path("file://host/x.svg"), None);
+        assert_eq!(file_uri_path("sftp://host/x.svg"), None);
+    }
+
+    #[test]
+    fn x11_windows_are_named_by_their_id() {
+        assert_eq!(x11_parent(0x3a0000f), "x11:3a0000f");
+    }
+
+    /// What the mock portal answers to each `SaveFile` call: the response code, and the file and
+    /// the label of the file type "picked".
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    type Script = Vec<(u32, Option<(&'static str, &'static str)>)>;
+
+    /// What each `SaveFile` call carried: `current_name` and the label of `current_filter`.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    type Seen = std::sync::Arc<std::sync::Mutex<Vec<(Option<String>, Option<String>)>>>;
+
+    /// A session bus of its own (`dbus-daemon`) with a mock `org.freedesktop.portal.FileChooser`
+    /// that answers `SaveFile` from `script`, as PhotoCraft's portal tests run it. With `own_paths`
+    /// it is a portal older than 0.9, which answers on a request path of its own. `None` when there
+    /// is no `dbus-daemon` to run.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    fn mock_portal(script: Script, own_paths: bool) -> Option<(zbus::blocking::Connection, Seen, std::process::Child)> {
+        use std::io::BufRead as _;
+
+        use zbus::zvariant::OwnedObjectPath;
+        let mut daemon = std::process::Command::new("dbus-daemon")
+            .args(["--session", "--nofork", "--print-address=1"])
+            .stdout(std::process::Stdio::piped())
+            .spawn()
+            .ok()?;
+        let mut address = String::new();
+        std::io::BufReader::new(daemon.stdout.take()?).read_line(&mut address).ok()?;
+        let address = address.trim().to_string();
+        let server =
+            zbus::blocking::connection::Builder::address(address.as_str()).ok()?.name("org.freedesktop.portal.Desktop").ok()?.build().ok()?;
+        let seen = Seen::default();
+        let log = seen.clone();
+        std::thread::spawn(move || {
+            let mut script = script.into_iter();
+            for msg in zbus::blocking::MessageIterator::from(&server) {
+                let Ok(msg) = msg else { break };
+                let header = msg.header();
+                if header.message_type() != zbus::message::Type::MethodCall || header.member().map(|m| m.as_str()) != Some("SaveFile") {
+                    continue;
+                }
+                let Ok((_parent, _title, options)) = msg.body().deserialize::<(String, String, HashMap<String, OwnedValue>)>() else { break };
+                let text = |key: &str| options.get(key).and_then(|v| String::try_from(v.try_clone().ok()?).ok());
+                let filter = options.get("current_filter").and_then(|v| {
+                    let (label, _): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+                    Some(label)
+                });
+                let calls = log.lock().map(|mut l| {
+                    l.push((text("current_name"), filter));
+                    l.len()
+                });
+                let Some(sender) = header.sender().map(|s| s.as_str().trim_start_matches(':').replace('.', "_")) else { break };
+                let token = if own_paths { format!("old{}", calls.unwrap_or_default()) } else { text("handle_token").unwrap_or_default() };
+                let path = format!("/org/freedesktop/portal/desktop/request/{sender}/{token}");
+                let Ok(handle) = OwnedObjectPath::try_from(path.as_str()) else { break };
+                if server.reply(&header, &handle).is_err() {
+                    break;
+                }
+                if own_paths {
+                    // As a person answers the dialog: after the caller listened on the path returned.
+                    std::thread::sleep(std::time::Duration::from_millis(300));
+                }
+                let (code, pick) = script.next().unwrap_or((2, None));
+                let mut results: HashMap<&str, Value<'_>> = HashMap::new();
+                if let Some((uri, label)) = pick {
+                    results.insert("uris", Value::from(vec![uri.to_string()]));
+                    results.insert("current_filter", Value::from((label.to_string(), vec![(0u32, "*.x".to_string())])));
+                }
+                let to = header.sender().cloned().map(zbus::names::BusName::from);
+                if server.emit_signal(to, path.as_str(), "org.freedesktop.portal.Request", "Response", &(code, results)).is_err() {
+                    break;
+                }
+            }
+        });
+        let client = zbus::blocking::connection::Builder::address(address.as_str()).ok()?.build().ok()?;
+        Some((client, seen, daemon))
+    }
+
+    /// Through a real D-Bus: the call starts the dialog on the first file type with the suggested
+    /// name, and the answer names the file and the type picked; Cancel answers no file.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    #[test]
+    fn the_portal_is_asked_on_the_first_file_type_and_answers_the_one_picked() {
+        let script = vec![(0, Some(("file:///home/me/Art/poster", "PDF-compatible .ai"))), (1, None)];
+        let Some((conn, seen, mut daemon)) = mock_portal(script, false) else {
+            eprintln!("no dbus-daemon: skipped");
+            return;
+        };
+        let request = request();
+        let saved = save_file(&conn, &request).unwrap();
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster", "ai"]);
+        assert_eq!(save_file(&conn, &request), Ok(None));
+        let seen = seen.lock().map(|s| s.clone()).unwrap_or_default();
+        assert_eq!(seen.first(), Some(&(Some("Untitled-1.vectorcraft".to_string()), Some(request.filters[0].0.clone()))));
+        let _ = daemon.kill();
+    }
+
+    /// A portal older than 0.9 answers on the request path it returns, and the answer is awaited
+    /// there.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    #[test]
+    fn the_answer_is_awaited_on_the_path_the_portal_returns() {
+        let Some((conn, _seen, mut daemon)) = mock_portal(vec![(0, Some(("file:///tmp/card", "SVG")))], true) else {
+            eprintln!("no dbus-daemon: skipped");
+            return;
+        };
+        let request = request();
+        assert_eq!(pick_answer(save_file(&conn, &request).unwrap(), &request), ["/tmp/card", "svg"]);
+        let _ = daemon.kill();
+    }
+
+    /// The labels go to the dialog in the interface's language, which is how the answer is matched.
+    #[test]
+    fn the_file_types_are_labeled_as_the_other_dialogs_label_them() {
+        let request = request();
+        let labels: Vec<&str> = request.filters.iter().map(|(l, _)| l.as_str()).collect();
+        let lang = vectorcraft_ui_egui::i18n::current();
+        let expected: Vec<&str> =
+            ["VectorCraft", "SVG", "PDF-compatible .ai"].iter().map(|l| vectorcraft_ui_egui::i18n::tr_ctx(lang, "file-filter", l)).collect();
+        assert_eq!(labels, expected);
+        assert_eq!(request.parent, "x11:3a0000f");
+    }
+}

crates/color/src/cms/icc.rs

@@ -320,9 +320,14 @@ fn labelled(mut p: ColorProfile, name: &str) -> ColorProfile {
 /// Grid points per input channel of the CMYK → Lab table and of the Lab → CMYK table.
 const A2B_GRID: usize = 9;
 const B2A_GRID: usize = 17;
+/// Grid points per Lab channel of the gamut table.
+const GAMUT_GRID: usize = 9;
 
 /// A CMYK output profile sampled from a conversion: `to_lab` (CMYK → media-relative Lab) in a
 /// 9⁴ table, `from_lab` (Lab → CMYK, gamut-mapped) in a 17³ table, Lab PCS (ICC v4 encoding).
+/// It carries every tag ICC.1 requires of an output profile: the tables for all three intents
+/// and the gamut tag (Windows rejects a CMYK profile without them, so Photos couldn't show a CMYK
+/// TIFF that embedded one, #2707).
 pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, from_lab: impl Fn(lab::Lab) -> [f32; 4]) -> ColorProfile {
     let unit = |i: usize, n: usize| i as f32 / (n - 1) as f32;
     let q = |v: f32| (v.clamp(0.0, 1.0) * 65535.0).round() as u16;
@@ -337,6 +342,13 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
         let [l, a, b] = [2, 1, 0].map(|d| unit(i / B2A_GRID.pow(d) % B2A_GRID, B2A_GRID));
         b2a.extend(from_lab(lab::Lab::new(l * 100.0, a * 255.0 - 128.0, b * 255.0 - 128.0)).map(q));
     }
+    // Gamut: 0 where a colour separates and comes back within a ΔE of 3, else out of gamut.
+    let mut gamut = Vec::with_capacity(GAMUT_GRID.pow(3));
+    for i in 0..GAMUT_GRID.pow(3) {
+        let [l, a, b] = [2, 1, 0].map(|d| unit(i / GAMUT_GRID.pow(d) % GAMUT_GRID, GAMUT_GRID));
+        let want = lab::Lab::new(l * 100.0, a * 255.0 - 128.0, b * 255.0 - 128.0);
+        gamut.push(if lab::delta_e2000(want, to_lab(from_lab(want))) <= 3.0 { 0 } else { u16::MAX });
+    }
     let identity = |n: usize| vec![ToneReprCurve::Parametric(vec![1.0]); n];
     let table = |inputs: usize, outputs: usize, grid: usize, clut: Vec<u16>| {
         let mut grid_points = [0u8; 16];
@@ -346,8 +358,9 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
             num_output_channels: outputs as u8,
             grid_points,
             clut: Some(LutStore::Store16(clut)),
-            // A curves sit on the device side, B curves on the PCS side.
-            a_curves: identity(4),
+            // A curves sit on the device side (the gamut tag's is its one output), B curves on the
+            // PCS side.
+            a_curves: identity(inputs + outputs - 3),
             b_curves: identity(3),
             m_curves: vec![],
             matrix: Matrix3d::IDENTITY,
@@ -356,6 +369,7 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
     };
     let a2b = table(4, 3, A2B_GRID, a2b);
     let b2a = table(3, 4, B2A_GRID, b2a);
+    let gamut = table(3, 1, GAMUT_GRID, gamut);
     let mut p = ColorProfile::default();
     p.profile_class = ProfileClass::OutputDevice;
     p.color_space = DataColorSpace::Cmyk;
@@ -364,9 +378,12 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
     p.white_point = moxcms::WHITE_POINT_D50.to_xyzd();
     p.media_white_point = Some(p.white_point);
     p.lut_a_to_b_perceptual = Some(a2b.clone());
+    p.lut_a_to_b_saturation = Some(a2b.clone());
     p.lut_a_to_b_colorimetric = Some(a2b);
     p.lut_b_to_a_perceptual = Some(b2a.clone());
+    p.lut_b_to_a_saturation = Some(b2a.clone());
     p.lut_b_to_a_colorimetric = Some(b2a);
+    p.gamut = Some(gamut);
     labelled(p, name)
 }
 

crates/color/src/cms/tests_icc.rs

@@ -135,3 +135,20 @@ fn written_profiles_align_their_tags() {
         }
     }
 }
+
+/// #2707: the CMYK profiles written here carry every tag ICC.1 requires of an output profile (the
+/// tables of all three intents and the gamut tag): Windows rejects one without them, and Photos
+/// then can't show a CMYK TIFF that embeds it.
+#[test]
+fn cmyk_profiles_have_the_tags_of_an_output_profile() {
+    for name in BUILTIN_CMYK {
+        let icc = icc_bytes(name).unwrap();
+        let be = |at: usize| u32::from_be_bytes([icc[at], icc[at + 1], icc[at + 2], icc[at + 3]]) as usize;
+        let tags: Vec<&[u8]> = (0..be(128)).map(|i| &icc[132 + 12 * i..136 + 12 * i]).collect();
+        for want in [b"desc", b"cprt", b"wtpt", b"A2B0", b"A2B1", b"A2B2", b"B2A0", b"B2A1", b"B2A2", b"gamt"] {
+            assert!(tags.contains(&&want[..]), "{name}: no {}", String::from_utf8_lossy(want));
+        }
+        let p = parse(&icc);
+        assert!(p.lut_a_to_b_saturation.is_some() && p.lut_b_to_a_saturation.is_some() && p.gamut.is_some(), "{name}");
+    }
+}

crates/color/src/freeform.rs

@@ -11,6 +11,7 @@
 use kurbo::{Affine, BezPath, CubicBez, ParamCurve, ParamCurveNearest, Point, Rect};
 use serde::{Deserialize, Serialize};
 
+use crate::cms::{self, Model};
 use crate::{Color, Gradient, GradientStop};
 
 /// The spread a new point gets.
@@ -157,11 +158,12 @@ impl Freeform {
         f
     }
 
-    /// Colour the points along `g`, first to last.
+    /// Color the points along `g`, first to last, mixing neighboring stops in the model they share
+    /// ([`Color::lerp_keep_model`]).
     pub fn recolor(&mut self, g: &Gradient) {
         let n = self.points.len();
         for (k, p) in self.points.iter_mut().enumerate() {
-            (p.color, p.opacity) = g.sample(k as f32 / (n - 1).max(1) as f32);
+            (p.color, p.opacity) = g.sample_with(k as f32 / (n - 1).max(1) as f32, Color::lerp_keep_model);
         }
     }
 
@@ -230,10 +232,10 @@ impl Freeform {
         best
     }
 
-    /// The colour and opacity at `p` for a painted box whose [`spread_scale`] is `scale`.
+    /// The color and opacity at `p` for a painted box whose [`spread_scale`] is `scale`, as
+    /// [`Self::model_field`] mixes them.
     pub fn sample(&self, p: Point, scale: f64) -> (Color, f32) {
-        let ([r, g, b], a) = self.field(scale).sample(p);
-        (Color::rgb(r, g, b), a)
+        self.model_field(scale).sample(p)
     }
 
     /// The colour field, with colours converted and lines tessellated once (for sampling many
@@ -265,6 +267,32 @@ impl Freeform {
         Field { points, pieces, eps: 1e-9 * (scale.abs() + 1.0) }
     }
 
+    /// [`Self::field`] mixing the colors in the model every point shares instead of display RGB:
+    /// the C, M, Y and K inks (as a CMYK document drawn by ink planes mixes them), the Gray ink,
+    /// or the RGB or Lab components. Points in different models mix in display RGB, as
+    /// [`Self::field`] mixes them, and the field gives that color in the working RGB space.
+    pub fn model_field(&self, scale: f64) -> ModelField {
+        let Some(model) = self.shared_model() else { return ModelField { model: None, first: self.field(scale), k: None } };
+        let parts = |c: &Color| match *c {
+            Color::Rgb { r, g, b } => [r, g, b, 0.0],
+            Color::Cmyk { c, m, y, k } => [c, m, y, k],
+            Color::Gray { k } => [k, 0.0, 0.0, 0.0],
+            Color::Lab { l, a, b } => [l, a, b, 0.0],
+        };
+        let first = self.field_with(scale, &|c| {
+            let [x, y, z, _] = parts(c);
+            [x, y, z]
+        });
+        let k = (model == Model::Cmyk).then(|| self.field_with(scale, &|c| [parts(c)[3], 0.0, 0.0]));
+        ModelField { model: Some(model), first, k }
+    }
+
+    /// The color model every point is in (`None` without points or when their models differ).
+    pub fn shared_model(&self) -> Option<Model> {
+        let m = self.points.first()?.color.model();
+        self.points.iter().all(|p| p.color.model() == m).then_some(m)
+    }
+
     /// Add a point; returns its index.
     pub fn add_point(&mut self, p: FreeformPoint) -> usize {
         self.points.push(p);
@@ -324,8 +352,9 @@ impl Freeform {
         true
     }
 
-    /// Insert a point on segment `segment` of line `line` at curve parameter `t`, with the colour,
-    /// opacity and spread between the segment's ends. Returns the new point's index.
+    /// Insert a point on segment `segment` of line `line` at curve parameter `t`, with the color
+    /// (in the model the ends share, [`Color::lerp_keep_model`]), opacity and spread between the
+    /// segment's ends. Returns the new point's index.
     pub fn split_line(&mut self, line: usize, segment: usize, t: f64) -> Option<usize> {
         let c = *self.segments(line).get(segment)?;
         let l = &self.lines[line];
@@ -334,7 +363,7 @@ impl Freeform {
         let u = t as f32;
         let p = FreeformPoint {
             at: c.eval(t),
-            color: a.color.lerp(&b.color, u),
+            color: a.color.lerp_keep_model(&b.color, u),
             opacity: a.opacity + (b.opacity - a.opacity) * u,
             spread: a.spread + (b.spread - a.spread) * u,
         };
@@ -440,6 +469,41 @@ impl Field {
     }
 }
 
+/// A freeform gradient ready to sample in its points' color model ([`Freeform::model_field`]).
+#[derive(Clone, Debug)]
+pub struct ModelField {
+    /// The model the points share (`None` when their models differ).
+    model: Option<Model>,
+    /// The first three components (C, M and Y; R, G and B; L, a and b; display RGB when the
+    /// models differ), or the Gray ink as the first of the three values.
+    first: Field,
+    /// The K ink of a CMYK field.
+    k: Option<Field>,
+}
+
+impl ModelField {
+    /// The model the points share (`None` when their models differ).
+    pub fn model(&self) -> Option<Model> {
+        self.model
+    }
+
+    /// The color and opacity at `p`: in the points' shared model, else in the working RGB space.
+    pub fn sample(&self, p: Point) -> (Color, f32) {
+        let ([x, y, z], a) = self.first.sample(p);
+        let c = match self.model {
+            None => {
+                let [r, g, b] = cms::active().srgb_to_rgb([x, y, z]);
+                Color::rgb(r, g, b)
+            }
+            Some(Model::Rgb) => Color::rgb(x, y, z),
+            Some(Model::Cmyk) => Color::cmyk(x, y, z, self.k.as_ref().map_or(0.0, |k| k.sample(p).0[0])),
+            Some(Model::Gray) => Color::gray(x),
+            Some(Model::Lab) => Color::lab(x, y, z),
+        };
+        (c, a)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -477,6 +541,31 @@ mod tests {
         assert!(close(c.to_rgb(), [0.5, 0.0, 0.5]) && (o - 0.75).abs() < 1e-6, "{c:?}");
     }
 
+    #[test]
+    fn the_sample_mixes_in_the_model_the_points_share() {
+        let halfway = |a: Color, b: Color| {
+            let mut f = two(0.0);
+            (f.points[0].color, f.points[1].color) = (a, b);
+            f.sample(Point::new(50.0, 0.0), 50.0).0
+        };
+        let near = |a: Color, b: Color| match (a, b) {
+            (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => {
+                [c - c2, m - m2, y - y2, k - k2].iter().all(|d| d.abs() < 1e-5)
+            }
+            (Color::Gray { k }, Color::Gray { k: k2 }) => (k - k2).abs() < 1e-5,
+            (Color::Lab { l, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => [l - l2, a - a2, b - b2].iter().all(|d| d.abs() < 1e-4),
+            _ => false,
+        };
+        let c = halfway(Color::cmyk(1.0, 0.0, 0.0, 0.0), Color::cmyk(0.0, 0.0, 0.0, 1.0));
+        assert!(near(c, Color::cmyk(0.5, 0.0, 0.0, 0.5)), "{c:?}");
+        let c = halfway(Color::gray(0.2), Color::gray(0.6));
+        assert!(near(c, Color::gray(0.4)), "{c:?}");
+        let c = halfway(Color::lab(50.0, 10.0, -20.0), Color::lab(70.0, 30.0, 0.0));
+        assert!(near(c, Color::lab(60.0, 20.0, -10.0)), "{c:?}");
+        // Points in different models mix in RGB.
+        assert!(matches!(halfway(Color::cmyk(1.0, 0.0, 0.0, 0.0), red()), Color::Rgb { .. }));
+    }
+
     #[test]
     fn spread_keeps_the_colour_pure_inside_and_falls_off_outside() {
         // Scale 100: a 0.2 spread is a 20 pt disc.

crates/color/src/lib.rs

@@ -241,6 +241,17 @@ impl Color {
         let b = other.to_rgb();
         Color::rgb(a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t, a[2] + (b[2] - a[2]) * t)
     }
+    /// Linear interpolation in the model both colors share when it is CMYK, Gray or Lab, else in
+    /// display RGB ([`Color::lerp`]).
+    pub fn lerp_keep_model(&self, other: &Color, t: f32) -> Color {
+        let l = |x: f32, y: f32| x + (y - x) * t;
+        match (*self, *other) {
+            (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => Color::cmyk(l(c, c2), l(m, m2), l(y, y2), l(k, k2)),
+            (Color::Gray { k }, Color::Gray { k: k2 }) => Color::gray(l(k, k2)),
+            (Color::Lab { l: l1, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => Color::lab(l(l1, l2), l(a, a2), l(b, b2)),
+            _ => self.lerp(other, t),
+        }
+    }
     /// The colour model this colour is authored in.
     pub fn model(&self) -> cms::Model {
         match self {

crates/doc/src/blend.rs

@@ -33,13 +33,7 @@ use crate::text::TextObject;
 
 /// Interpolate two colours in their shared model (display RGB when the models differ).
 pub fn lerp_color(a: &Color, b: &Color, t: f32) -> Color {
-    let l = |x: f32, y: f32| x + (y - x) * t;
-    match (*a, *b) {
-        (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => Color::cmyk(l(c, c2), l(m, m2), l(y, y2), l(k, k2)),
-        (Color::Gray { k }, Color::Gray { k: k2 }) => Color::gray(l(k, k2)),
-        (Color::Lab { l: l1, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => Color::lab(l(l1, l2), l(a, a2), l(b, b2)),
-        _ => a.lerp(b, t),
-    }
+    a.lerp_keep_model(b, t)
 }
 
 fn lerp_f32(x: f32, y: f32, t: f32) -> f32 {

crates/doc/src/hit.rs

@@ -541,13 +541,16 @@ pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) ->
         out
     }
     /// Does the marquee `r` touch `n`? It skips the children of a Shaper Group that clicks skip
-    /// ([`shaper_hides`]).
+    /// ([`shaper_hides`]). An Intertwine group is touched by its members, and a repeat is touched
+    /// by the copies it draws, as clicks hit them. Objects of every other kind except paths,
+    /// compound paths, layers and groups are touched by their box.
     fn touches(n: &Node, s: &SymbolBoxes, r: Rect, scope: Option<NodeId>) -> bool {
         match &n.kind {
             NodeKind::Path { path, .. } => vectorcraft_geom::hit::intersects_rect(path, r),
-            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } => marquee_in(n, r)
+            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Intertwine { children } => marquee_in(n, r)
                 .is_some_and(|r| children.iter().enumerate().any(|(i, c)| c.visible && !shaper_hides(n, i, scope) && touches(c, s, r, scope))),
             NodeKind::Compound { children, .. } => children.iter().any(|c| c.visible && touches(c, s, r, scope)),
+            NodeKind::Repeat(spec) => spec.expand().iter().any(|copy| touches(copy, s, r, scope)),
             // A box with no width or no height (an instance of a symbol that draws a straight
             // line) is touched where the marquee crosses it.
             _ => n.geometric_bounds_with(s).is_some_and(|b| {
@@ -558,7 +561,7 @@ pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) ->
     }
     fn collect_leaves(n: &Node, s: &SymbolBoxes, r: Rect, scope: Option<NodeId>, out: &mut Vec<NodeId>) {
         match &n.kind {
-            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } => {
+            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Intertwine { children } => {
                 let Some(r) = marquee_in(n, r) else { return };
                 for (i, c) in children.iter().enumerate() {
                     if c.visible && !c.locked && !shaper_hides(n, i, scope) {
@@ -822,6 +825,92 @@ mod tests {
         assert_eq!(marquee(&d, erased, Some(sources_id), false), vec![b_id]);
     }
 
+    /// A marquee touches an Intertwine group by its members, as it touches a plain group (#1103) and
+    /// as clicks do: in the gap between two members, or inside one member's fill, it selects nothing.
+    /// Across a member's edge it selects the group, and with the leaves that Direct and Group
+    /// Selection take, or in isolation mode, it selects the member.
+    #[test]
+    fn a_marquee_meets_an_intertwine_group_by_its_members() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        // Two squares, 0..100 and 150..250, with a gap between them inside the group's box.
+        let square = |x: f64| shapes::rectangle(Rect::new(x, 0.0, x + 100.0, 100.0));
+        let mut a = Node::path(d.alloc_id(), square(0.0), Appearance::default_art());
+        a.extras_mut().intertwine = Some(Box::new(shapes::rectangle(Rect::new(50.0, 0.0, 100.0, 100.0))));
+        let b = Node::path(d.alloc_id(), square(150.0), Appearance::default_art());
+        let (a_id, g) = (a.id, d.alloc_id());
+        d.insert(Some(l), 0, Node::new(g, NodeKind::Intertwine { children: vec![Arc::new(a), Arc::new(b)] })).unwrap();
+        let gap = Rect::new(110.0, 40.0, 140.0, 60.0);
+        assert!(hit_test(&d, gap.center(), HitOptions::default()).is_none(), "a click in the gap misses");
+        assert!(marquee(&d, gap, None, false).is_empty());
+        assert!(marquee(&d, gap, None, true).is_empty());
+        assert!(marquee(&d, gap, Some(g), false).is_empty());
+        assert!(marquee(&d, Rect::new(20.0, 20.0, 40.0, 40.0), None, false).is_empty(), "inside a member's fill");
+        // This marquee crosses the first square's left edge.
+        let edge = Rect::new(-10.0, 40.0, 10.0, 60.0);
+        assert_eq!(marquee(&d, edge, None, false), vec![g]);
+        assert_eq!(marquee(&d, edge, None, true), vec![a_id]);
+        assert_eq!(marquee(&d, edge, Some(g), false), vec![a_id]);
+    }
+
+    /// A marquee touches a repeat by the copies it draws, as clicks do: between two copies of a
+    /// grid repeat it selects nothing, and across a copy's edge it takes the repeat.
+    #[test]
+    fn a_marquee_meets_a_repeat_by_its_copies() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        let source = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 20.0, 20.0)), Appearance::default_art());
+        // Copies at 0..20, 40..60 and 80..100.
+        let kind = crate::pattern::RepeatKind::Grid {
+            h_spacing: 20.0,
+            v_spacing: 20.0,
+            rows: 1,
+            cols: 3,
+            grid_type: crate::pattern::TileType::Grid,
+            flip_rows: false,
+            flip_cols: false,
+        };
+        let r = d.alloc_id();
+        d.insert(Some(l), 0, Node::new(r, NodeKind::Repeat(crate::pattern::RepeatSpec { kind, source: vec![Arc::new(source)] }))).unwrap();
+        let gap = Rect::new(25.0, 5.0, 35.0, 15.0);
+        assert!(hit_test(&d, gap.center(), HitOptions::default()).is_none(), "a click between copies misses");
+        assert!(marquee(&d, gap, None, false).is_empty());
+        assert!(marquee(&d, gap, None, true).is_empty());
+        assert_eq!(marquee(&d, Rect::new(35.0, 5.0, 45.0, 15.0), None, false), vec![r], "across the second copy's left edge");
+        assert_eq!(marquee(&d, Rect::new(35.0, 5.0, 45.0, 15.0), None, true), vec![r]);
+    }
+
+    /// A blend and an envelope are clicked anywhere in their box, and a marquee touches them there
+    /// too: inside the box, away from every key object's and the content's outline, it takes them.
+    #[test]
+    fn a_marquee_meets_blends_and_envelopes_by_their_box() {
+        let mut d = Document::new(300.0, 300.0);
+        let l = d.layers[0].id;
+        let square = |id, x: f64, y: f64| Arc::new(Node::path(id, shapes::rectangle(Rect::new(x, y, x + 20.0, y + 20.0)), Appearance::default_art()));
+        let blend = d.alloc_id();
+        let keys = vec![square(d.alloc_id(), 0.0, 0.0), square(d.alloc_id(), 100.0, 0.0)];
+        d.insert(Some(l), 0, Node::new(blend, NodeKind::Blend { children: keys, spec: Default::default() })).unwrap();
+        let envelope = d.alloc_id();
+        let content = vec![Arc::new(Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 150.0, 100.0, 250.0)), Appearance::default_art()))];
+        let e = Node::new(
+            envelope,
+            NodeKind::Envelope {
+                content,
+                kind: Box::new(crate::live::EnvelopeKind::Warp { style: "arc".to_string(), bend: 0.0, h: 0.0, v: 0.0, horizontal: true }),
+                fidelity: 100.0,
+                editing: false,
+                options: Default::default(),
+                frame: Box::new(vectorcraft_geom::Affine::IDENTITY),
+            },
+        );
+        d.insert(Some(l), 1, e).unwrap();
+        for (r, id) in [(Rect::new(50.0, 5.0, 60.0, 15.0), blend), (Rect::new(40.0, 190.0, 60.0, 210.0), envelope)] {
+            assert_eq!(hit_test(&d, r.center(), HitOptions::default()).map(|h| h.leaf), Some(id));
+            assert_eq!(marquee(&d, r, None, false), vec![id]);
+            assert_eq!(marquee(&d, r, None, true), vec![id]);
+        }
+    }
+
     /// Art in a sublayer is an object of its own: a click or a marquee takes it, not the
     /// sublayer; hidden, locked and template sublayers block both.
     #[test]

crates/doc/src/lib.rs

@@ -117,9 +117,9 @@ pub use setup::{Background, DocSetup, ExportText, GridSize, Quotes};
 pub use slices::{CellAlign, CellVAlign, Slice, SliceArea, SliceKind, SliceOptions, SliceSource};
 pub use style_libs::StyleLibrary;
 pub use text::{
-    AreaFit, AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, Digits, FirstBaseline, HyphenationOptions, InlineArt, Justify,
-    Kinsoku, LeadingModel, Mojikumi, ParaDirection, ParaStyle, PathAlign, PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject,
-    TextRun, TextStyleDef, TextWrap, VerticalAlign, WrapShape,
+    AreaFit, AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, Digits, FirstBaseline, HyphenationOptions, InlineArt,
+    JustificationOptions, Justify, Kinsoku, LeadingModel, Mojikumi, ParaDirection, ParaStyle, PathAlign, PathEffect, ScriptMetrics,
+    SingleWordJustify, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef, TextWrap, VerticalAlign, WrapShape,
 };
 pub use trace::TraceView;
 pub use variables::{DataSet, DataValue, Variable, VariableKind, Variables};
@@ -274,7 +274,12 @@ impl Unit {
     pub fn named(name: &str) -> Option<Unit> {
         let letters = |s: &'static str| s.chars().filter(char::is_ascii_alphanumeric).map(|c| c.to_ascii_lowercase());
         let given = || name.chars().filter(char::is_ascii_alphanumeric).map(|c| c.to_ascii_lowercase());
-        Unit::ALL.into_iter().find(|u| letters(u.label()).eq(given()) || u.suffix().chars().eq(given()))
+        // Feet and Feet & Inches share the suffix `ft`: it names the plain unit, so Feet & Inches
+        // is left to its label and key.
+        Unit::ALL
+            .into_iter()
+            .find(|u| letters(u.label()).eq(given()))
+            .or_else(|| Unit::ALL.into_iter().filter(|u| *u != Unit::FeetInches).find(|u| u.suffix().chars().eq(given())))
     }
     /// A point value as the canvas measurement labels show it: two decimals and the suffix
     /// (`12.50 mm`).
@@ -801,6 +806,12 @@ type Places = BTreeMap<Vec<usize>, Vec<(usize, usize)>>;
 pub const FORMAT_VERSION: u32 = 1;
 
 impl Document {
+    /// Document Raster Effects Settings › Resolution in ppi, 1 to 2400 (72 when the stored value
+    /// isn't a number).
+    pub fn raster_ppi(&self) -> f64 {
+        Some(self.raster_effects_ppi).filter(|v| v.is_finite()).unwrap_or(72.0).clamp(1.0, 2400.0)
+    }
+
     /// The ruler zero point, or zero on both axes when either stored coordinate is invalid.
     /// Rulers, coordinate fields and guide snapping use the same supported range.
     pub fn ruler_origin_or_zero(&self) -> Point {

crates/doc/src/live.rs

@@ -730,19 +730,35 @@ impl GradientMesh {
             .to_point()
     }
 
-    /// Bilinear colour and opacity of patch (r, c) at local (u, v).
+    /// Bilinear colour and opacity of patch (r, c) at local (u, v). Corners all in CMYK (or all
+    /// grey) mix in that space, as a PDF shading mixes in its own colour space: the inks come out
+    /// exact, and a CMYK document separates no colour to draw them. Other corners mix in RGB.
     pub fn color_at(&self, r: usize, c: usize, u: f64, v: f64) -> (Color, f32) {
         let q =
             [&self.points[self.idx(r, c)], &self.points[self.idx(r, c + 1)], &self.points[self.idx(r + 1, c)], &self.points[self.idx(r + 1, c + 1)]];
         let w = [(1.0 - u) * (1.0 - v), u * (1.0 - v), (1.0 - u) * v, u * v];
+        let op = q.iter().zip(w).map(|(p, w)| p.opacity * w as f32).sum();
+        let cmyk: Option<Vec<[f32; 4]>> =
+            q.iter().map(|p| if let Color::Cmyk { c, m, y, k } = p.color { Some([c, m, y, k]) } else { None }).collect();
+        if let Some(inks) = cmyk {
+            let mut mix = [0.0f32; 4];
+            for (ink, w) in inks.iter().zip(w) {
+                for (m, x) in mix.iter_mut().zip(ink) {
+                    *m += x * w as f32;
+                }
+            }
+            let [c, m, y, k] = mix;
+            return (Color::Cmyk { c, m, y, k }, op);
+        }
+        let grey: Option<Vec<f32>> = q.iter().map(|p| if let Color::Gray { k } = p.color { Some(k) } else { None }).collect();
+        if let Some(ks) = grey {
+            return (Color::Gray { k: ks.iter().zip(w).map(|(k, w)| k * w as f32).sum() }, op);
+        }
         let mut rgb = [0.0f32; 3];
-        let mut op = 0.0f32;
-        for k in 0..4 {
-            let c = q[k].color.to_rgb();
-            for (ch, x) in rgb.iter_mut().zip(c) {
-                *ch += x * w[k] as f32;
+        for (p, w) in q.iter().zip(w) {
+            for (ch, x) in rgb.iter_mut().zip(p.color.to_rgb()) {
+                *ch += x * w as f32;
             }
-            op += q[k].opacity * w[k] as f32;
         }
         (Color::rgb(rgb[0], rgb[1], rgb[2]), op)
     }
@@ -1823,4 +1839,19 @@ mod tests {
         assert!(m.remove_point_lines(i));
         assert_eq!((m.rows, m.cols), (1, 1));
     }
+
+    /// Corners all in CMYK mix in CMYK (the inks halfway), not in RGB.
+    #[test]
+    fn a_cmyk_mesh_mixes_its_inks() {
+        let cyan = Color::Cmyk { c: 1.0, m: 0.0, y: 0.0, k: 0.0 };
+        let mut m = GradientMesh::for_path(&shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), 1, 1, cyan, MeshAppearance::Flat, 0.0).unwrap();
+        m.points[0].color = Color::Cmyk { c: 0.0, m: 0.0, y: 0.0, k: 1.0 };
+        let (c, op) = m.color_at(0, 0, 0.0, 0.0);
+        assert_eq!((c, op), (Color::Cmyk { c: 0.0, m: 0.0, y: 0.0, k: 1.0 }, 1.0));
+        let Color::Cmyk { c, k, .. } = m.color_at(0, 0, 0.5, 0.5).0 else { panic!("mixed out of CMYK") };
+        assert!((c - 0.75).abs() < 1e-6 && (k - 0.25).abs() < 1e-6, "{c} {k}");
+        // A corner in another space mixes them all in RGB.
+        m.points[1].color = Color::rgb(1.0, 0.0, 0.0);
+        assert!(matches!(m.color_at(0, 0, 0.5, 0.5).0, Color::Rgb { .. }));
+    }
 }

crates/doc/src/metadata.rs

@@ -82,6 +82,25 @@ impl DocMetadata {
     }
 }
 
+/// The time exported files record: PDF `CreationDate` and `ModDate`, the PNG `Creation Time`
+/// entry, a zip entry's date, and a saved document's `created` and `modified`. It is the clock,
+/// unless `SOURCE_DATE_EPOCH` is set, which replaces it so that the same commands produce the same
+/// bytes twice (#2880).
+///
+/// The raw clock stays in [`now_unix`], which is what a heartbeat is judged by and what seeds
+/// encryption: neither may be pinned by the environment.
+pub fn output_time() -> Option<i64> {
+    stamp_from_env(|n| std::env::var(n).ok()).or_else(now_unix)
+}
+
+/// `SOURCE_DATE_EPOCH` as Unix seconds: the reproducible-builds variable
+/// (<https://reproducible-builds.org/specs/source-date-epoch/>), a non-negative decimal integer of
+/// seconds since the epoch. `None` when it is unset, blank, negative or not an integer, and then
+/// the clock decides — an export is never refused over the environment.
+fn stamp_from_env(get: impl Fn(&str) -> Option<String>) -> Option<i64> {
+    get("SOURCE_DATE_EPOCH")?.trim().parse::<i64>().ok().filter(|t| *t >= 0)
+}
+
 /// The current time as Unix seconds (UTC); `None` where the platform has no clock (the web build).
 #[cfg(not(target_arch = "wasm32"))]
 pub fn now_unix() -> Option<i64> {
@@ -148,4 +167,21 @@ mod tests {
         );
         assert!(DocMetadata::default().png_text("").is_empty());
     }
+
+    /// `SOURCE_DATE_EPOCH` replaces the clock in exported output only when it is a non-negative
+    /// decimal integer; anything else leaves the clock to decide, so an export is never refused.
+    #[test]
+    fn source_date_epoch_is_read_only_as_a_non_negative_integer() {
+        let env = |v: Option<&'static str>| move |n: &str| v.filter(|_| n == "SOURCE_DATE_EPOCH").map(str::to_owned);
+        assert_eq!(stamp_from_env(env(Some("1791208980"))), Some(1_791_208_980));
+        assert_eq!(stamp_from_env(env(Some("0"))), Some(0));
+        assert_eq!(stamp_from_env(env(Some("  1791208980  "))), Some(1_791_208_980));
+        for bad in ["", "   ", "-1", "later", "1791208980.5", "1e9", "99999999999999999999"] {
+            assert_eq!(stamp_from_env(env(Some(bad))), None, "{bad:?}");
+        }
+        assert_eq!(stamp_from_env(env(None)), None, "unset");
+        // Another variable never stands in for it.
+        assert_eq!(stamp_from_env(|_| Some("1791208980".to_owned())), Some(1_791_208_980));
+        assert_eq!(stamp_from_env(|n: &str| (n == "TZ").then(|| "1791208980".to_owned())), None);
+    }
 }

crates/doc/src/tests_units.rs

@@ -98,6 +98,13 @@ fn units_are_named_by_label_key_or_suffix() {
     assert_eq!(Unit::named(""), None);
 }
 
+#[test]
+fn a_shared_suffix_names_the_plain_unit() {
+    assert_eq!(Unit::named(Unit::Feet.suffix()), Some(Unit::Feet));
+    assert_eq!(Unit::named("FT"), Some(Unit::Feet));
+    assert_eq!(Unit::named(Unit::FeetInches.label()), Some(Unit::FeetInches));
+}
+
 #[test]
 fn readouts_show_two_decimals() {
     assert_eq!(Unit::Points.readout(15.0), "15.00 pt");

crates/doc/src/text.rs

@@ -506,6 +506,98 @@ impl Default for HyphenationOptions {
     }
 }
 
+/// How a justified line holding a single word is set ([`JustificationOptions::single_word`]).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum SingleWordJustify {
+    /// Spread across the line, between its letters.
+    #[default]
+    FullJustify,
+    AlignLeft,
+    AlignCenter,
+    AlignRight,
+}
+
+/// A paragraph's justification options (Paragraph panel menu › Justification…), in percent.
+///
+/// Each spacing has a Minimum, a Desired and a Maximum value (`[min, desired, max]`). Desired
+/// applies to every line of the paragraph, justified or not: word spaces are that share of the
+/// font's word space, each letter is followed by that share of a word space, and glyphs are that
+/// wide. Justified lines may vary them between Minimum and Maximum to fill the measure. Saved only
+/// when they differ from the defaults: word spacing 80/100/133, letter spacing 0/0/0, glyph
+/// scaling 100/100/100, Auto Leading 120 and Full Justify.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct JustificationOptions {
+    /// Word Spacing, percent of the font's word space (0..1000).
+    pub word_spacing: [f64; 3],
+    /// Letter Spacing, percent of the font's word space added after each letter (-100..500).
+    pub letter_spacing: [f64; 3],
+    /// Glyph Scaling, percent of the glyphs' width (50..200).
+    pub glyph_scaling: [f64; 3],
+    /// Auto Leading: the leading of characters whose leading is Auto, in percent of their size
+    /// (0..500).
+    pub auto_leading: f64,
+    /// Single Word Justification: how a justified line holding one word is set.
+    pub single_word: SingleWordJustify,
+}
+
+impl JustificationOptions {
+    /// Word Spacing's range (percent).
+    pub const WORD_SPACING: (f64, f64) = (0.0, 1000.0);
+    /// Letter Spacing's range (percent).
+    pub const LETTER_SPACING: (f64, f64) = (-100.0, 500.0);
+    /// Glyph Scaling's range (percent).
+    pub const GLYPH_SCALING: (f64, f64) = (50.0, 200.0);
+    /// Auto Leading's range (percent).
+    pub const AUTO_LEADING: (f64, f64) = (0.0, 500.0);
+
+    /// Are Desired word spacing, letter spacing and glyph scaling the defaults (nothing to change
+    /// in a line's natural widths)?
+    pub fn desired_is_default(&self) -> bool {
+        let d = Self::default();
+        self.word_spacing[1] == d.word_spacing[1] && self.letter_spacing[1] == d.letter_spacing[1] && self.glyph_scaling[1] == d.glyph_scaling[1]
+    }
+
+    /// Keeps options read from a file to what `text.setFormat` can set: a value that is not a
+    /// finite number becomes its default, every value is clamped to its range, and a Minimum,
+    /// Desired and Maximum out of order go back to their defaults together.
+    pub fn keep_in_range(&mut self) {
+        let d = Self::default();
+        for (v, dv, (lo, hi)) in [
+            (&mut self.word_spacing, d.word_spacing, Self::WORD_SPACING),
+            (&mut self.letter_spacing, d.letter_spacing, Self::LETTER_SPACING),
+            (&mut self.glyph_scaling, d.glyph_scaling, Self::GLYPH_SCALING),
+        ] {
+            for (x, dx) in v.iter_mut().zip(dv) {
+                *x = if x.is_finite() { x.clamp(lo, hi) } else { dx };
+            }
+            if !(v[0] <= v[1] && v[1] <= v[2]) {
+                *v = dv;
+            }
+        }
+        let (lo, hi) = Self::AUTO_LEADING;
+        self.auto_leading = if self.auto_leading.is_finite() { self.auto_leading.clamp(lo, hi) } else { d.auto_leading };
+    }
+
+    /// A paragraph's leading for characters of `size` whose leading is Auto.
+    pub fn auto_leading_for(&self, size: f64) -> f64 {
+        size * self.auto_leading / 100.0
+    }
+}
+
+impl Default for JustificationOptions {
+    fn default() -> Self {
+        Self {
+            word_spacing: [80.0, 100.0, 133.0],
+            letter_spacing: [0.0, 0.0, 0.0],
+            glyph_scaling: [100.0, 100.0, 100.0],
+            auto_leading: 120.0,
+            single_word: SingleWordJustify::FullJustify,
+        }
+    }
+}
+
 /// Paragraph attributes (the Paragraph panel).
 ///
 /// Saved through [`ParaStyleFile`], which keeps files with text openable by builds from before
@@ -522,6 +614,9 @@ pub struct ParaStyle {
     pub hyphenate: bool,
     /// The limits automatic hyphenation keeps to (Paragraph panel menu › Hyphenation…).
     pub hyphenation: HyphenationOptions,
+    /// Word and letter spacing, glyph scaling, Auto Leading and Single Word Justification
+    /// (Paragraph panel menu › Justification…).
+    pub justification: JustificationOptions,
     /// Line breaking: Single-line or Every-line Composer.
     pub composer: Composer,
     /// Tab stops (Tabs panel), sorted by position.
@@ -591,6 +686,8 @@ struct ParaStyleFile {
     hyphenate: bool,
     #[serde(default, skip_serializing_if = "crate::skip::is_default")]
     hyphenation: HyphenationOptions,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    justification: JustificationOptions,
     #[serde(default, skip_serializing_if = "Composer::is_default")]
     composer: Composer,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
@@ -627,6 +724,7 @@ impl From<ParaStyle> for ParaStyleFile {
             space_after,
             hyphenate,
             hyphenation,
+            justification,
             composer,
             tabs,
             style_name,
@@ -648,6 +746,7 @@ impl From<ParaStyle> for ParaStyleFile {
             space_after,
             hyphenate,
             hyphenation,
+            justification,
             composer,
             tabs,
             style_name,
@@ -664,6 +763,8 @@ impl From<ParaStyle> for ParaStyleFile {
 impl From<ParaStyleFile> for ParaStyle {
     fn from(f: ParaStyleFile) -> Self {
         let justify = if f.justify_auto { Justify::Auto } else { f.justify };
+        let mut justification = f.justification;
+        justification.keep_in_range();
         let ParaStyleFile {
             left_indent,
             right_indent,
@@ -692,6 +793,7 @@ impl From<ParaStyleFile> for ParaStyle {
             space_after,
             hyphenate,
             hyphenation,
+            justification,
             composer,
             tabs,
             style_name,
@@ -1585,6 +1687,37 @@ mod tests {
         assert_eq!(serde_json::from_value::<CharStyle>(serde_json::to_value(&farsi).unwrap()).unwrap(), farsi);
     }
 
+    /// A file can't feed layout justification values `text.setFormat` would refuse: each is
+    /// clamped to its range, one that isn't finite takes its default, and a Minimum, Desired and
+    /// Maximum out of order go back to their defaults.
+    #[test]
+    fn justification_options_read_from_a_file_stay_in_range() {
+        let d = JustificationOptions::default();
+        let read: ParaStyle = serde_json::from_value(serde_json::json!({
+            "justification": {
+                "word_spacing": [-5.0, 1e300, 1e308], "letter_spacing": [10.0, 5.0, 20.0],
+                "glyph_scaling": [1.0, 100.0, 9e9], "auto_leading": -1e12
+            }
+        }))
+        .unwrap();
+        let j = read.justification;
+        assert_eq!(j.word_spacing, [0.0, 1000.0, 1000.0]);
+        assert_eq!(j.letter_spacing, d.letter_spacing, "out of order");
+        assert_eq!(j.glyph_scaling, [50.0, 100.0, 200.0]);
+        assert_eq!(j.auto_leading, 0.0);
+        let mut j = JustificationOptions {
+            word_spacing: [f64::NAN, 100.0, f64::INFINITY],
+            letter_spacing: [-1.0, 0.0, f64::NEG_INFINITY],
+            auto_leading: f64::NAN,
+            ..d.clone()
+        };
+        j.keep_in_range();
+        assert_eq!((j.word_spacing, j.letter_spacing, j.auto_leading), (d.word_spacing, [-1.0, 0.0, 0.0], d.auto_leading));
+        let mut same = d.clone();
+        same.keep_in_range();
+        assert_eq!(same, d);
+    }
+
     #[test]
     fn character_controls_reject_collapsed_and_nonfinite_transforms() {
         let mut t = TextObject::point(Point::ZERO, "Text", CharStyle::default());

crates/effects/src/adjust.rs

@@ -48,15 +48,29 @@ enum Channel {
 
 impl Channel {
     fn of(p: &Value) -> Self {
-        match text(p, "channel", "rgb").to_ascii_lowercase().as_str() {
-            "red" | "r" => Channel::One(0),
-            "green" | "g" => Channel::One(1),
-            "blue" | "b" => Channel::One(2),
-            _ => Channel::All,
+        Self::parse(text(p, "channel", "rgb")).unwrap_or(Channel::All)
+    }
+
+    fn parse(s: &str) -> Option<Self> {
+        match s.to_ascii_lowercase().as_str() {
+            "rgb" => Some(Channel::All),
+            "red" | "r" => Some(Channel::One(0)),
+            "green" | "g" => Some(Channel::One(1)),
+            "blue" | "b" => Some(Channel::One(2)),
+            _ => None,
         }
     }
 }
 
+/// The channels Curves and Levels apply to (`channel`), as their parameters list them.
+pub const CHANNELS: [&str; 4] = ["rgb", "red", "green", "blue"];
+
+/// Do Curves and Levels read `s` as their `channel`: one of [`CHANNELS`], or r, g or b, in any
+/// case? They draw any other value on all three channels, as RGB.
+pub fn is_channel(s: &str) -> bool {
+    Channel::parse(s).is_some()
+}
+
 /// Entries of a sampled tone curve.
 const LUT: usize = 256;
 

crates/effects/src/lib.rs

@@ -59,7 +59,10 @@ use serde_json::{Map, Value, json};
 use vectorcraft_doc::{AppearanceItem, Effect, Node, NodeKind, StrokeLayer};
 use vectorcraft_geom::{BezPath, FillRule, PathData, Rect};
 
-pub use adjust::{ADJUSTMENTS, ColorMap, ImageHook, adjust, adjust_in_document, color_map, curve_at, curve_points, has_adjustment, is_adjustment};
+pub use adjust::{
+    ADJUSTMENTS, CHANNELS, ColorMap, ImageHook, adjust, adjust_in_document, color_map, curve_at, curve_points, has_adjustment, is_adjustment,
+    is_channel,
+};
 pub use bake::{StrokeArt, bake_appearance, bake_document, expand_art, expand_leaf, fresh_ids, needs_bake};
 pub use clip::clip_outline;
 pub use group::{

crates/effects/src/pixel/mod.rs

@@ -594,6 +594,45 @@ pub fn blur_plane(a: &mut Vec<f32>, w: usize, h: usize, sigma: f64) {
     }
 }
 
+/// Grow a `w` × `h` plane by `radius` pixels each way, the box of SVG's feMorphology: each value
+/// becomes the largest within the radius. A fractional radius blends the two whole radii around
+/// it, so a silhouette grows smoothly as the raster scales. Does nothing for a radius of zero or
+/// less, or when the sizes don't match.
+pub fn dilate_plane(a: &mut Vec<f32>, w: usize, h: usize, radius: f64) {
+    if radius.is_nan() || radius <= 0.0 || w == 0 || h == 0 || w.checked_mul(h) != Some(a.len()) {
+        return;
+    }
+    let radius = radius.min(MAX_BOX as f64);
+    let whole = radius.floor() as usize;
+    let frac = (radius - whole as f64) as f32;
+    let mut tmp = vec![0.0; a.len()];
+    for (len, other) in [(w, h), (h, w)] {
+        max_plane(a, &mut tmp, len, whole, frac);
+        std::mem::swap(a, &mut tmp);
+        transpose(a, &mut tmp, len, other);
+        std::mem::swap(a, &mut tmp);
+    }
+}
+
+/// One horizontal pass of [`dilate_plane`] over the rows of `w` values of a plane: the largest
+/// value within `whole`, blended by `frac` towards the largest within `whole + 1`.
+fn max_plane(src: &[f32], dst: &mut [f32], w: usize, whole: usize, frac: f32) {
+    for (row, out) in src.chunks_exact(w).zip(dst.chunks_exact_mut(w)) {
+        for (x, o) in out.iter_mut().enumerate() {
+            let lo = x.saturating_sub(whole + 1);
+            let hi = (x + whole + 1).min(w - 1);
+            let (mut inner, mut ring) = (row[x], row[x]);
+            for (j, v) in row[lo..=hi].iter().enumerate() {
+                if (lo + j).abs_diff(x) <= whole {
+                    inner = inner.max(*v);
+                }
+                ring = ring.max(*v);
+            }
+            *o = inner + (ring - inner) * frac;
+        }
+    }
+}
+
 /// Premultiplied RGBA at 16 bits (×257): blurs and averages that keep their tones.
 pub(super) type Px16 = [u16; 4];
 

crates/effects/src/pixel/tests.rs

@@ -41,6 +41,26 @@ fn fx(id: &str, p: serde_json::Value) -> PixelFx {
     }
 }
 
+#[test]
+fn dilate_plane_grows_by_its_radius_and_blends_a_fraction() {
+    // GUARDS: an Outer Glow grows its silhouette by a quarter raster pixel before the blur; a step in
+    // that growth as the raster scales would show as the glow's width jumping with the zoom.
+    let mut dot = vec![0.0f32; 7 * 7];
+    dot[3 * 7 + 3] = 255.0;
+    let mut grown = dot.clone();
+    dilate_plane(&mut grown, 7, 7, 1.0);
+    assert_eq!(grown[2 * 7 + 2], 255.0);
+    assert_eq!(grown[7 + 3], 0.0);
+    let mut half = dot.clone();
+    dilate_plane(&mut half, 7, 7, 1.5);
+    assert_eq!(half[3 * 7 + 4], 255.0);
+    assert_eq!(half[3 * 7 + 5], 127.5);
+    assert_eq!(half[3 * 7 + 6], 0.0);
+    let mut same = dot.clone();
+    dilate_plane(&mut same, 7, 7, 0.0);
+    assert_eq!(same, dot);
+}
+
 fn grey(v: u8) -> [u8; 4] {
     [v, v, v, 255]
 }

crates/effects/src/raster.rs

@@ -29,6 +29,8 @@ pub enum RasterFx {
         /// instead of `color`; `None` when it is `color`.
         darkness: Option<f32>,
     },
+    /// Blurs the art's solid silhouette grown by a quarter of a pixel of the document's raster grid,
+    /// as the glows AI files export measure.
     OuterGlow {
         mode: BlendMode,
         opacity: f32,
@@ -93,6 +95,10 @@ impl RasterFx {
     pub fn spread(&self, bounds: Rect, line: f64) -> Rect {
         match self {
             RasterFx::Rasterize(r) => r.image(bounds, line),
+            RasterFx::OuterGlow { .. } => {
+                let o = self.outset(bounds) + 0.25 * line;
+                bounds.inflate(o, o)
+            }
             fx => {
                 let o = fx.outset(bounds);
                 bounds.inflate(o, o)

crates/engine/src/cmd/brushsym.rs

@@ -210,7 +210,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Symbolism Tool",
             [],
             None,
-            "{tool: shift|scrunch|size|spin|stain|screen|style, points: [[x,y]…], radius?: 40, intensity?: 1..10 (5), alt?: bool, color?, style?: name} adjust instances near the points (selection, else all) → {count}",
+            "{tool: shift|scrunch|size|spin|stain|screen|style, points: [[x,y]…], radius?: 40, intensity?: 1..10 (5), alt?: bool, color?, keepModel?: bool (as paint.setFill), style?: name} adjust instances near the points (selection, else all) → {count}",
             has_doc,
             symbol_adjust
         ),
@@ -1110,7 +1110,7 @@ fn symbol_adjust(s: &mut Session, p: &Value) -> Result<Value> {
     let alt = bool_or(p, "alt", false);
     let st = s.doc()?;
     let color = match p.get("color").and_then(color_value) {
-        Some(c) => c,
+        Some(c) => super::paint::new_color(s, p, c),
         None => s.paint.fill.color().unwrap_or(Color::BLACK),
     };
     let style_paint = match str_param(p, "style") {

crates/engine/src/cmd/buildcmds.rs

@@ -232,7 +232,7 @@ fn fill_param(s: &Session, p: &Value, cmd: &str) -> Result<Option<Paint>> {
         Some(v @ Value::Object(o)) if o.contains_key("color") || o.contains_key("swatch") || o.contains_key("gradient") || o.contains_key("none") => {
             paint_from(s, v)
         }
-        Some(v) => color_value(v).map(|c| Some(Paint::solid(c))).ok_or_else(|| bad(cmd, format!("bad fill {v}"))),
+        Some(v) => color_value(v).map(|c| Some(Paint::solid(super::paint::new_color(s, p, c)))).ok_or_else(|| bad(cmd, format!("bad fill {v}"))),
     }
 }
 

crates/engine/src/cmd/colortheme.rs

@@ -142,7 +142,8 @@ fn add_to_swatches(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "colorTheme.addToSwatches";
     let name = str_param(p, "name").ok_or_else(|| bad(C, "missing `name`"))?;
     let t = &s.prefs.color_themes[find(s, name, C)?];
-    let params = json!({ "name": t.name, "colors": t.colors.iter().map(color_json).collect::<Vec<_>>() });
+    // The theme's colors keep their model, in a CMYK document too.
+    let params = json!({ "name": t.name, "colors": t.colors.iter().map(color_json).collect::<Vec<_>>(), "keepModel": true });
     let r = s.execute("swatch.newGroup", &params)?;
     Ok(json!({ "name": r["name"], "swatches": r["swatches"] }))
 }

crates/engine/src/cmd/create.rs

@@ -74,7 +74,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Create Text",
             [],
             None,
-            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, area?: {width, height, fit?: none|autoHeight|shrinkText, fitMinPercent?}, placeholder?: bool (fill it with placeholder text instead, as the Type tools do with prefs placeholderText), justify?: \"auto\" (default: the start of each paragraph's direction)|\"left\"|\"center\"|\"right\"|\"justifyAll\" (point type: aligned on x, so \"center\" centres each line on the point and \"right\" ends it there; text.setStyle changes it later), leadingModel?: \"romanBaseline\"|\"emBoxTop\", charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (default: emBoxTop and emBoxCenter while the interface is in Japanese, else romanBaseline)} → {id, bounds: {x, y, width, height} (the new type's box as document.inspect reports it, after justify), overflow?: [id] (area type whose text doesn't fit its frame: the lines past it aren't drawn; left out when it fits)}; new area type gets Auto Size (fit autoHeight) when the autoSizeAreaType preference is on",
+            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, keepModel?: bool (as paint.setFill), area?: {width, height, fit?: none|autoHeight|shrinkText, fitMinPercent?}, placeholder?: bool (fill it with placeholder text instead, as the Type tools do with prefs placeholderText), justify?: \"auto\" (default: the start of each paragraph's direction)|\"left\"|\"center\"|\"right\"|\"justifyAll\" (point type: aligned on x, so \"center\" centres each line on the point and \"right\" ends it there; text.setStyle changes it later), leadingModel?: \"romanBaseline\"|\"emBoxTop\", charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (default: emBoxTop and emBoxCenter while the interface is in Japanese, else romanBaseline)} → {id, bounds: {x, y, width, height} (the new type's box as document.inspect reports it, after justify), overflow?: [id] (area type whose text doesn't fit its frame: the lines past it aren't drawn; left out when it fits)}; new area type gets Auto Size (fit autoHeight) when the autoSizeAreaType preference is on",
             has_doc,
             text_create
         ),
@@ -573,8 +573,9 @@ pub(crate) fn new_area_fit(s: &Session, p: &Value, c: &str) -> Result<vectorcraf
     Ok(super::typecmd::fit_param(p, default, c)?.unwrap_or(default))
 }
 
-/// The character style new type gets: `size`, `font`, `style` and `color` from `p`, else the
-/// defaults, filled with the current fill unless that is None or white (black then).
+/// The character style new type gets: `size`, `font`, `style` and `color` from `p` (an RGB
+/// `color` in a CMYK document as [`super::paint::new_color`] stores it), else the defaults,
+/// filled with the current fill unless that is None or white (black then).
 pub(crate) fn new_type_style(s: &Session, p: &Value) -> CharStyle {
     let mut style = CharStyle::default();
     if let Some(sz) = p.get("size").and_then(Value::as_f64) {
@@ -587,7 +588,7 @@ pub(crate) fn new_type_style(s: &Session, p: &Value) -> CharStyle {
         style.font_style = f.to_string();
     }
     style.fill = match p.get("color").and_then(color_value) {
-        Some(c) => vectorcraft_color::Paint::solid(c),
+        Some(c) => vectorcraft_color::Paint::solid(super::paint::new_color(s, p, c)),
         None if !s.paint.fill.is_none() && s.paint.fill != vectorcraft_color::Paint::solid(vectorcraft_color::Color::WHITE) => s.paint.fill.clone(),
         None => vectorcraft_color::Paint::solid(vectorcraft_color::Color::BLACK),
     };

crates/engine/src/cmd/draw2.rs

@@ -26,7 +26,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Pencil",
             [],
             None,
-            "{points: [[x,y]…] or [[x,y,pressure]…] (pen pressure 0..1: the stroke keeps it, for Calligraphic brushes with Pressure variation; a point without one presses fully), fidelity?: pt (1.5), closed?, style?: \"pencil\"|\"brush\", fill?: bool, keepSelected?: bool (true: the drawn or continued path is selected; false: it is not, and the rest of the selection stays), extend?: {id, end: \"start\"|\"end\"}} fit a freehand stroke → {id}",
+            "{points: [[x,y]…] or [[x,y,pressure]…] (pen pressure 0..1: the stroke keeps it, for Calligraphic brushes with Pressure variation; a point without one presses fully), fidelity?: pt (1.5), closed?, style?: \"pencil\"|\"brush\", fill?: bool, keepSelected?: bool (true: the drawn or continued path is selected; false: it is not, and the rest of the selection stays), extend?: {id, end: \"start\"|\"end\"}, redraw?: {id, within?: pt (12)}} fit a freehand stroke → {id}. extend continues the path from that end; redraw (Edit Selected Paths) replaces the section of the path between where the stroke starts and ends, each within `within` of one subpath (the shorter way round a closed one), and draws a new path when the stroke doesn't end on it",
             has_doc,
             freehand
         ),
@@ -53,7 +53,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Delete Anchor Point",
             [],
             None,
-            "{id, subpath, anchor} remove one anchor, re-fitting the curve",
+            "{id, subpath?, anchor} remove one anchor, re-fitting the curve",
             has_doc,
             remove_anchor
         ),
@@ -71,7 +71,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Convert Anchor Point",
             [],
             None,
-            "{id, subpath, anchor, to: \"corner\"|\"smooth\", x?, y?} (smooth with x/y: out handle there, in handle mirrored; without: as the Curvature tool curves a point, along the circle through it and its neighbours, or at an open end one handle into the curve)",
+            "{id, subpath?, anchor, to: \"corner\"|\"smooth\", x?, y?} (smooth with x/y: out handle there, in handle mirrored; without: as the Curvature tool curves a point, along the circle through it and its neighbours, or at an open end one handle into the curve)",
             has_doc,
             convert_anchor
         ),
@@ -80,7 +80,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Reshape Segment",
             [],
             None,
-            "{id, subpath, segment, t, dx, dy, perpendicular?: bool} bend a segment so the point at t moves by (dx, dy); with perpendicular (Shift), both handles stand at right angles to the line between its anchors at one length, and the point at t lies as far from that line as the moved point does",
+            "{id, subpath?, segment, t, dx, dy, perpendicular?: bool} bend a segment so the point at t moves by (dx, dy); with perpendicular (Shift), both handles stand at right angles to the line between its anchors at one length, and the point at t lies as far from that line as the moved point does",
             has_doc,
             reshape_segment
         ),
@@ -89,7 +89,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Split Path",
             [],
             None,
-            "{id, subpath, segment, t} or {id, subpath, anchor}: closed paths open there, open paths become two → {ids}",
+            "{id, subpath?, segment, t} or {id, subpath?, anchor}: closed paths open there, open paths become two → {ids}",
             has_doc,
             split
         ),
@@ -215,6 +215,15 @@ fn usize_req(p: &Value, key: &str, cmd: &str) -> Result<usize> {
     p.get(key).and_then(Value::as_u64).map(|v| v as usize).ok_or_else(|| bad(cmd, format!("missing integer `{key}`")))
 }
 
+/// The whole number of 0 or more that `key` holds, or `None` when `key` is absent or null. Any other
+/// value is [`usize_req`]'s error.
+pub(super) fn usize_opt(p: &Value, key: &str, cmd: &str) -> Result<Option<usize>> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(_) => usize_req(p, key, cmd).map(Some),
+    }
+}
+
 fn path_mut(d: &mut Document, id: NodeId) -> Result<&mut PathData> {
     let n = d.node_mut(id).ok_or(EngineError::NoNode(id))?;
     match &mut n.kind {
@@ -548,6 +557,87 @@ fn fit_freehand(pts: &[Point], tol: f64, closed: bool) -> SubPath {
     fitted.subpaths.into_iter().next().filter(|s| s.anchors.len() >= 2).unwrap_or(sp)
 }
 
+/// Pencil's Edit Selected Paths in the middle of a path: a stroke from one point of a subpath of
+/// `pd` to another, each within `within` of it, replaces the section between them (the shorter
+/// way round a closed subpath) with the stroke fitted at `tol`. The subpath's index and its new
+/// shape; None when the stroke doesn't start and end on the same subpath, or meets it once.
+fn redraw_section(pd: &PathData, pts: &[Point], tol: f64, within: f64) -> Option<(usize, SubPath)> {
+    use kurbo::ParamCurveArclen;
+    let (first, last) = (*pts.first()?, *pts.last()?);
+    let (si, _, _, _, d_a) = pd.nearest(first)?;
+    let (sj, _, _, _, d_b) = pd.nearest(last)?;
+    if si != sj || d_a > within || d_b > within || pts.len() < 2 {
+        return None;
+    }
+    let mut sp = pd.subpaths.get(si)?.clone();
+    if sp.anchors.len() < 2 {
+        return None;
+    }
+    // The anchor nearest to `q`: the one there, else a new one, and whether it was added. Each
+    // point is looked up on the subpath as it is by then: splitting a straight segment makes two
+    // new ones, which a `t` along the old one doesn't measure.
+    let place = |sp: &mut SubPath, q: Point| {
+        let (_, seg, t, _, _) = PathData::single(sp.clone()).nearest(q)?;
+        let n = sp.anchors.len();
+        Some(if t <= 1e-6 {
+            (seg % n, false)
+        } else if t >= 1.0 - 1e-6 {
+            ((seg + 1) % n, false)
+        } else {
+            (sp.insert_anchor(seg, t), true)
+        })
+    };
+    let (mut from, _) = place(&mut sp, first)?;
+    let (to, added) = place(&mut sp, last)?;
+    if added && to <= from {
+        from += 1;
+    }
+    if from == to {
+        return None;
+    }
+    let n = sp.anchors.len();
+    // The length of the run of segments from anchor i forward to anchor j.
+    let run = |i: usize, j: usize| (0..(j + n - i) % n).map(|k| sp.segment((i + k) % n).arclen(0.01)).sum::<f64>();
+    // The stroke goes from `start` to `end` and replaces the run between them; `kept` runs from
+    // `end` round to `start`, then the stroke's inner anchors follow.
+    let (start, end, reversed) = if sp.closed {
+        if run(from, to) <= run(to, from) { (from, to, false) } else { (to, from, true) }
+    } else if from < to {
+        (from, to, false)
+    } else {
+        (to, from, true)
+    };
+    let mut stroke = pts.to_vec();
+    if reversed {
+        stroke.reverse();
+    }
+    let (Some(s0), Some(s1)) = (stroke.first_mut(), sp.anchors.get(start)) else { return None };
+    *s0 = s1.p;
+    let (Some(e0), Some(e1)) = (stroke.last_mut(), sp.anchors.get(end)) else { return None };
+    *e0 = e1.p;
+    let fit = fit_freehand(&stroke, tol, false).anchors;
+    let (Some(f0), Some(f1)) = (fit.first().copied(), fit.last().copied()) else { return None };
+    let inner = fit.get(1..fit.len().saturating_sub(1)).unwrap_or_default();
+    let (before, after): (Vec<Anchor>, Vec<Anchor>) = if sp.closed {
+        ((0..=(start + n - end) % n).filter_map(|k| sp.anchors.get((end + k) % n).copied()).collect(), vec![])
+    } else {
+        (sp.anchors.get(..=start)?.to_vec(), sp.anchors.get(end..)?.to_vec())
+    };
+    let mut anchors = before;
+    if let Some(a) = anchors.last_mut() {
+        *a = Anchor::with_handles(a.p, a.h_in, f0.h_out);
+    }
+    anchors.extend_from_slice(inner);
+    let at_end = anchors.len();
+    anchors.extend(after);
+    // The anchor the stroke ends on: the first after it, or round to the first of a closed one.
+    let end_at = if sp.closed { 0 } else { at_end };
+    if let Some(a) = anchors.get_mut(end_at) {
+        *a = Anchor::with_handles(a.p, f1.h_in, a.h_out);
+    }
+    Some((si, SubPath::new(anchors, sp.closed)))
+}
+
 fn freehand(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.freehand";
     let samples = samples_param(p, "points", C)?;
@@ -630,6 +720,28 @@ fn freehand(s: &mut Session, p: &Value) -> Result<Value> {
         })?;
         return Ok(json!({ "id": id.0 }));
     }
+    if let Some(rd) = p.get("redraw").filter(|v| !v.is_null()) {
+        let id = id_param(rd, "id").ok_or_else(|| bad(C, "redraw needs id"))?;
+        let within = f64_or(rd, "within", 12.0);
+        if !within.is_finite() || within < 0.0 {
+            return Err(bad(C, "redraw within must be a finite distance of 0 or more"));
+        }
+        let (pd, _) = path_of(&s.doc()?.doc, id)?;
+        // shortcut: a stroke pressure profile is left as it was, measured along the old path; fit
+        // it to the new length if Calligraphic pressure strokes get redrawn.
+        if let Some((si, sp)) = redraw_section(&pd, &pts, tol, within) {
+            s.edit(if brush { "Paintbrush" } else { "Pencil" }, |d, sel| {
+                *path_mut(d, id)?.subpaths.get_mut(si).ok_or_else(|| bad(C, "no such subpath"))? = sp;
+                if keep_selected {
+                    sel.set([id]);
+                } else {
+                    sel.remove(id);
+                }
+                Ok(())
+            })?;
+            return Ok(json!({ "id": id.0 }));
+        }
+    }
     if pts.len() < 2 {
         return Err(bad(C, "need at least two points"));
     }
@@ -692,7 +804,7 @@ fn curvature_edit(s: &mut Session, p: &Value) -> Result<Value> {
     use vectorcraft_tools::draw2::{EndCurve, curvature_close, curvature_extend, curvature_insert, curvature_move};
     const C: &str = "path.curvatureEdit";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
     let at = match (p.get("x").and_then(Value::as_f64), p.get("y").and_then(Value::as_f64)) {
         (Some(x), Some(y)) if x.is_finite() && y.is_finite() => Some(Point::new(x, y)),
         (None, None) => None,
@@ -756,7 +868,7 @@ fn curvature_edit(s: &mut Session, p: &Value) -> Result<Value> {
 fn remove_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.removeAnchor";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
     let ai = usize_req(p, "anchor", C)?;
     let removed = s.edit("Delete Anchor Point", |d, sel| {
         let sp = path_mut(d, id)?.subpaths.get(si).ok_or_else(|| EngineError::Other("no such subpath".into()))?;
@@ -863,7 +975,7 @@ fn remove_anchors_of(
 fn convert_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.convertAnchor";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
     let ai = usize_req(p, "anchor", C)?;
     let smooth = str_param(p, "to") == Some("smooth");
     let target = match (p.get("x").and_then(Value::as_f64), p.get("y").and_then(Value::as_f64)) {
@@ -898,7 +1010,7 @@ fn convert_anchor(s: &mut Session, p: &Value) -> Result<Value> {
 fn reshape_segment(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.reshapeSegment";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
     let seg = usize_req(p, "segment", C)?;
     let t = f64_or(p, "t", 0.5).clamp(0.05, 0.95);
     let dv = Vec2::new(f64_or(p, "dx", 0.0), f64_or(p, "dy", 0.0));
@@ -923,9 +1035,9 @@ fn reshape_segment(s: &mut Session, p: &Value) -> Result<Value> {
 fn split(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "path.split";
     let id = id_param(p, "id").ok_or_else(|| bad(C, "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
-    let anchor = p.get("anchor").and_then(Value::as_u64).map(|v| v as usize);
-    let seg = p.get("segment").and_then(Value::as_u64).map(|v| v as usize);
+    let si = usize_opt(p, "subpath", C)?.unwrap_or(0);
+    let anchor = usize_opt(p, "anchor", C)?;
+    let seg = usize_opt(p, "segment", C)?;
     if anchor.is_none() && seg.is_none() {
         return Err(bad(C, "need `anchor` or `segment` + `t`"));
     }

crates/engine/src/cmd/edit.rs

@@ -75,6 +75,15 @@ pub fn specs() -> Vec<CommandSpec> {
         ),
         cmd!("edit.undo", "Undo", ["Edit"], Some("Cmd+Z"), "{}", can_undo, undo),
         cmd!("edit.redo", "Redo", ["Edit"], Some("Cmd+Shift+Z"), "{}", can_redo, redo),
+        cmd!(
+            "edit.clearHistory",
+            "Clear History",
+            [],
+            None,
+            "{} remove every undo and redo step of the active document (the History panel menu's Clear History): the document stays as it is, and clearing is not an undo step → {cleared: the number of steps removed}",
+            can_clear_history,
+            clear_history
+        ),
         cmd!(
             "edit.undoGroup.begin",
             "Begin Undo Group",
@@ -380,7 +389,9 @@ fn undo(s: &mut Session, _: &Value) -> Result<Value> {
     let doc = std::mem::replace(&mut st.doc, e.doc);
     let selection = std::mem::replace(&mut st.selection, Arc::unwrap_or_clone(e.selection));
     let selection = shared_selection(selection, st.history.redo.last());
-    st.history.redo.push(crate::HistoryEntry::turned(e.label, doc, selection, &st.doc, costs));
+    let mut turned = crate::HistoryEntry::turned(e.label, doc, selection, &st.doc, costs);
+    turned.named = e.named;
+    st.history.redo.push(turned);
     st.history.trim();
     st.revision += 1;
     st.selection.prune(&st.doc);
@@ -403,7 +414,9 @@ fn redo(s: &mut Session, _: &Value) -> Result<Value> {
     let doc = std::mem::replace(&mut st.doc, e.doc);
     let selection = std::mem::replace(&mut st.selection, Arc::unwrap_or_clone(e.selection));
     let selection = shared_selection(selection, st.history.undo.last());
-    st.history.undo.push(crate::HistoryEntry::turned(e.label, doc, selection, &st.doc, costs));
+    let mut turned = crate::HistoryEntry::turned(e.label, doc, selection, &st.doc, costs);
+    turned.named = e.named;
+    st.history.undo.push(turned);
     st.history.trim();
     st.revision += 1;
     st.selection.prune(&st.doc);
@@ -414,6 +427,19 @@ fn redo(s: &mut Session, _: &Value) -> Result<Value> {
     Ok(json!({ "redone": label }))
 }
 
+/// History panel › Clear History: removes the steps after the current state and the steps before
+/// it, and leaves the document as it is. Typing or a drag still in progress is first kept as a
+/// step, as Undo keeps it, so it is removed with the others and its change stays in the document.
+fn clear_history(s: &mut Session, _: &Value) -> Result<Value> {
+    settle_interaction(s)?;
+    let st = s.doc_mut()?;
+    let cleared = st.history.undo.len() + st.history.redo.len();
+    st.history.undo.clear();
+    st.history.redo.clear();
+    st.revision += 1;
+    Ok(json!({ "cleared": cleared }))
+}
+
 /// `selection` for an undo (redo) step, sharing that of `like`, the step beside it, when the same.
 fn shared_selection(selection: vectorcraft_doc::Selection, like: Option<&crate::HistoryEntry>) -> Arc<vectorcraft_doc::Selection> {
     match like {

crates/engine/src/cmd/effectcmd.rs

@@ -139,6 +139,7 @@ pub(crate) fn apply(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, "`params` must be an object"));
     }
     super::params::check_effect_color(C, id, &params)?;
+    super::params::check_effect_channel(C, id, &params)?;
     // Crop Marks take their style from the preferences when applied.
     if id == effects::CROP_MARKS && params.get("style").is_none() {
         params["style"] = json!(s.crop_mark_style().id());
@@ -317,6 +318,7 @@ fn set_params(s: &mut Session, p: &Value) -> Result<Value> {
     let edited = set_params_effects(s, p);
     for effect in &edited {
         super::params::check_effect_color(C, effect, &params)?;
+        super::params::check_effect_channel(C, effect, &params)?;
     }
     if edited.iter().any(|e| e == GLASS) {
         load_texture(&mut params, C)?;

crates/engine/src/cmd/expand.rs

@@ -318,7 +318,7 @@ fn expand_fills(d: &mut Document, l: &Node, to: GradientTo) -> Option<Node> {
 /// fill's opacity, blend mode and effects other than geometry effects ([`fill_effects`]).
 fn gradient_art(d: &mut Document, l: &Node, path: &PathData, bounds: Rect, f: &FillLayer, g: &GradientPaint, to: GradientTo) -> Option<Node> {
     let content = if g.gradient.kind == GradientKind::Freeform {
-        let m = GradientMesh::for_path_with(path, FREEFORM_MESH, FREEFORM_MESH, &*gradient_sampler(g, bounds))?;
+        let m = GradientMesh::for_path_with(path, FREEFORM_MESH, FREEFORM_MESH, &*gradient_sampler(g, bounds, d.color_mode.model()))?;
         vec![Node::new(d.alloc_id(), NodeKind::Mesh(m))]
     } else {
         let frame = Frame::new(g, bounds);
@@ -720,29 +720,24 @@ fn tile_art(d: &mut Document, l: &Node, f: &FillLayer, tiles: &[Node]) -> Option
 
 /// The colour and opacity gradient fill `g` paints at a document point of an object whose box is
 /// `bounds`, as the canvas draws it (the end colours continue past the ends). Colours stay in the
-/// colour model their stops (or freeform points) share; display RGB where models differ.
-pub(crate) fn gradient_sampler(g: &GradientPaint, bounds: Rect) -> Box<dyn Fn(Point) -> (Color, f32) + '_> {
+/// color model their stops share; display RGB where models differ. Freeform points mix in the
+/// model they share ([`vectorcraft_color::Freeform::model_field`]); where their models differ, the
+/// RGB color they mix to is stored in `doc_model` (the document's model) the way `paint.setFill`
+/// stores an RGB color ([`super::paint::stored_color`]).
+pub(crate) fn gradient_sampler(g: &GradientPaint, bounds: Rect, doc_model: Model) -> Box<dyn Fn(Point) -> (Color, f32) + '_> {
     if g.gradient.kind == GradientKind::Freeform {
         let b = bounds.abs();
-        let f = g.freeform_on(b);
-        let model = shared_model(f.points.iter().map(|p| p.color));
-        let field = f.field(spread_scale(b));
+        let field = g.freeform_on(b).model_field(spread_scale(b));
+        let store_in = (field.model().is_none() && doc_model != Model::Rgb).then_some(doc_model);
         return Box::new(move |p| {
-            let ([r, g, b], a) = field.sample(p);
-            let c = Color::rgb(r, g, b);
-            (model.map_or(c, |m| c.in_model(m)), a)
+            let (c, a) = field.sample(p);
+            (super::paint::stored_color(store_in, c), a)
         });
     }
     let geom = g.resolve(bounds);
     Box::new(move |p| g.gradient.sample_with(geom.param_at(g.gradient.kind, p) as f32, lerp_color))
 }
 
-/// The colour model all of `colors` share.
-fn shared_model(mut colors: impl Iterator<Item = Color>) -> Option<Model> {
-    let m = colors.next()?.model();
-    colors.all(|c| c.model() == m).then_some(m)
-}
-
 /// Where the colour changes along a gradient between parameters `t0` and `t1`: both ends, every
 /// stop between them (in its own colour, so coincident stops keep a sharp edge) and every midpoint
 /// off the centre, as (parameter, colour, opacity) in order, with more between them where they

crates/engine/src/cmd/fileio/eps.rs

@@ -278,7 +278,7 @@ pub(super) fn encode(doc: &Document, p: &Value) -> Result<Encoded> {
     if transparent && flat.is_some() {
         enc.warnings.push("transparency is flattened into opaque art and images (EPS has none): see the flattener preset".into());
     }
-    let created = vectorcraft_doc::metadata::now_unix();
+    let created = vectorcraft_doc::metadata::output_time();
     let mut renderer = vectorcraft_render::Renderer::new();
     for (board, region, origin) in pages {
         let rect = vectorcraft_eps::preview_rect(region, origin);

crates/engine/src/cmd/fileio/export.rs

@@ -172,7 +172,7 @@ fn selection(s: &mut Session, cmd: &str) -> Result<(Document, vectorcraft_geom::
 
 /// The selected objects (their top-most selected ancestors) that are artwork: those on template
 /// layers are guides and are left out.
-pub(crate) fn selected_artwork(s: &mut Session) -> Result<Vec<NodeId>> {
+pub(crate) fn selected_artwork(s: &Session) -> Result<Vec<NodeId>> {
     let ids = edit::selected_roots(s)?;
     let st = s.doc()?;
     let is_template = |id| st.doc.node(id).is_some_and(|l| matches!(l.kind, NodeKind::Layer { template: true, .. }));

crates/engine/src/cmd/fileio/legacy_ai.rs

@@ -15,7 +15,9 @@
 //! blending mode written opaque is a box hiding the art under it (version 7 images have no alpha
 //! channel, §8.1). With `flatten` (the default) each becomes an opaque image of itself and the art
 //! under it, rendered from the document as it is, clipped to the area where it changes what shows;
-//! the art under it stays as it was. With `omit` they are left out.
+//! the art under it stays as it was. With `omit` they are left out. An image that can't be decoded
+//! is missing from the images that flattening and expanding raster effects draw, and the warnings
+//! then carry the raster exports' note once.
 //!
 //! The format can't hide objects, only layers (`hiddenObjects`): with `layer` (the default) each
 //! layer's hidden objects go to a hidden layer of their own just above it, with `omit` they are
@@ -33,15 +35,20 @@ use vectorcraft_geom::{Anchor, FillRule, PathData, Point, Rect, SubPath};
 use super::super::*;
 use super::{ArtboardPick, Encoded, Format};
 
-/// Does `p` ask for a legacy `.ai` file of version 7 (`aiVersion: "7"`)? An unknown version is an error.
-pub(super) fn wanted(cmd: &str, p: &Value) -> Result<bool> {
-    match p.get("aiVersion") {
-        None | Some(Value::Null) => Ok(false),
-        Some(Value::String(v)) if v.trim().is_empty() || v.eq_ignore_ascii_case("pdf") => Ok(false),
-        Some(Value::String(v)) if v.trim() == "7" => Ok(true),
-        Some(Value::Number(n)) if n.as_f64() == Some(7.0) => Ok(true),
-        Some(v) => Err(bad(cmd, format!("aiVersion {v}: \"pdf\" (PDF-compatible, the default) or \"7\" (legacy .ai, version 7)"))),
+/// Does `p` ask a save in `f` for a legacy `.ai` file of version 7 (`aiVersion: "7"`)? An unknown
+/// version is an error, and so is version 7 for a `.ait` template, which is PDF-compatible only.
+pub(super) fn wanted(cmd: &str, f: &Format, p: &Value) -> Result<bool> {
+    let legacy = match p.get("aiVersion") {
+        None | Some(Value::Null) => false,
+        Some(Value::String(v)) if v.trim().is_empty() || v.eq_ignore_ascii_case("pdf") => false,
+        Some(Value::String(v)) if v.trim() == "7" => true,
+        Some(Value::Number(n)) if n.as_f64() == Some(7.0) => true,
+        Some(v) => return Err(bad(cmd, format!("aiVersion {v}: \"pdf\" (PDF-compatible, the default) or \"7\" (legacy .ai, version 7)"))),
+    };
+    if legacy && f.id == "ait" {
+        return Err(bad(cmd, "aiVersion 7 writes legacy .ai files; a .ait template is always PDF-compatible"));
     }
+    Ok(legacy)
 }
 
 /// What a legacy `.ai` does with the images it can't hold (`transparentImages`).
@@ -103,7 +110,8 @@ pub(super) fn encode(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result
     if boards.len() > 1 {
         enc.warnings.push(SEPARATE.to_string());
     }
-    let created = vectorcraft_doc::metadata::now_unix();
+    let created = vectorcraft_doc::metadata::output_time();
+    let failed = vectorcraft_render::decode_failures();
     for b in boards {
         let one = super::save::artboard_doc(doc, b);
         let (full, placed) = crate::cmd::place::document::full_documents(&one);
@@ -127,6 +135,11 @@ pub(super) fn encode(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result
         }
         enc.files.push((Some(b), out.bytes));
     }
+    // Expanding raster effects and flattening images draw the art, and an image the renderer
+    // couldn't decode drew nothing there.
+    if let Some(w) = super::super::rasterfx::undecoded_warning(failed) {
+        note(&mut enc.warnings, w);
+    }
     Ok(enc)
 }
 

crates/engine/src/cmd/fileio/load.rs

@@ -194,6 +194,12 @@ fn from_editing_data_alone(bytes: &[u8], opts: &LoadOptions) -> Option<Result<(D
     )
 }
 
+/// Do `opts` read every page of the PDF `bytes`: no `pages`, or a range that names each one?
+fn every_page(bytes: &[u8], opts: &LoadOptions) -> bool {
+    let Some(range) = &opts.pages else { return true };
+    vectorcraft_pdf::info(bytes, opts.password.as_deref()).is_ok_and(|i| parse_range(range, i.pages.len()).is_ok_and(|p| p.len() == i.pages.len()))
+}
+
 /// [`load`] with `document.open` options (the PDF pages, box and password; the DXF options).
 pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded> {
     let format = detect(name, bytes).ok_or_else(|| match super::unsupported(&super::extension(name)) {
@@ -239,9 +245,11 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
                     let alone = r.only_text.then(|| from_editing_data_alone(bytes, opts)).flatten().and_then(|read| read.ok());
                     Ok(alone.unwrap_or_else(|| through_editing_data(bytes, opts, r.document, r.warnings, r.user_unit)))
                 }
-                // Saved without its PDF part: the editing copy is all the file has.
+                // Saved without its PDF part: the editing copy is all the file has (`pages` that
+                // name every page read it as the whole file).
                 Err(e) if e.to_string() == vectorcraft_pdf::PdfError::PlaceholderOnly.to_string() => {
-                    from_editing_data_alone(bytes, opts).unwrap_or(Err(e))
+                    let whole = LoadOptions { pages: None, ..opts.clone() };
+                    from_editing_data_alone(bytes, if every_page(bytes, opts) { &whole } else { opts }).unwrap_or(Err(e))
                 }
                 Err(e) => Err(e),
             })?
@@ -481,6 +489,10 @@ pub(crate) fn too_large_note(bytes: &[u8]) -> Option<String> {
 /// too ([`vectorcraft_doc::cmyk::group3_tiff_rgba`]).
 /// Grayscale TIFFs with an alpha channel or other extra channels, which the decoder can't read
 /// either, become RGBA too, whether they store their channels together or one plane per channel.
+/// A Targa file, which starts with no signature, is recognized by its header
+/// ([`super::tgaread::is_targa`]) and becomes RGBA with the transparency it stores
+/// ([`super::tgaread::fix_alpha`]). An image stored as PNG whose decoded samples, or whose pixels
+/// as RGBA, need more than [`MAX_RASTER_ALLOC`] is refused as too large to draw.
 /// A TIFF with more strips or tiles than the decoder can count
 /// ([`vectorcraft_doc::cmyk::oversized_tiff`]) is refused as too large to draw.
 pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
@@ -493,6 +505,9 @@ pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
         return as_png(psdread::decode(bytes, MAX_RASTER_ALLOC, |c| cms.cmyk_to_srgb(c, false)).map_err(err)?, ppi);
     }
     let mut reader = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().map_err(err)?;
+    if reader.format().is_none() && super::tgaread::is_targa(bytes) {
+        reader.set_format(image::ImageFormat::Tga);
+    }
     let mut limits = image::Limits::default();
     limits.max_alloc = Some(MAX_RASTER_ALLOC);
     reader.limits(limits);
@@ -511,13 +526,25 @@ pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
         let cms = vectorcraft_color::cms::active();
         vectorcraft_doc::cmyk::extra_samples_tiff_rgba(bytes, |c| cms.cmyk_to_srgb(c, false))
     };
-    let img = match (f.id == "tiff").then(extra_samples).flatten() {
+    let mut img = match (f.id == "tiff").then(extra_samples).flatten() {
         Some(img) => img,
         None => match (f.id == "tiff").then(|| vectorcraft_doc::cmyk::group3_tiff_rgba(bytes)).flatten() {
             Some(read) => read.map_err(err)?,
-            None => reader.decode().map_err(err)?.to_rgba8(),
+            None => {
+                use image::ImageDecoder as _;
+                let decoder = reader.into_decoder().map_err(err)?;
+                // The allowance counts the decoded samples and the RGBA pixels they become (#1717).
+                let (w, h) = decoder.dimensions();
+                if decoder.total_bytes() > MAX_RASTER_ALLOC || u64::from(w) * u64::from(h) * 4 > MAX_RASTER_ALLOC {
+                    return Err(err(format!("an image of {w} × {h} pixels is too large to draw")));
+                }
+                image::DynamicImage::from_decoder(decoder).map_err(err)?.to_rgba8()
+            }
         },
     };
+    if f.id == "tga" {
+        super::tgaread::fix_alpha(bytes, &mut img);
+    }
     as_png(img, ppi)
 }
 

crates/engine/src/cmd/fileio/mod.rs

@@ -40,11 +40,13 @@ pub mod pdf;
 mod pdfimport;
 pub mod pngtext;
 pub mod ppi;
+pub mod progress;
 pub mod psdread;
 mod save;
 mod screens;
 mod svg;
 mod text;
+mod tgaread;
 pub mod zip;
 
 use serde_json::{Value, json};
@@ -75,7 +77,7 @@ pub use save::{
 };
 pub use screens::{
     PRESET_KEYS as SCREEN_EXPORT_PRESET_KEYS, PRESETS as SCREEN_PRESETS, ScreenExportPreset, ScreenSize,
-    builtin_presets as screen_export_builtin_presets, preset_rows as screen_preset_rows,
+    builtin_presets as screen_export_builtin_presets, first_file as screen_first_file, preset_rows as screen_preset_rows,
 };
 pub(crate) use screens::{
     SHARED_KEYS as SCREEN_SETTINGS_KEYS, check_settings as check_screen_settings, export as export_screens, safe_file_name,
@@ -115,7 +117,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Serialize Document",
             [],
             None,
-            "{format?: vectorcraft (default)|template|svg|svgz|pdf|ai|png|jpg|webp|gif|png8|txt|dxf|eps|emf|wmf|tiff|bmp|tga|psd, …the format's options (see document.formats; SVG ones also as svg: {…}), selectedOnly?: false (the selected objects alone, in their layers)} → {text, warnings} for svg (plus dataBase64, the file, when its encoding isn't UTF-8), else {dataBase64, warnings}; an SVG of several artboards also gives files: [{name, text}], linked images linked: [{name, dataBase64}]",
+            "{format?: vectorcraft (default)|template|svg|svgz|pdf|ai|png|jpg|webp|gif|png8|txt|dxf|eps|emf|wmf|tiff|bmp|tga|psd (ait, a .ait template, is written by file.saveAsTemplate), …the format's options (see document.formats; SVG ones also as svg: {…}), selectedOnly?: false (the selected objects alone, in their layers)} → {text, warnings} for svg (plus dataBase64, the file, when its encoding isn't UTF-8), else {dataBase64, warnings}; an SVG of several artboards also gives files: [{name, text}], linked images linked: [{name, dataBase64}]",
             has_doc,
             export::serialize
         ),
@@ -124,7 +126,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Export Document",
             [],
             None,
-            "{path?, format?: svg|svgz|pdf|ai|png|jpg|webp|gif|png8|txt|dxf|eps|emf|wmf|tiff|bmp|tga|psd|vectorcraft|template (default: from the path's extension, else png; png8 writes an indexed .png), selectedOnly?: false (the selected objects alone, in their layers), artboard?: 0, artboards?: [i…], rect?: [x, y, width, height] (raster formats: that area of the page in points, y down, instead of an artboard; not with artboard, artboards, range or useArtboards), range?: \"1-3, 5\" | \"all\" (1-based; PDF and .ai write one page per artboard, default all; SVG writes one file per artboard, {stem}-{artboard}.svg; raster formats write one artboard), useArtboards?: true (raster: one file per chosen artboard, default all, {stem}-{artboard}.{ext}; pdf/ai: every page) | false (pdf/ai/raster: the bounds of the visible art; SVG has it as an SVG option), ppi?: 72 (raster formats: pixels per inch, stored in the file; wins over scale), scale?: 1 (pixels per point), background?: transparent|white|black|\"#rrggbb\" (jpg: white when transparent), antiAlias?: none|art (default)|type (text snapped to pixels), interlaced?: false (png, Adam7), embedIcc?: true (png: an sRGB chunk marks the colours as sRGB), quality?: 90 (jpg: 0–100), colorModel?: rgb|cmyk|gray (jpg), method?: baseline|optimized|progressive, scans?: 3 (3–5, progressive), embedIcc?: true, imageMap?: none|client|server (an HTML or NCSA map of the objects with a URL, written as <stem>.html / <stem>.map), colors?: 256 (gif/png8: 2–256), reduction?: perceptual|selective (default)|adaptive|web|blackWhite|gray, dither?: none|diffusion (default)|pattern|noise, ditherAmount?: 100, transparency?: true, matte?: white|\"#rrggbb\"|none, interlaced?, lossless?: true (webp: lossy WebP isn't available yet: written lossless, with a warning), encoding?: utf8|utf16 (txt: the stories in stacking order, back to front, a thread once; utf16 with a byte order mark), lineEndings?: lf|crlf, selectionOnly?: false, svg?: {styling, outlineText, images, objectIds, decimals, minify, responsive, useArtboards, preserveEditing, metadata, fewerTspans, hiddenLayers, encoding, profile, embedFonts} (see document.formats), …the SVG options given flat instead, …the PDF options of document.exportPdf, …the DXF options of document.exportDxf (useArtboards: one drawing per artboard), …the EPS options of document.exportEps (useArtboards: one file per artboard, {stem}_{artboard}.eps; else the visible art), …emf and wmf write one picture of the artboard (useArtboards: true one file per chosen artboard, false the bounds of the visible art; EMF keeps curves, clipping, transparent images and gradients as images clipped to their shape; WMF flattens curves into polygons behind a placeable header; what a format leaves out comes back in warnings), colorModel?: rgb|cmyk|gray (tiff: rgb keeps transparency as an alpha channel), lzw?: true, byteOrder?: little|big, embedIcc?: true, colorModel?: rgb|gray (bmp), depth?: 24 (bmp: 1 black and white, 4|8 a palette by reduction and dither, 16, 24, 32 with alpha), fileFormat?: windows|os2 (1, 4, 8 or 24 bits), rle?: false (4 and 8 bits, windows), flipRows?: false (top-down rows), depth?: 24 (tga: 16 one-bit alpha, 24, 32 with alpha), colorModel?: rgb|cmyk|gray (psd), layers?: true (each top-level layer a pixel layer with its opacity and blend mode; a background colour is a Background layer; false: one flat image, on white), maxEditability?: false (layers and sublayers become groups, each object a layer named as in the Layers panel, text by its text; clipping, masked or knockout layers stay one layer), hiddenLayers?: false (hidden layers and objects written hidden instead of left out), embedIcc?: true (at most 30000 pixels a side; formats without alpha are flattened on white)} → {path, format, bytes, warnings, files?: [path…] (several), linked?: [path…] (linked images, image maps)}; no path → {dataBase64, format, bytes, warnings, files?: [{name, dataBase64}], linked?: [{name, dataBase64}]}. Never changes the document's path",
+            "{path?, format?: svg|svgz|pdf|ai|png|jpg|webp|gif|png8|txt|dxf|eps|emf|wmf|tiff|bmp|tga|psd|vectorcraft|template (default: from the path's extension, else png; png8 writes an indexed .png; ait, a .ait template, is written by file.saveAsTemplate), selectedOnly?: false (the selected objects alone, in their layers), artboard?: 0, artboards?: [i…], rect?: [x, y, width, height] (raster formats: that area of the page in points, y down, instead of an artboard; not with artboard, artboards, range or useArtboards), range?: \"1-3, 5\" | \"all\" (1-based; PDF and .ai write one page per artboard, default all; SVG writes one file per artboard, {stem}-{artboard}.svg; raster formats write one artboard), useArtboards?: true (raster: one file per chosen artboard, default all, {stem}-{artboard}.{ext}; pdf/ai: every page) | false (pdf/ai/raster: the bounds of the visible art; SVG has it as an SVG option), ppi?: 72 (raster formats: pixels per inch, stored in the file; wins over scale), scale?: 1 (pixels per point), background?: transparent|white|black|\"#rrggbb\" (jpg: white when transparent), antiAlias?: none|art (default)|type (text snapped to pixels), interlaced?: false (png, Adam7), embedIcc?: true (png: an sRGB chunk marks the colours as sRGB), quality?: 90 (jpg: 0–100), colorModel?: rgb|cmyk|gray (jpg), method?: baseline|optimized|progressive, scans?: 3 (3–5, progressive), embedIcc?: true, imageMap?: none|client|server (an HTML or NCSA map of the objects with a URL, written as <stem>.html / <stem>.map), colors?: 256 (gif/png8: 2–256), reduction?: perceptual|selective (default)|adaptive|web|blackWhite|gray, dither?: none|diffusion (default)|pattern|noise, ditherAmount?: 100, transparency?: true, matte?: white|\"#rrggbb\"|none, interlaced?, lossless?: true (webp: lossy WebP isn't available yet: written lossless, with a warning), encoding?: utf8|utf16 (txt: the stories in stacking order, back to front, a thread once; utf16 with a byte order mark), lineEndings?: lf|crlf, selectionOnly?: false, svg?: {styling, outlineText, images, objectIds, decimals, minify, responsive, useArtboards, preserveEditing, metadata, fewerTspans, hiddenLayers, encoding, profile, embedFonts} (see document.formats), …the SVG options given flat instead, …the PDF options of document.exportPdf, …the DXF options of document.exportDxf (useArtboards: one drawing per artboard), …the EPS options of document.exportEps (useArtboards: one file per artboard, {stem}_{artboard}.eps; else the visible art), …emf and wmf write one picture of the artboard (useArtboards: true one file per chosen artboard, false the bounds of the visible art; EMF keeps curves, clipping, transparent images and gradients as images clipped to their shape; WMF flattens curves into polygons behind a placeable header; what a format leaves out comes back in warnings), colorModel?: rgb|cmyk|gray (tiff: rgb keeps transparency as an alpha channel), lzw?: true, byteOrder?: little|big, embedIcc?: true, colorModel?: rgb|gray (bmp), depth?: 24 (bmp: 1 black and white, 4|8 a palette by reduction and dither, 16, 24, 32 with alpha), fileFormat?: windows|os2 (1, 4, 8 or 24 bits), rle?: false (4 and 8 bits, windows), flipRows?: false (top-down rows), depth?: 24 (tga: 16 one-bit alpha, 24, 32 with alpha), colorModel?: rgb|cmyk|gray (psd), layers?: true (each top-level layer a pixel layer with its opacity and blend mode; a background colour is a Background layer; false: one flat image, on white), maxEditability?: false (layers and sublayers become groups, each object a layer named as in the Layers panel, text by its text; clipping, masked or knockout layers stay one layer), hiddenLayers?: false (hidden layers and objects written hidden instead of left out), embedIcc?: true (at most 30000 pixels a side; formats without alpha are flattened on white)} → {path, format, bytes, warnings, files?: [path…] (several), linked?: [path…] (linked images, image maps)}; no path → {dataBase64, format, bytes, warnings, files?: [{name, dataBase64}], linked?: [{name, dataBase64}]}. Never changes the document's path",
             has_doc,
             export::export
         ),
@@ -205,7 +207,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "PDF Info",
             [],
             None,
-            "{path | name? | dataBase64 (a file's path, or its bytes), password?, thumbnail?: page (1-based), thumbnailSize?: 160 (px, longest side), cropTo?: crop (the thumbnail's box)} → {pages, needsPassword, wrongPassword?, pageInfo: [{width, height (pt, as shown), rotation, boxes: {media, crop, bleed, trim, art: [x0, y0, x1, y1] (PDF space, pt)}}], thumbnail?: PNG dataBase64}; a page whose UserUnit (PDF 1.6) is above 1 gives its size and boxes in pt, its numbers times the UserUnit (one above 75,000 counts as 75,000); an encrypted PDF without its password → {pages: 0, needsPassword: true}",
+            "{path | name? | dataBase64 (a file's path, or its bytes), password?, thumbnail?: page (1-based), thumbnailSize?: 160 (px, longest side), cropTo?: crop (the thumbnail's box)} → {pages, needsPassword, wrongPassword?, pageInfo: [{width, height (pt, as shown), rotation, boxes: {media, crop, bleed, trim, art: [x0, y0, x1, y1] (PDF space, pt)}}], thumbnail?: PNG dataBase64}; a page whose UserUnit (PDF 1.6) is above 1 gives its size and boxes in pt, its numbers times the UserUnit (one above 75,000 counts as 75,000); an encrypted PDF without its password → {pages: 0, needsPassword: true}; a PostScript file (an EPS, a .ps file, a .ai in PostScript form) → {pages: 1, needsPassword: false, pageInfo: [{width, height (its bounding box, a US Letter page without one), rotation: 0, boxes: {}}]} (password and cropTo don't apply; thumbnail: 1 shows what the page prints)",
             always,
             pdfimport::pdf_info
         ),
@@ -645,7 +647,16 @@ pub const FORMATS: &[Format] = &[
     },
     Format { id: "emf", label: "EMF", extensions: &["emf"], mime: "image/emf", read: true, write: true, raster: false, options: metafile::OPTIONS },
     Format { id: "wmf", label: "WMF", extensions: &["wmf"], mime: "image/wmf", read: true, write: true, raster: false, options: metafile::OPTIONS },
-    Format { id: "tga", label: "Targa", extensions: &["tga"], mime: "image/x-tga", read: false, write: true, raster: true, options: TGA_OPTIONS },
+    Format {
+        id: "tga",
+        label: "Targa",
+        extensions: &["tga", "vda", "icb", "vst"],
+        mime: "image/x-tga",
+        read: true,
+        write: true,
+        raster: true,
+        options: TGA_OPTIONS,
+    },
     Format { id: "psd", label: "PSD", extensions: &["psd"], mime: "image/x-psd", read: true, write: true, raster: true, options: PSD_OPTIONS },
     // Affinity Photo's `.afphoto` opens by its content but isn't listed: Finder shouldn't offer a
     // vector app for a raster editor's documents.
@@ -673,6 +684,10 @@ pub const OPEN_EXTS: &[&str] = &[
     "tif",
     "tiff",
     "bmp",
+    "tga",
+    "vda",
+    "icb",
+    "vst",
     "psd",
     "psb",
     "vctemplate",
@@ -689,9 +704,9 @@ pub const OPEN_EXTS: &[&str] = &[
 
 /// Extensions in [`OPEN_EXTS`] the desktop packaging doesn't associate with VectorCraft: Photoshop
 /// documents belong to raster editors, so Finder and file managers don't offer a vector app for
-/// them, and the packaging declares no `.epsf` or `.ps` type (File › Open and Place still read
-/// them all).
-pub const UNASSOCIATED_EXTS: &[&str] = &["psd", "psb", "epsf", "ps"];
+/// them, and the packaging declares no `.epsf`, `.ps` or Targa type (File › Open and Place still
+/// read them all).
+pub const UNASSOCIATED_EXTS: &[&str] = &["psd", "psb", "epsf", "ps", "tga", "vda", "icb", "vst"];
 
 /// The extension that picks each writable format when exporting (the format's first; PNG-8 shares
 /// `.png` with PNG, so `.png` comes once), in [`FORMATS`] order.
@@ -732,6 +747,10 @@ pub const PLACE_EXTS: &[&str] = &[
     "tif",
     "tiff",
     "bmp",
+    "tga",
+    "vda",
+    "icb",
+    "vst",
     "psd",
     "psb",
     "vctemplate",
@@ -813,7 +832,8 @@ pub fn format_for_name(name: &str) -> Option<&'static Format> {
     Some(extension(name)).filter(|e| !e.is_empty()).and_then(|e| format(&e))
 }
 
-/// The format to write: `format` (an id or extension), else the path's extension, else PNG.
+/// The format to write: `format` (an id or extension), else the path's extension, else PNG. For a
+/// `.ait` template it returns an error that names `file.saveAsTemplate`, which writes it.
 pub fn writable_format(format_param: Option<&str>, path: Option<&str>) -> std::result::Result<&'static Format, String> {
     // Formats that can't be written say what to use instead.
     let unknown = |what: String, key: &str| unsupported(key).map_or(what, |u| u.hint.to_string());
@@ -822,7 +842,13 @@ pub fn writable_format(format_param: Option<&str>, path: Option<&str>) -> std::r
         (None, Some(e)) => format(&e).ok_or_else(|| unknown(format!("unknown extension `.{e}`: pass `format` (see document.formats)"), &e))?,
         (None, None) => format("png").ok_or("no PNG encoder")?,
     };
-    if f.write { Ok(f) } else { Err(format!("{} files can be opened but not written (see document.formats)", f.label)) }
+    if f.write {
+        Ok(f)
+    } else if TEMPLATE_FORMATS.contains(&f.id) {
+        Err(format!("{} files are written by file.saveAsTemplate", f.label))
+    } else {
+        Err(format!("{} files can be opened but not written (see document.formats)", f.label))
+    }
 }
 
 /// [`writable_format`] for command `cmd`.
@@ -1077,14 +1103,74 @@ pub(crate) fn absolute_path(path: &str) -> String {
 /// stored in, when it has one: a relative path is taken from its folder. Only files on this
 /// computer, or on the network share the document is on, are followed (see `craft_docpath`); a
 /// path that is still relative (no document) is refused, as the working directory isn't the
-/// document's choice. Every stored path reaches the file system through this.
+/// document's choice. On Windows, a document on a mapped drive is on the share behind the drive
+/// ([`share_path`]): a path refused as on another computer is checked again against the
+/// document's path on that share. Every stored path reaches the file system through this.
 pub(crate) fn document_path(stored: &str, document: Option<&str>) -> std::result::Result<String, craft_docpath::Refused> {
+    document_path_with(stored, document, share_path)
+}
+
+/// [`document_path`], with `share` giving a document's path on the network share behind its drive.
+pub(crate) fn document_path_with(
+    stored: &str,
+    document: Option<&str>,
+    share: impl FnOnce(&str) -> Option<String>,
+) -> std::result::Result<String, craft_docpath::Refused> {
+    use craft_docpath::Refused;
     let document = document.map(absolute_path);
-    let path = craft_docpath::resolve(stored, document.as_deref().map(std::path::Path::new))?;
+    let resolve = |document: Option<&str>| craft_docpath::resolve(stored, document.map(std::path::Path::new));
+    let path = match resolve(document.as_deref()) {
+        Err(Refused::Network) => {
+            let share = document.as_deref().and_then(share).ok_or(Refused::Network)?;
+            resolve(Some(share.as_str()))?
+        }
+        path => path?,
+    };
     if !path.is_absolute() {
-        return Err(craft_docpath::Refused::Invalid);
+        return Err(Refused::Invalid);
     }
-    path.into_os_string().into_string().map_err(|_| craft_docpath::Refused::Invalid)
+    path.into_os_string().into_string().map_err(|_| Refused::Invalid)
+}
+
+/// The path of `document` (on a drive, `Z:\jobs\doc.vectorcraft`) on the network share the drive is
+/// mapped to (`\\server\share\jobs\doc.vectorcraft`), when its folder is on one and automation may
+/// read the folder. The folder's final path ([`std::fs::canonicalize`]) names the share as
+/// `\\?\UNC\server\share\…`.
+#[cfg(windows)]
+pub(crate) fn share_path(document: &str) -> Option<String> {
+    share_of(document, |folder| {
+        may_read(folder).ok()?;
+        std::fs::canonicalize(folder).ok()
+    })
+}
+
+#[cfg(not(windows))]
+pub(crate) fn share_path(_: &str) -> Option<String> {
+    None
+}
+
+/// The path of `document` on the network share its drive is mapped to, given `final_path`, which
+/// returns the final path of a folder: `None` when `document` is not on a drive (`C:\` or `C:/`)
+/// or `final_path` gives no share (`\\?\UNC\server\share\…`), such as a folder on a local volume.
+#[cfg(any(windows, test))]
+pub(crate) fn share_of(document: &str, final_path: impl FnOnce(&str) -> Option<std::path::PathBuf>) -> Option<String> {
+    let mut chars = document.chars();
+    if !matches!((chars.next(), chars.next(), chars.next()), (Some(l), Some(':'), Some('\\' | '/')) if l.is_ascii_alphabetic()) {
+        return None;
+    }
+    // The drive's root folder keeps its separator (`Z:\`).
+    let split = document.rfind(['\\', '/'])?;
+    let (folder, name) = (document.get(..split.max(3))?, document.get(split + 1..)?);
+    if name.is_empty() {
+        return None;
+    }
+    let target = final_path(folder)?;
+    let target = target.to_str()?;
+    let unc = target.get(..8).filter(|p| p.eq_ignore_ascii_case(r"\\?\UNC\")).and(target.get(8..))?.trim_end_matches('\\');
+    if unc.split('\\').filter(|c| !c.is_empty()).count() < 2 {
+        return None;
+    }
+    Some(format!(r"\\{unc}\{name}"))
 }
 
 #[cfg(target_arch = "wasm32")]

crates/engine/src/cmd/fileio/native.rs

@@ -103,7 +103,7 @@ pub const AI_OPTIONS: &[FormatOption] = &[
         name: "aiVersion",
         ty: "string",
         default: "\"pdf\"",
-        description: "pdf (a PDF-compatible .ai carrying the VectorCraft document) or 7 (the legacy, PostScript-form .ai of version 7, which keeps layers, groups, compound paths and clipping groups in apps that read it; one file per artboard, transparent objects opaque; the other .ai options don't apply)",
+        description: "pdf (a PDF-compatible .ai carrying the VectorCraft document) or 7 (the legacy, PostScript-form .ai of version 7, which keeps layers, groups, compound paths and clipping groups in apps that read it; one file per artboard, transparent objects opaque; the other .ai options don't apply; an error for a .ait template)",
     },
     FormatOption {
         name: "transparentImages",

crates/engine/src/cmd/fileio/pdf.rs

@@ -235,11 +235,15 @@ pub fn expand_preset<'a>(s: &Session, cmd: &str, p: &'a Value) -> Result<Cow<'a,
     super::eps::with_flattener(s, cmd, expanded)
 }
 
-/// The full export options for `doc`: settings plus the artboards `p` picks (default all).
+/// The full export options for `doc`: settings plus the artboards `p` picks (default all), created
+/// at `doc`'s File Info creation date (the time of writing when it has none) and modified at the
+/// time of writing. On the web, which has no clock, the creation date is the modification date too,
+/// and a document without one gets neither.
 pub fn options(cmd: &str, doc: &Document, p: &Value) -> Result<PdfOptions> {
     let pick = if p.is_object() { ArtboardPick::deserialize(p).map_err(|e| bad(cmd, format!("PDF options: {e}")))? } else { ArtboardPick::default() };
     let artboards = pick.resolve(doc.artboards.len()).map_err(|e| bad(cmd, e))?;
-    Ok(PdfOptions { settings: settings(cmd, p)?, artboards, ..Default::default() })
+    let now = vectorcraft_doc::metadata::output_time();
+    Ok(PdfOptions { settings: settings(cmd, p)?, artboards, created: doc.metadata.created.or(now), modified: now, ..Default::default() })
 }
 
 /// Why a PDF of some artboards carries no editing data.

crates/engine/src/cmd/fileio/pdfimport.rs

@@ -1,6 +1,6 @@
 //! Opening and placing PDF (and PDF-compatible `.ai`/`.ait`) files: the options `document.open`
 //! and `file.place` read ([`LoadOptions`]), the pages they import and `document.pdfInfo` (pages,
-//! boxes, a thumbnail) for the Import PDF dialog.
+//! boxes, a thumbnail; one page for a PostScript file) for the Import PDF dialog.
 
 use serde_json::{Value, json};
 use vectorcraft_doc::{ColorMode, Document};
@@ -162,6 +162,10 @@ const INFO: &str = "document.pdfInfo";
 pub(super) fn pdf_info(_: &mut Session, p: &Value) -> Result<Value> {
     let bytes = source(p, INFO)?.bytes;
     let o = LoadOptions::from_params(INFO, p)?;
+    // Programs whose header is only `%!` are PostScript too, as `clipboard.importEps` reads them.
+    if bytes.starts_with(b"%!") || vectorcraft_pdf::is_postscript(&bytes) {
+        return postscript_info(&bytes, p);
+    }
     let info = match vectorcraft_pdf::info(&bytes, o.password.as_deref()) {
         Ok(i) => i,
         Err(e @ (PdfError::NeedsPassword | PdfError::WrongPassword)) => {
@@ -183,10 +187,34 @@ pub(super) fn pdf_info(_: &mut Session, p: &Value) -> Result<Value> {
         let page = usize::try_from(n).ok().and_then(|n| n.checked_sub(1)).filter(|i| *i < info.pages.len());
         let page = page.ok_or_else(|| bad(INFO, format!("thumbnail: no page {n} (the PDF has {})", info.pages.len())))?;
         let (doc, _) = page_document(&bytes, page, &o)?;
-        let size = f64_or(p, "thumbnailSize", 160.0).clamp(16.0, 1024.0);
-        let r = doc.artboards.first().map(|a| a.rect).ok_or_else(|| err("the page has no area"))?;
-        let png = super::encode(&doc, "png", &json!({"scale": size / r.width().max(r.height()).max(1.0)}))?;
-        out["thumbnail"] = json!(vectorcraft_format::base64_encode(&png));
+        out["thumbnail"] = json!(thumbnail(&doc, p)?);
     }
     Ok(out)
 }
+
+/// `document.pdfInfo` of a PostScript file (an EPS, a `.ps` file, a `.ai` in PostScript form): one
+/// page, the page [`vectorcraft_eps::page`] reads, with no PDF boxes. Its thumbnail is the file as
+/// the EPS reader reads it without any editing data it carries: what the page prints, or the
+/// file's preview when its PostScript can't be read.
+fn postscript_info(bytes: &[u8], p: &Value) -> Result<Value> {
+    let page = vectorcraft_eps::page(bytes).map_err(err)?;
+    let info = json!({"width": page.width(), "height": page.height(), "rotation": 0, "boxes": {}});
+    let mut out = json!({"pages": 1, "needsPassword": false, "pageInfo": [info]});
+    if let Some(n) = p.get("thumbnail").and_then(Value::as_u64) {
+        if n != 1 {
+            return Err(bad(INFO, format!("thumbnail: no page {n} (the file has 1)")));
+        }
+        let doc = vectorcraft_eps::import_with(bytes, false).map_err(err)?.document;
+        out["thumbnail"] = json!(thumbnail(&doc, p)?);
+    }
+    Ok(out)
+}
+
+/// A PNG of `doc`'s first artboard, `thumbnailSize` px (default 160, from 16 to 1024) on its longer
+/// side, base64.
+fn thumbnail(doc: &Document, p: &Value) -> Result<String> {
+    let size = f64_or(p, "thumbnailSize", 160.0).clamp(16.0, 1024.0);
+    let r = doc.artboards.first().map(|a| a.rect).ok_or_else(|| err("the page has no area"))?;
+    let png = super::encode(doc, "png", &json!({"scale": size / r.width().max(r.height()).max(1.0)}))?;
+    Ok(vectorcraft_format::base64_encode(&png))
+}

crates/engine/src/cmd/fileio/progress.rs

@@ -0,0 +1,82 @@
+//! Progress and Cancel of an export running off the UI thread (Background Export), on the shared
+//! [`vectorcraft_doc::cancel`] mechanism.
+//!
+//! The frontend makes a [`Progress`], runs the export inside [`scope`] on its worker and reads the
+//! counts from the UI thread to draw them; its Cancel button calls [`Progress::cancel`]. Inside the
+//! scope the encoders that work in steps (raster formats: one artboard at a time) report each step
+//! through [`vectorcraft_doc::cancel::progress`] and stop at the next check once cancelled; the
+//! renderer stops drawing and keeps no half-drawn pattern tile or effect raster. Encoders that
+//! make one file in one go report nothing: the frontend shows them as busy and checks
+//! [`Progress::cancelled`] itself before writing, so a cancelled export never writes a file.
+
+use std::rc::Rc;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use vectorcraft_doc::cancel::{self, CancelToken, ProgressSink};
+
+/// How far an export has got, shared between the worker and the UI thread.
+#[derive(Debug, Default)]
+pub struct Progress {
+    token: CancelToken,
+    done: AtomicU64,
+    total: AtomicU64,
+}
+
+impl Progress {
+    pub fn new() -> Arc<Self> {
+        Arc::new(Self::default())
+    }
+
+    /// `(steps done, steps in all)`; `total` is 0 while the export can't say (one file made in one go).
+    pub fn counts(&self) -> (u64, u64) {
+        let total = self.total.load(Ordering::Relaxed);
+        (self.done.load(Ordering::Relaxed).min(total), total)
+    }
+
+    /// The share of the export done, 0 to 1; `None` while the export can't say.
+    pub fn fraction(&self) -> Option<f64> {
+        let (done, total) = self.counts();
+        (total > 0).then(|| done as f64 / total as f64)
+    }
+
+    /// Ask the export to stop: it writes nothing more, and a render under way stops drawing.
+    pub fn cancel(&self) {
+        self.token.cancel();
+    }
+
+    pub fn cancelled(&self) -> bool {
+        self.token.is_cancelled()
+    }
+}
+
+/// Run `f` with `progress`'s token in effect on this thread and the steps reported to it.
+pub fn scope<R>(progress: &Arc<Progress>, f: impl FnOnce() -> R) -> R {
+    let to = Arc::clone(progress);
+    let sink: ProgressSink = Rc::new(move |done, total, _| {
+        to.total.store(total, Ordering::Relaxed);
+        to.done.store(done, Ordering::Relaxed);
+    });
+    cancel::scope(&progress.token, Some(sink), f)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_raster_export_counts_its_artboards_and_stops_once_cancelled() {
+        let mut doc = vectorcraft_doc::Document::new(100.0, 100.0);
+        let second = doc.artboards[0].clone();
+        doc.artboards.push(second);
+        let p = Progress::new();
+        assert_eq!(p.fraction(), None, "nothing reported yet");
+        let png = scope(&p, || super::super::encode_all(&doc, "png", &serde_json::json!({"useArtboards": true})));
+        assert!(png.is_ok(), "{:?}", png.err());
+        assert_eq!(p.counts(), (1, 2), "the step under way when the last artboard started");
+        p.cancel();
+        let r = scope(&p, || super::super::encode_all(&doc, "png", &serde_json::json!({"useArtboards": true})));
+        assert!(matches!(r, Err(crate::EngineError::Cancelled)), "{:?}", r.err());
+        assert!(!cancel::is_cancelled(), "the scope ended");
+    }
+}

crates/engine/src/cmd/fileio/save.rs

@@ -371,7 +371,7 @@ impl<W: std::io::Write> std::io::Write for Counted<W> {
 /// `separateArtboards`, those `range` names (default all).
 fn separate_boards(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result<Vec<usize>> {
     // A legacy .ai file is a file per artboard already.
-    if !is_native(f) || !bool_or(p, "separateArtboards", false) || super::legacy_ai::wanted(cmd, p)? {
+    if !is_native(f) || !bool_or(p, "separateArtboards", false) || super::legacy_ai::wanted(cmd, f, p)? {
         return Ok(vec![]);
     }
     let range = str_param(p, "range").filter(|r| !r.trim().is_empty()).map(str::to_string);
@@ -424,7 +424,7 @@ const NOT_PDF_COMPATIBLE: &str = "saved without PDF content: VectorCraft opens i
 /// The shared Save and Export encoder for PDF-compatible `.ai` files (and `.ait` templates, the
 /// same file).
 pub(super) fn encode_ai(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Result<Encoded> {
-    if super::legacy_ai::wanted(cmd, p)? {
+    if super::legacy_ai::wanted(cmd, f, p)? {
         return super::legacy_ai::encode(cmd, f, doc, p);
     }
     let mut params = if p.is_object() { p.clone() } else { json!({}) };
@@ -508,7 +508,7 @@ fn job_for_stamped(s: &Session, st: &DocState, plan: SavePlan, stamped: Option<i
     }
     let boards = separate_boards(cmd, plan.format, &doc, &params)?;
     let mut params = super::pdf::expand_preset(s, cmd, &params)?.into_owned();
-    let legacy = super::legacy_ai::wanted(cmd, &params)?;
+    let legacy = super::legacy_ai::wanted(cmd, plan.format, &params)?;
     if let (Some(o), "ai" | "ait") = (params.as_object_mut(), plan.format.id) {
         // Save keeps every artboard; exports may choose a subset instead. A legacy .ai file per
         // artboard keeps a range given: the artboards to save.
@@ -558,7 +558,7 @@ impl SaveJob {
         let (cmd, f) = (self.plan.mode.command(), self.plan.format);
         let enc = if matches!(f.id, "ai" | "ait") { encode_ai(cmd, f, doc, &self.params)? } else { encode_all(doc, f.id, &self.params)? };
         // A legacy .ai file per artboard.
-        let per_artboard = f.id == "ai" && super::legacy_ai::wanted(cmd, &self.params)?;
+        let per_artboard = f.id == "ai" && super::legacy_ai::wanted(cmd, f, &self.params)?;
         if enc.files.len() != 1 && !per_artboard {
             return Err(bad(cmd, "Save writes one artboard: name one, or export several with document.export"));
         }
@@ -797,7 +797,7 @@ pub(super) fn specs() -> Vec<CommandSpec> {
             "Save as Template…",
             ["File"],
             None,
-            "{…as document.save} {path? (saved with the format's extension: one naming another format is replaced, and one is added to a name without it), format?: template (default) | ait (also when format is not given and the path ends in .ait), compress?, version?, preview?} a template that opens as a new untitled document: a native template (.vctemplate), or a PDF-compatible .ait written as a .ai file is (the .ai options and the PDF options, as document.save takes them for .ai); the document is unchanged → {path, format, bytes, warnings}; no path → {dataBase64, format, name: \"<name> template.<ext>\", folder: the Templates folder (preference templatesFolder), warnings}",
+            "{…as document.save} {path? (saved with the format's extension: one naming another format is replaced, and one is added to a name without it), format?: template (default) | ait (also when format is not given and the path ends in .ait), compress?, version?, preview?} a template that opens as a new untitled document: a native template (.vctemplate), or a PDF-compatible .ait written as a .ai file is (the .ai options and the PDF options, as document.save takes them for .ai; aiVersion 7 is an error); the document is unchanged → {path, format, bytes, warnings}; no path → {dataBase64, format, name: \"<name> template.<ext>\", folder: the Templates folder (preference templatesFolder), warnings}",
             has_doc,
             |s, p| save(s, SaveMode::Template, p)
         ),

crates/engine/src/cmd/fileio/screens.rs

@@ -18,7 +18,7 @@ use vectorcraft_geom::Rect;
 
 use super::super::*;
 use super::encode::single_artboard;
-use super::export::{isolated, selected_artwork, without_artboards};
+use super::export::{export_crop, isolated, selected_artwork, without_artboards};
 use super::naming::{self, NameParts};
 use super::{
     ARTBOARD_PARAMS, ArtboardPick, Format, artboard_file_names, create_dir, distinct_names, encode_with_warnings, unique_file_names,
@@ -342,6 +342,97 @@ impl ScreenParams {
     fn of(p: &Value) -> Result<Self> {
         if p.is_object() { Self::deserialize(p).map_err(|e| bad(C, e.to_string())) } else { Ok(Self::default()) }
     }
+
+    /// An error when more than one of `assets`, `layers`, `selection` and `fullDocument` is given.
+    fn one_source(&self) -> Result<()> {
+        let sources = [self.full_document, self.assets.is_some(), self.layers.is_some(), self.selection.is_some()].iter().filter(|b| **b).count();
+        if sources > 1 {
+            return Err(bad(C, "give one of assets, layers, selection or fullDocument"));
+        }
+        Ok(())
+    }
+
+    /// `selection`: `None` without it, `Some(false)` for `one` file, `Some(true)` for `each` object.
+    fn selection_mode(&self) -> Result<Option<bool>> {
+        match self.selection.as_deref() {
+            None => Ok(None),
+            Some("one") => Ok(Some(false)),
+            Some("each") => Ok(Some(true)),
+            Some(m) => Err(bad(C, format!("selection `{m}`: one or each"))),
+        }
+    }
+}
+
+/// How a batch export names its files and sorts them into folders.
+struct Naming<'a> {
+    /// The `name` pattern, when it holds more than spaces.
+    pattern: Option<&'a str>,
+    /// The `prefix`, through [`file_part`].
+    prefix: String,
+    /// The document's name, safe as a file name (`<filename>`, the Full Document's item).
+    filename: String,
+    /// The date and time the pattern's tokens use.
+    when: [i64; 6],
+    counter_start: u64,
+    /// The counter counts files rather than items.
+    per_file: bool,
+    folders: Folders,
+}
+
+impl<'a> Naming<'a> {
+    /// The naming of params `o` for a document titled `title`.
+    fn of(o: &'a ScreenParams, title: &str) -> Result<Self> {
+        let folders = Folders::of(o)?;
+        // A prefix names files, not folders.
+        let prefix = file_part(o.prefix.as_deref().unwrap_or(""));
+        let when = match o.date.as_deref() {
+            Some(d) => naming::parse_date(d).ok_or_else(|| bad(C, format!("date `{d}`: YYYY-MM-DD")))?,
+            None => vectorcraft_doc::metadata::output_time().map_or([1970, 1, 1, 0, 0, 0], vectorcraft_doc::metadata::civil),
+        };
+        let per_file = match o.counter_per.as_deref() {
+            None | Some("item") => false,
+            Some("file") => true,
+            Some(c) => return Err(bad(C, format!("counterPer `{c}`: item or file"))),
+        };
+        let filename = safe_name(&super::file_stem(title)).unwrap_or_else(|| "Untitled".into());
+        let pattern = o.name.as_deref().filter(|n| !n.trim().is_empty());
+        Ok(Self { pattern, prefix, filename, when, counter_start: o.counter_start.unwrap_or(1), per_file, folders })
+    }
+
+    /// The sub-folder (`None` for the export folder itself) and the file name of the file row `r`
+    /// writes of `item`, the `index`th item (from 0), when `files` files came before it.
+    fn file(&self, item: &Item, index: usize, files: u64, r: &Row) -> (Option<String>, String) {
+        let counter = self.counter_start.saturating_add(if self.per_file { files } else { index as u64 });
+        let ext = r.format.extensions.first().copied().unwrap_or(r.format.id);
+        let prefix = &self.prefix;
+        let stem = match self.pattern {
+            Some(pattern) => {
+                let parts = NameParts {
+                    filename: &self.filename,
+                    name: &item.name,
+                    index: index + 1,
+                    counter,
+                    format: ext,
+                    scale: &if r.format.raster { r.size.label() } else { String::new() },
+                    suffix: &r.suffix,
+                    when: self.when,
+                };
+                let named = naming::render(pattern, &parts);
+                let named = if named.is_empty() { item.stem.clone() } else { named };
+                if naming::has_suffix_token(pattern) { format!("{prefix}{named}") } else { format!("{prefix}{named}{}", r.suffix) }
+            }
+            None => format!("{prefix}{}{}", item.stem, r.suffix),
+        };
+        let file = safe_file_name(&format!("{stem}.{ext}"));
+        let sub = match self.folders {
+            Folders::None => None,
+            Folders::Rows => Some(safe_file_name(&r.folder)),
+            Folders::Format => Some(ext.to_string()),
+            Folders::Item => Some(item.stem.clone()),
+            Folders::ItemFormat => Some(format!("{}/{ext}", item.stem)),
+        };
+        (sub, file)
+    }
 }
 
 /// The format rows `p` asks for (`formats`, else `preset`'s, else one PNG at 1x), each with the
@@ -566,36 +657,15 @@ pub(super) fn presets_delete(s: &mut Session, p: &Value) -> Result<Value> {
 pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
     let o = ScreenParams::of(p)?;
     let rows = rows_of(s, p, o.preset.as_deref())?;
-    let sources = [o.full_document, o.assets.is_some(), o.layers.is_some(), o.selection.is_some()].iter().filter(|b| **b).count();
-    if sources > 1 {
-        return Err(bad(C, "give one of assets, layers, selection or fullDocument"));
-    }
-    let folders = Folders::of(&o)?;
-    // A prefix names files, not folders.
-    let prefix = file_part(o.prefix.as_deref().unwrap_or(""));
+    o.one_source()?;
+    let naming = Naming::of(&o, &s.doc()?.doc.title)?;
     let folder = o.folder.as_deref().filter(|f| !f.is_empty());
-    let when = match o.date.as_deref() {
-        Some(d) => naming::parse_date(d).ok_or_else(|| bad(C, format!("date `{d}`: YYYY-MM-DD")))?,
-        None => vectorcraft_doc::metadata::now_unix().map_or([1970, 1, 1, 0, 0, 0], vectorcraft_doc::metadata::civil),
-    };
-    let per_file = match o.counter_per.as_deref() {
-        None | Some("item") => false,
-        Some("file") => true,
-        Some(c) => return Err(bad(C, format!("counterPer `{c}`: item or file"))),
-    };
-    let counter_start = o.counter_start.unwrap_or(1);
-    let selection = match o.selection.as_deref() {
-        None => None,
-        Some("one") => Some(false),
-        Some("each") => Some(true),
-        Some(m) => return Err(bad(C, format!("selection `{m}`: one or each"))),
-    };
+    let selection = o.selection_mode()?;
     let selected = if selection.is_some() { selected_artwork(s)? } else { vec![] };
     if let Some(dir) = folder {
         create_dir(dir)?;
     }
     let doc = s.doc()?.doc.clone();
-    let filename = safe_name(&super::file_stem(&doc.title)).unwrap_or_else(|| "Untitled".into());
     // Include Bleed: each artboard grown by the document's bleed.
     let doc = if o.include_bleed && doc.setup.has_bleed() {
         let mut d = (*doc).clone();
@@ -607,7 +677,7 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
         doc
     };
     let crop = rows.iter().any(|r| r.format.id != "pdf");
-    let items = items(&doc, &o, selection, &selected, &filename, crop)?;
+    let items = items(&doc, &o, selection, &selected, &naming.filename, crop, true)?;
     let mut out = Output::default();
     // The encoders' warnings for every file, each once.
     let mut warnings: Vec<String> = Vec::new();
@@ -626,34 +696,7 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
     let mut files = 0u64;
     for (index, item) in items.iter().enumerate() {
         for r in &rows {
-            let counter = counter_start.saturating_add(if per_file { files } else { index as u64 });
-            let ext = r.format.extensions.first().copied().unwrap_or(r.format.id);
-            let stem = match o.name.as_deref().filter(|n| !n.trim().is_empty()) {
-                Some(pattern) => {
-                    let parts = NameParts {
-                        filename: &filename,
-                        name: &item.name,
-                        index: index + 1,
-                        counter,
-                        format: ext,
-                        scale: &if r.format.raster { r.size.label() } else { String::new() },
-                        suffix: &r.suffix,
-                        when,
-                    };
-                    let named = naming::render(pattern, &parts);
-                    let named = if named.is_empty() { item.stem.clone() } else { named };
-                    if naming::has_suffix_token(pattern) { format!("{prefix}{named}") } else { format!("{prefix}{named}{}", r.suffix) }
-                }
-                None => format!("{prefix}{}{}", item.stem, r.suffix),
-            };
-            let file = safe_file_name(&format!("{stem}.{ext}"));
-            let sub = match folders {
-                Folders::None => None,
-                Folders::Rows => Some(safe_file_name(&r.folder)),
-                Folders::Format => Some(ext.to_string()),
-                Folders::Item => Some(item.stem.clone()),
-                Folders::ItemFormat => Some(format!("{}/{ext}", item.stem)),
-            };
+            let (sub, file) = naming.file(item, index, files, r);
             let name = sub.map_or_else(|| file.clone(), |d| format!("{d}/{file}"));
             let Some(name) = out.claim(&name, &format!("{}|{}", item.stem, r.key), o.name.is_some()) else { continue };
             let bytes = if let (Some(all), "pdf") = (&item.every_artboard, r.format.id) {
@@ -675,7 +718,7 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
     let names: Vec<&str> = out.kept.iter().map(|(n, _)| n.as_str()).collect();
     if o.zip {
         let zip = super::zip::store(&out.kept).map_err(|e| bad(C, e))?;
-        let zip_name = safe_file_name(&format!("{prefix}{filename}.zip"));
+        let zip_name = safe_file_name(&format!("{}{}.zip", naming.prefix, naming.filename));
         return match folder {
             Some(dir) => {
                 let path = format!("{dir}/{zip_name}");
@@ -697,12 +740,52 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
     })
 }
 
+/// The path, relative to the export folder, of the first file `document.exportForScreens` with
+/// params `p` writes (sub-folders included: `2x/[email protected]`): the first format row's file of the
+/// first artboard, asset, layer or selected object, or of the whole document, named as [`export`]
+/// names it. It encodes and writes nothing and cuts no art out of the document: of the objects
+/// selected for a file each, it measures only the first ones, up to the first that draws something.
+/// It does not refuse what the export refuses for drawing nothing: a checked asset or layer, the
+/// selection as one file, or the Full Document with no visible art.
+/// The Export for Screens dialog shows it on its Example line.
+pub fn first_file(s: &Session, p: &Value) -> Result<String> {
+    let p = with_preset(s, p)?;
+    let o = ScreenParams::of(&p)?;
+    let rows = rows_of(s, &p, o.preset.as_deref())?;
+    o.one_source()?;
+    let selection = o.selection_mode()?;
+    let doc = &s.doc()?.doc;
+    let mut selected = if selection.is_some() { selected_artwork(s)? } else { vec![] };
+    // A file per object: objects that draw nothing write no file.
+    if selection == Some(true) {
+        selected = selected.into_iter().find(|id| export_crop(doc, &[*id]).is_some()).into_iter().collect();
+    }
+    let naming = Naming::of(&o, &doc.title)?;
+    let items = items(doc, &o, selection, &selected, &naming.filename, false, false)?;
+    let (Some(item), Some(r)) = (items.first(), rows.first()) else { return Err(bad(C, "nothing to export")) };
+    let (sub, file) = naming.file(item, 0, 0, r);
+    Ok(sub.map_or_else(|| file.clone(), |d| format!("{d}/{file}")))
+}
+
 /// What `o` exports a file of per row ([`Item`]): the whole document, the assets, the layers, the
 /// selection (one item, or one per object), else the chosen artboards.
-/// `crop`: some row needs the Full Document's art bounds (a format other than PDF).
-fn items(doc: &Arc<Document>, o: &ScreenParams, selection: Option<bool>, selected: &[NodeId], filename: &str, crop: bool) -> Result<Vec<Item>> {
+/// `crop`: some row needs the Full Document's art bounds (a format other than PDF). `art`: each
+/// asset, layer and selected object is cut out of the document; without it, only the items' names
+/// are made, every item holds the whole document, and none is left out for drawing nothing.
+fn items(
+    doc: &Arc<Document>,
+    o: &ScreenParams,
+    selection: Option<bool>,
+    selected: &[NodeId],
+    filename: &str,
+    crop: bool,
+    art: bool,
+) -> Result<Vec<Item>> {
     // The art of `ids` alone, as an item named `name`.
     let alone = |ids: &[NodeId], name: &str| -> Option<(Arc<Document>, Rect)> {
+        if !art {
+            return Some((doc.clone(), Rect::ZERO));
+        }
         isolated(doc, &doc.paint_order(ids.iter().copied()), name).map(|(d, r)| (Arc::new(d), r))
     };
     // Each item's stem follows Windows' file-naming rules, and no two items share one.

crates/engine/src/cmd/fileio/tests.rs

@@ -189,6 +189,22 @@ fn planar_tiffs_with_more_strips_than_can_be_counted_are_too_large() {
     assert_eq!(vectorcraft_doc::cmyk::oversized_tiff(&file), Some((3, 1 << 31 | 1)));
 }
 
+/// A 16-bit RGB TIFF whose samples need more than the allowance (6 bytes a pixel), though its RGBA
+/// pixels would fit, is refused as too large to draw before it is decoded.
+#[test]
+fn tiffs_whose_samples_pass_the_allowance_are_too_large() {
+    let plane = |v: u16| vec![v; 6];
+    let mut file = hand_tiff(2, 16, &[], false, &[plane(9000), plane(30_000), plane(60_000)]);
+    // The loop sets ImageWidth, ImageLength and RowsPerStrip (the first, second and eighth entries) to `side`.
+    let side = 20_000u32;
+    assert!(u64::from(side * side) * 6 > MAX_RASTER_ALLOC && u64::from(side * side) * 4 <= MAX_RASTER_ALLOC);
+    for at in [18, 30, 102] {
+        file[at..at + 4].copy_from_slice(&side.to_le_bytes());
+    }
+    let e = raster_image(&file).err().expect("refused");
+    assert_eq!(e.to_string(), "an image of 20000 × 20000 pixels is too large to draw");
+}
+
 /// A planar CMYK TIFF opens and places with its ink amounts, stored as a TIFF the image decoder
 /// reads (#1466).
 #[test]

crates/engine/src/cmd/fileio/tests_aiimport.rs

@@ -135,16 +135,42 @@ fn a_pdfs_art_past_the_page_opens_whole_from_its_editing_data() {
     assert!(s.doc().unwrap().doc.art_bounds().is_some_and(|b| b.x1 < 200.5));
 }
 
-/// Editing data that can't be read leaves the file as its PDF part reads, with that part's notes:
-/// a `.ai`'s art outside its artboards is missing, and a PDF's art past the page is clipped.
+/// A `.ai` or a PDF whose editing data can't be decompressed opens from its PDF part with a note
+/// that its layers weren't read, and an export to its own path is refused unless it is given
+/// `acknowledgeLoss`.
+#[test]
+fn a_file_whose_editing_data_cant_be_decompressed_is_not_written_over_unasked() {
+    let d = std::env::temp_dir().join(format!("vc-aiundecoded-{}", std::process::id()));
+    std::fs::create_dir_all(&d).unwrap();
+    let damaged = b"%AI12_CompressedDataxx";
+    for (name, file) in [("art.ai", ai::ai(damaged, ai::page_pdf())), ("art.pdf", ai::pdf(damaged, ai::page_pdf()))] {
+        let path = d.join(name);
+        std::fs::write(&path, &file).unwrap();
+        let path = path.to_string_lossy().to_string();
+        let mut s = Session::new();
+        let r = s.execute("document.open", &json!({"path": path})).unwrap();
+        assert!(r["warnings"].to_string().contains("layers weren't read from its editing data (its zlib compression is damaged)"), "{name}: {r}");
+        let e = s.execute("document.export", &json!({"path": path})).unwrap_err().to_string();
+        assert!(e.contains("left things out") && e.contains("layers weren't read"), "{name}: {e}");
+        assert_eq!(std::fs::read(&path).unwrap(), file, "{name}");
+        s.execute("document.export", &json!({"path": path, "acknowledgeLoss": true})).unwrap();
+        assert_ne!(std::fs::read(&path).unwrap(), file, "{name}");
+    }
+    std::fs::remove_dir_all(d).ok();
+}
+
+/// Editing data that can't be read leaves the file as its PDF part reads, with that part's notes
+/// and then a note saying why its layers weren't read: a `.ai`'s art outside its artboards is
+/// missing, and a PDF's art past the page is clipped.
 #[test]
 fn editing_data_that_cant_be_read_keeps_the_pdf_parts_notes() {
     let damaged = b"%AI12_CompressedData not zlib";
+    let unread = "the file's layers weren't read from its editing data (its zlib compression is damaged): they come from its PDF part";
     let mut s = Session::new();
     let r = open(&mut s, "damaged.ai", &ai::ai(damaged, ai::page_pdf()), json!({})).unwrap();
-    assert_eq!(r["warnings"], json!([vectorcraft_pdf::OFF_ARTBOARD_NOTE]), "{r}");
+    assert_eq!(r["warnings"], json!([vectorcraft_pdf::OFF_ARTBOARD_NOTE, unread]), "{r}");
     let r = open(&mut s, "damaged.pdf", &ai::pdf(damaged, "0 g 150 20 100 60 re f"), json!({})).unwrap();
-    assert_eq!(r["warnings"], json!([vectorcraft_pdf::PAST_PAGE_NOTE]), "{r}");
+    assert_eq!(r["warnings"], json!([vectorcraft_pdf::PAST_PAGE_NOTE, unread]), "{r}");
 }
 
 #[test]
@@ -158,6 +184,34 @@ fn what_the_reader_doesnt_read_opens_as_before_with_a_warning() {
     assert!(r["warnings"].to_string().contains("symbols") && r["warnings"].to_string().contains("PDF part"), "{r}");
 }
 
+/// A `.ai` whose document data has a variable library opens with a note that its variables and
+/// data sets weren't read, whether its layers are read or it comes in as its PDF part.
+#[test]
+fn an_ai_file_with_a_variable_library_says_its_variables_werent_read() {
+    const NOTE: &str = "the file's variables and data sets weren't read (variables: 2, data sets: 3): the Variables panel doesn't list them";
+    let library = ai::variable_library(&["Name", "Number"], &["One", "Two", "Three"]);
+    let square = format!("0 1 1 0 1 0 0 Xa\n{}f\n", ai::rect(10.0, 50.0, 40.0, 90.0));
+    let notes =
+        |r: &Value| r["warnings"].as_array().unwrap().iter().filter(|w| w.as_str().unwrap().contains("variables")).cloned().collect::<Vec<_>>();
+    let mut s = Session::new();
+    let layered = ai::editing_data(200.0, 100.0, &format!("{library}{}", ai::layer("Art", &square)));
+    let file = ai::ai(&compressed(layered.as_bytes()), "1 0 0 rg 10 50 30 40 re f");
+    let r = open(&mut s, "variables.ai", &file, json!({})).unwrap();
+    assert_eq!(names(&s.doc().unwrap().doc.layers), ["Art"], "{r}");
+    assert_eq!(notes(&r), [json!(NOTE)], "{r}");
+    let r = s.execute("variable.list", &json!({})).unwrap();
+    assert_eq!(r["variables"], json!([]), "{r}");
+    // Its layers can't be read (a symbol): it comes in as its PDF part, with the note.
+    let symbols = ai::editing_data(200.0, 100.0, &format!("{library}{}", ai::layer("Art", "/SymbolInstance :\n(Dot) /SymbolRef ,\n;\n")));
+    let r = open(&mut s, "symbols.ai", &ai::ai(&compressed(symbols.as_bytes()), ai::page_pdf()), json!({})).unwrap();
+    assert!(r["warnings"].to_string().contains("PDF part"), "{r}");
+    assert_eq!(notes(&r), [json!(NOTE)], "{r}");
+    // Without a library, no note.
+    let plain = ai::editing_data(200.0, 100.0, &ai::layer("Art", &square));
+    let r = open(&mut s, "plain.ai", &ai::ai(&compressed(plain.as_bytes()), "1 0 0 rg 10 50 30 40 re f"), json!({})).unwrap();
+    assert!(notes(&r).is_empty(), "{r}");
+}
+
 /// A page showing only a placeholder line, as a `.ai` saved without PDF compatibility has.
 const PLACEHOLDER: &str = "BT /F1 12 Tf 10 50 Td (Saved without its PDF part) Tj ET";
 
@@ -175,6 +229,19 @@ fn an_ai_file_saved_without_its_pdf_part_opens_from_its_editing_data() {
     assert!(e.contains("placeholder"), "{e}");
 }
 
+#[test]
+fn an_ai_file_saved_without_its_pdf_part_opens_with_pages_naming_every_page() {
+    let file = ai::ai(&compressed(&ai::sample_data()), PLACEHOLDER);
+    for pages in [json!("1"), json!(1), json!("1-")] {
+        let mut s = Session::new();
+        open(&mut s, "art.ai", &file, json!({"pages": pages})).unwrap();
+        check_sample(&s);
+    }
+    // Without editing data, the placeholder still isn't opened as the art.
+    let e = open(&mut Session::new(), "plain.ai", &ai::ai(b"", PLACEHOLDER), json!({"pages": "1"})).unwrap_err().to_string();
+    assert!(e.contains("placeholder"), "{e}");
+}
+
 /// A page of text alone, as text-only art has in its PDF part: no path is painted.
 const TEXT_ART: &str = "BT /F1 36 Tf 10 40 Td (Text only) Tj ET";
 

crates/engine/src/cmd/fileio/tests_epsimport.rs

@@ -1,6 +1,8 @@
 //! EPS and PostScript files opened and placed: our own EPS files restore the document they carry,
 //! others are read by the PostScript interpreter or come in as their preview.
 
+use std::io::Write as _;
+
 use serde_json::{Value, json};
 
 use super::tests_svgedit::{comparable, rich};
@@ -93,6 +95,33 @@ fn cmyk_images_keep_their_inks_when_an_eps_opens_or_is_placed() {
     assert_eq!(images(&s), [want.clone(), want]);
 }
 
+/// A 4-bit gray image compressed with Flate and TIFF predictor 2 draws the samples it had before
+/// differencing, in an EPS and in a PostScript `.ai`.
+#[test]
+fn tiff_predicted_4_bit_images_open_from_eps_and_postscript_ai_files() {
+    // Two rows of four samples, 0 5 15 3 and 9 9 2 0, differenced to 0 5 10 4 and 9 0 9 14.
+    let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+    z.write_all(&[0x05, 0xa4, 0x90, 0x9e]).unwrap();
+    let hex: String = z.finish().unwrap().iter().map(|b| format!("{b:02x}")).collect();
+    let ps = format!(
+        "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 40 20\n%%EndComments\n40 20 scale 4 2 4 [4 0 0 -2 0 2] currentfile /ASCIIHexDecode filter \
+         << /Predictor 2 /Colors 1 /BitsPerComponent 4 /Columns 4 >> /FlateDecode filter image\n{hex}>\nshowpage\n%%EOF\n"
+    );
+    for name in ["predicted.eps", "predicted.ai"] {
+        let mut s = Session::new();
+        let r = open(&mut s, name, ps.as_bytes()).unwrap();
+        assert_eq!(r["warnings"], json!([]), "{name}: {r}");
+        let d = &s.doc().unwrap().doc;
+        let mut grays = vec![];
+        d.walk(|n| {
+            if let vectorcraft_doc::NodeKind::Image(im) = &n.kind {
+                grays = image::load_from_memory(&d.images[&im.key].bytes).unwrap().to_luma8().into_raw();
+            }
+        });
+        assert_eq!(grays, [0, 5, 15, 3, 9, 9, 2, 0].map(|v| v * 17), "{name}");
+    }
+}
+
 #[test]
 fn an_unreadable_eps_file_comes_in_as_its_preview() {
     let mut s = Session::new();

crates/engine/src/cmd/fileio/tests_pdf.rs

@@ -131,6 +131,56 @@ fn options_not_applied_yet_and_document_features_warn() {
     assert!(warnings(&s.execute("document.export", &json!({"format": "png"})).unwrap()).is_empty());
 }
 
+/// A placed image whose pixel data can't be decoded is left out of every PDF the engine writes,
+/// and the rest of the page is written. Each reply that carries the PDF's warnings has the note
+/// raster exports give, once.
+#[test]
+fn every_pdf_leaves_out_an_image_that_cant_be_decoded() {
+    const NOTE: &str = "an image couldn't be decoded and is missing from the picture";
+    let mut s = session(1);
+    let cut = crate::tests_menucmds::place_undecodable_png(&mut s);
+    // Whether each object on the PDF's pages is an image. The pages should hold the rectangle and
+    // no image.
+    let drawn = |bytes: &[u8]| {
+        let mut images = vec![];
+        vectorcraft_pdf::import(bytes).unwrap().walk(|n| {
+            if !n.is_container() && !matches!(n.kind, vectorcraft_doc::NodeKind::Path { clipping: true, .. }) {
+                images.push(matches!(n.kind, vectorcraft_doc::NodeKind::Image(_)));
+            }
+        });
+        images
+    };
+    for (cmd, p) in [
+        ("document.exportPdf", json!({})),
+        ("document.exportPdf", json!({"preset": "High Quality Print"})),
+        ("document.exportPdf", json!({"standard": "pdfX1a"})),
+        ("document.export", json!({"format": "pdf"})),
+        ("file.saveCopy", json!({"format": "pdf"})),
+        ("file.saveCopy", json!({"format": "ai"})),
+        ("file.print", json!({})),
+    ] {
+        let v = s.execute(cmd, &p).unwrap_or_else(|e| panic!("{cmd} {p}: {e}"));
+        assert_eq!(warnings(&v).iter().filter(|w| *w == NOTE).count(), 1, "{cmd} {p}: {}", v["warnings"]);
+        assert_eq!(drawn(&b64(&v)), [false], "{cmd} {p}");
+    }
+    // The .ai file reopens with the image as it was placed, from the image bytes in its editing data.
+    let ai = b64(&s.execute("file.saveCopy", &json!({"format": "ai"})).unwrap());
+    let placed = s.doc().unwrap().doc.images.clone();
+    s.execute("document.open", &json!({"name": "cut.ai", "dataBase64": vectorcraft_format::base64_encode(&ai)})).unwrap();
+    let reopened = &s.doc().unwrap().doc;
+    assert!(reopened.node(cut).is_some_and(|n| matches!(n.kind, vectorcraft_doc::NodeKind::Image(_))));
+    assert_eq!(reopened.images, placed);
+    // Export for Screens, a native file carrying a PDF, and the PDF that Copy offers are written.
+    let r = s.execute("document.exportForScreens", &json!({"formats": [{"format": "pdf"}]})).unwrap();
+    assert_eq!(drawn(&b64(&r["files"][0])), [false]);
+    assert!(s.execute("file.saveCopy", &json!({"format": "vectorcraft", "pdfCompatible": true})).is_ok());
+    s.execute("select.set", &json!({"ids": [cut.0]})).unwrap();
+    s.execute("edit.copy", &json!({})).unwrap();
+    assert!(b64(&s.execute("clipboard.exportPdf", &json!({})).unwrap()).starts_with(b"%PDF"));
+    s.execute("prefs.set", &json!({"key": "copyAsPdf", "value": true})).unwrap();
+    assert!(s.clipboard_flavours().iter().any(|f| f.mime == crate::cmd::clipboard::PDF));
+}
+
 #[test]
 fn export_pdf_writes_a_path() {
     let mut s = session(2);

crates/engine/src/cmd/fileio/tests_pdfedit.rs

@@ -69,6 +69,33 @@ fn pages_changed_elsewhere_open_as_artwork_with_a_warning() {
     assert_eq!(r["warnings"][0], load::EDITING_DAMAGED, "{r}");
 }
 
+/// `pdf` with its editing file's description rewritten by another app in UTF-16BE with a byte
+/// order mark: "hash " and the hash it held, padded with spaces to its length.
+fn utf16_described(pdf: &[u8]) -> Vec<u8> {
+    let from = b"(VectorCraft editing data; page hash ";
+    let at = pdf.windows(from.len()).position(|w| w == from).unwrap_or_else(|| panic!("no description"));
+    let (hash, len) = (&pdf[at + from.len()..at + from.len() + 16], from.len() + 17);
+    let mut desc = b"(\xFE\xFF".to_vec();
+    desc.extend(b"hash ".iter().chain(hash).flat_map(|&c| [0, c]));
+    desc.push(b')');
+    desc.resize(len, b' ');
+    patched(pdf, &pdf[at..at + len], &desc)
+}
+
+#[test]
+fn pages_changed_elsewhere_are_noticed_with_a_utf16_description() {
+    let mut s = rich();
+    let pdf = b64(&s.execute("document.exportPdf", &json!({"compression": {"compressText": false}})).unwrap());
+    let ai = b64(&s.execute("document.export", &json!({"format": "ai", "compress": false})).unwrap());
+    for (name, file) in [("edited.pdf", pdf), ("edited.ai", ai)] {
+        let r = open(&mut s, name, &utf16_described(&file));
+        assert_eq!((&r["warnings"], &r["restored"]), (&json!([]), &json!(true)), "{name}: the same pages: {r}");
+        let edited = patched(&file, b"/MediaBox[0 0 300 200]", b"/MediaBox[0 0 300 201]");
+        let r = open(&mut s, name, &utf16_described(&edited));
+        assert_eq!((&r["warnings"][0], &r["restored"]), (&json!(load::EDITING_STALE), &json!(false)), "{name}: {r}");
+    }
+}
+
 #[test]
 fn the_legacy_payload_name_is_accepted() {
     let mut s = rich();
@@ -232,6 +259,52 @@ fn save_as_template_names_its_file_after_the_template_format() {
     }
 }
 
+/// Exports don't write a `.ait`: each export asked for one, by its path or `format`, answers an
+/// error that names `file.saveAsTemplate`, which writes it, and writes nothing. A format that
+/// nothing writes keeps its own error.
+#[test]
+fn exports_of_an_ait_name_save_as_template() {
+    let mut s = rich();
+    let path = tmp("exported.ait");
+    let _ = std::fs::remove_file(&path);
+    for (cmd, p) in [
+        ("document.export", json!({"path": path})),
+        ("document.export", json!({"format": "ait"})),
+        ("document.serialize", json!({"format": "ait"})),
+        ("document.exportSelection", json!({"path": path})),
+        ("document.exportForScreens", json!({"formats": [{"format": "ait"}]})),
+    ] {
+        let e = s.execute(cmd, &p).unwrap_err().to_string();
+        assert!(e.contains("PDF-compatible .ait template files are written by file.saveAsTemplate"), "{cmd} {p}: {e}");
+    }
+    assert!(!std::path::Path::new(&path).exists(), "nothing written");
+    assert_eq!(writable_format(Some("ps"), None).unwrap_err(), "PostScript files can be opened but not written (see document.formats)");
+}
+
+/// Save as Template refuses `aiVersion` 7 for a `.ait`, given in `options` or flat, and writes no
+/// file; `aiVersion` "pdf" writes the PDF-compatible template.
+#[test]
+fn save_as_template_refuses_a_legacy_ait() {
+    let mut s = rich();
+    let path = tmp("legacy-ait/card.ait");
+    let dir = std::path::Path::new(&path).parent().unwrap().to_path_buf();
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    for p in [
+        json!({"path": path, "options": {"aiVersion": "7"}}),
+        json!({"path": path, "format": "ait", "aiVersion": 7}),
+        json!({"format": "ait", "options": {"aiVersion": "7"}}),
+    ] {
+        let e = s.execute("file.saveAsTemplate", &p).unwrap_err().to_string();
+        assert!(e.contains("aiVersion 7 writes legacy .ai files"), "{p}: {e}");
+    }
+    assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 0, "nothing written");
+    let r = s.execute("file.saveAsTemplate", &json!({"path": path, "options": {"aiVersion": "pdf"}})).unwrap();
+    assert_eq!(r["format"], "ait", "{r}");
+    let bytes = std::fs::read(&path).unwrap();
+    assert!(bytes.starts_with(b"%PDF") && vectorcraft_pdf::editing(&bytes).is_some_and(|e| e.intact), "PDF-compatible, carrying the document");
+}
+
 #[test]
 fn standards_and_screens_leave_the_editing_data_out() {
     let mut s = rich();

crates/engine/src/cmd/fileio/tests_pdffidelity.rs

@@ -59,6 +59,23 @@ fn layers_option_keeps_or_flattens_optional_content() {
     assert!(open(&mut s, &bytes, json!({"layers": "no"})).unwrap_err().to_string().contains("layers must be true or false"));
 }
 
+/// A PDF-compatible `.ai` without the editor's private data opens its layers from its optional
+/// content groups, whose names without a byte order mark are PDFDocEncoding.
+#[test]
+fn ai_layer_names_are_read_as_pdf_doc_encoding() {
+    let (a, b) = (first_extra(1), first_extra(1) + 1);
+    let catalog = format!("/OCProperties << /OCGs [{a} 0 R {b} 0 R] /D << >> >> ");
+    let page = PdfPage {
+        resources: format!("/Properties << /A {a} 0 R /B {b} 0 R >>"),
+        ..PdfPage::new(100.0, 100.0, "/OC /A BDC 0 g 0 0 10 10 re f EMC /OC /B BDC 0 g 20 20 10 10 re f EMC")
+    };
+    let bytes = pdf_with_catalog(&[page], &[r"<< /Type /OCG /Name (Art\205final) >>", "<< /Type /OCG /Name (Notes) >>"], &catalog, None);
+    let mut s = Session::new();
+    s.execute("document.open", &json!({"name": "art.ai", "dataBase64": vectorcraft_format::base64_encode(&bytes)})).unwrap();
+    let names: Vec<String> = s.active().unwrap().doc.layers.iter().map(|l| l.name.clone().unwrap_or_default()).collect();
+    assert_eq!(names, ["Art\u{2013}final", "Notes"]);
+}
+
 #[test]
 fn load_options_read_text_and_layers() {
     let o = LoadOptions::from_params("x", &json!({"textAs": "Outlines", "layers": false})).unwrap();

crates/engine/src/cmd/fileio/tests_pdfimport.rs

@@ -157,27 +157,31 @@ fn a_postscript_ai_file_says_it_cannot_be_opened_yet() {
         let e = s.execute("document.open", &json!({"name": name, "dataBase64": b64(ps)})).unwrap_err().to_string();
         assert!(e.contains(name) && e.contains("PostScript") && e.contains("save it as PDF"), "{name}: {e}");
     }
-    // An EPS with a binary header too, and the PDF info of either.
+    // An EPS with a binary header too, and the PDF info of each. The plain program's PDF info gives
+    // its page, and its thumbnail gives the reader's error; the binary file's header points at no
+    // PostScript, so its PDF info is an error.
     let mut binary = vec![0xC5, 0xD0, 0xD3, 0xC6];
     binary.extend_from_slice(&[0; 28]);
     binary.extend_from_slice(ps);
     assert!(s.execute("document.open", &json!({"name": "x.eps", "dataBase64": b64(&binary)})).unwrap_err().to_string().contains("PostScript"));
-    assert!(s.execute("document.pdfInfo", &json!({"dataBase64": b64(ps)})).unwrap_err().to_string().contains("PostScript"));
+    assert!(s.execute("document.pdfInfo", &json!({"dataBase64": b64(&binary)})).unwrap_err().to_string().contains("PostScript"));
+    let v = s.execute("document.pdfInfo", &json!({"dataBase64": b64(ps)})).unwrap();
+    assert_eq!((v["pages"].as_u64(), v["pageInfo"][0]["width"].as_f64()), (Some(1), Some(100.0)), "{v}");
+    let e = s.execute("document.pdfInfo", &json!({"dataBase64": b64(ps), "thumbnail": 1})).unwrap_err().to_string();
+    assert!(e.contains("PostScript") && e.contains("frobnicate"), "{e}");
     assert!(s.active().is_none());
 }
 
-/// PostScript given where a PDF is read (`document.pdfInfo`, `clipboard.importPdf`) is refused
-/// with an error that names File › Open and File › Place, and both of those read the file.
+/// PostScript given where a PDF is read (`clipboard.importPdf`) is refused with an error that
+/// names File › Open and File › Place, and both of those read the file.
 #[test]
 fn postscript_read_as_a_pdf_names_open_and_place() {
     let ps = b"%!PS-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\n1 0 0 setrgbcolor 10 10 50 50 rectfill\nshowpage\n%%EOF\n";
     let mut s = Session::new();
     s.execute("file.new", &json!({})).unwrap();
-    for cmd in ["document.pdfInfo", "clipboard.importPdf"] {
-        let e = s.execute(cmd, &json!({"dataBase64": b64(ps)})).unwrap_err().to_string();
-        assert!(e.contains("PostScript") && e.contains("not a PDF: File › Open and File › Place read it as EPS"), "{cmd}: {e}");
-        assert!(!e.contains("can't be opened"), "{cmd}: {e}");
-    }
+    let e = s.execute("clipboard.importPdf", &json!({"dataBase64": b64(ps)})).unwrap_err().to_string();
+    assert!(e.contains("PostScript") && e.contains("not a PDF: File › Open and File › Place read it as EPS"), "{e}");
+    assert!(!e.contains("can't be opened"), "{e}");
     for name in ["legacy.ai", "art.eps"] {
         let r = s.execute("document.open", &json!({"name": name, "dataBase64": b64(ps)})).unwrap();
         assert_eq!(r["warnings"], json!([]), "{name}: {r}");
@@ -186,6 +190,44 @@ fn postscript_read_as_a_pdf_names_open_and_place() {
     }
 }
 
+/// `document.pdfInfo` reads PostScript (an EPS, a `.ai` in PostScript form, a `.ps` file) as one
+/// page, its bounding box or a letter page without one, and its thumbnail shows that page. Each
+/// file here opens on that page with `editingData: false`.
+#[test]
+fn pdf_info_reads_postscript_as_one_page() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 300, "height": 200})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 100, "height": 50})).unwrap();
+    let data = |r: Value| vectorcraft_format::base64_decode(r["dataBase64"].as_str().unwrap()).unwrap();
+    let eps = data(s.execute("document.exportEps", &json!({"useArtboards": true})).unwrap());
+    let ai = data(s.execute("file.saveCopy", &json!({"format": "ai", "aiVersion": "7"})).unwrap());
+    assert!(eps.starts_with(&[0xC5, 0xD0, 0xD3, 0xC6]) && ai.starts_with(b"%!PS"));
+    let hires = b"%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 101 41\n%%HiResBoundingBox: 0 0 100.5 40.25\n%%EndComments\n0 0 1 setrgbcolor 0 0 50 20 rectfill\n";
+    let letter = b"%!PS\n1 0 0 setrgbcolor 72 72 144 72 rectfill\nshowpage\n";
+    let bare = b"%!\n0 0 1 setrgbcolor 100 100 50 50 rectfill\nshowpage\n";
+    for (name, bytes, size) in [
+        ("art.eps", &eps[..], (300.0, 200.0)),
+        ("legacy.ai", &ai, (101.0, 51.0)),
+        ("hires.eps", hires, (100.5, 40.25)),
+        ("page.ps", letter, (612.0, 792.0)),
+        ("bare.ps", bare, (612.0, 792.0)),
+    ] {
+        let v = s.execute("document.pdfInfo", &json!({"dataBase64": b64(bytes), "thumbnail": 1, "thumbnailSize": 100})).unwrap();
+        let png = vectorcraft_format::base64_decode(v["thumbnail"].as_str().unwrap()).unwrap();
+        let img = image::load_from_memory(&png).unwrap();
+        assert_eq!(img.width().max(img.height()), 100, "{name}");
+        let mut v = v;
+        v["thumbnail"] = json!("png");
+        let page = json!({"width": size.0, "height": size.1, "rotation": 0, "boxes": {}});
+        assert_eq!(v, json!({"pages": 1, "needsPassword": false, "pageInfo": [page], "thumbnail": "png"}), "{name}");
+        s.execute("document.open", &json!({"name": name, "dataBase64": b64(bytes), "editingData": false})).unwrap();
+        let board = s.doc().unwrap().doc.artboards[0].rect;
+        assert_eq!((board.width(), board.height()), size, "{name}: the page document.open reads");
+    }
+    let e = s.execute("document.pdfInfo", &json!({"dataBase64": b64(&eps), "thumbnail": 2})).unwrap_err().to_string();
+    assert!(e.contains("no page 2"), "{e}");
+}
+
 /// A page showing only text, with an editor's private data when `private`.
 fn text_page(private: bool, also: &str) -> PdfPage {
     PdfPage {

crates/engine/src/cmd/fileio/tests_screens.rs

@@ -146,6 +146,63 @@ fn device_names_and_trailing_periods_follow_windows_naming_rules() {
     assert_eq!(r["name"], "nul-.zip");
 }
 
+/// `first_file` names the file the export writes first, for the same params: the item's file name,
+/// a prefix and a suffix with characters Windows does not allow, a range, a Windows device name,
+/// every kind of folder, presets, size suffixes, a name pattern with its counter and date, an
+/// export preset, a ZIP, Full Document, Include Bleed, assets, layers and the selection; and it
+/// refuses what the export refuses.
+#[test]
+fn the_first_file_is_the_file_the_export_writes_first() {
+    let mut s = session(3);
+    s.execute("artboard.setProps", &json!({"index": 1, "name": "CON"})).unwrap();
+    let layer = s.doc().unwrap().doc.layers[0].id.0;
+    let square = s.doc().unwrap().doc.layers[0].children().unwrap()[0].id.0;
+    let asset = s.execute("assets.add", &json!({"ids": [square], "name": "Logo?"})).unwrap()["assets"][0].as_u64().unwrap();
+    s.execute("shape.ellipse", &json!({"x": 2, "y": 2, "width": 10, "height": 10})).unwrap();
+    s.execute("select.all", &json!({})).unwrap();
+    let written = |r: &Value| r["files"][0].as_str().or_else(|| r["files"][0]["name"].as_str()).unwrap_or_default().to_string();
+    let cases = [
+        json!({}),
+        json!({"prefix": "a?b/", "formats": [{"format": "png", "suffix": "<x>"}]}),
+        json!({"range": "2-3", "folders": "item"}),
+        json!({"range": "2", "folders": "itemFormat", "formats": [{"format": "svg", "scale": "2x", "suffix": "@2x"}]}),
+        json!({"preset": "mobile"}),
+        json!({"preset": "density"}),
+        json!({"subfolders": true, "formats": [{"format": "png", "scale": "144ppi", "folder": "a b"}]}),
+        json!({"folders": "format", "formats": [{"format": "jpg", "quality": 50}]}),
+        json!({
+            "name": "<filename>-<name>-<scale>-<index>-###-YYYYMMDD",
+            "counterStart": 7,
+            "counterPer": "file",
+            "date": "2026-10-17",
+            "formats": [{"format": "png", "scale": "2x"}]
+        }),
+        json!({"name": "<suffix>", "formats": [{"format": "png", "suffix": ""}]}),
+        json!({"exportPreset": "Logo Package"}),
+        json!({"zip": true, "formats": [{"format": "svg"}, {"format": "png"}]}),
+        json!({"fullDocument": true, "folders": "item", "formats": [{"format": "pdf"}]}),
+        json!({"fullDocument": true, "formats": [{"format": "png"}]}),
+        json!({"includeBleed": true}),
+        json!({"assets": [asset], "formats": [{"format": "svg"}]}),
+        json!({"layers": [layer], "folders": "item"}),
+        json!({"selection": "one"}),
+        json!({"selection": "each", "name": "<name>"}),
+    ];
+    for p in cases {
+        let first = super::screens::first_file(&s, &p).unwrap();
+        assert_eq!(first, written(&export(&mut s, p.clone())), "{p}");
+    }
+    for p in [json!({"layers": [layer], "assets": [asset]}), json!({"selection": "all"}), json!({"counterPer": "row"})] {
+        assert!(super::screens::first_file(&s, &p).is_err() && s.execute("document.exportForScreens", &p).is_err(), "{p}");
+    }
+    // A document named after a Windows device.
+    s.execute("file.new", &json!({"width": 40, "height": 30, "name": "nul"})).unwrap();
+    for p in [json!({"fullDocument": true, "folders": "item", "formats": [{"format": "pdf"}]}), json!({"name": "<filename>"})] {
+        let first = super::screens::first_file(&s, &p).unwrap();
+        assert_eq!(first, written(&export(&mut s, p.clone())), "{p}");
+    }
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 #[test]
 fn sub_folders_are_made_in_the_export_folder() {

crates/engine/src/cmd/fileio/tests_tiffbmp.rs

@@ -1,5 +1,5 @@
 //! TIFF, BMP and Targa export through `document.export`: the options reach the files, impossible
-//! ones are refused, and the files open again.
+//! ones are refused, and the files open again; Targa files open and place.
 
 use serde_json::{Value, json};
 
@@ -135,6 +135,152 @@ fn targa_depth_reaches_the_file() {
     }
 }
 
+/// The RGBA pixels of the image `document.open` or `file.place` stored for the first object of the
+/// active document's first layer.
+fn stored_pixels(s: &Session) -> image::RgbaImage {
+    let doc = &s.doc().unwrap().doc;
+    let im = match &doc.layers[0].children().unwrap()[0].kind {
+        vectorcraft_doc::NodeKind::Image(im) => im.clone(),
+        other => panic!("expected an image, got {other:?}"),
+    };
+    image::load_from_memory(&doc.images[&im.key].bytes).unwrap().to_rgba8()
+}
+
+/// A Targa header: no image id or color map, image type `kind`, `w` × `h` pixels of `depth` bits,
+/// image descriptor `descriptor`.
+fn targa_header(kind: u8, w: u16, h: u16, depth: u8, descriptor: u8) -> Vec<u8> {
+    let mut f = vec![0, 0, kind, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+    f.extend(w.to_le_bytes());
+    f.extend(h.to_le_bytes());
+    f.extend([depth, descriptor]);
+    f
+}
+
+/// Targa files open and place at their pixel size with the transparency they store, by any of the
+/// four Targa extensions; copied in a file manager they paste as a bitmap; the dialogs list them.
+#[test]
+fn targa_files_open_and_place() {
+    use crate::cmd::clipboard::{PASTE_ORDER, file_flavour};
+    let mut s = session();
+    let b64 = vectorcraft_format::base64_encode;
+    // VectorCraft's own exports: the transparent corner stays transparent at 16 and 32 bits (24
+    // bits are flattened on white) and the black rectangle stays black.
+    for depth in [16, 24, 32] {
+        let tga = export(&mut s, json!({"format": "tga", "depth": depth}));
+        let r = s.execute("document.open", &json!({"name": "art.tga", "dataBase64": b64(&tga)})).unwrap();
+        assert_eq!((&r["format"], &r["warnings"]), (&json!("tga"), &json!([])), "{depth} bits: {r}");
+        assert_eq!(s.doc().unwrap().doc.artboards[0].rect.size(), vectorcraft_geom::Size::new(60.0, 40.0));
+        let px = stored_pixels(&s);
+        assert_eq!(px.dimensions(), (60, 40));
+        let corner = if depth == 24 { [255; 4] } else { [0, 0, 0, 0] };
+        assert_eq!(px.get_pixel(5, 5).0[3], corner[3], "{depth} bits: the corner's alpha");
+        if depth == 24 {
+            assert_eq!(px.get_pixel(5, 5).0, corner, "flattened on white");
+        }
+        let black = px.get_pixel(40, 20).0;
+        assert!(black[3] == 255 && black[..3].iter().all(|c| *c < 80), "{depth} bits: {black:?}");
+        // The next export starts from the session's document again.
+        s = session();
+    }
+    let tga = export(&mut s, json!({"format": "tga", "depth": 32}));
+    for name in ["art.vda", "ART.ICB", "art.vst"] {
+        let r = s.execute("document.open", &json!({"name": name, "dataBase64": b64(&tga)})).unwrap();
+        assert_eq!(r["format"], "tga", "{name}: {r}");
+    }
+    s.execute("file.new", &json!({"width": 600, "height": 600})).unwrap();
+    let r = s.execute("file.place", &json!({"name": "art.tga", "dataBase64": b64(&tga)})).unwrap();
+    assert_eq!((&r["format"], r["ids"].as_array().map(Vec::len)), (&json!("tga"), Some(1)), "{r}");
+    assert_eq!(stored_pixels(&s).get_pixel(5, 5).0[3], 0, "placed with its transparency");
+    // Copied in a file manager, a Targa file pastes as a bitmap.
+    assert_eq!(file_flavour("art.tga", &tga, &PASTE_ORDER), Some("image/x-tga"));
+    let r = s.execute("clipboard.importImage", &json!({"mime": "image/x-tga", "dataBase64": b64(&tga)})).unwrap();
+    assert_eq!((&r["count"], &r["pixelWidth"], &r["pixelHeight"]), (&json!(1), &json!(60), &json!(40)), "{r}");
+    // The dialogs list the four extensions; the desktop packaging doesn't associate them.
+    for e in ["tga", "vda", "icb", "vst"] {
+        assert!(OPEN_EXTS.contains(&e) && PLACE_EXTS.contains(&e) && UNASSOCIATED_EXTS.contains(&e), "{e}");
+    }
+    let targa = ("Targa", &["tga", "vda", "icb", "vst"][..]);
+    assert!(open_filters().any(|f| f == targa) && place_filters().any(|f| f == targa));
+}
+
+/// Targa pixels in every layout: run-length encoded rows stored top down (as the `image` crate
+/// writes them), a 16-bit file whose one attribute bit per pixel is its alpha, with runs, stored
+/// right to left and top down, 32-bit files with no attribute bits (opaque), with eight, and with
+/// each Attributes Type in an extension area, and color-mapped files whose 16-bit entries carry the
+/// attribute bit.
+#[test]
+fn targa_layouts_and_alpha_read() {
+    let src = image::RgbaImage::from_fn(3, 2, |x, y| image::Rgba([x as u8 * 100, y as u8 * 200, 50, if x == 1 { 128 } else { 255 }]));
+    let mut rle = Vec::new();
+    src.write_to(&mut std::io::Cursor::new(&mut rle), image::ImageFormat::Tga).unwrap();
+    assert_eq!((rle[2], rle[17] & 0x20), (10, 0x20), "run-length encoded true color, stored top down");
+    assert_eq!(raster_image(&rle).map(|r| image::load_from_memory(&r.blob.bytes).unwrap().to_rgba8()).unwrap(), src);
+
+    // 3 × 2, 5-5-5 color and an attribute bit, right to left (bit 4), top down (bit 5): a raw
+    // packet of red, blue and a clear pixel for the first row, then a run of green.
+    let mut f = targa_header(10, 3, 2, 16, 0x31);
+    f.push(0x02);
+    f.extend([0xfc00u16, 0x801f, 0x0000].iter().flat_map(|v| v.to_le_bytes()));
+    f.push(0x82);
+    f.extend(0x83e0u16.to_le_bytes());
+    let img = image::load_from_memory(&raster_image(&f).unwrap().blob.bytes).unwrap().to_rgba8();
+    let px = |x, y| img.get_pixel(x, y).0;
+    assert_eq!((px(2, 0), px(1, 0), px(0, 0)[3]), ([255, 0, 0, 255], [0, 0, 255, 255], 0), "the first row, right to left");
+    assert!((0..3).all(|x| px(x, 1) == [0, 255, 0, 255]), "the run");
+
+    // 2 × 1 at 32 bits with no attribute bits: the fourth byte isn't alpha, whatever it holds.
+    for fourth in [[0, 0], [0, 255]] {
+        let mut f = targa_header(2, 2, 1, 32, 0x20);
+        f.extend([10, 20, 30, fourth[0], 40, 50, 60, fourth[1]]);
+        let img = image::load_from_memory(&raster_image(&f).unwrap().blob.bytes).unwrap().to_rgba8();
+        assert_eq!((img.get_pixel(0, 0).0, img.get_pixel(1, 0).0), ([30, 20, 10, 255], [60, 50, 40, 255]), "{fourth:?}");
+    }
+    // The same with eight attribute bits: the fourth byte is alpha, also when it is 0 everywhere.
+    let mut f = targa_header(2, 2, 1, 32, 0x28);
+    f.extend([10, 20, 30, 0, 40, 50, 60, 0]);
+    let img = image::load_from_memory(&raster_image(&f).unwrap().blob.bytes).unwrap().to_rgba8();
+    assert!(img.pixels().all(|p| p.0[3] == 0));
+    // The extension area's Attributes Type: undefined data (1, 2) isn't alpha, premultiplied colors
+    // (4) are divided by their alpha, and alpha (3) or 0, the field left unset, keeps it.
+    for (kind, want) in [(0, [50, 50, 50, 128]), (1, [50, 50, 50, 255]), (2, [50, 50, 50, 255]), (3, [50, 50, 50, 128]), (4, [100, 100, 100, 128])] {
+        let mut f = targa_header(2, 1, 1, 32, 0x28);
+        f.extend([50, 50, 50, 128]);
+        let mut area = vec![0; 495];
+        area[..2].copy_from_slice(&495u16.to_le_bytes());
+        area[494] = kind;
+        let at = f.len() as u32;
+        f.extend(area);
+        f.extend(at.to_le_bytes());
+        f.extend([0; 4]);
+        f.extend(b"TRUEVISION-XFILE.\0");
+        let img = image::load_from_memory(&raster_image(&f).unwrap().blob.bytes).unwrap().to_rgba8();
+        assert_eq!(img.get_pixel(0, 0).0, want, "Attributes Type {kind}");
+    }
+
+    // Color-mapped, one attribute bit, top down: 16-bit entries 5 (clear black) and 6 (red), as a
+    // raw row of 8-bit indices and as runs.
+    for (kind, data) in [(1, vec![6, 5, 6]), (9, vec![0x80, 6, 0x00, 5, 0x80, 6])] {
+        let mut f = vec![0, 1, kind, 5, 0, 2, 0, 16, 0, 0, 0, 0, 3, 0, 1, 0, 8, 0x21];
+        f.extend([0x0000u16, 0xfc00].iter().flat_map(|v| v.to_le_bytes()));
+        f.extend(data);
+        let img = image::load_from_memory(&raster_image(&f).unwrap().blob.bytes).unwrap().to_rgba8();
+        let row: Vec<[u8; 4]> = (0..3).map(|x| img.get_pixel(x, 0).0).collect();
+        assert_eq!(row, [[255, 0, 0, 255], [0, 0, 0, 0], [255, 0, 0, 255]], "image type {kind}");
+    }
+
+    // A grayscale image the decoder could hold whose RGBA pixels pass the allowance is refused from
+    // its header.
+    let huge = targa_header(11, 32768, 32768, 8, 0);
+    let e = raster_image(&huge).err().expect("refused");
+    assert_eq!(e.to_string(), "an image of 32768 × 32768 pixels is too large to draw");
+
+    // Headers with values the specification doesn't define aren't Targa files.
+    for bad in [targa_header(2, 0, 1, 24, 0), targa_header(1, 1, 1, 8, 0), targa_header(2, 1, 1, 12, 0), targa_header(2, 1, 1, 24, 0xc0)] {
+        assert!(!super::tgaread::is_targa(&bad), "{bad:?}");
+    }
+    assert!(raster_image(b"nothing an image reader knows").is_err());
+}
+
 #[test]
 fn the_formats_are_listed_and_write_one_file_per_artboard() {
     let mut s = Session::new();
@@ -143,7 +289,7 @@ fn the_formats_are_listed_and_write_one_file_per_artboard() {
     let find = |id: &str| r["formats"].as_array().unwrap().iter().find(|f| f["id"] == id).unwrap().clone();
     let (tiff, bmp, tga) = (find("tiff"), find("bmp"), find("tga"));
     assert_eq!((tiff["write"].as_bool(), tiff["read"].as_bool()), (Some(true), Some(true)));
-    assert_eq!((bmp["write"].as_bool(), tga["write"].as_bool(), tga["read"].as_bool()), (Some(true), Some(true), Some(false)));
+    assert_eq!((bmp["write"].as_bool(), tga["write"].as_bool(), tga["read"].as_bool()), (Some(true), Some(true), Some(true)));
     for (f, keys) in [
         (&tiff, &["colorModel", "lzw", "byteOrder", "embedIcc", "ppi", "antiAlias"][..]),
         (&bmp, &["colorModel", "depth", "fileFormat", "rle", "flipRows", "reduction", "dither"]),

crates/engine/src/cmd/fileio/tgaread.rs

@@ -0,0 +1,152 @@
+//! Reading Targa files (`.tga`, `.vda`, `.icb`, `.vst`) for File › Open and File › Place, from the
+//! Truevision TGA File Format Specification, version 2.0. The `image` crate decodes the pixels.
+//! A Targa file starts with no signature, so [`is_targa`] checks its header's fields instead, and
+//! [`fix_alpha`] gives the decoded image the transparency the file stores. The file is untrusted:
+//! every read is checked.
+
+/// Does `bytes` start with a Targa header? The fields must hold values the specification defines:
+/// a color map type of 0 or 1; an image type of 1, 2, 3, 9, 10 or 11 (color-mapped, true-color or
+/// black-and-white, raw or run-length encoded), with a color map for the color-mapped types; a
+/// color map entry size of 15, 16, 24 or 32 bits when there is a map; a width and a height; a pixel
+/// depth of 8, 15, 16, 24 or 32 bits; and bits 6 and 7 of the image descriptor clear.
+pub(super) fn is_targa(bytes: &[u8]) -> bool {
+    let [_, map_type, image_type, _, _, _, _, entry_bits, _, _, _, _, w0, w1, h0, h1, depth, descriptor, ..] = *bytes else {
+        return false;
+    };
+    matches!(map_type, 0 | 1)
+        && matches!(image_type, 1 | 2 | 3 | 9 | 10 | 11)
+        && (map_type == 1 || !matches!(image_type, 1 | 9))
+        && (map_type == 0 || matches!(entry_bits, 15 | 16 | 24 | 32))
+        && u16::from_le_bytes([w0, w1]) > 0
+        && u16::from_le_bytes([h0, h1]) > 0
+        && matches!(depth, 8 | 15 | 16 | 24 | 32)
+        && descriptor & 0xc0 == 0
+}
+
+/// Give `img`, decoded from Targa file `bytes`, the transparency the file stores. Bits 0 to 3 of
+/// the image descriptor give the number of attribute bits per pixel, and the extension area's
+/// Attributes Type, when the file has one, says what they hold:
+/// - with no attribute bits, or attribute data the Attributes Type calls undefined (1 or 2), the
+///   image is opaque, whatever a 32-bit pixel's fourth byte holds (the decoder reads it as alpha);
+/// - with one bit, a 16-bit true-color pixel takes that bit as its alpha (clear: transparent), and
+///   a color-mapped pixel takes the bit of the 16-bit color map entry it indexes; the decoder drops
+///   the bit;
+/// - with more, the decoder's alpha stays, and colors the Attributes Type calls premultiplied (4)
+///   are divided by it.
+///
+/// An Attributes Type of 0 ("no alpha") with attribute bits in the descriptor counts as alpha.
+pub(super) fn fix_alpha(bytes: &[u8], img: &mut image::RgbaImage) {
+    let Some(bits) = bytes.get(17).map(|d| d & 0x0f) else { return };
+    let kind = attributes_type(bytes);
+    if bits == 0 || matches!(kind, Some(1 | 2)) {
+        img.pixels_mut().for_each(|p| p.0[3] = 255);
+        return;
+    }
+    if bits == 1 {
+        one_bit_alpha(bytes, img);
+    }
+    if kind == Some(4) {
+        for p in img.pixels_mut() {
+            let a = u16::from(p.0[3]);
+            for c in &mut p.0[..3] {
+                // A fully transparent pixel keeps its colors.
+                if let Some(v) = (u16::from(*c) * 255 + a / 2).checked_div(a) {
+                    *c = v.min(255) as u8;
+                }
+            }
+        }
+    }
+}
+
+/// The Attributes Type of a Targa 2.0 file's extension area: `None` without the footer's
+/// `TRUEVISION-XFILE.` signature, an extension area, or one of the 495 bytes the specification
+/// gives it.
+fn attributes_type(bytes: &[u8]) -> Option<u8> {
+    let footer = bytes.len().checked_sub(26)?;
+    if bytes.get(footer + 8..)? != b"TRUEVISION-XFILE.\0" {
+        return None;
+    }
+    let at = usize::try_from(u32::from_le_bytes(bytes.get(footer..footer + 4)?.try_into().ok()?)).ok()?;
+    // The area follows the header and ends before the footer; its first field is its size.
+    if at < 18 || at.checked_add(495)? > footer || u16::from_le_bytes([*bytes.get(at)?, *bytes.get(at + 1)?]) != 495 {
+        return None;
+    }
+    bytes.get(at + 494).copied()
+}
+
+/// The attribute bit of each pixel of a Targa image with one attribute bit per pixel, as `img`'s
+/// alpha: the top bit of a 16-bit true-color pixel, or of the 16-bit color map entry an 8- or
+/// 16-bit index names, raw or run-length encoded. Rows and columns are stored in the order the
+/// image descriptor's bits 5 (top to bottom) and 4 (right to left) give. Other images, and pixels
+/// the data doesn't reach, keep the alpha they have.
+fn one_bit_alpha(bytes: &[u8], img: &mut image::RgbaImage) {
+    let [id_len, map_type, image_type, o0, o1, m0, m1, entry_bits, _, _, _, _, w0, w1, h0, h1, depth, descriptor, ..] = *bytes else {
+        return;
+    };
+    let (w, h) = (u32::from(u16::from_le_bytes([w0, w1])), u32::from(u16::from_le_bytes([h0, h1])));
+    let mapped = matches!(image_type, 1 | 9);
+    // The number of bytes each pixel takes.
+    let size = match image_type {
+        2 | 10 if depth == 16 => 2,
+        1 | 9 if map_type == 1 && entry_bits == 16 && matches!(depth, 8 | 16) => usize::from(depth / 8),
+        _ => return,
+    };
+    if img.dimensions() != (w, h) {
+        return;
+    }
+    let (first, entries) = (u16::from_le_bytes([o0, o1]), u16::from_le_bytes([m0, m1]));
+    let map_at = 18 + usize::from(id_len);
+    let map_len = if map_type == 1 { usize::from(entries) * usize::from(entry_bits).div_ceil(8) } else { 0 };
+    // The attribute bit is the top bit of the little-endian pixel or color map entry.
+    let attribute = |at: usize| -> Option<bool> {
+        let px = bytes.get(at..at.checked_add(size)?)?;
+        let high = if mapped {
+            let index = match *px {
+                [i] => u16::from(i),
+                [lo, hi] => u16::from_le_bytes([lo, hi]),
+                _ => return None,
+            };
+            let entry = index.checked_sub(first).filter(|e| *e < entries)?;
+            *bytes.get(map_at + usize::from(entry) * 2 + 1)?
+        } else {
+            *px.get(1)?
+        };
+        Some(high & 0x80 != 0)
+    };
+    let (top_down, right_to_left) = (descriptor & 0x20 != 0, descriptor & 0x10 != 0);
+    let total = u64::from(w) * u64::from(h);
+    let mut set = |i: u64, opaque: bool| {
+        let (row, col) = ((i / u64::from(w)) as u32, (i % u64::from(w)) as u32);
+        let y = if top_down { row } else { h - 1 - row };
+        let x = if right_to_left { w - 1 - col } else { col };
+        img.get_pixel_mut(x, y).0[3] = if opaque { 255 } else { 0 };
+    };
+    let mut at = map_at + map_len;
+    let mut i = 0;
+    while i < total {
+        if image_type < 9 {
+            let Some(opaque) = attribute(at) else { return };
+            set(i, opaque);
+            (i, at) = (i + 1, at + size);
+            continue;
+        }
+        let Some(&packet) = bytes.get(at) else { return };
+        let count = u64::from(packet & 0x7f) + 1;
+        at += 1;
+        if packet & 0x80 != 0 {
+            // A run packet repeats one pixel.
+            let Some(opaque) = attribute(at) else { return };
+            at += size;
+            for _ in 0..count.min(total - i) {
+                set(i, opaque);
+                i += 1;
+            }
+        } else {
+            for _ in 0..count.min(total - i) {
+                let Some(opaque) = attribute(at) else { return };
+                set(i, opaque);
+                (i, at) = (i + 1, at + size);
+            }
+        }
+    }
+}

crates/engine/src/cmd/freeform.rs

@@ -19,7 +19,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add Freeform Point",
             [],
             None,
-            "{at: [x,y] (document coordinates), color? (default: the gradient's colour there), opacity?: 0..1 (or 0..100), spread?: 0..1 (or 0..100 %; the radius of pure colour around the point, a fraction of half the object's larger side; default 0), line?: true (join it to the selected point: extends the line ending there, else starts one), ids?|id?, stroke?: bool (default: the targeted item's kind, else the active proxy), item?: fill/stroke item index|null (omitted: the Appearance panel's active item when it is of the edited kind), target?: \"object\"|\"contents\"} add a point to the freeform gradient (an unplaced one keeps its automatic points first) and select it → {index}",
+            "{at: [x,y] (document coordinates), color? (default: the gradient's colour there), keepModel?: bool (as paint.setFill), opacity?: 0..1 (or 0..100), spread?: 0..1 (or 0..100 %; the radius of pure colour around the point, a fraction of half the object's larger side; default 0), line?: true (join it to the selected point: extends the line ending there, else starts one), ids?|id?, stroke?: bool (default: the targeted item's kind, else the active proxy), item?: fill/stroke item index|null (omitted: the Appearance panel's active item when it is of the edited kind), target?: \"object\"|\"contents\"} add a point to the freeform gradient (an unplaced one keeps its automatic points first) and select it → {index}",
             has_doc,
             add_point
         ),
@@ -28,7 +28,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Edit Freeform Point",
             [],
             None,
-            "{index? (default: the selected point), at?: [x,y] (document coordinates), color?, opacity?: 0..1 (or 0..100), spread?: 0..1 (or 0..100 %), ids?|id?, stroke?: bool (default: the targeted item's kind, else the active proxy), item?: fill/stroke item index|null (omitted: the Appearance panel's active item when it is of the edited kind), target?: \"object\"|\"contents\"} move or recolour a point of the freeform gradient → {index}",
+            "{index? (default: the selected point), at?: [x,y] (document coordinates), color?, keepModel?: bool (as paint.setFill), opacity?: 0..1 (or 0..100), spread?: 0..1 (or 0..100 %), ids?|id?, stroke?: bool (default: the targeted item's kind, else the active proxy), item?: fill/stroke item index|null (omitted: the Appearance panel's active item when it is of the edited kind), target?: \"object\"|\"contents\"} move or recolour a point of the freeform gradient → {index}",
             has_doc,
             set_point
         ),
@@ -134,6 +134,12 @@ fn point_fields(v: &Value, pt: &mut FreeformPoint, to_paint: Affine) -> std::res
     Ok(())
 }
 
+/// The `color` of `p` as the document stores it: an RGB color in a CMYK document becomes CMYK
+/// through the color settings ([`super::paint::new_color`]). `None` without a valid one.
+fn given_color(s: &Session, p: &Value) -> Option<vectorcraft_color::Color> {
+    p.get("color").and_then(color_value).map(|c| super::paint::new_color(s, p, c))
+}
+
 /// Parse the `freeform` param of a gradient paint (`{points: [{at, color, opacity?, spread?}],
 /// lines?: [[index, …]], mode?}`; points in the paint's space). Lossless for
 /// `vectorcraft_tools::params::freeform_json`.
@@ -238,11 +244,15 @@ fn add_point(s: &mut Session, p: &Value) -> Result<Value> {
         Some(Value::Bool(true)) => s.selected_freeform_point(),
         Some(_) => return Err(bad(C, "`line` must be true or false")),
     };
+    let given = given_color(s, p);
     let index = edit(s, p, C, |f, sp| {
         let q = sp.to_paint * at;
         let (color, opacity) = f.sample(q, sp.scale);
         let mut pt = FreeformPoint { opacity, ..FreeformPoint::new(q, color) };
         point_fields(p, &mut pt, sp.to_paint)?;
+        if let Some(c) = given {
+            pt.color = c;
+        }
         let i = f.add_point(pt);
         if let Some(from) = join {
             f.connect(from, i);
@@ -256,9 +266,14 @@ fn add_point(s: &mut Session, p: &Value) -> Result<Value> {
 fn set_point(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "paint.freeform.setPoint";
     let i = point_index(s, p, C)?;
+    let given = given_color(s, p);
     edit(s, p, C, |f, sp| {
         check_index(f, i)?;
-        point_fields(p, &mut f.points[i], sp.to_paint)
+        point_fields(p, &mut f.points[i], sp.to_paint)?;
+        if let Some(c) = given {
+            f.points[i].color = c;
+        }
+        Ok(())
     })?;
     Ok(json!({ "index": i }))
 }

crates/engine/src/cmd/gradient.rs

@@ -20,7 +20,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Gradient",
             ["Window", "Gradient"],
             None,
-            "{stroke?: bool (default: the targeted item's kind, else the active proxy), kind?: linear|radial|freeform (freeform places points on each object, coloured along the stops), mode?: points|lines (freeform: how the Gradient tool adds points), stops?: [{offset 0..1, color? (needed without swatch), opacity? 0..1 (or 0..100), midpoint? 0.13..0.87, swatch?: colour swatch name (a global or spot colour or tint swatch links the stop, so swatch edits recolour it and a spot stop prints on its plate; a process colour just gives its colour), tint?: 0..100 (% of the linked swatch; default 100, or a tint swatch's own)}] (at least 2; a freeform gradient's points are recoloured along them), angle?: deg, aspect?: %, reverse?: bool, item?: fill/stroke item index|null (omitted: the Appearance panel's active item when it is of the edited kind), ids?|id?, strokeMode?: within|along|across (strokes only: the gradient lies on the page and shows through the stroke, runs from the start of each subpath to its end, or runs from the stroke's left edge to its right all along it; with nothing selected, for the next object drawn; type characters' own strokes always paint within), target?: \"object\"|\"contents\"} edit the gradient in place (keeps its placement); solid/none paints become the default gradient",
+            "{stroke?: bool (default: the targeted item's kind, else the active proxy), kind?: linear|radial|freeform (freeform places points on each object, coloured along the stops), mode?: points|lines (freeform: how the Gradient tool adds points), stops?: [{offset 0..1, color? (needed without swatch), opacity? 0..1 (or 0..100), midpoint? 0.13..0.87, swatch?: colour swatch name (a global or spot colour or tint swatch links the stop, so swatch edits recolour it and a spot stop prints on its plate; a process colour just gives its colour), tint?: 0..100 (% of the linked swatch; default 100, or a tint swatch's own)}] (at least 2; a freeform gradient's points are recoloured along them), keepModel?: bool (as paint.setFill; a stop color the gradient already has keeps its model), angle?: deg, aspect?: %, reverse?: bool, item?: fill/stroke item index|null (omitted: the Appearance panel's active item when it is of the edited kind), ids?|id?, strokeMode?: within|along|across (strokes only: the gradient lies on the page and shows through the stroke, runs from the start of each subpath to its end, or runs from the stroke's left edge to its right all along it; with nothing selected, for the next object drawn; type characters' own strokes always paint within), target?: \"object\"|\"contents\"} edit the gradient in place (keeps its placement); solid/none paints become the default gradient",
             has_doc,
             edit_gradient
         ),
@@ -137,6 +137,47 @@ pub(crate) fn link_stops(d: &Document, v: &Value) -> Parsed<Value> {
     Ok(v)
 }
 
+/// Stop colors to store, one per stop of `g` (params holding `stops`, before [`link_stops`]): the
+/// color a stop gives and the color the document stores it as when it is new to the gradient, an
+/// RGB color in a CMYK document becoming CMYK through the color settings
+/// ([`super::paint::new_color`], with `p`'s `keepModel`). `None` for a stop that names a swatch,
+/// which gives its color in the swatch's model, and for a color stored as given.
+pub(crate) type StopColors = Vec<Option<(vectorcraft_color::Color, vectorcraft_color::Color)>>;
+
+/// The [`StopColors`] of `g`'s stops.
+pub(crate) fn stop_colors(s: &Session, p: &Value, g: &Value) -> StopColors {
+    let stops = g.get("stops").and_then(Value::as_array).map(Vec::as_slice).unwrap_or_default();
+    let stored = |st: &Value| {
+        let c = st.get("color").and_then(color_value).filter(|_| str_param(st, "swatch").is_none())?;
+        let to = super::paint::new_color(s, p, c);
+        (to != c).then_some((c, to))
+    };
+    stops.iter().map(stored).collect()
+}
+
+/// `g` (params holding `stops`, resolved by [`link_stops`] in their order) for an edit of paint
+/// `old`, with each stop's color replaced by the one `stored` ([`stop_colors`]) gives for it,
+/// unless `old`'s stops already have that color. A freeform gradient's points are colored from the
+/// stored colors, and a stop list sent back with only its positions changed keeps its colors.
+pub(crate) fn with_stored_stops<'a>(g: &'a Value, old: &Paint, stored: &StopColors) -> std::borrow::Cow<'a, Value> {
+    use std::borrow::Cow;
+    if stored.iter().all(Option::is_none) {
+        return Cow::Borrowed(g);
+    }
+    let had = |c: &vectorcraft_color::Color| matches!(old, Paint::Gradient(o) if o.gradient.stops.iter().any(|st| st.color == *c));
+    let mut v = g.clone();
+    let Some(stops) = v.get_mut("stops").and_then(Value::as_array_mut) else { return Cow::Borrowed(g) };
+    for (st, sc) in stops.iter_mut().zip(stored) {
+        let Some((from, to)) = sc.filter(|(from, _)| !had(from)) else { continue };
+        if st.get("color").and_then(color_value) == Some(from)
+            && let Some(o) = st.as_object_mut()
+        {
+            o.insert("color".into(), color_json(&to));
+        }
+    }
+    Cow::Owned(v)
+}
+
 /// Parse `stops` params: at least two, each with a numeric `offset` (clamped to 0..1) and a valid
 /// `color`; `opacity` is 0..1 (values above 1 are percentages) and `midpoint` is clamped to the
 /// diamond's range; `swatch` and `tint` (%) keep a stop's link as given (resolve them first with
@@ -340,11 +381,13 @@ fn edit_gradient(s: &mut Session, p: &Value) -> Result<Value> {
         Some(_) if !stroke => return Err(bad(C, "`strokeMode` applies to strokes (stroke: true)")),
         Some(m) => Some(StrokeGradientMode::parse(m).ok_or_else(|| bad(C, format!("strokeMode must be within|along|across, got {m}")))?),
     };
+    // New RGB stop colors take the document's model; those of the swatches the stops name don't.
+    let stored = stop_colors(s, p, p);
     // Stops naming swatches take their colours from them.
     let p = &link_stops(&s.doc()?.doc, p).map_err(|e| bad(C, e))?;
     // Validate against the defaults first so bad params fail without touching the document.
     let default_paint = if stroke { s.paint.stroke.clone() } else { s.paint.fill.clone() };
-    let new_default = apply_gradient_edit(&default_paint, p, None).map_err(|e| bad(C, e))?;
+    let new_default = apply_gradient_edit(&default_paint, &with_stored_stops(p, &default_paint, &stored), None).map_err(|e| bad(C, e))?;
     let freeform = str_param(p, "kind").and_then(GradientKind::parse) == Some(GradientKind::Freeform);
     edit_items(s, &ids, item, C, "Gradient", !stroke, |n, index| {
         if index.is_none()
@@ -353,7 +396,7 @@ fn edit_gradient(s: &mut Session, p: &Value) -> Result<Value> {
             let lb = t.local_bounds();
             for r in &mut t.runs {
                 let (cur, b) = run_paint_mut(r, stroke, lb);
-                *cur = apply_gradient_edit(cur, p, Some(b)).map_err(|e| bad(C, e))?;
+                *cur = apply_gradient_edit(cur, &with_stored_stops(p, cur, &stored), Some(b)).map_err(|e| bad(C, e))?;
             }
             return Ok(());
         }
@@ -364,7 +407,8 @@ fn edit_gradient(s: &mut Session, p: &Value) -> Result<Value> {
             Some(f) => f,
             None => &|_| true,
         };
-        let np = apply_gradient_edit_in(n.appearance.paint_at(index, !stroke).unwrap_or(&Paint::None), p, b, inside).map_err(|e| bad(C, e))?;
+        let old = n.appearance.paint_at(index, !stroke).unwrap_or(&Paint::None);
+        let np = apply_gradient_edit_in(old, &with_stored_stops(p, old, &stored), b, inside).map_err(|e| bad(C, e))?;
         n.appearance.set_paint_at(index, !stroke, np);
         if let Some(m) = mode
             && let Some(st) = n.appearance.stroke_at_mut(index)

crates/engine/src/cmd/live.rs

@@ -256,7 +256,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Set Mesh Point Color",
             [],
             None,
-            "{id, index, color, opacity?: 0..1} colour of one mesh point",
+            "{id, index, color, keepModel?: bool (as paint.setFill), opacity?: 0..1} colour of one mesh point",
             has_doc,
             mesh_set_color
         ),
@@ -274,7 +274,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add Mesh Line",
             [],
             None,
-            "{id, x, y, color?} add a row and a column through (x, y) to a gradient mesh (new point in `color`) or a mesh envelope → {index}",
+            "{id, x, y, color?, keepModel?: bool (as paint.setFill)} add a row and a column through (x, y) to a gradient mesh (new point in `color`) or a mesh envelope → {index}",
             has_doc,
             mesh_add_line
         ),
@@ -410,6 +410,7 @@ const DEFAULT_STEPS: u32 = 5;
 const DEFAULT_DISTANCE: f64 = 10.0;
 
 fn spacing_param(p: &Value, cmd: &str, current: BlendSpacing) -> Result<BlendSpacing> {
+    check_numbers(p, &["value", "steps", "distance"], cmd)?;
     let num = |k: &str| p.get(k).and_then(Value::as_f64);
     let steps = |k: &str, n: f64| whole(n, k, cmd).map(|n| BlendSpacing::Steps(n as u32));
     let mode = str_param(p, "spacing");
@@ -971,7 +972,11 @@ fn blend_reverse_stack(s: &mut Session, _: &Value) -> Result<Value> {
 
 // ---------- Envelope ----------
 
+/// The number keys of a warp: `bend`, and the two distortions by their short and long names.
+const WARP_NUMBERS: &[&str] = &["bend", "h", "v", "horizontalDistortion", "verticalDistortion"];
+
 fn warp_kind(p: &Value, cmd: &str, cur: Option<&EnvelopeKind>) -> Result<EnvelopeKind> {
+    check_numbers(p, WARP_NUMBERS, cmd)?;
     let (mut style, mut bend, mut h, mut v, mut horizontal) = ("arc".to_string(), 50.0, 0.0, 0.0, true);
     if let Some(EnvelopeKind::Warp { style: s0, bend: b0, h: h0, v: v0, horizontal: z0 }) = cur {
         (style, bend, h, v, horizontal) = (s0.clone(), *b0, *h0, *v0, *z0);
@@ -1005,6 +1010,7 @@ fn envelope(id: NodeId, content: Vec<Arc<Node>>, kind: EnvelopeKind, (options, f
 
 /// `rows` and `cols` (or `columns`), whole numbers 1..50 each, defaulting to `default`.
 fn rows_cols(p: &Value, cmd: &str, default: (u32, u32)) -> Result<(u32, u32)> {
+    check_numbers(p, &["rows", "cols", "columns"], cmd)?;
     let rows = f64_or(p, "rows", default.0 as f64);
     let cols_key = if p.get("cols").and_then(Value::as_f64).is_some() { "cols" } else { "columns" };
     let cols = f64_or(p, cols_key, default.1 as f64);
@@ -1241,6 +1247,8 @@ fn env_release(s: &mut Session, _: &Value) -> Result<Value> {
 
 fn env_options(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "object.envelope.options";
+    check_numbers(p, &["fidelity"], C)?;
+    check_numbers(p, WARP_NUMBERS, C)?;
     let fid = p.get("fidelity").and_then(Value::as_f64);
     if fid.is_some_and(|f| !(0.0..=100.0).contains(&f)) {
         return Err(bad(C, "fidelity must be 0..100"));
@@ -1386,14 +1394,19 @@ fn mesh_create(s: &mut Session, p: &Value) -> Result<Value> {
         Some(a) => MeshAppearance::parse(a).ok_or_else(|| bad(C, "appearance must be flat|center|edge"))?,
         None => MeshAppearance::Flat,
     };
+    check_numbers(p, &["highlight"], C)?;
     let highlight = f64_or(p, "highlight", 100.0).clamp(0.0, 100.0);
-    let at = point_param(p, "at");
+    let at = match p.get("at") {
+        None | Some(Value::Null) => None,
+        Some(v) => Some(finite_numbers(v).map(|[x, y]| Point::new(x, y)).ok_or_else(|| bad(C, "`at` must be [x, y]"))?),
+    };
     let (rows, cols) = if at.is_some() { (1, 1) } else { (rows, cols) };
     let roots = roots_param(s, p)?;
     let (ids, index) = s.edit("Create Gradient Mesh", |d, sel| {
         let mut out = vec![];
         let mut index = None;
         let mut refused = None;
+        let model = d.color_mode.model();
         for id in &roots {
             let Some(n) = d.node(*id).cloned() else { continue };
             let m = if let NodeKind::Image(im) = &n.kind {
@@ -1413,7 +1426,7 @@ fn mesh_create(s: &mut Session, p: &Value) -> Result<Value> {
                 match n.appearance.fill_paint() {
                     // The points take the colours the gradient paints there.
                     Paint::Gradient(g) => {
-                        path.bounds().and_then(|b| GradientMesh::for_path_with(&path, rows, cols, &*gradient_sampler(&g, b))).map(|mut m| {
+                        path.bounds().and_then(|b| GradientMesh::for_path_with(&path, rows, cols, &*gradient_sampler(&g, b, model))).map(|mut m| {
                             m.highlight(app, highlight);
                             m
                         })
@@ -1521,8 +1534,9 @@ fn whole(x: f64, key: &str, cmd: &str) -> Result<f64> {
 
 fn mesh_set_color(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "object.mesh.setPointColor";
+    check_numbers(p, &["opacity"], C)?;
     let index = index_param(p, "index", C)?;
-    let color = p.get("color").and_then(color_value);
+    let color = p.get("color").and_then(color_value).map(|c| super::paint::new_color(s, p, c));
     let opacity = p.get("opacity").and_then(Value::as_f64);
     if color.is_none() && opacity.is_none() {
         return Err(bad(C, "missing `color` or `opacity`"));
@@ -1559,7 +1573,7 @@ fn mesh_move_point(s: &mut Session, p: &Value) -> Result<Value> {
 fn mesh_add_line(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "object.mesh.addLine";
     let q = Point::new(f64_req(p, "x", C)?, f64_req(p, "y", C)?);
-    let color = p.get("color").and_then(color_value);
+    let color = p.get("color").and_then(color_value).map(|c| super::paint::new_color(s, p, c));
     let index = with_mesh(s, p, C, "Add Mesh Line", true, |m| {
         let i = m.add_lines_at(q).ok_or_else(|| bad(C, "point is outside the mesh"))?;
         if let Some(c) = color {

crates/engine/src/cmd/menucmds.rs

@@ -341,6 +341,7 @@ pub(crate) fn transform_each_again(s: &mut Session, p: &Value) -> Result<Value>
 /// repeats; a dialog's preview records it as it commits (`Session::commit_interaction`).
 fn transform_each_as(s: &mut Session, p: &Value, label: &str) -> Result<Value> {
     let roots = selected_roots(s)?;
+    check_numbers(p, &["scaleH", "scaleV", "moveH", "moveV", "rotate"], "object.transformEach")?;
     // Bounded so coordinates stay finite (and the document stays serializable).
     let sh = f64_or(p, "scaleH", 100.0).clamp(-100_000.0, 100_000.0);
     let sv = f64_or(p, "scaleV", 100.0).clamp(-100_000.0, 100_000.0);
@@ -480,6 +481,7 @@ impl Rasterized {
 /// `cmd`, each defaulting to `doc`'s raster effects settings: over the bounds of what the art draws
 /// ([`vectorcraft_render::drawn_bounds`]) and the room around them, in whole pixels.
 pub(crate) fn rasterize_art(doc: &vectorcraft_doc::Document, nodes: Vec<Node>, p: &Value, cmd: &str) -> Result<Rasterized> {
+    check_numbers(p, &["ppi"], cmd)?;
     let ppi = f64_or(p, "ppi", doc.raster_effects_ppi);
     if !(1.0..=2400.0).contains(&ppi) {
         return Err(bad(cmd, "ppi must be between 1 and 2400"));
@@ -600,6 +602,7 @@ fn object_mosaic(s: &mut Session, p: &Value) -> Result<Value> {
     let colors = vectorcraft_trace::mosaic(&raster, cols, rows);
     // Tiles in image space, placed by the image transform (scaled to a new size if asked).
     let b = node.geometric_bounds().ok_or_else(|| bad(C, "image has no bounds"))?;
+    check_numbers(p, &["width", "height", "spacingX", "spacingY"], C)?;
     let (nw, nh) = (f64_or(p, "width", b.width()).max(0.1), f64_or(p, "height", b.height()).max(0.1));
     let resize = Affine::translate(b.origin().to_vec2())
         * Affine::scale_non_uniform(nw / b.width().max(1e-9), nh / b.height().max(1e-9))
@@ -671,8 +674,8 @@ fn crop_image(s: &mut Session, p: &Value) -> Result<Value> {
         return trim_image(s, id, (**im).clone());
     }
     let ib = node.geometric_bounds().ok_or_else(|| bad(C, "image has no bounds"))?;
-    let rect = match p.get("rect").and_then(Value::as_array) {
-        Some(a) if a.len() == 4 => {
+    let rect = match p.get("rect").filter(|v| !v.is_null()) {
+        Some(Value::Array(a)) if a.len() == 4 => {
             let v: Vec<f64> = a.iter().filter_map(Value::as_f64).collect();
             if v.len() != 4 {
                 return Err(bad(C, "rect must be [x, y, width, height]"));
@@ -832,6 +835,7 @@ impl Session {
 
 fn trim_marks(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "object.createTrimMarks";
+    check_numbers(p, &["offset", "length", "bleed", "weight"], C)?;
     let style = match str_param(p, "style") {
         Some(v) => MarkStyle::parse(v).ok_or_else(|| bad(C, "`style` must be roman or japanese"))?,
         None => s.crop_mark_style(),
@@ -1001,6 +1005,7 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
         L::Row => (1, n_ab),
         L::Column => (n_ab, 1),
     };
+    check_numbers(p, &["spacing"], CMD)?;
     let spacing = f64_or(p, "spacing", 20.0).clamp(-1.0e5, 1.0e5);
     let move_art = bool_or(p, "moveArtwork", true);
     let locked_and_hidden = s.prefs.move_locked_with_artboard;

crates/engine/src/cmd/mod.rs

@@ -181,6 +181,10 @@ pub fn can_undo(s: &Session) -> std::result::Result<(), String> {
 pub fn can_redo(s: &Session) -> std::result::Result<(), String> {
     s.active().filter(|d| !d.history.redo.is_empty()).map(|_| ()).ok_or_else(|| "nothing to redo".into())
 }
+/// The active document has a step to undo or to redo (Clear History).
+pub fn can_clear_history(s: &Session) -> std::result::Result<(), String> {
+    s.active().filter(|d| !d.history.undo.is_empty() || !d.history.redo.is_empty()).map(|_| ()).ok_or_else(|| "no history to clear".into())
+}
 pub fn has_clipboard(s: &Session) -> std::result::Result<(), String> {
     has_doc(s)?;
     if s.clipboard.is_empty() { Err("clipboard is empty".into()) } else { Ok(()) }
@@ -496,7 +500,7 @@ pub(crate) fn date_param(p: &Value, key: &str, cmd: &str) -> Result<Option<Optio
 /// no clock). It joins the running command's journal entry as `key`, so a replay of the journal
 /// gives the same date whenever it runs (an action leaves it out: [`crate::Session::journal_for_action`]).
 pub(crate) fn clock_date(s: &mut Session, key: &str, given: Option<Option<i64>>) -> Option<i64> {
-    let t = given.unwrap_or_else(vectorcraft_doc::metadata::now_unix);
+    let t = given.unwrap_or_else(vectorcraft_doc::metadata::output_time);
     s.note_journal(key, serde_json::json!(t));
     t
 }

crates/engine/src/cmd/package.rs

@@ -400,7 +400,7 @@ fn check_no_overwrite(root: &Path, entries: &[Entry], sources: &[&str]) -> Resul
 
 /// The MS-DOS time and date a zip entry records: now (UTC), else 1980-01-01.
 fn dos_time() -> (u16, u16) {
-    let Some(t) = vectorcraft_doc::metadata::now_unix() else { return (0, 0x21) };
+    let Some(t) = vectorcraft_doc::metadata::output_time() else { return (0, 0x21) };
     let [y, mo, d, h, mi, s] = vectorcraft_doc::metadata::civil(t);
     let date = (((y - 1980).clamp(0, 127) << 9) | (mo << 5) | d) as u16;
     (((h << 11) | (mi << 5) | (s / 2)) as u16, date)

crates/engine/src/cmd/paint.rs

@@ -301,7 +301,7 @@ fn new_color_model(s: &Session, p: &Value) -> Option<vectorcraft_color::cms::Mod
 /// `c` in `model` ([`new_color_model`]) when it is an RGB color, converted through the color
 /// settings (the working spaces and their intent) as Document Color Mode converts it. Other colors
 /// are returned as given.
-fn stored_color(model: Option<vectorcraft_color::cms::Model>, c: Color) -> Color {
+pub(crate) fn stored_color(model: Option<vectorcraft_color::cms::Model>, c: Color) -> Color {
     match (c, model) {
         (Color::Rgb { .. }, Some(m)) => {
             let cms = vectorcraft_color::cms::active();
@@ -318,8 +318,8 @@ pub(crate) fn new_color(s: &Session, p: &Value, c: Color) -> Color {
 }
 
 /// Parse a paint from params (color / none / swatch / gradient). None = no paint keys given. A
-/// colour or gradient given in RGB takes the document's colour model ([`new_color_model`]),
-/// converted through the color settings.
+/// color or gradient (its stops and freeform points) given in RGB takes the document's color
+/// model ([`new_color_model`]), converted through the color settings.
 pub(crate) fn paint_from(s: &Session, p: &Value) -> Result<Option<Paint>> {
     let model = new_color_model(s, p);
     let new_color = |c: Color| stored_color(model, c);
@@ -342,9 +342,17 @@ pub(crate) fn paint_from(s: &Session, p: &Value) -> Result<Option<Paint>> {
         };
     }
     if let Some(g) = p.get("gradient") {
+        // A stop naming a process swatch keeps the swatch's model.
+        let stored = super::gradient::stop_colors(s, p, g);
         let g = super::gradient::link_stops(&s.doc()?.doc, g).map_err(|e| bad("paint", e))?;
-        let mut gp = super::gradient::parse_gradient(&g).map_err(|e| bad("paint", e))?;
-        gp.gradient.stops.iter_mut().filter(|st| st.swatch.is_none()).for_each(|st| st.color = new_color(st.color));
+        let mut gp = super::gradient::parse_gradient(&super::gradient::with_stored_stops(&g, &Paint::None, &stored)).map_err(|e| bad("paint", e))?;
+        if g.get("stops").is_none() {
+            // The default stops, white to black.
+            gp.gradient.stops.iter_mut().for_each(|st| st.color = new_color(st.color));
+        }
+        if let Some(f) = &mut gp.freeform {
+            f.points.iter_mut().for_each(|pt| pt.color = new_color(pt.color));
+        }
         return Ok(Some(Paint::Gradient(Box::new(gp))));
     }
     if let Some(c) = p.get("color") {

crates/engine/src/cmd/panelcmds.rs

@@ -2,7 +2,7 @@
 //! Character/Paragraph attributes.
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Composer, NodeKind, Scaling};
+use vectorcraft_doc::{Composer, JustificationOptions, NodeKind, Scaling, SingleWordJustify};
 use vectorcraft_geom::{Rect, Vec2};
 
 use super::*;
@@ -43,7 +43,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Character / Paragraph",
             [],
             None,
-            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt (±1296), hyphenate?: bool, wordsLongerThan?: letters 1..25 (5), afterFirst?, beforeLast?: letters 1..15 (3), hyphenLimit?: lines 0..25 (0: no limit), hyphenationZone?: pt 0..1296 (0; Single-line Composer only), hyphenateCapitalized?: bool (true) (Paragraph panel menu › Hyphenation…: only words longer than wordsLongerThan break, keeping afterFirst letters before the hyphen and beforeLast after it; at most hyphenLimit lines in a row end with a hyphen; a line whose text already ends within hyphenationZone of its right edge breaks before the next word instead of hyphenating it; the counts are rounded, and every value is clamped to its range), mojikumi?: \"none\"|\"lineEndHalf\" (Japanese punctuation spacing), kinsoku?: \"none\"|\"hard\"|\"soft\" (Kinsoku Set: Soft lets 々, ー and small kana start a line), direction?: \"auto\"|\"leftToRight\"|\"rightToLeft\" (paragraph direction; auto: from each paragraph's first strong character), leadingModel?: \"romanBaseline\"|\"emBoxTop\" (leading measured baseline to baseline, or em box top to top), charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (where characters smaller than the largest on their line line up with it), proportionalMetrics?: bool (full-width glyphs on the font's proportional widths: `palt` in horizontal type, `vpal` in vertical type), digits?: \"default\"|\"arabic\"|\"hindi\"|\"farsi\" (Character panel menu › Digits: the numeral system every digit is drawn in, whatever was typed), fontAxes?: {\"wght\": 650, …} (Character panel › Variable Font, as text.setRangeStyle: each axis named set in its units and clamped to its range, null back to the style's own setting), burasagari?: \"none\"|\"standard\"|\"forced\" (Paragraph panel menu › Burasagari None/Regular/Force: an East Asian comma or full stop ending an area type line hangs outside it: when it doesn't fit, or always; new type: \"standard\"), romanHangingPunctuation?: bool (Paragraph panel menu › Roman Hanging Punctuation: quotation marks, hyphens, full stops and commas starting or ending a line hang outside the margin, asterisks, tildes, ellipses, dashes, colons and semicolons by half; off by default), composer?: \"singleLine\"|\"everyLine\" (line breaking, Every-line by default), start?: byte, end?: byte} (baselineShift is in document points and hScale includes the object transform; groups include their text descendants; with a range: the character attributes style that range and the paragraph attributes apply to the paragraphs it touches; without: all the text)",
+            "{ids?|id?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, underline?, strikethrough?, allCaps?, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), leftIndent?, rightIndent?, firstLineIndent?, spaceBefore?, spaceAfter?: pt (±1296), hyphenate?: bool, wordsLongerThan?: letters 1..25 (5), afterFirst?, beforeLast?: letters 1..15 (3), hyphenLimit?: lines 0..25 (0: no limit), hyphenationZone?: pt 0..1296 (0; Single-line Composer only), hyphenateCapitalized?: bool (true) (Paragraph panel menu › Hyphenation…: only words longer than wordsLongerThan break, keeping afterFirst letters before the hyphen and beforeLast after it; at most hyphenLimit lines in a row end with a hyphen; a line whose text already ends within hyphenationZone of its right edge breaks before the next word instead of hyphenating it; the counts are rounded, and every value is clamped to its range), wordSpacing?: % 0..1000 (80, 100, 133), letterSpacing?: % of a word space -100..500 (0, 0, 0), glyphScaling?: % 50..200 (100, 100, 100): each [min, desired, max] or {min?, desired?, max?} (Paragraph panel menu › Justification…: Desired applies to every line, Minimum and Maximum bound what justified lines may use; values are clamped to their range, and Minimum ≤ Desired ≤ Maximum must hold afterwards or nothing changes), autoLeading?: % of the size 0..500 (120; the leading of characters whose leading is Auto), singleWordJustification?: \"fullJustify\"|\"alignLeft\"|\"alignCenter\"|\"alignRight\" (a justified line holding one word), mojikumi?: \"none\"|\"lineEndHalf\" (Japanese punctuation spacing), kinsoku?: \"none\"|\"hard\"|\"soft\" (Kinsoku Set: Soft lets 々, ー and small kana start a line), direction?: \"auto\"|\"leftToRight\"|\"rightToLeft\" (paragraph direction; auto: from each paragraph's first strong character), leadingModel?: \"romanBaseline\"|\"emBoxTop\" (leading measured baseline to baseline, or em box top to top), charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (where characters smaller than the largest on their line line up with it), proportionalMetrics?: bool (full-width glyphs on the font's proportional widths: `palt` in horizontal type, `vpal` in vertical type), digits?: \"default\"|\"arabic\"|\"hindi\"|\"farsi\" (Character panel menu › Digits: the numeral system every digit is drawn in, whatever was typed), fontAxes?: {\"wght\": 650, …} (Character panel › Variable Font, as text.setRangeStyle: each axis named set in its units and clamped to its range, null back to the style's own setting), burasagari?: \"none\"|\"standard\"|\"forced\" (Paragraph panel menu › Burasagari None/Regular/Force: an East Asian comma or full stop ending an area type line hangs outside it: when it doesn't fit, or always; new type: \"standard\"), romanHangingPunctuation?: bool (Paragraph panel menu › Roman Hanging Punctuation: quotation marks, hyphens, full stops and commas starting or ending a line hang outside the margin, asterisks, tildes, ellipses, dashes, colons and semicolons by half; off by default), composer?: \"singleLine\"|\"everyLine\" (line breaking, Every-line by default), start?: byte, end?: byte} (baselineShift is in document points and hScale includes the object transform; groups include their text descendants; with a range: the character attributes style that range and the paragraph attributes apply to the paragraphs it touches; without: all the text)",
             has_doc,
             set_format
         ),
@@ -236,6 +236,34 @@ pub(crate) fn push_artboard_copy(d: &mut vectorcraft_doc::Document, src: &vector
 /// Largest indent or paragraph spacing (points; Illustrator's limit).
 const MAX_PARA: f64 = 1296.0;
 
+/// A justification spacing of `text.setFormat` (`wordSpacing`, `letterSpacing`, `glyphScaling`):
+/// `[min, desired, max]` or `{min?, desired?, max?}`, in percent. The values not given are kept.
+fn spacing_param(p: &Value, key: &str, c: &str) -> Result<Option<[Option<f64>; 3]>> {
+    let number = |v: &Value| v.as_f64().filter(|v| v.is_finite());
+    let err = || bad(c, format!("`{key}` must be [min, desired, max] or {{min?, desired?, max?}}, in percent"));
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::Array(a)) if a.len() == 3 => {
+            let mut out = [None; 3];
+            for (o, v) in out.iter_mut().zip(a) {
+                *o = Some(number(v).ok_or_else(err)?);
+            }
+            Ok(Some(out))
+        }
+        Some(Value::Object(o)) => {
+            let mut out = [None; 3];
+            for (k, v) in o {
+                let i = ["min", "desired", "max"].iter().position(|n| n == k).ok_or_else(err)?;
+                if let Some(slot) = out.get_mut(i) {
+                    *slot = Some(number(v).ok_or_else(err)?);
+                }
+            }
+            Ok(Some(out))
+        }
+        Some(_) => Err(err()),
+    }
+}
+
 fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "text.setFormat";
     let ids = super::typecmd::text_targets(s, p, C)?;
@@ -269,6 +297,11 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
         "hyphenLimit",
         "hyphenationZone",
         "hyphenateCapitalized",
+        "wordSpacing",
+        "letterSpacing",
+        "glyphScaling",
+        "autoLeading",
+        "singleWordJustification",
         "mojikumi",
         "kinsoku",
         "direction",
@@ -339,6 +372,24 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
             _ => return Err(bad(C, "`burasagari` must be \"none\", \"standard\" or \"forced\"")),
         }),
     };
+    let spacing = |k: &str| spacing_param(p, k, C);
+    let (word_spacing, letter_spacing, glyph_scaling) = (spacing("wordSpacing")?, spacing("letterSpacing")?, spacing("glyphScaling")?);
+    let single_word = match p.get("singleWordJustification") {
+        None => None,
+        Some(v) => Some(match v.as_str() {
+            Some("fullJustify") => SingleWordJustify::FullJustify,
+            Some("alignLeft") => SingleWordJustify::AlignLeft,
+            Some("alignCenter") => SingleWordJustify::AlignCenter,
+            Some("alignRight") => SingleWordJustify::AlignRight,
+            _ => return Err(bad(C, "`singleWordJustification` must be \"fullJustify\", \"alignLeft\", \"alignCenter\" or \"alignRight\"")),
+        }),
+    };
+    let auto_leading = match p.get("autoLeading") {
+        None => None,
+        Some(v) => Some(v.as_f64().filter(|v| v.is_finite()).ok_or_else(|| bad(C, "`autoLeading` must be a number"))?),
+    };
+    // A paragraph whose Minimum, Desired and Maximum would no longer be in order.
+    let mut out_of_order: Option<&str> = None;
     let range = super::typecmd::TextRange::parse(p, C)?;
     // The character attributes, given the baseline shift and horizontal scale in the type's own units.
     let chars = |st: &mut vectorcraft_doc::CharStyle, baseline_shift: Option<f64>, h_scale: Option<f64>| {
@@ -430,6 +481,28 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
                 if let Some(v) = flag("hyphenateCapitalized") {
                     para.hyphenation.capitalized = v;
                 }
+                let j = &mut para.justification;
+                for (name, given, value, limits) in [
+                    ("wordSpacing", &word_spacing, &mut j.word_spacing, JustificationOptions::WORD_SPACING),
+                    ("letterSpacing", &letter_spacing, &mut j.letter_spacing, JustificationOptions::LETTER_SPACING),
+                    ("glyphScaling", &glyph_scaling, &mut j.glyph_scaling, JustificationOptions::GLYPH_SCALING),
+                ] {
+                    let Some(given) = given else { continue };
+                    for (v, g) in value.iter_mut().zip(given) {
+                        if let Some(g) = g {
+                            *v = g.clamp(limits.0, limits.1);
+                        }
+                    }
+                    if !(value[0] <= value[1] && value[1] <= value[2]) {
+                        out_of_order.get_or_insert(name);
+                    }
+                }
+                if let Some(v) = auto_leading {
+                    j.auto_leading = v.clamp(JustificationOptions::AUTO_LEADING.0, JustificationOptions::AUTO_LEADING.1);
+                }
+                if let Some(v) = single_word {
+                    j.single_word = v;
+                }
                 if let Some(v) = mojikumi {
                     para.mojikumi = v;
                 }
@@ -452,6 +525,9 @@ fn set_format(s: &mut Session, p: &Value) -> Result<Value> {
                     para.composer = v;
                 }
             });
+            if let Some(name) = out_of_order {
+                return Err(bad(C, format!("`{name}`: Minimum must not exceed Desired, nor Desired Maximum")));
+            }
             super::typecmd::refresh_bounds(t);
         }
         // Graph labels keep a change made to all of their text through the graph being drawn again.

crates/engine/src/cmd/params.rs

@@ -14,8 +14,9 @@
 //! `effect.setParams` answer a key the effect doesn't take, or a value of another type than its
 //! default, with a parameter error ([`check_effect_params`]). [`Session::execute`] itself takes
 //! what it is given, so the journal of an older version still replays, except for an effect's
-//! `color` that the effect can't read, which `effect.apply` and `effect.setParams` refuse
-//! themselves ([`check_effect_color`]).
+//! `color` that the effect can't read and a Levels or Curves `channel` that the effect doesn't
+//! have, which `effect.apply` and `effect.setParams` refuse themselves ([`check_effect_color`],
+//! [`check_effect_channel`]).
 
 use serde_json::Value;
 
@@ -214,9 +215,10 @@ fn unknown(id: &str, key: &str, keys: &[&str]) -> crate::EngineError {
 
 /// `params` of built-in effect `effect`, as command `id` was given them (#1592): only keys the
 /// effect takes (those of its dialog defaults and of its params description), each of its
-/// default's type, and a `color` the effect can draw ([`check_effect_color`]). Numbers out of
-/// range pass: the effect clamps them when it draws. An effect plug-in resolves its own against
-/// its manifest, and an unknown effect is the command's to report.
+/// default's type, a `color` the effect can draw ([`check_effect_color`]) and a Levels or Curves
+/// `channel` the effect has ([`check_effect_channel`]). Numbers out of range pass: the effect
+/// clamps them when it draws. An effect plug-in resolves its own against its manifest, and an
+/// unknown effect is the command's to report.
 pub fn check_effect_params(id: &str, effect: &str, params: &Value) -> Result<()> {
     let Value::Object(given) = params else { return Ok(()) };
     if effect.starts_with(vectorcraft_plugins::effect::PREFIX) {
@@ -243,7 +245,8 @@ pub fn check_effect_params(id: &str, effect: &str, params: &Value) -> Result<()>
             _ => {}
         }
     }
-    check_effect_color(id, effect, params)
+    check_effect_color(id, effect, params)?;
+    check_effect_channel(id, effect, params)
 }
 
 /// Can an effect read `v` as its `color`: a string [`Color::from_hex`] reads (`#rrggbb`, `#rgb`,
@@ -280,6 +283,20 @@ pub(crate) fn check_effect_color(id: &str, effect: &str, params: &Value) -> Resu
     Ok(())
 }
 
+/// The `channel` in `params` of Levels or Curves (`effect`), as command `id` was given it: a
+/// parameter error naming the channels unless the effect reads it
+/// ([`vectorcraft_render::effects::is_channel`]); the effect draws any other value as RGB.
+/// `effect.apply` and `effect.setParams` run this themselves before they edit, as they run
+/// [`check_effect_color`].
+pub(crate) fn check_effect_channel(id: &str, effect: &str, params: &Value) -> Result<()> {
+    let key = "channel";
+    let Some(v) = params.get(key) else { return Ok(()) };
+    if !matches!(effect, "adjust.levels" | "adjust.curves") || v.as_str().is_some_and(vectorcraft_render::effects::is_channel) {
+        return Ok(());
+    }
+    Err(bad(id, format!("`{key}` must be one of {}", vectorcraft_render::effects::CHANNELS.join(", "))))
+}
+
 /// Commands whose params aren't checked yet (#1442): they read keys in ways the audit of the
 /// descriptions couldn't follow (a list of keys in a loop, a whole object read as settings), so
 /// their descriptions aren't proven to name every key they take. Sorted; take a command out once

crates/engine/src/cmd/path.rs

@@ -7,6 +7,7 @@ use vectorcraft_doc::{NodeId, NodeKind, Scaling};
 use vectorcraft_geom::{Anchor, AnchorKind, PathData, Point, SubPath, Vec2};
 
 use super::create::anchor_from_json;
+use super::draw2::usize_opt;
 use super::pathops::Beside;
 use super::*;
 use crate::EngineError;
@@ -37,7 +38,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Move Direction Handle",
             [],
             None,
-            "{id, subpath, anchor, which: \"in\"|\"out\", x, y, independent?: bool}",
+            "{id, subpath?, anchor, which: \"in\"|\"out\", x, y, independent?: bool}",
             has_doc,
             set_handle
         ),
@@ -100,11 +101,11 @@ pub fn specs() -> Vec<CommandSpec> {
             "Reshape",
             [],
             None,
-            "{id, x, y, dx, dy, tol=3, radius?} Reshape tool: grab the path at (x, y) (adding an anchor there unless one is within tol) and drag it by (dx, dy); nearby anchors follow with a smooth falloff over radius (default: half the subpath's size)",
+            "{id, x, y, dx, dy, tol=3, radius?} Reshape tool: grab the path at (x, y) (adding an anchor there unless one is within tol) and drag it by (dx, dy); nearby anchors follow with a smooth falloff over radius, measured along the path (default: half the subpath's size)",
             has_doc,
             reshape
         ),
-        cmd!("path.insertAnchor", "Add Anchor Point", [], None, "{id, subpath, segment, t: 0..1}", has_doc, insert_anchor),
+        cmd!("path.insertAnchor", "Add Anchor Point", [], None, "{id, subpath?, segment, t: 0..1}", has_doc, insert_anchor),
         cmd!(
             "path.cutAtAnchors",
             "Cut Path at Selected Anchor Points",
@@ -215,7 +216,7 @@ pub(crate) fn transform_anchors(s: &mut Session, label: &str, xf: vectorcraft_ge
 
 fn set_handle(s: &mut Session, p: &Value) -> Result<Value> {
     let id = id_param(p, "id").ok_or_else(|| bad("path.setHandle", "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", "path.setHandle")?.unwrap_or(0);
     let ai = p.get("anchor").and_then(Value::as_u64).ok_or_else(|| bad("path.setHandle", "missing anchor"))? as usize;
     let out = str_param(p, "which") != Some("in");
     let pos = Point::new(f64_req(p, "x", "path.setHandle")?, f64_req(p, "y", "path.setHandle")?);
@@ -680,18 +681,27 @@ fn reshape(s: &mut Session, p: &Value) -> Result<Value> {
             Some((i, dist)) if dist <= tol => i,
             _ => sp.insert_anchor(seg, t),
         };
-        let origin = sp.anchors[grabbed].p;
+        // Each anchor's distance along the path from the grabbed one, the shorter way round a
+        // closed path: the lengths are measured once, as a path can have many anchors.
+        let pos = sp.anchor_arc_positions();
+        let total = pos.last().copied().unwrap_or(0.0);
+        // The default reach is the subpath's size, as before, now measured along it.
         let r = radius.unwrap_or_else(|| {
             let mut bp = vectorcraft_geom::BezPath::new();
             sp.to_bezpath_into(&mut bp);
             let b = vectorcraft_geom::Shape::bounding_box(&bp);
             (b.width().hypot(b.height()) / 2.0).max(1.0)
         });
+        let from = pos.get(grabbed).copied().unwrap_or(0.0);
+        let closed = sp.closed;
         for (i, a) in sp.anchors.iter_mut().enumerate() {
             let w = if i == grabbed {
                 1.0
             } else {
-                let q = (a.p.distance(origin) / r).min(1.0);
+                let d = (pos.get(i).copied().unwrap_or(f64::INFINITY) - from).abs();
+                let d = if closed { d.min(total - d) } else { d };
+                // A distance or radius that isn't finite gives NaN here, which `min` reads as 1: no move.
+                let q = (d / r).min(1.0);
                 (1.0 - q * q).powi(2)
             };
             let v = delta * w;
@@ -706,7 +716,7 @@ fn reshape(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn insert_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     let id = id_param(p, "id").ok_or_else(|| bad("path.insertAnchor", "missing id"))?;
-    let si = p.get("subpath").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let si = usize_opt(p, "subpath", "path.insertAnchor")?.unwrap_or(0);
     let seg = p.get("segment").and_then(Value::as_u64).ok_or_else(|| bad("path.insertAnchor", "missing segment"))? as usize;
     let t = f64_or(p, "t", 0.5).clamp(0.0, 1.0);
     let idx = s.edit("Add Anchor Point", |d, _| {

crates/engine/src/cmd/patterncmds.rs

@@ -210,14 +210,14 @@ fn roots(s: &Session, p: &Value) -> Result<Vec<NodeId>> {
 }
 
 fn unique_pattern_name(d: &Document, base: &str) -> String {
-    if d.pattern(base).is_none() && d.swatch(base).is_none() {
+    if d.pattern(base).is_none() && !d.swatch_name_taken(base) {
         return base.to_string();
     }
-    (2..).map(|i| format!("{base} {i}")).find(|n| d.pattern(n).is_none() && d.swatch(n).is_none()).unwrap_or_else(|| base.to_string())
+    (2..).map(|i| format!("{base} {i}")).find(|n| d.pattern(n).is_none() && !d.swatch_name_taken(n)).unwrap_or_else(|| base.to_string())
 }
 
 fn next_pattern_name(d: &Document) -> String {
-    (1..).map(|i| format!("New Pattern {i}")).find(|n| d.pattern(n).is_none() && d.swatch(n).is_none()).unwrap_or_else(|| "New Pattern".to_string())
+    (1..).map(|i| format!("New Pattern {i}")).find(|n| d.pattern(n).is_none() && !d.swatch_name_taken(n)).unwrap_or_else(|| "New Pattern".to_string())
 }
 
 /// Add pattern `def` and its swatch.
@@ -420,10 +420,14 @@ fn pattern_options(s: &mut Session, p: &Value) -> Result<Value> {
         }
     }
     let new_name = str_param(p, "newName").map(str::trim).filter(|n| !n.is_empty() && *n != name).map(str::to_string);
-    if let Some(n) = &new_name
-        && s.doc()?.doc.pattern(n).is_some()
-    {
-        return Err(bad(C, format!("a pattern named `{n}` exists")));
+    if let Some(n) = &new_name {
+        let d = &s.doc()?.doc;
+        if d.pattern(n).is_some() {
+            return Err(bad(C, format!("a pattern named `{n}` exists")));
+        }
+        if swatch_name_clash(d, &name, n) {
+            return Err(bad(C, format!("a swatch or color group named `{n}` exists")));
+        }
     }
     let overlap = match p.get("overlap") {
         Some(o) => Overlap {
@@ -479,7 +483,19 @@ fn pattern_options(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "name": out_name }))
 }
 
-/// Rename a pattern in swatches, paints and the edit record.
+/// Is `new` taken for pattern `old` by a swatch or a color group (they share one namespace,
+/// [`Document::swatch_name_taken`])? It is free when the swatches named `new` are one or more
+/// swatches of the pattern and none of the pattern's swatches is named `old` (those take the new
+/// name in [`rename_pattern_uses`]).
+fn swatch_name_clash(d: &Document, old: &str, new: &str) -> bool {
+    let own = |w: &vectorcraft_color::Swatch| pattern_name(&w.paint).is_some_and(|p| p == old);
+    let mut holders = d.swatches_iter().filter(|w| w.name == new).peekable();
+    let only_own = holders.peek().is_some() && holders.all(own);
+    d.swatch_name_taken(new) && !(only_own && !d.swatches_iter().any(|w| w.name == old && own(w)))
+}
+
+/// Rename a pattern in swatches, paints and the edit record. Of the swatches named `old`, only the
+/// pattern's own take the new name.
 fn rename_pattern_uses(d: &mut Document, old: &str, new: &str) {
     let fix = |p: &mut Paint| {
         if let Paint::Pattern { pattern, .. } = p
@@ -489,7 +505,7 @@ fn rename_pattern_uses(d: &mut Document, old: &str, new: &str) {
         }
     };
     for sw in d.swatches.iter_mut().chain(d.swatch_groups.iter_mut().flat_map(|g| g.swatches.iter_mut())) {
-        if sw.name == old {
+        if sw.name == old && pattern_name(&sw.paint).is_some_and(|p| p == old) {
             sw.name = new.to_string();
         }
         fix(&mut sw.paint);

crates/engine/src/cmd/place/document.rs

@@ -68,8 +68,9 @@ pub(crate) fn document_art(name: &str, bytes: &[u8], path: Option<&str>, page: u
     let board = (page as usize).checked_sub(1).and_then(|i| l.doc.artboards.get(i)).map(|a| a.rect);
     let board = board.ok_or_else(|| bad(cmd, format!("page {page}: `{file}` has {n} artboard(s)")))?;
     let layers = std::mem::take(&mut l.doc.layers);
-    let nodes = super::on_artboard(&layers, board);
-    let frame = if bounding { nodes.iter().fold(None, |acc, n| vectorcraft_geom::union_opt(acc, n.visual_bounds())) } else { Some(board) };
+    let symbols = l.doc.symbol_boxes();
+    let nodes = super::on_artboard(&symbols, &layers, board);
+    let frame = if bounding { super::shown_bounds(&symbols, &nodes) } else { Some(board) };
     let frame = frame.filter(|r| r.width() > 0.0 || r.height() > 0.0).ok_or_else(|| bad(cmd, format!("`{file}` has no art to place")))?;
     Ok(DocumentArt { doc: l.doc, nodes, clip: (!bounding).then_some(board), frame, warnings: l.warnings })
 }

crates/engine/src/cmd/place/mod.rs

@@ -38,7 +38,7 @@ use std::sync::Arc;
 
 use serde_json::{Value, json};
 use vectorcraft_color::Paint;
-use vectorcraft_doc::{Appearance, Document, ImageObject, LinkInfo, Node, NodeId, NodeKind, Scaling};
+use vectorcraft_doc::{Appearance, Document, ImageObject, LinkInfo, Node, NodeId, NodeKind, Scaling, SymbolBoxes};
 use vectorcraft_geom::{Affine, Point, Rect, shapes};
 use vectorcraft_pdf::CropTo;
 
@@ -62,7 +62,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Place…",
             ["File"],
             Some("Cmd+Shift+P"),
-            "{path | name | dataBase64 (a file's path, or its name with its bytes), link?: true (a raster image keeps its file's path; a VectorCraft document at path becomes one locked placed document showing artboard `page`, linked to the file and read again when it changes (links.update; saving it in this app updates it at once), drawn as vectors in every output; false: an editable copy of its art, as from dataBase64; other files are embedded), text?: {characterSet?: \"unicode\" (UTF-8, or UTF-16 with a byte-order mark; other bytes as the platform's 8-bit set) | \"ansi\" (the platform's 8-bit set), platform?: \"windows\" (Windows-1252) | \"mac\" (Mac Roman), removeLineReturns?: false (each block of lines becomes one paragraph; blank lines end paragraphs), removeParagraphReturns?: false (drop blank lines), replaceSpaces?: n (runs of n ≥ 2 spaces become a tab)} (a .txt file, placed as area type filling rect, the replaced object's bounds, or else the artboard less a 36 pt margin), template?: false (onto a new locked template layer below the current layer), replace?: false (swap the one selected object, keeping its stacking place and transform; no at/rect), at?: [x, y] centre (default: the first artboard's centre), rect?: [x, y, width, height] fit inside; aspect kept (wins over at), page?: 1 (PDF/.ai page, or a native document's artboard), crop?: \"crop\" (clipped to that page or artboard, default; an SVG, only when given: framed and clipped by its viewBox, else by its art's bounds) | \"bounding\" (the art's bounds) | \"art\" | \"trim\" | \"bleed\" | \"media\" (a PDF page's boxes), password? (an encrypted PDF), dxf?: {…the DXF options of document.open} (a .dxf drawing: fit fills the artboard under at, else the first; fitted or uncentred art lands with its drawing's artboard on that artboard, else it is centred on at)} → {ids, name, format, linked, width, height, warnings}. Raster images come in at 100% of their physical size (the file's ppi, else 72); SVG, DXF, PDF/.ai, EMF/WMF (clipped to the picture's frame), EPS (clipped to its bounding box; as document.open reads it) and native documents as one group, with the images, symbols, patterns and swatches they use. One undo step; selects what it placed (unless on a template layer); never touches the clipboard",
+            "{path | name | dataBase64 (a file's path, or its name with its bytes), link?: true (a raster image keeps its file's path; a VectorCraft document at path becomes one locked placed document showing artboard `page`, linked to the file and read again when it changes (links.update; saving it in this app updates it at once), drawn as vectors in every output; false: an editable copy of its art, as from dataBase64; other files are embedded), text?: {characterSet?: \"unicode\" (UTF-8, or UTF-16 with a byte-order mark; other bytes as the platform's 8-bit set) | \"ansi\" (the platform's 8-bit set), platform?: \"windows\" (Windows-1252) | \"mac\" (Mac Roman), removeLineReturns?: false (each block of lines becomes one paragraph; blank lines end paragraphs), removeParagraphReturns?: false (drop blank lines), replaceSpaces?: n (runs of n ≥ 2 spaces become a tab)} (a .txt file, placed as area type filling rect, the replaced object's bounds, or else the artboard less a 36 pt margin), template?: false (onto a new locked template layer below the current layer), replace?: false (swap the one selected object, keeping its stacking place and transform; no at/rect), at?: [x, y] centre (default: the first artboard's centre), rect?: [x, y, width, height] fit inside; aspect kept (wins over at), page?: 1 (PDF/.ai page, or a native document's artboard), crop?: \"crop\" (clipped to that page or artboard, default; an SVG, only when given: framed and clipped by its viewBox, else by its art's bounds) | \"bounding\" (the bounds of the art that shows, with its strokes and effects, as an export measures them: hidden objects and guides left out) | \"art\" | \"trim\" | \"bleed\" | \"media\" (a PDF page's boxes), password? (an encrypted PDF), dxf?: {…the DXF options of document.open} (a .dxf drawing: fit fills the artboard under at, else the first; fitted or uncentred art lands with its drawing's artboard on that artboard, else it is centred on at)} → {ids, name, format, linked, width, height, warnings}. Raster images come in at 100% of their physical size (the file's ppi, else 72); SVG, DXF, PDF/.ai, EMF/WMF (clipped to the picture's frame), EPS (clipped to its bounding box; as document.open reads it) and native documents as one group, with the images, symbols, patterns and swatches they use. One undo step; selects what it placed (unless on a template layer); never touches the clipboard",
             has_doc,
             place
         ),
@@ -239,6 +239,7 @@ fn load(p: &Value, cmd: &str, board: Option<Rect>) -> Result<Loaded> {
     doc.drop_edit_modes();
     let board = doc.artboards.first().map(|a| a.rect).filter(|_| anchored);
     let layers = std::mem::take(&mut doc.layers);
+    let symbols = doc.symbol_boxes();
     let (nodes, clip) = if matches!(format.id, "svg" | "svgz" | "dxf") {
         // An SVG with `crop: "crop"` asked for is framed and clipped by its viewBox (its artboard),
         // as a PDF by its page: art drawn on a shared canvas keeps its place and scale (#788). By
@@ -253,16 +254,28 @@ fn load(p: &Value, cmd: &str, board: Option<Rect>) -> Result<Loaded> {
         let board = doc.artboards.get(index).map(|a| a.rect).ok_or_else(|| bad(cmd, format!("page {page}: `{name}` has {n} page(s)")))?;
         // A PDF import has one layer per page; an EPS file's art is whatever lies on the artboard.
         let pages = if pdf { layers.get(index..=index).unwrap_or_default() } else { &layers[..] };
-        (on_artboard(pages, board), crop.then_some(board))
+        (on_artboard(&symbols, pages, board), crop.then_some(board))
     };
-    let natural = clip.or_else(|| nodes.iter().fold(None, |acc, n| vectorcraft_geom::union_opt(acc, n.visual_bounds())));
+    let natural = clip.or_else(|| shown_bounds(&symbols, &nodes));
     let natural = natural.filter(|r| r.width() > 0.0 || r.height() > 0.0).ok_or_else(|| bad(cmd, format!("`{name}` has no art to place")))?;
     Ok(Loaded { name, format, art: Art::Vector { src: Box::new(doc), nodes, clip }, natural, warnings, link: None, board })
 }
 
-/// The placeable art of `layers` that lies on `board`.
-fn on_artboard(layers: &[Arc<Node>], board: Rect) -> Vec<Node> {
-    let on_board = |c: &&Arc<Node>| c.visual_bounds().is_some_and(|b| b.intersect(board).area() > 0.0 || board.contains(b.origin()));
+/// The bounds of what `nodes` draw, as an export measures art
+/// ([`vectorcraft_render::encode::drawn_bounds`]): hidden objects, guides and template layers
+/// left out, symbol instances measured by their art in `symbols`.
+pub(crate) fn shown_bounds(symbols: &SymbolBoxes, nodes: &[Node]) -> Option<Rect> {
+    nodes.iter().fold(None, |acc, n| vectorcraft_geom::union_opt(acc, vectorcraft_render::encode::drawn_bounds(symbols, n)))
+}
+
+/// The placeable art of `layers` that lies on `board`: each object whose drawn bounds
+/// ([`vectorcraft_render::encode::drawn_bounds`]) lie on it, or, for an object that draws nothing,
+/// each object whose visual bounds lie on it.
+fn on_artboard(symbols: &SymbolBoxes, layers: &[Arc<Node>], board: Rect) -> Vec<Node> {
+    let on_board = |c: &&Arc<Node>| {
+        let b = vectorcraft_render::encode::drawn_bounds(symbols, c).or_else(|| c.visual_bounds_with(symbols));
+        b.is_some_and(|b| b.intersect(board).area() > 0.0 || board.contains(b.origin()))
+    };
     art_of(layer_art(layers).filter(on_board))
 }
 
@@ -376,7 +389,7 @@ fn replace_xf(d: &Document, old: &Node, natural: Rect, image_xf: bool) -> Affine
             return im.xf * full.inverse() * Affine::translate(centre - natural.center());
         }
     }
-    let c = old.geometric_bounds().map_or(natural.center(), |b| b.center());
+    let c = old.geometric_bounds_with(&d.symbol_boxes()).map_or(natural.center(), |b| b.center());
     Affine::translate(c - natural.center())
 }
 
@@ -411,7 +424,7 @@ fn place(s: &mut Session, p: &Value) -> Result<Value> {
     // Type reflows rather than scales: its frame takes the size it is placed at.
     let is_text = matches!(loaded.art, Art::Text(_));
     if is_text {
-        let size = match (old_node.and_then(Node::geometric_bounds), rect) {
+        let size = match (old_node.and_then(|o| o.geometric_bounds_with(&st.doc.symbol_boxes())), rect) {
             (Some(b), _) => b.size(),
             (None, Some(r)) => r.size(),
             (None, None) => text_frame(&st.doc, at).size(),
@@ -436,7 +449,7 @@ fn place(s: &mut Session, p: &Value) -> Result<Value> {
     let (name, format, warnings) = (loaded.name.clone(), loaded.format.id, std::mem::take(&mut loaded.warnings));
     let (id, size) = s.edit("Place", |d, sel| {
         let node = transformed(build(d, loaded, link), m);
-        let size = node.geometric_bounds().unwrap_or_default();
+        let size = node.geometric_bounds_with(&d.symbol_boxes()).unwrap_or_default();
         let (into, index) = match old {
             Some(old) => {
                 let (par, idx, _) = d.position(old).ok_or(EngineError::NoNode(old))?;

crates/engine/src/cmd/place/rtf.rs

@@ -14,6 +14,8 @@
 //!   superscript and subscript, baseline shift (`\up`, `\dn`) and the color table's color (`\cf`).
 //! - Paragraph formatting, reset by `\pard`: alignment (`\ql`, `\qc`, `\qr`, `\qj`, `\qd`), left,
 //!   right and first-line indents, space before and after, and direction (`\rtlpar`, `\ltrpar`).
+//!   `\ql` and `\qr` are the left and right edges in either direction, and a justified (`\qj`)
+//!   paragraph marked right to left (`\rtlpar`) ends its last line on the right.
 //!
 //! Other control words are skipped, and so are hidden text (`\v`) and the groups of destinations
 //! that are not the document's text: every `\*` destination, the style sheet, document
@@ -608,7 +610,11 @@ impl Reader {
             .paras
             .iter()
             .map(|p| ParaStyle {
-                justify: p.justify,
+                // `\qj` in an `\rtlpar` paragraph justifies it with its last line on the right.
+                justify: match p.justify {
+                    Justify::JustifyLeft if p.rtl == Some(true) => Justify::JustifyRight,
+                    j => j,
+                },
                 left_indent: twips(p.left),
                 right_indent: twips(p.right),
                 first_line_indent: twips(p.first),
@@ -682,6 +688,18 @@ mod tests {
         assert_eq!(s.paras.last().map(|p| p.left_indent), Some(20.0));
     }
 
+    #[test]
+    fn justified_right_to_left_paragraphs_end_their_last_line_on_the_right() {
+        let s = read(concat!(
+            r"{\rtf1\pard\rtlpar\qj a\par\pard\qj\rtlpar b\par\pard\qj c\par\pard\rtlpar\ltrpar\qj d\par",
+            r"\pard\rtlpar\ql e\par\pard\rtlpar\qr f\par\pard\rtlpar\qc g\par\pard\rtlpar\qd h}"
+        ));
+        let justify: Vec<Justify> = s.paras.iter().map(|p| p.justify).collect();
+        use Justify::*;
+        assert_eq!(justify, [JustifyRight, JustifyRight, JustifyLeft, JustifyLeft, Left, Right, Center, JustifyAll]);
+        assert_eq!(s.paras.first().and_then(|p| p.direction), Some(ParaDirection::RightToLeft));
+    }
+
     #[test]
     fn deep_nesting_and_stray_braces_end_cleanly() {
         let deep = format!("{{\\rtf1 {}x{}}}", "{".repeat(5000), "}".repeat(5000));

crates/engine/src/cmd/select.rs

@@ -89,6 +89,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_doc,
             anchors_many
         ),
+        cmd!(
+            "select.color",
+            "Select by Color",
+            [],
+            None,
+            "{fill?: colour, stroke?: colour (as paint.setFill's color; at least one)} select the objects whose fill (and stroke) reads as that colour in #rrggbb, as document.inspect reports colours, whatever its swatch or tint; with both, the objects that match both. No object needs to be selected first; Select > Reselect repeats it → {count}",
+            has_doc,
+            select_color
+        ),
         cmd!(
             "select.same.fillColor",
             "Fill Color",
@@ -528,6 +537,29 @@ fn stroke_weight(n: &Node) -> f64 {
     if paint.is_none() { 0.0 } else { width }
 }
 
+/// Select by Color: the objects whose fill and stroke read as the colours given, compared as the
+/// `#rrggbb` `document.inspect` reports, so a script can pick art by colour without an object id.
+fn select_color(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "select.color";
+    let hex = |key: &str| match p.get(key).filter(|v| !v.is_null()) {
+        None => Ok(None),
+        Some(v) => color_value(v).map(|c| Some(c.to_hex())).ok_or_else(|| bad(C, format!("`{key}`: not a colour: {v}"))),
+    };
+    let (fill, stroke) = (hex("fill")?, hex("stroke")?);
+    if fill.is_none() && stroke.is_none() {
+        return Err(bad(C, "give `fill`, `stroke` or both"));
+    }
+    let reads_as = |paint: Paint, hex: Option<&str>| hex.is_none_or(|h| paint.color().is_some_and(|c| c.to_hex() == h));
+    select_where(s, C, p, |d, n| paint_reported(d, n) && reads_as(fill_of(n), fill.as_deref()) && reads_as(stroke_of(n).0, stroke.as_deref()))
+}
+
+/// Does `document.inspect` report a fill and stroke for `n`? A compound path's are its own, though
+/// it holds its members, and its members report none.
+fn paint_reported(d: &Document, n: &Node) -> bool {
+    let compound = |n: &Node| matches!(n.kind, NodeKind::Compound { .. });
+    compound(n) || (!n.is_container() && !d.parent_of(n.id).and_then(|p| d.node(p)).is_some_and(compound))
+}
+
 fn same(s: &mut Session, cmd: &str, eq: impl Fn(&Node, &Node) -> bool) -> Result<Value> {
     let st = s.doc()?;
     let refn = st.selection.objects.first().and_then(|id| st.doc.node(*id)).cloned().ok_or_else(|| bad(cmd, "nothing selected"))?;

crates/engine/src/cmd/style.rs

@@ -456,7 +456,7 @@ fn style_redefine(s: &mut Session, p: &Value) -> Result<Value> {
     let look = GraphicStyle::of(String::new(), captured(n), n);
     let name = d.graphic_styles[i].name.clone();
     let chars = s.prefs.override_char_color;
-    s.edit(&format!("Redefine Graphic Style \u{201c}{name}\u{201d}"), |d, _| {
+    s.edit_named("Redefine Graphic Style “{name}”", &name, false, |d, _| {
         let id = d.graphic_style_id(i);
         let old = std::mem::replace(&mut d.graphic_styles[i], GraphicStyle { name: name.clone(), id, ..look });
         // Objects still linked follow the new definition; edited ones are unlinked (they keep

crates/engine/src/cmd/swatch.rs

@@ -35,7 +35,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "New Color Group",
             ["Window", "Swatches"],
             None,
-            "{name?, swatches?: [names] (solid colours move into the group; gradients, patterns and None stay), colors?: [colour] (added as new swatches), fromArtwork?: false (add the unique colours of the selected art: fills, strokes, text, gradient stops and mesh points; a colour linked to a global swatch moves that swatch into the group), toGlobal?: true (with fromArtwork: the new swatches are global and the selected art's matching unlinked colours link to them), includeTints?: false (with fromArtwork: tints of global swatches also get swatches of their own)} → {name, swatches: [names in the group], linked: paints linked}",
+            "{name?, swatches?: [names] (solid colours move into the group; gradients, patterns and None stay), colors?: [colour] (added as new swatches), keepModel?: bool (as paint.setFill), fromArtwork?: false (add the unique colours of the selected art: fills, strokes, text, gradient stops and mesh points; a colour linked to a global swatch moves that swatch into the group), toGlobal?: true (with fromArtwork: the new swatches are global and the selected art's matching unlinked colours link to them), includeTints?: false (with fromArtwork: tints of global swatches also get swatches of their own)} → {name, swatches: [names in the group], linked: paints linked}",
             has_doc,
             swatch_new_group
         ),
@@ -46,7 +46,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Swatch Options",
             ["Window", "Swatches"],
             None,
-            "{name, newName?, color? (e.g. {l, a, b} for a Lab colour), mode?: \"gray\"|\"rgb\"|\"hsb\"|\"lab\"|\"cmyk\"|\"web\" (convert the colour), global?, spot? (spot colours are always global), paint?: paint.setFill params ({color}, {gradient}, {swatch} or {pattern}) replacing the swatch's colour; gradient or pattern with one of the same kind} edit a swatch in any colour group, as one undo step. Fills, strokes, text, gradient stops and tint swatches linked to a global swatch take its new colour (at their own tint) and name; turning Global off unlinks them (they keep their colour). Colour, mode and spot apply to solid colours only; a tint swatch only takes a new name (edit its base) → {name, relinked: paints changed}",
+            "{name, newName?, color? (e.g. {l, a, b} for a Lab colour), keepModel?: bool (as paint.setFill; the swatch's own color and a color given with mode keep their model), mode?: \"gray\"|\"rgb\"|\"hsb\"|\"lab\"|\"cmyk\"|\"web\" (convert the colour), global?, spot? (spot colours are always global), paint?: paint.setFill params ({color}, {gradient}, {swatch} or {pattern}) replacing the swatch's colour; gradient or pattern with one of the same kind} edit a swatch in any colour group, as one undo step. Fills, strokes, text, gradient stops and tint swatches linked to a global swatch take its new colour (at their own tint) and name; turning Global off unlinks them (they keep their colour). Colour, mode and spot apply to solid colours only; a tint swatch only takes a new name (edit its base) → {name, relinked: paints changed}",
             has_doc,
             swatch_edit
         ),
@@ -127,7 +127,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Edit Color Group",
             ["Window", "Swatches"],
             None,
-            "{group: colour group, colors: [colour] (hex, key, {c,m,y,k} or {l,a,b}; the group's swatches take them in order, extra colours become new swatches, swatches past the end are removed; built-in swatches can't change), rename?: new group name} rewrite a colour group as one undo step; art linked to its global swatches takes their new colours (and keeps its colour, unlinked, when its swatch goes) → {name, swatches: [names], relinked}",
+            "{group: colour group, colors: [colour] (hex, key, {c,m,y,k} or {l,a,b}; the group's swatches take them in order, extra colours become new swatches, swatches past the end are removed; built-in swatches can't change; a color the swatch already has keeps its model), keepModel?: bool (as paint.setFill), rename?: new group name} rewrite a colour group as one undo step; art linked to its global swatches takes their new colours (and keeps its colour, unlinked, when its swatch goes) → {name, swatches: [names], relinked}",
             has_doc,
             swatch_edit_group
         ),
@@ -136,10 +136,15 @@ pub fn specs() -> Vec<CommandSpec> {
 
 fn swatch_new(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "swatch.new";
+    let mode = str_param(p, "mode");
     let paints = match (p.get("colors").and_then(Value::as_array), str_param(p, "pattern")) {
         (Some(cs), _) => {
-            let cs: Vec<Paint> =
-                cs.iter().map(|c| color_value(c).map(Paint::solid)).collect::<Option<_>>().ok_or_else(|| bad(C, "bad colour in `colors`"))?;
+            let stored = |c: Color| if mode.is_some() { c } else { super::paint::new_color(s, p, c) };
+            let cs: Vec<Paint> = cs
+                .iter()
+                .map(|c| color_value(c).map(|c| Paint::solid(stored(c))))
+                .collect::<Option<_>>()
+                .ok_or_else(|| bad(C, "bad colour in `colors`"))?;
             if cs.is_empty() {
                 return Err(bad(C, "`colors` is empty"));
             }
@@ -148,7 +153,11 @@ fn swatch_new(s: &mut Session, p: &Value) -> Result<Value> {
         (None, Some(name)) if s.doc()?.doc.pattern(name).is_some() => vec![pattern_paint(name)],
         (None, Some(name)) => return Err(bad(C, format!("no pattern `{name}`"))),
         (None, None) => {
-            let paint = paint_from(s, p)?.unwrap_or_else(|| s.paint.fill.clone());
+            let paint = match mode {
+                Some(_) => paint_from(s, &keeping_model(p))?,
+                None => paint_from(s, p)?,
+            }
+            .unwrap_or_else(|| s.paint.fill.clone());
             // `tint` alone: that tint of the global colour the current fill links to.
             match (super::paint::tint_param(p, C)?, &paint) {
                 (Some(t), Paint::Solid { swatch: Some(l), .. }) if p.get("swatch").is_none() => {
@@ -161,7 +170,6 @@ fn swatch_new(s: &mut Session, p: &Value) -> Result<Value> {
     };
     let spot = bool_or(p, "spot", false);
     let global = spot || bool_or(p, "global", false);
-    let mode = str_param(p, "mode");
     let group = str_param(p, "group");
     let paints = paints
         .into_iter()
@@ -294,7 +302,11 @@ fn link_colors(d: &mut Document, ids: &[NodeId], links: &[(Color, String)]) -> u
 fn swatch_new_group(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "swatch.newGroup";
     let mut names = str_list(p, "swatches");
-    let colors: Vec<Color> = p.get("colors").and_then(Value::as_array).map(|a| a.iter().filter_map(color_value).collect()).unwrap_or_default();
+    let colors: Vec<Color> = p
+        .get("colors")
+        .and_then(Value::as_array)
+        .map(|a| a.iter().filter_map(color_value).map(|c| super::paint::new_color(s, p, c)).collect())
+        .unwrap_or_default();
     let from_art = bool_or(p, "fromArtwork", false);
     let to_global = from_art && bool_or(p, "toGlobal", true);
     let tints = bool_or(p, "includeTints", false);
@@ -448,6 +460,16 @@ fn convert_to_mode(c: Color, mode: &str, cmd: &str) -> Result<Color> {
     })
 }
 
+/// Paint params `p` with `keepModel: true`, for a color given with a `mode`: [`convert_to_mode`]
+/// converts it, and the document's color mode does not convert it first.
+fn keeping_model(p: &Value) -> Value {
+    let mut q = p.clone();
+    if let Some(o) = q.as_object_mut() {
+        o.insert("keepModel".into(), Value::Bool(true));
+    }
+    q
+}
+
 /// How a swatch edit reaches the solid paints linked to swatch `from`.
 struct Relink {
     from: String,
@@ -518,7 +540,7 @@ fn swatch_edit(s: &mut Session, p: &Value) -> Result<Value> {
     }
     // A replacement paint of the swatch's kind (a dropped colour or edited gradient).
     let paint = match p.get("paint").filter(|v| !v.is_null()) {
-        Some(v) => match (paint_from(s, v)?, &sw.paint) {
+        Some(v) => match (if given("mode") { paint_from(s, &keeping_model(v))? } else { paint_from(s, v)? }, &sw.paint) {
             (Some(Paint::Solid { color, .. }), Paint::Solid { .. }) => Some(Paint::solid(color)),
             (Some(Paint::Gradient(g)), Paint::Gradient(_)) => {
                 Some(Paint::Gradient(Box::new(vectorcraft_color::GradientPaint { geom: None, swatch: None, ..*g })))
@@ -529,7 +551,11 @@ fn swatch_edit(s: &mut Session, p: &Value) -> Result<Value> {
         None => None,
     };
     let mut color = match p.get("color").filter(|v| !v.is_null()) {
-        Some(v) => Some(color_value(v).ok_or_else(|| bad(C, format!("bad color {v}")))?),
+        Some(v) => {
+            let c = color_value(v).ok_or_else(|| bad(C, format!("bad color {v}")))?;
+            // The swatch's own color, and a color given with a mode, keep their model.
+            Some(if given("mode") || solid == Some(c) { c } else { super::paint::new_color(s, p, c) })
+        }
         None => paint.as_ref().and_then(Paint::color).or(solid),
     };
     if let (Some(c), Some(m)) = (color, str_param(p, "mode")) {
@@ -849,6 +875,11 @@ fn swatch_edit_group(s: &mut Session, p: &Value) -> Result<Value> {
         .iter()
         .map(|v| color_value(v).ok_or_else(|| bad(C, format!("bad colour {v}"))))
         .collect::<Result<_>>()?;
+    // A color its swatch already has keeps its model. The others take the document's.
+    let old: Vec<Option<Color>> =
+        s.doc()?.doc.swatch_groups.iter().find(|g| g.name == group).map(|g| g.swatches.iter().map(|w| w.paint.color()).collect()).unwrap_or_default();
+    let colors: Vec<Color> =
+        colors.into_iter().enumerate().map(|(i, c)| if old.get(i) == Some(&Some(c)) { c } else { super::paint::new_color(s, p, c) }).collect();
     let rename = str_param(p, "rename");
     let e = s.edit("Edit Color Group", |d, _| rewrite_group(d, group, &colors, rename, C))?;
     e.defaults(s);

crates/engine/src/cmd/textedit.rs

@@ -27,7 +27,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Character",
             [],
             None,
-            "{id? (default: the one selected type object), start?: byte, end?: byte (default: all text), font?, style?, size?: pt, leading?: pt|\"auto\", tracking?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, fill?: colour|\"none\", stroke?: colour|\"none\", strokeWidth?: pt, strokeOptions?: {weight?, cap?, join?, miterLimit?, align?, dash?, dashOffset?, alignDashes?} (as stroke.set: the character stroke), underline?, strikethrough?, allCaps?: bool, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), features?: [\"dlig\", \"-liga\", …], charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\", proportionalMetrics?: bool (full-width glyphs on the font's proportional widths: `palt` in horizontal type, `vpal` in vertical type), digits?: \"default\"|\"arabic\"|\"hindi\"|\"farsi\" (Character panel menu › Digits: the numeral system every digit is drawn in, whatever was typed), fontAxes?: {\"wght\": 650, …} (Character panel › Variable Font: the setting of each variation axis named, in the axis's units and clamped to its range; null: back to the style's own setting; other axes keep theirs; tags the font has no axis for are left out; a font or style change clears them; text.fontList {family, style} lists the axes)} style a character range (size/leading/baselineShift are document points and hScale includes the object transform; runs are split at the range ends) → {id, runs}",
+            "{id? (default: the one selected type object), start?: byte, end?: byte (default: all text), font?, style?, size?: pt, leading?: pt|\"auto\", tracking?, kerning?: 1/1000 em|\"auto\", baselineShift?: pt, hScale?: %, vScale?: %, rotation?: deg, fill?: colour|\"none\", stroke?: colour|\"none\", keepModel?: bool (fill and stroke, as paint.setFill), strokeWidth?: pt, strokeOptions?: {weight?, cap?, join?, miterLimit?, align?, dash?, dashOffset?, alignDashes?} (as stroke.set: the character stroke), underline?, strikethrough?, allCaps?: bool, smallCaps?: bool, position?: \"normal\"|\"superscript\"|\"subscript\" (sizes from Document Setup), features?: [\"dlig\", \"-liga\", …], charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\", proportionalMetrics?: bool (full-width glyphs on the font's proportional widths: `palt` in horizontal type, `vpal` in vertical type), digits?: \"default\"|\"arabic\"|\"hindi\"|\"farsi\" (Character panel menu › Digits: the numeral system every digit is drawn in, whatever was typed), fontAxes?: {\"wght\": 650, …} (Character panel › Variable Font: the setting of each variation axis named, in the axis's units and clamped to its range; null: back to the style's own setting; other axes keep theirs; tags the font has no axis for are left out; a font or style change clears them; text.fontList {family, style} lists the axes)} style a character range (size/leading/baselineShift are document points and hScale includes the object transform; runs are split at the range ends) → {id, runs}",
             has_doc,
             set_range_style
         ),
@@ -54,7 +54,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Area / Path Type",
             [],
             None,
-            "{path: id, mode: \"area\"|\"onPath\", text?: \"\", vertical?: bool = false, at?: [x, y] (on-path start: nearest point), size?, font?, style?, color? (as text.create), fit?: none|autoHeight|shrinkText, fitMinPercent? (area: as text.areaOptions; default autoHeight when the autoSizeAreaType preference is on), placeholder?: bool (placeholder text instead, as text.create), justify?, leadingModel?, charAlign? (as text.create)} turn a path into an area-type frame or a type-on-a-path baseline (the path's paint is dropped) → {id, bounds: {x, y, width, height} (as text.create), overflow?: [id] (the text doesn't fit; left out when it fits)}",
+            "{path: id, mode: \"area\"|\"onPath\", text?: \"\", vertical?: bool = false, at?: [x, y] (on-path start: nearest point), size?, font?, style?, color?, keepModel? (as text.create), fit?: none|autoHeight|shrinkText, fitMinPercent? (area: as text.areaOptions; default autoHeight when the autoSizeAreaType preference is on), placeholder?: bool (placeholder text instead, as text.create), justify?, leadingModel?, charAlign? (as text.create)} turn a path into an area-type frame or a type-on-a-path baseline (the path's paint is dropped) → {id, bounds: {x, y, width, height} (as text.create), overflow?: [id] (the text doesn't fit; left out when it fits)}",
             has_doc,
             create_in_path
         ),
@@ -421,6 +421,16 @@ impl CharChange {
         Ok(c)
     }
 
+    /// The `fill` and `stroke` colors as the document stores them: an RGB color in a CMYK
+    /// document becomes CMYK through the color settings ([`super::paint::new_color`]).
+    fn store_colors(&mut self, s: &Session, p: &Value) {
+        for paint in [&mut self.fill, &mut self.stroke].into_iter().flatten() {
+            if let Paint::Solid { color, .. } = paint {
+                *color = super::paint::new_color(s, p, *color);
+            }
+        }
+    }
+
     pub(crate) fn is_empty(&self) -> bool {
         self.font.is_none()
             && self.style.is_none()
@@ -600,6 +610,7 @@ fn set_range_style(s: &mut Session, p: &Value) -> Result<Value> {
         },
     };
     let mut change = CharChange::parse(p, C, &s.doc()?.doc.setup)?;
+    change.store_colors(s, p);
     if change.is_empty() {
         return Err(bad(C, "nothing to change"));
     }

crates/engine/src/cmd/textstyles.rs

@@ -164,12 +164,13 @@ pub fn char_attrs(v: &CharStyle) -> Map<String, Value> {
 }
 
 /// Every paragraph attribute of `v` as a JSON map, without the style name: those the paragraph's
-/// JSON leaves out at their defaults (the Hyphenation options, the Every-line Composer, no tab
+/// JSON leaves out at their defaults (the Hyphenation and Justification options, the Every-line Composer, no tab
 /// stops, Auto direction…) are written out, as [`char_attrs`] does for characters.
 pub fn para_attrs(v: &ParaStyle) -> Map<String, Value> {
     let mut m = to_attrs(v);
     for (k, x) in [
         ("hyphenation", json!(v.hyphenation)),
+        ("justification", json!(v.justification)),
         ("composer", json!(v.composer)),
         ("tabs", json!(v.tabs)),
         ("mojikumi", json!(v.mojikumi)),
@@ -442,7 +443,7 @@ fn new(s: &mut Session, p: &Value, kind: Kind) -> Result<Value> {
         return Err(bad(&c, format!("a style named `{name}` already exists")));
     }
     let n2 = name.clone();
-    s.edit(&format!("New {base}"), |d, _| {
+    s.edit(if kind == Kind::Char { "New Character Style" } else { "New Paragraph Style" }, |d, _| {
         kind.defs_mut(d).push(TextStyleDef { name: n2, attrs });
         Ok(())
     })?;
@@ -478,7 +479,7 @@ fn apply(s: &mut Session, p: &Value, kind: Kind) -> Result<Value> {
         Ok(st)
     };
     let count = ids.len();
-    s.edit(&format!("Apply {name}"), |d, _| {
+    s.edit_named("Apply {name}", &name, name == kind.normal(), |d, _| {
         for id in &ids {
             let Some(t) = text_mut(d, *id) else { continue };
             match kind {
@@ -528,7 +529,7 @@ fn redefine_to(s: &mut Session, kind: Kind, name: &str, new_attrs: Map<String, V
     let d = &s.doc()?.doc;
     let old = kind.attrs(d, name).ok_or_else(|| bad(&kind.cmd(verb), format!("no style `{name}`")))?;
     let name = name.to_string();
-    s.edit(&format!("Redefine {name}"), |d, _| {
+    s.edit_named("Redefine {name}", &name, name == kind.normal(), |d, _| {
         match kind.defs_mut(d).iter_mut().find(|s| s.name == name) {
             Some(def) => def.attrs = new_attrs.clone(),
             None => kind.defs_mut(d).push(TextStyleDef { name: name.clone(), attrs: new_attrs.clone() }),
@@ -664,6 +665,37 @@ mod tests {
         assert_eq!(list["styles"][1]["uses"], 1);
     }
 
+    /// Applying and redefining a style record a step named from a template with the style's name
+    /// in it (`HistoryEntry::named`), and undo and redo keep it. The Normal styles' names are
+    /// marked as names VectorCraft gives. A new style's step has a name of its own.
+    #[test]
+    fn style_steps_are_named_from_a_template() {
+        let (mut s, id) = session_with_text("Hello");
+        let last = |s: &Session| {
+            let e = s.doc().unwrap().history.undo.last().unwrap();
+            (e.label.clone(), e.named().map(|n| (n.template, n.name.clone(), n.built_in)))
+        };
+        let named = |template, name: &str, built_in| Some((template, name.to_string(), built_in));
+        s.execute("charStyle.new", &json!({"name": "Body"})).unwrap();
+        assert_eq!(last(&s), ("New Character Style".into(), None));
+        s.execute("charStyle.apply", &json!({"name": "Body", "id": id})).unwrap();
+        assert_eq!(last(&s), ("Apply Body".into(), named("Apply {name}", "Body", false)));
+        s.execute("edit.undo", &json!({})).unwrap();
+        let redo = s.doc().unwrap().history.redo.last().unwrap().named().cloned();
+        assert_eq!(redo.map(|n| n.label()).as_deref(), Some("Apply Body"));
+        s.execute("edit.redo", &json!({})).unwrap();
+        assert_eq!(last(&s), ("Apply Body".into(), named("Apply {name}", "Body", false)));
+        s.execute("charStyle.apply", &json!({"name": NORMAL_CHAR, "id": id})).unwrap();
+        assert_eq!(last(&s), (format!("Apply {NORMAL_CHAR}"), named("Apply {name}", NORMAL_CHAR, true)));
+        s.execute("paraStyle.new", &json!({"name": "Lead"})).unwrap();
+        assert_eq!(last(&s), ("New Paragraph Style".into(), None));
+        s.execute("paraStyle.setAttrs", &json!({"name": "Lead", "attrs": {"direction": "rightToLeft"}})).unwrap();
+        assert_eq!(last(&s), ("Redefine Lead".into(), named("Redefine {name}", "Lead", false)));
+        // A step renamed since it was recorded is no longer named from the template.
+        s.doc_mut().unwrap().history.undo.last_mut().unwrap().label = "Typing".into();
+        assert_eq!(last(&s), ("Typing".into(), None));
+    }
+
     #[test]
     fn new_from_selection_rename_delete_and_undo() {
         let (mut s, id) = session_with_text("Title");

crates/engine/src/cmd/typecmd.rs

@@ -84,7 +84,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Character",
             [],
             None,
-            "{ids?|id?, font?, style?, size?: pt, leading?: pt|\"auto\", tracking?: 1/1000 em, justify?: \"auto\" (the start of each paragraph's direction)|\"left\"|\"center\"|\"right\"|\"justifyAll\", fill?: colour, features?: [\"dlig\", \"-liga\", …] OpenType, start?: byte, end?: byte} (size/leading are document points after object scaling; with a range: the character attributes style that range and justify the paragraphs it touches; without: all the text) → {ids, overflow?: [id…] (area type and type on a path whose text no longer fits; left out when all fits)}",
+            "{ids?|id?, font?, style?, size?: pt, leading?: pt|\"auto\", tracking?: 1/1000 em, justify?: \"auto\" (the start of each paragraph's direction)|\"left\"|\"center\"|\"right\"|\"justifyAll\", fill?: colour, keepModel?: bool (as paint.setFill), features?: [\"dlig\", \"-liga\", …] OpenType, start?: byte, end?: byte} (size/leading are document points after object scaling; with a range: the character attributes style that range and justify the paragraphs it touches; without: all the text) → {ids, overflow?: [id…] (area type and type on a path whose text no longer fits; left out when all fits)}",
             has_doc,
             set_style
         ),
@@ -547,7 +547,7 @@ fn set_style(s: &mut Session, p: &Value) -> Result<Value> {
     let fill = match p.get("fill") {
         None | Some(Value::Null) => None,
         Some(Value::String(n)) if n.eq_ignore_ascii_case("none") => Some(vectorcraft_color::Paint::None),
-        Some(v) => Some(vectorcraft_color::Paint::solid(color_value(v).ok_or_else(|| bad(C, "bad fill colour"))?)),
+        Some(v) => Some(vectorcraft_color::Paint::solid(super::paint::new_color(s, p, color_value(v).ok_or_else(|| bad(C, "bad fill colour"))?))),
     };
     let features = super::textedit::features_param(p, C)?;
     if font.is_none()
@@ -1098,6 +1098,61 @@ mod area_tests {
         assert!(text(&s).para_at(1).roman_hanging);
     }
 
+    /// Paragraph panel menu › Justification…: `text.setFormat` sets each paragraph's word and
+    /// letter spacing, glyph scaling, Auto Leading and Single Word Justification, clamped to their
+    /// ranges, in one undo step; Minimum ≤ Desired ≤ Maximum must hold or nothing changes. They
+    /// are saved only when not the defaults, and paragraph styles carry them.
+    #[test]
+    fn justification_options_are_set_per_paragraph_and_saved_only_when_not_default() {
+        use vectorcraft_doc::{JustificationOptions, SingleWordJustify};
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+        let id = s.execute("text.create", &json!({"x": 10, "y": 10, "text": "One\nTwo", "area": {"width": 200, "height": 100}})).unwrap()["id"]
+            .as_u64()
+            .unwrap();
+        let paras = |s: &Session| match &s.doc().unwrap().doc.node(NodeId(id)).unwrap().kind {
+            NodeKind::Text(t) => (t.para_at(0).clone(), t.para_at(1).clone()),
+            _ => panic!("text"),
+        };
+        assert_eq!(paras(&s).0.justification, JustificationOptions::default());
+        assert!(serde_json::to_value(paras(&s).0).unwrap().get("justification").is_none());
+        s.execute("select.set", &json!({"ids": [id]})).unwrap();
+        s.execute(
+            "text.setFormat",
+            &json!({
+                "wordSpacing": [60, 90, 2000], "letterSpacing": {"max": 10}, "glyphScaling": [95, 100, 105],
+                "autoLeading": 150, "singleWordJustification": "alignCenter", "start": 5, "end": 5
+            }),
+        )
+        .unwrap();
+        let want = JustificationOptions {
+            word_spacing: [60.0, 90.0, 1000.0],
+            letter_spacing: [0.0, 0.0, 10.0],
+            glyph_scaling: [95.0, 100.0, 105.0],
+            auto_leading: 150.0,
+            single_word: SingleWordJustify::AlignCenter,
+        };
+        let (first, second) = paras(&s);
+        assert_eq!((first.justification, &second.justification), (JustificationOptions::default(), &want), "only the paragraph the caret is in");
+        assert_eq!(serde_json::to_value(&second).unwrap()["justification"]["single_word"], "alignCenter");
+        let back: vectorcraft_doc::ParaStyle = serde_json::from_value(serde_json::to_value(&second).unwrap()).unwrap();
+        assert_eq!(back.justification, want);
+        // Out of order: nothing changes, and the error names the setting.
+        let e = s.execute("text.setFormat", &json!({"wordSpacing": {"desired": 85}, "letterSpacing": {"min": 5}})).unwrap_err().to_string();
+        assert!(e.contains("letterSpacing"), "{e}");
+        assert_eq!(paras(&s).1.justification, want);
+        assert!(s.execute("text.setFormat", &json!({"glyphScaling": [100, 100]})).is_err());
+        assert!(s.execute("text.setFormat", &json!({"singleWordJustification": "spread"})).is_err());
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(paras(&s).1.justification, JustificationOptions::default());
+        // A paragraph style carries them; an older file's paragraph reads the defaults.
+        s.execute("paraStyle.new", &json!({"name": "Airy", "attrs": {"justification": {"auto_leading": 200.0}}})).unwrap();
+        s.execute("paraStyle.apply", &json!({"name": "Airy", "id": id})).unwrap();
+        assert_eq!(paras(&s).0.justification, JustificationOptions { auto_leading: 200.0, ..JustificationOptions::default() });
+        let old: vectorcraft_doc::ParaStyle = serde_json::from_value(json!({"justify": "Left", "hyphenate": true})).unwrap();
+        assert_eq!(old.justification, JustificationOptions::default());
+    }
+
     /// #432: while the interface is in Japanese, new type (text.create, text.createInPath) starts
     /// with em box top-to-top leading and em box centre alignment, and new styles made from nothing
     /// carry them; params override; the values are journaled; imported text keeps the Roman

crates/engine/src/cmd/typemenu.rs

@@ -160,6 +160,13 @@ fn edit_runs<S: Default>(s: &mut Session, label: &str, ids: &[NodeId], f: impl F
 
 // ---------- Change Case ----------
 
+/// Does `c` take a capital at the start of a word or sentence? Georgian has no word capitals:
+/// Mtavruli is a separate all-caps style, so title and sentence case leave Mkhedruli (and turn
+/// Mtavruli back into) lower case. Upper case still gives Mtavruli, as Unicode defines it.
+fn capitalizes(c: char) -> bool {
+    !matches!(c, '\u{10D0}'..='\u{10FF}' | '\u{1C90}'..='\u{1CBF}')
+}
+
 #[derive(Default)]
 struct CaseState {
     /// Previous character (across runs).
@@ -187,7 +194,7 @@ fn change_case(s: &mut Session, p: &Value) -> Result<Value> {
                 "upper" | "uppercase" => out.extend(c.to_uppercase()),
                 "lower" | "lowercase" => out.extend(c.to_lowercase()),
                 "title" => {
-                    if st.prev.is_none_or(|p| p.is_whitespace() || matches!(p, '-' | '(' | '"' | '“' | '/')) {
+                    if capitalizes(c) && st.prev.is_none_or(|p| p.is_whitespace() || matches!(p, '-' | '(' | '"' | '“' | '/')) {
                         out.extend(c.to_uppercase())
                     } else {
                         out.extend(c.to_lowercase())
@@ -195,7 +202,11 @@ fn change_case(s: &mut Session, p: &Value) -> Result<Value> {
                 }
                 _ => {
                     if c.is_alphabetic() && st.sentence {
-                        out.extend(c.to_uppercase());
+                        if capitalizes(c) {
+                            out.extend(c.to_uppercase());
+                        } else {
+                            out.extend(c.to_lowercase());
+                        }
                         st.sentence = false;
                     } else {
                         out.extend(c.to_lowercase());

crates/engine/src/cmd/wand.rs

@@ -87,10 +87,11 @@ fn set(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!(s.menu.wand))
 }
 
-/// The fill an object shows: type's comes from its characters (the first run speaks for all).
+/// The fill an object shows: type's comes from its characters (the first run speaks for all; type
+/// without any, the default character fill, as `document.inspect` reports it).
 pub(crate) fn fill_of(n: &Node) -> Paint {
     match &n.kind {
-        NodeKind::Text(t) => t.runs.first().map(|r| r.style.fill.clone()).unwrap_or_default(),
+        NodeKind::Text(t) => t.runs.first().map(|r| r.style.fill.clone()).unwrap_or_else(|| vectorcraft_doc::CharStyle::default().fill),
         _ => n.appearance.fill_paint(),
     }
 }

crates/engine/src/lib.rs

@@ -91,6 +91,27 @@ pub struct HistoryEntry {
     next_bytes: usize,
     /// Which document the figures were taken against (its address): the next state.
     next: usize,
+    /// The template and name `label` was made from ([`Session::edit_named`]).
+    named: Option<NamedStep>,
+}
+
+/// A step name made by filling the `{name}` placeholder of a template with a name
+/// ([`Session::edit_named`]).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct NamedStep {
+    /// The English template, with one `{name}` placeholder (`Apply {name}`).
+    pub template: &'static str,
+    /// The name in the placeholder, as the document holds it (a style's name).
+    pub name: String,
+    /// The name is one VectorCraft gives (`[Normal Character Style]`), not one the user typed.
+    pub built_in: bool,
+}
+
+impl NamedStep {
+    /// The step name: the template with the name in its placeholder.
+    pub fn label(&self) -> String {
+        self.template.replace("{name}", &self.name)
+    }
 }
 
 impl HistoryEntry {
@@ -98,7 +119,14 @@ impl HistoryEntry {
     pub(crate) fn kept(label: String, doc: Arc<Document>, selection: Arc<Selection>, next: &Document) -> Self {
         doc.drop_lookup_cache();
         let (bytes, next_bytes) = doc.retained_bytes_each(next);
-        HistoryEntry { label, doc, selection, bytes, next_bytes, next: std::ptr::from_ref(next) as usize }
+        HistoryEntry { label, doc, selection, bytes, next_bytes, next: std::ptr::from_ref(next) as usize, named: None }
+    }
+
+    /// The template and name the step's label was made from, while the label is still the one
+    /// they make: `None` for a step named any other way, and for one whose label was changed
+    /// since it was recorded.
+    pub fn named(&self) -> Option<&NamedStep> {
+        self.named.as_ref().filter(|n| n.label() == self.label)
     }
 
     /// The step that undoing (redoing) the step `costs` came from makes: it keeps `doc`, the
@@ -112,7 +140,7 @@ impl HistoryEntry {
             return Self::kept(label, doc, selection, now);
         }
         doc.drop_lookup_cache();
-        HistoryEntry { label, doc, selection, bytes: costs.next_bytes, next_bytes: costs.bytes, next: Arc::as_ptr(now) as usize }
+        HistoryEntry { label, doc, selection, bytes: costs.next_bytes, next_bytes: costs.bytes, next: Arc::as_ptr(now) as usize, named: None }
     }
 
     /// The figures [`HistoryEntry::turned`] reuses.
@@ -1739,6 +1767,33 @@ impl Session {
         }
     }
 
+    /// [`Session::edit`] with the step named `template`, its `{name}` placeholder filled with `name`
+    /// (a style's name). The undo step it records keeps the template and the name
+    /// ([`HistoryEntry::named`]), and a frontend shows the template's translation with the name in
+    /// it. An edit that records no step of its own (inside an interaction, or a later edit of an
+    /// undo group) keeps neither, and neither does a step an undo group names.
+    pub fn edit_named<T>(
+        &mut self,
+        template: &'static str,
+        name: &str,
+        built_in: bool,
+        f: impl FnOnce(&mut Document, &mut Selection) -> Result<T>,
+    ) -> Result<T> {
+        let named = NamedStep { template, name: name.to_string(), built_in };
+        let step = named.label();
+        // The step this edit records keeps the document as it is now.
+        let now = Arc::as_ptr(&self.doc()?.doc);
+        let v = self.edit(&step, f)?;
+        if let Ok(st) = self.doc_mut()
+            && let Some(e) = st.history.undo.last_mut()
+            && Arc::as_ptr(&e.doc) == now
+            && e.label == step
+        {
+            e.named = Some(named);
+        }
+        Ok(v)
+    }
+
     /// Change only the selection (not an undo step).
     pub fn select(&mut self, f: impl FnOnce(&Document, &mut Selection)) -> Result<()> {
         self.active_appearance_item = None;

crates/engine/src/tests.rs

@@ -28,6 +28,61 @@ fn create_and_undo_redo() {
     assert!(s.execute("edit.redo", &json!({})).is_err());
 }
 
+/// Clear History removes the steps to undo and the steps to redo. The document and the selection
+/// stay as they are, Undo and Redo are then disabled, and clearing is not a step itself.
+#[test]
+fn clear_history_removes_every_step_and_keeps_the_document() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0, 10.0, 100.0, 50.0);
+    let b = rect(&mut s, 200.0, 10.0, 100.0, 50.0);
+    rect(&mut s, 400.0, 10.0, 100.0, 50.0);
+    s.execute("edit.undo", &json!({})).unwrap();
+    let st = s.doc().unwrap();
+    assert_eq!((st.history.undo.len(), st.history.redo.len()), (2, 1));
+    let (doc, selection, dirty) = (st.doc.clone(), st.selection.clone(), st.is_dirty());
+    assert_eq!(s.execute("edit.clearHistory", &json!({})).unwrap(), json!({"cleared": 3}));
+    let st = s.doc().unwrap();
+    assert_eq!((st.history.undo.len(), st.history.redo.len()), (0, 0));
+    assert!(Arc::ptr_eq(&st.doc, &doc), "the document is the one from before clearing");
+    assert_eq!((&st.selection, st.is_dirty()), (&selection, dirty));
+    assert!(st.doc.node(a).is_some() && st.doc.node(b).is_some());
+    for cmd in ["edit.undo", "edit.redo", "edit.clearHistory"] {
+        assert!(matches!(s.execute(cmd, &json!({})), Err(EngineError::Disabled(..))), "{cmd}");
+    }
+    // A new edit is a step again: undoing it goes back to the document the history was cleared at.
+    rect(&mut s, 600.0, 10.0, 100.0, 50.0);
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert!(Arc::ptr_eq(&s.doc().unwrap().doc, &doc));
+    assert!(s.execute("edit.undo", &json!({})).is_err());
+}
+
+/// Clear History is disabled without a document and in a document with no step to undo or redo.
+#[test]
+fn clear_history_needs_a_step_to_clear() {
+    let mut s = Session::new();
+    assert!(matches!(s.execute("edit.clearHistory", &json!({})), Err(EngineError::Disabled(..))), "no document");
+    s.execute("file.new", &json!({})).unwrap();
+    match s.execute("edit.clearHistory", &json!({})) {
+        Err(EngineError::Disabled(_, why)) => assert_eq!(why, "no history to clear"),
+        other => panic!("a new document: {other:?}"),
+    }
+}
+
+/// A drag still in progress when the history is cleared ends, and its change stays in the document
+/// without a step to undo it.
+#[test]
+fn clear_history_keeps_a_drag_in_progress_in_the_document() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0, 10.0, 100.0, 50.0);
+    s.begin_interaction("Move").unwrap();
+    s.preview("object.move", &json!({"dx": 30, "dy": 0})).unwrap();
+    assert_eq!(s.execute("edit.clearHistory", &json!({})).unwrap(), json!({"cleared": 2}));
+    assert!(!s.in_interaction());
+    let st = s.doc().unwrap();
+    assert_eq!(st.doc.node(a).unwrap().geometric_bounds().unwrap().x0, 40.0);
+    assert!(st.history.undo.is_empty() && st.history.redo.is_empty());
+}
+
 #[test]
 fn unknown_and_disabled() {
     let mut s = Session::new();
@@ -1729,6 +1784,24 @@ fn bounding_box_handles_snap_to_the_grid() {
     }
 }
 
+/// A Shift-constrained move with Snap to Grid on stays level: the square's center lands on a
+/// gridline across, and its top stays where it was, off the grid.
+#[test]
+fn a_shift_move_snapped_to_the_grid_stays_on_its_line() {
+    let mut s = session();
+    let a = rect(&mut s, 101.0, 101.0, 100.0, 100.0);
+    let step = s.doc().unwrap().doc.grid.spacing / f64::from(s.doc().unwrap().doc.grid.subdivisions.max(1));
+    let on_grid = |v: f64| (v / step - (v / step).round()).abs() < 1e-9;
+    let v = ViewInfo { snap_to_grid: true, ..ViewInfo::default() };
+    let shift = vectorcraft_tools::Mods { shift: true, ..Default::default() };
+    s.select_tool("selection", v).unwrap();
+    for (kind, x, y) in [(PointerKind::Down, 151.0, 151.0), (PointerKind::Drag, 180.0, 153.0), (PointerKind::Up, 180.0, 153.0)] {
+        s.pointer(&PointerEvent::new(kind, x, y).with_mods(shift), v).unwrap();
+    }
+    let b = s.doc().unwrap().doc.node(a).unwrap().geometric_bounds().unwrap();
+    assert!(on_grid(b.center().x) && (b.y0 - 101.0).abs() < 1e-9, "{b:?}, grid step {step}");
+}
+
 /// Follow-up to #1254: toggling or adding anchors of a path selected as a whole starts from all
 /// its anchors, so toggling one deselects it alone and adding one keeps them all.
 #[test]
@@ -2270,6 +2343,29 @@ fn reshape_moves_the_grabbed_point_and_its_neighbourhood() {
     assert!(pts.iter().filter(|p| (p.y - 100.0).abs() < 1e-9).count() == 2);
 }
 
+#[test]
+fn reshape_falloff_follows_arc_length_on_open_paths() {
+    let mut s = session();
+    let id = NodeId(
+        s.execute(
+            "path.create",
+            &json!({
+                "anchors": [{"x": 0, "y": 0}, {"x": 100, "y": 0}, {"x": 200, "y": 0}, {"x": 300, "y": 0}],
+                "closed": false
+            }),
+        )
+        .unwrap()["id"]
+            .as_u64()
+            .unwrap(),
+    );
+    s.execute("path.reshape", &json!({"id": id.0, "x": 300.0, "y": 0.0, "dx": 0.0, "dy": 100.0})).unwrap();
+    let pts: Vec<_> = s.doc().unwrap().doc.node(id).unwrap().path_data().unwrap().subpaths[0].anchors.iter().map(|a| a.p).collect();
+    assert!((pts[3].y - 100.0).abs() < 1e-6, "grabbed end moves full delta: {pts:?}");
+    assert!(pts[0].y.abs() < 1e-6, "far end stays put: {pts:?}");
+    assert!(pts[2].y > 1.0 && pts[2].y < 100.0, "mid-anchor moves partially: {pts:?}");
+    assert!(pts[1].y < pts[2].y, "nearer anchors move more: {pts:?}");
+}
+
 #[test]
 fn graph_tool_drag_creates_a_graph_and_asks_for_data() {
     let mut s = session();
@@ -2356,6 +2452,29 @@ fn object_mosaic_refuses_columns_and_rows_that_are_not_whole_numbers() {
     assert_eq!(r["tiles"], json!(2));
 }
 
+/// A new width or height, or a spacing, given as text or as another value that is not a number is an error naming the
+/// key, and no mosaic is made.
+#[test]
+fn object_mosaic_refuses_a_size_or_spacing_given_as_text() {
+    let mut s = session();
+    rect(&mut s, 0.0, 0.0, 100.0, 50.0);
+    s.execute("object.rasterize", &json!({"ppi": 72})).unwrap();
+    let undo = |s: &Session| s.doc().unwrap().history.undo.len();
+    let before = undo(&s);
+    for (p, msg) in [
+        (json!({"width": "200"}), "`width` must be a number, not \"200\""),
+        (json!({"columns": 2, "height": "50 pt"}), "`height` must be a number, not \"50 pt\""),
+        (json!({"spacingX": "4"}), "`spacingX` must be a number, not \"4\""),
+        (json!({"spacingY": [4]}), "`spacingY` must be a number, not [4]"),
+    ] {
+        let r = s.execute("object.createObjectMosaic", &p);
+        assert!(matches!(&r, Err(EngineError::BadParams { msg: m, .. }) if m == msg), "{p}: {r:?}");
+        assert_eq!(undo(&s), before, "{p}");
+    }
+    let r = s.execute("object.createObjectMosaic", &json!({"columns": 2, "rows": 1, "width": 200, "spacingX": null})).unwrap();
+    assert_eq!(r["tiles"], json!(2));
+}
+
 #[test]
 fn snap_to_pixel_rounds_drawing_and_moves() {
     let mut s = session();

crates/engine/src/tests_brushsym.rs

@@ -655,6 +655,20 @@ fn symbolism_adjustments() {
     assert!(s.execute("symbol.adjust", &json!({"tool": "nope", "points": at})).is_err());
 }
 
+/// In a CMYK document the Symbol Stainer's RGB `color` separates through the color settings, as
+/// `paint.setFill` stores it.
+#[test]
+fn symbol_stainer_rgb_color_in_a_cmyk_document_separates_through_the_color_settings() {
+    use vectorcraft_color::{Color, Paint, cms};
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 300, "colorMode": "cmyk"})).unwrap();
+    let (inst, _, b) = make_symbol(&mut s);
+    let c = b.center();
+    s.execute("symbol.adjust", &json!({"tool": "stain", "points": [[c.x, c.y]], "color": "#ff0000", "intensity": 10})).unwrap();
+    let red = cms::active().convert(&Color::rgb(1.0, 0.0, 0.0), cms::Model::Cmyk, cms::active().settings().intent);
+    assert_eq!(node(&s, inst).appearance.fill().map(|f| f.paint.clone()), Some(Paint::solid(red)));
+}
+
 #[test]
 fn symbol_sprayer_tool_gesture_is_one_undo_step() {
     let mut s = session();

crates/engine/src/tests_colorthemes.rs

@@ -103,4 +103,9 @@ fn add_to_swatches_makes_a_colour_group_in_one_step() {
     // Again: a second group with a free name.
     assert_eq!(run(&mut s, "colorTheme.addToSwatches", json!({"name": "Tide"}))["name"], "Tide 2");
     assert!(s.execute("colorTheme.addToSwatches", &json!({"name": "Nope"})).is_err());
+    // In a CMYK document the theme's colors keep their model.
+    run(&mut s, "file.new", json!({"width": 100, "height": 100, "colorMode": "cmyk"}));
+    run(&mut s, "colorTheme.addToSwatches", json!({"name": "Tide"}));
+    let g = s.doc().unwrap().doc.swatch_groups.iter().find(|g| g.name == "Tide").expect("the group");
+    assert_eq!(g.swatches.iter().filter_map(|w| w.paint.color()).collect::<Vec<_>>(), s.prefs.color_themes[0].colors);
 }

crates/engine/src/tests_draw2.rs

@@ -130,6 +130,62 @@ fn pencil_continues_selected_open_path() {
     assert_eq!(p.subpaths[0].anchors[0].p, Point::new(100.0, 100.0));
 }
 
+/// Edit Selected Paths in the middle of a path (#2850): a Pencil stroke that starts and ends on a
+/// selected path replaces the section between, drawn either way; the path stays one path with
+/// its ends, and is one undo step.
+#[test]
+fn pencil_redraws_the_section_of_a_selected_path_between_its_ends() {
+    let bump = [(100.0, 101.0), (125.0, 70.0), (150.0, 60.0), (175.0, 70.0), (200.0, 101.0)];
+    for reversed in [false, true] {
+        let mut s = session();
+        let id = line(&mut s, 0.0, 100.0, 300.0, 100.0);
+        let mut pts = bump.to_vec();
+        if reversed {
+            pts.reverse();
+        }
+        let undo = undo_steps(&s);
+        drag(&mut s, "pencil", &pts, Mods::default());
+        assert_eq!(paths(&s).len(), 1, "no new object");
+        assert_eq!(undo_steps(&s), undo + 1);
+        let sp = &path(&s, id).subpaths[0];
+        assert!(!sp.closed);
+        let ps: Vec<Point> = sp.anchors.iter().map(|a| a.p).collect();
+        assert!(near(ps[0], Point::new(0.0, 100.0)) && near(*ps.last().unwrap(), Point::new(300.0, 100.0)), "{ps:?}");
+        // The section starts and ends on the line, where the stroke met it, and rises between.
+        let on = |x: f64| ps.iter().any(|p| (p.x - x).abs() < 1.5 && (p.y - 100.0).abs() < 1e-6);
+        assert!(on(100.0) && on(200.0), "{reversed}: {ps:?}");
+        let top = kurbo::Shape::bounding_box(&path(&s, id).to_bezpath()).y0;
+        assert!(top < 75.0, "the bump: top {top}");
+        assert!(ps.windows(2).all(|w| w[0].x <= w[1].x + 1.0), "in order along the line: {ps:?}");
+    }
+}
+
+/// On a closed path the stroke replaces the shorter way between where it starts and ends, and the
+/// path stays closed; a stroke that doesn't end on the path draws a new one.
+#[test]
+fn pencil_redraws_the_shorter_way_round_a_closed_path() {
+    let mut s = session();
+    let id = rect(&mut s, 0.0, 0.0, 200.0, 100.0);
+    s.execute("select.set", &json!({"ids": [id.0]})).unwrap();
+    s.execute("path.freehand", &json!({"points": [[50, 1], [80, -25], [100, -30], [120, -25], [150, 1]], "redraw": {"id": id.0, "within": 4}}))
+        .unwrap();
+    assert_eq!(paths(&s).len(), 1);
+    let sp = &path(&s, id).subpaths[0];
+    assert!(sp.closed);
+    let ps: Vec<Point> = sp.anchors.iter().map(|a| a.p).collect();
+    for corner in [(0.0, 0.0), (200.0, 0.0), (200.0, 100.0), (0.0, 100.0)] {
+        assert!(ps.iter().any(|p| near(*p, Point::new(corner.0, corner.1))), "{corner:?} kept: {ps:?}");
+    }
+    let top = kurbo::Shape::bounding_box(&path(&s, id).to_bezpath()).y0;
+    assert!(top < -20.0, "the dip: top {top}");
+    // Not ending on the path: a new path, the rectangle as it was.
+    let before = path(&s, id);
+    s.execute("path.freehand", &json!({"points": [[50, 100], [80, 150], [120, 160]], "redraw": {"id": id.0, "within": 4}})).unwrap();
+    assert_eq!(paths(&s).len(), 2);
+    assert_eq!(path(&s, id), before);
+    assert!(s.execute("path.freehand", &json!({"points": [[0, 0], [1, 1]], "redraw": {"id": id.0, "within": -1}})).is_err());
+}
+
 /// With Keep selected off, the path a stroke draws or continues is not selected afterwards, the
 /// rest of the selection stays, and the stroke is one undo step.
 #[test]
@@ -811,6 +867,131 @@ fn draw2_commands_reject_bad_params() {
     }
 }
 
+/// A path of two open subpaths, each of three anchors from x 100 to x 300 with a middle anchor that
+/// has two handles: subpath 0 at y 100, subpath 1 at y 300.
+fn two_subpaths(s: &mut Session) -> NodeId {
+    let id = curve(s);
+    let sub = |y: f64| {
+        let anchors = json!([
+            {"x": 100, "y": y, "out": [130, y - 30.0]},
+            {"x": 200, "y": y, "in": [170, y - 30.0], "out": [230, y - 30.0]},
+            {"x": 300, "y": y, "in": [270, y - 30.0]},
+        ]);
+        json!({"anchors": anchors, "closed": false})
+    };
+    s.execute("path.setAnchors", &json!({"id": id.0, "subpaths": [sub(100.0), sub(300.0)]})).unwrap();
+    id
+}
+
+/// Runs `cmd` with `p` and `key` set to each of 1.5, -1 and "1": each call fails with an error that
+/// names `key`, and the document and the undo history stay as they were.
+fn refuses_an_index_that_is_not_whole(s: &mut Session, cmd: &str, p: &serde_json::Value, key: &str) {
+    for v in [json!(1.5), json!(-1), json!("1")] {
+        let mut p = p.clone();
+        p[key] = v;
+        let before = s.doc().unwrap().doc.clone();
+        let undo = undo_steps(s);
+        let Err(e) = s.execute(cmd, &p) else { panic!("{cmd} {p} succeeded") };
+        assert!(e.to_string().contains(&format!("`{key}`")), "{cmd} {p}: {e}");
+        assert!(s.doc().unwrap().doc == before, "{cmd} {p} changed the document");
+        assert_eq!(undo_steps(s), undo, "{cmd} {p} left an undo step");
+    }
+}
+
+/// Runs `cmd` with `p` on path `id` (made by [`two_subpaths`]) with `subpath: 1`, without `subpath`
+/// and with `subpath: null`, undoing each: the first changes subpath 1 alone, and the others change
+/// subpath 0 alone.
+fn edits_the_subpath_given(s: &mut Session, cmd: &str, p: &serde_json::Value, id: NodeId) {
+    let before = path(s, id).subpaths;
+    for (si, p) in [(1, with(p, json!({"subpath": 1}))), (0, p.clone()), (0, with(p, json!({"subpath": null})))] {
+        s.execute(cmd, &p).unwrap();
+        let after = path(s, id).subpaths;
+        assert_eq!(after.len(), 2, "{cmd} {p}");
+        assert!(after[si] != before[si] && after[1 - si] == before[1 - si], "{cmd} {p}: {after:?}");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(path(s, id).subpaths, before, "{cmd} {p}: undo");
+    }
+}
+
+#[test]
+fn curvature_edit_refuses_a_subpath_that_is_not_a_whole_number() {
+    let mut s = session();
+    let id = two_subpaths(&mut s);
+    let p = json!({"id": id.0, "op": "move", "anchor": 1, "x": 200, "y": 150});
+    refuses_an_index_that_is_not_whole(&mut s, "path.curvatureEdit", &p, "subpath");
+    edits_the_subpath_given(&mut s, "path.curvatureEdit", &p, id);
+}
+
+#[test]
+fn remove_anchor_refuses_a_subpath_that_is_not_a_whole_number() {
+    let mut s = session();
+    let id = two_subpaths(&mut s);
+    let p = json!({"id": id.0, "anchor": 1});
+    refuses_an_index_that_is_not_whole(&mut s, "path.removeAnchor", &p, "subpath");
+    edits_the_subpath_given(&mut s, "path.removeAnchor", &p, id);
+}
+
+#[test]
+fn convert_anchor_refuses_a_subpath_that_is_not_a_whole_number() {
+    let mut s = session();
+    let id = two_subpaths(&mut s);
+    let p = json!({"id": id.0, "anchor": 1, "to": "corner"});
+    refuses_an_index_that_is_not_whole(&mut s, "path.convertAnchor", &p, "subpath");
+    edits_the_subpath_given(&mut s, "path.convertAnchor", &p, id);
+}
+
+#[test]
+fn reshape_segment_refuses_a_subpath_that_is_not_a_whole_number() {
+    let mut s = session();
+    let id = two_subpaths(&mut s);
+    let p = json!({"id": id.0, "segment": 0, "t": 0.5, "dx": 0, "dy": 20});
+    refuses_an_index_that_is_not_whole(&mut s, "path.reshapeSegment", &p, "subpath");
+    edits_the_subpath_given(&mut s, "path.reshapeSegment", &p, id);
+}
+
+#[test]
+fn split_refuses_a_subpath_anchor_or_segment_that_is_not_a_whole_number() {
+    // A bad `anchor` beside a good `segment` is refused, and so is a bad `segment` beside a good
+    // `anchor`.
+    let mut s = session();
+    let id = two_subpaths(&mut s);
+    let at_anchor = json!({"id": id.0, "anchor": 1});
+    let at_segment = json!({"id": id.0, "segment": 0, "t": 0.5});
+    refuses_an_index_that_is_not_whole(&mut s, "path.split", &at_anchor, "subpath");
+    refuses_an_index_that_is_not_whole(&mut s, "path.split", &at_segment, "subpath");
+    refuses_an_index_that_is_not_whole(&mut s, "path.split", &at_segment, "anchor");
+    refuses_an_index_that_is_not_whole(&mut s, "path.split", &at_anchor, "segment");
+    let before = path(&s, id).subpaths;
+    for (si, p) in [(1, with(&at_anchor, json!({"subpath": 1}))), (0, at_anchor.clone()), (0, with(&at_anchor, json!({"subpath": null})))] {
+        s.execute("path.split", &p).unwrap();
+        let after = path(&s, id).subpaths;
+        // The subpath split becomes two of two anchors each, in its place.
+        let kept = if si == 1 { &after[0] } else { &after[2] };
+        assert!(after.len() == 3 && after[si].anchors.len() == 2 && after[si + 1].anchors.len() == 2, "{p}: {after:?}");
+        assert_eq!(kept, &before[1 - si], "{p}");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(path(&s, id).subpaths, before, "{p}: undo");
+    }
+}
+
+#[test]
+fn set_handle_refuses_a_subpath_that_is_not_a_whole_number() {
+    let mut s = session();
+    let id = two_subpaths(&mut s);
+    let p = json!({"id": id.0, "anchor": 0, "which": "out", "x": 140, "y": 250});
+    refuses_an_index_that_is_not_whole(&mut s, "path.setHandle", &p, "subpath");
+    edits_the_subpath_given(&mut s, "path.setHandle", &p, id);
+}
+
+#[test]
+fn insert_anchor_refuses_a_subpath_that_is_not_a_whole_number() {
+    let mut s = session();
+    let id = two_subpaths(&mut s);
+    let p = json!({"id": id.0, "segment": 0, "t": 0.5});
+    refuses_an_index_that_is_not_whole(&mut s, "path.insertAnchor", &p, "subpath");
+    edits_the_subpath_given(&mut s, "path.insertAnchor", &p, id);
+}
+
 #[test]
 fn path_commands_refuse_a_delta_or_point_of_1e9_pt_or_more() {
     // `path.reshapeSegment` refuses a delta of 1e9 pt or longer, and `path.convertAnchor` and
@@ -849,6 +1030,33 @@ fn path_commands_refuse_a_delta_or_point_of_1e9_pt_or_more() {
     }
 }
 
+#[test]
+fn a_selected_curve_whose_handles_are_near_1e308_is_refused() {
+    // The canvas check measures a selected curve whose handles are near ±1e308 by its control
+    // points, so `path.create` refuses such a curve, given as anchors or as path data: the document
+    // stays as it was, with no undo step.
+    let mut s = session();
+    curve(&mut s);
+    let h = 1e308;
+    for p in [
+        json!({"anchors": [{"x": 100, "y": 100, "out": [150, h]}, {"x": 300, "y": 100, "in": [250, h]}]}),
+        json!({"anchors": [{"x": 100, "y": 100, "out": [150, -h]}, {"x": 300, "y": 100, "in": [250, h]}]}),
+        json!({"anchors": [{"x": 100, "y": 100, "out": [1.7e308, 100]}, {"x": 300, "y": 100}]}),
+        json!({"d": "M100 100 C150 1e308 250 1e308 300 100"}),
+    ] {
+        let before = s.doc().unwrap().doc.clone();
+        let undo = s.doc().unwrap().history.undo.len();
+        let e = s.execute("path.create", &p).unwrap_err().to_string();
+        assert!(e.contains("exceed the canvas"), "{p}: {e}");
+        assert!(s.doc().unwrap().doc == before, "{p} changed the document");
+        assert_eq!(s.doc().unwrap().history.undo.len(), undo, "{p} left an undo step");
+    }
+    // A curve whose handles stay on the canvas is kept.
+    let p = json!({"anchors": [{"x": 100, "y": 100, "out": [150, 3e6]}, {"x": 300, "y": 100, "in": [250, 3e6]}]});
+    let id = NodeId(s.execute("path.create", &p).unwrap()["id"].as_u64().unwrap());
+    assert!(path(&s, id).bounds().is_some_and(|b| b.y1 > 2e6));
+}
+
 /// A curve from (100, 100) to (300, 100) whose first anchor has an out handle at (150, 100).
 fn curve(s: &mut Session) -> NodeId {
     let anchors = json!([{"x": 100, "y": 100, "out": [150, 100]}, {"x": 300, "y": 100, "in": [250, 100]}]);

crates/engine/src/tests_emptytype.rs

@@ -62,10 +62,14 @@ fn clicking_without_typing_leaves_no_text_and_no_history() {
     click(&mut s, 150.0, 100.0);
     s.select_tool("rectangle", v).unwrap();
     assert!(texts(&s).is_empty());
-    // Click in two places: the first is gone when the second is placed.
+    // Click in two places: the second click discards the first type and places none (#2871); a
+    // third places new type.
     s.select_tool("type", v).unwrap();
     click(&mut s, 100.0, 300.0);
     click(&mut s, 400.0, 300.0);
+    assert!(texts(&s).is_empty());
+    assert!(!s.tool_wants_text());
+    click(&mut s, 400.0, 300.0);
     assert_eq!(texts(&s).len(), 1);
     s.select_tool("selection", v).unwrap();
     assert!(texts(&s).is_empty());
@@ -95,6 +99,25 @@ fn typed_text_stays_and_typing_it_away_leaves_nothing() {
     assert_eq!(undo_labels(&s), kept);
 }
 
+/// A click on blank canvas while type is being edited ends the editing and makes no new type; the
+/// Type tool stays, and the next click places point type (#2871, #2854).
+#[test]
+fn a_click_away_from_typed_text_ends_editing_without_new_type() {
+    let mut s = session();
+    let v = ViewInfo::default();
+    s.select_tool("type", v).unwrap();
+    click(&mut s, 100.0, 100.0);
+    s.tool_text("Hi", v).unwrap();
+    click(&mut s, 400.0, 300.0);
+    assert_eq!(texts(&s).iter().map(|t| t.2.as_str()).collect::<Vec<_>>(), ["Hi"]);
+    assert_eq!(s.tool_id(), "type");
+    assert!(!s.tool_wants_text());
+    assert_eq!(undo_labels(&s), ["Type", "Typing"]);
+    click(&mut s, 400.0, 300.0);
+    assert_eq!(texts(&s).len(), 2);
+    assert!(s.tool_wants_text());
+}
+
 #[test]
 fn frames_stay_when_left_empty() {
     let mut s = session();

crates/engine/src/tests_eyedropper.rs

@@ -250,6 +250,131 @@ fn rgb_colors_given_to_a_cmyk_document_separate_through_the_color_settings() {
     assert_eq!(node(&s, a).appearance.fill_paint().color(), Some(blue));
 }
 
+/// A new CMYK document.
+fn cmyk_session() -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 800, "height": 600, "colorMode": "cmyk"})).unwrap();
+    s
+}
+
+/// RGB colors given to the type commands in a CMYK document separate through the color settings,
+/// as `paint.setFill` stores them: `text.create {color}`, `text.setStyle {fill}` and
+/// `text.setRangeStyle {fill, stroke}`. CMYK colors are stored as given.
+#[test]
+fn rgb_type_colors_given_to_a_cmyk_document_separate_through_the_color_settings() {
+    let mut s = cmyk_session();
+    let blue = managed_cmyk(Color::rgb8(83, 170, 223));
+    let t = id_of(s.execute("text.create", &json!({"x": 10, "y": 40, "text": "Hello", "color": "#53aadf"})).unwrap());
+    let runs = |s: &Session| match node(s, t).kind {
+        NodeKind::Text(o) => o.runs.iter().map(|r| (r.style.fill.color(), r.style.stroke.color())).collect::<Vec<_>>(),
+        k => panic!("not type: {k:?}"),
+    };
+    assert_eq!(runs(&s)[0].0, Some(blue));
+    s.execute("text.setStyle", &json!({"ids": [t.0], "fill": "#ff0000"})).unwrap();
+    assert_eq!(runs(&s)[0].0, Some(managed_cmyk(Color::rgb8(255, 0, 0))));
+    s.execute("text.setRangeStyle", &json!({"id": t.0, "start": 0, "end": 2, "fill": "#53aadf", "stroke": "#53aadf"})).unwrap();
+    assert_eq!(runs(&s)[0], (Some(blue), Some(blue)));
+    s.execute("text.setStyle", &json!({"ids": [t.0], "fill": {"c": 10, "m": 20, "y": 30, "k": 40}})).unwrap();
+    assert!(runs(&s).iter().all(|r| r.0 == Some(Color::cmyk(0.1, 0.2, 0.3, 0.4))), "{:?}", runs(&s));
+    s.execute("text.setRangeStyle", &json!({"id": t.0, "start": 0, "end": 2, "stroke": "#53aadf", "keepModel": true})).unwrap();
+    assert_eq!(runs(&s)[0].1, Some(Color::rgb8(83, 170, 223)), "keepModel keeps RGB");
+}
+
+/// `shapeBuilder.merge {fill: "#rrggbb"}` in a CMYK document fills the merged shape as
+/// `fill: {color}` does.
+#[test]
+fn a_shape_builder_hex_fill_in_a_cmyk_document_separates_through_the_color_settings() {
+    let mut s = cmyk_session();
+    let (a, b) = (rect(&mut s, 10.0), rect(&mut s, 40.0));
+    let r = s.execute("shapeBuilder.merge", &json!({"ids": [a.0, b.0], "points": [[20, 30], [80, 30]], "fill": "#53aadf"})).unwrap();
+    let merged = NodeId(r["merged"].as_u64().unwrap());
+    assert_eq!(node(&s, merged).appearance.fill_paint().color(), Some(managed_cmyk(Color::rgb8(83, 170, 223))));
+    // The paint form takes keepModel.
+    let (a, b) = (rect(&mut s, 200.0), rect(&mut s, 230.0));
+    let fill = json!({"color": "#53aadf", "keepModel": true});
+    let r = s.execute("shapeBuilder.merge", &json!({"ids": [a.0, b.0], "points": [[210, 30], [270, 30]], "fill": fill})).unwrap();
+    let merged = NodeId(r["merged"].as_u64().unwrap());
+    assert_eq!(node(&s, merged).appearance.fill_paint().color(), Some(Color::rgb8(83, 170, 223)));
+}
+
+/// RGB colors given to gradient stops, freeform gradient points and gradient mesh points in a CMYK
+/// document separate through the color settings: `paint.editGradient {stops}`, a freeform
+/// `gradient` given to `paint.setFill`, `paint.freeform.addPoint` and `setPoint`, and
+/// `object.mesh.setPointColor` and `addLine`. The Mesh tool adds a line in the fill's own model.
+#[test]
+fn rgb_gradient_and_mesh_colors_given_to_a_cmyk_document_separate_through_the_color_settings() {
+    let mut s = cmyk_session();
+    let (blue, red) = (managed_cmyk(Color::rgb8(83, 170, 223)), managed_cmyk(Color::rgb8(255, 0, 0)));
+    let a = rect(&mut s, 10.0);
+    let gradient = |s: &Session| match node(s, a).appearance.fill_paint() {
+        Paint::Gradient(g) => *g,
+        p => panic!("not a gradient: {p:?}"),
+    };
+    let stops = |s: &Session| gradient(s).gradient.stops.iter().map(|st| st.color).collect::<Vec<_>>();
+    s.execute("paint.editGradient", &json!({"stops": [{"offset": 0, "color": {"gray": 0}}, {"offset": 1, "color": "#53aadf"}]})).unwrap();
+    assert_eq!(stops(&s), vec![Color::gray(0.0), blue]);
+    // keepModel keeps RGB, and stops sent back with only their offsets changed keep their colors.
+    let rgb = [Color::rgb8(255, 0, 0), Color::rgb8(83, 170, 223)];
+    s.execute("paint.editGradient", &json!({"stops": [{"offset": 0, "color": "#ff0000"}, {"offset": 1, "color": "#53aadf"}], "keepModel": true}))
+        .unwrap();
+    assert_eq!(stops(&s), rgb);
+    s.execute("paint.editGradient", &json!({"stops": [{"offset": 0.2, "color": "#ff0000"}, {"offset": 1, "color": "#53aadf"}]})).unwrap();
+    assert_eq!(stops(&s), rgb);
+    // A stop naming an RGB process swatch takes the swatch's color as it is.
+    let orange = Color::rgb8(255, 128, 0);
+    s.execute("swatch.new", &json!({"name": "Screen", "color": "#ff8000", "keepModel": true})).unwrap();
+    let named = json!([{"offset": 0, "swatch": "Screen"}, {"offset": 1, "color": "#53aadf"}]);
+    s.execute("paint.editGradient", &json!({"stops": named})).unwrap();
+    assert_eq!(stops(&s), [orange, rgb[1]], "the RGB blue the gradient has stays RGB");
+    s.execute("paint.setFill", &json!({"gradient": {"stops": named}})).unwrap();
+    assert_eq!(stops(&s), [orange, blue]);
+    let magenta = Color::cmyk(0.0, 1.0, 0.0, 0.0);
+    let points = json!([{"at": [20, 20], "color": "#53aadf"}, {"at": [50, 50], "color": {"c": 0, "m": 100, "y": 0, "k": 0}}]);
+    s.execute("paint.setFill", &json!({"gradient": {"kind": "freeform", "freeform": {"points": points}}})).unwrap();
+    let colors = |s: &Session| gradient(s).freeform.map(|f| f.points.iter().map(|p| p.color).collect::<Vec<_>>()).unwrap_or_default();
+    assert_eq!(colors(&s), vec![blue, magenta]);
+    let i = s.execute("paint.freeform.addPoint", &json!({"at": [40, 20], "color": "#ff0000"})).unwrap()["index"].as_u64().unwrap() as usize;
+    assert_eq!(colors(&s)[i], red);
+    s.execute("paint.freeform.setPoint", &json!({"index": 1, "color": "#53aadf"})).unwrap();
+    assert_eq!(colors(&s)[1], blue);
+    // New stops recolor the three points from their CMYK values.
+    s.execute("paint.editGradient", &json!({"stops": [{"offset": 0, "color": "#ffffff"}, {"offset": 1, "color": "#ff0000"}]})).unwrap();
+    let stored = vectorcraft_color::Gradient {
+        kind: Default::default(),
+        stops: vec![vectorcraft_color::GradientStop::new(0.0, managed_cmyk(Color::WHITE)), vectorcraft_color::GradientStop::new(1.0, red)],
+    };
+    // The points mix in the model the stops share (#2829): CMYK here.
+    assert_eq!(colors(&s), [0.0, 0.5, 1.0].map(|t| stored.sample_with(t, Color::lerp_keep_model).0), "{:?}", colors(&s));
+
+    let m = rect(&mut s, 300.0);
+    s.execute("object.mesh.create", &json!({"ids": [m.0], "rows": 1, "cols": 1})).unwrap();
+    let mesh = |s: &Session| match node(s, m).kind {
+        NodeKind::Mesh(g) => g.points.iter().map(|p| p.color).collect::<Vec<_>>(),
+        k => panic!("not a mesh: {k:?}"),
+    };
+    s.execute("object.mesh.setPointColor", &json!({"id": m.0, "index": 1, "color": "#53aadf", "keepModel": true})).unwrap();
+    assert_eq!(mesh(&s)[1], Color::rgb8(83, 170, 223), "keepModel keeps RGB");
+    s.execute("object.mesh.setPointColor", &json!({"id": m.0, "index": 0, "color": "#53aadf"})).unwrap();
+    assert_eq!(mesh(&s)[0], blue);
+    let i = s.execute("object.mesh.addLine", &json!({"id": m.0, "x": 320, "y": 30, "color": "#ff0000"})).unwrap()["index"].as_u64().unwrap() as usize;
+    assert_eq!(mesh(&s)[i], red);
+    let cyan = Color::cmyk(0.5, 0.2, 0.0, 0.0);
+    s.execute("select.set", &json!({"ids": []})).unwrap();
+    s.execute("paint.setFill", &json!({"color": {"c": 50, "m": 20, "y": 0, "k": 0}})).unwrap();
+    let before = mesh(&s).len();
+    s.select_tool("mesh", ViewInfo::default()).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Down, 335.0, 45.0), ViewInfo::default()).unwrap();
+    let after = mesh(&s);
+    assert!(after.len() > before, "the click adds a line");
+    assert!(after.contains(&cyan), "{after:?}");
+    // An RGB fill kept with keepModel stays RGB on the new point.
+    let orange = Color::rgb8(255, 128, 0);
+    s.execute("select.set", &json!({"ids": []})).unwrap();
+    s.execute("paint.setFill", &json!({"color": "#ff8000", "keepModel": true})).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Down, 340.0, 20.0), ViewInfo::default()).unwrap();
+    assert!(mesh(&s).contains(&orange), "{:?}", mesh(&s));
+}
+
 #[test]
 fn the_options_are_a_preference() {
     let mut s = Session::new();

crates/engine/src/tests_fileinfo.rs

@@ -141,6 +141,78 @@ fn an_exported_pdf_opens_with_its_file_info() {
     assert_eq!(back["title"], "poster.pdf", "the title stays the file name");
 }
 
+/// Unix seconds of 2020-01-01 00:00:00 UTC.
+const CREATED: i64 = 1_577_836_800;
+
+/// A session whose document was created at `created` (Unix seconds, or `null` for none).
+fn created_at(created: Value) -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 100, "height": 80, "created": created})).unwrap();
+    s
+}
+
+/// The PDF date the writer gives Unix seconds `t` (UTC).
+fn pdf_date(t: i64) -> String {
+    let [y, mo, d, h, mi, s] = vectorcraft_doc::metadata::civil(t);
+    format!("(D:{y:04}{mo:02}{d:02}{h:02}{mi:02}{s:02}Z)")
+}
+
+/// Check that a PDF or PDF-compatible `.ai` was created at a time in `created` and modified at a
+/// time in `modified`: in the XMP packet (`vectorcraft_pdf::file_info`) and in the document
+/// information dictionary.
+fn assert_dated(bytes: &[u8], created: std::ops::RangeInclusive<i64>, modified: std::ops::RangeInclusive<i64>) {
+    let xmp = vectorcraft_pdf::file_info(bytes, None).expect("a PDF");
+    assert!(xmp.created.is_some_and(|t| created.contains(&t)), "xmp:CreateDate {:?} in {created:?}", xmp.created);
+    assert!(xmp.modified.is_some_and(|t| modified.contains(&t)), "xmp:ModifyDate {:?} in {modified:?}", xmp.modified);
+    let text = String::from_utf8_lossy(bytes);
+    let trailer = &text[text.rfind("trailer").expect("a trailer")..];
+    let n = trailer.split("/Info ").nth(1).and_then(|r| r.split(' ').next()).expect("an /Info entry");
+    let info = &text[text.find(&format!("\n{n} 0 obj")).expect("the document information")..];
+    let info = &info[..info.find("endobj").expect("its end")];
+    assert!(created.clone().any(|t| info.contains(&format!("/CreationDate{}", pdf_date(t)))), "/CreationDate in {created:?}: {info}");
+    assert!(modified.clone().any(|t| info.contains(&format!("/ModDate{}", pdf_date(t)))), "/ModDate in {modified:?}: {info}");
+}
+
+/// Run `f` → (its result, the time of writing: the Unix seconds before and after it).
+fn written<T>(f: impl FnOnce() -> T) -> (T, std::ops::RangeInclusive<i64>) {
+    let before = vectorcraft_doc::metadata::output_time().unwrap();
+    let out = f();
+    (out, before..=vectorcraft_doc::metadata::output_time().unwrap())
+}
+
+#[test]
+fn an_exported_pdf_is_created_with_the_document_and_modified_when_it_is_written() {
+    let mut s = created_at(json!(CREATED));
+    for p in [json!({}), json!({"preset": "PDF/X-4:2010"})] {
+        let (pdf, now) = written(|| b64(&s.execute("document.exportPdf", &p).unwrap()));
+        assert_dated(&pdf, CREATED..=CREATED, now);
+    }
+    let (pdf, now) = written(|| b64(&s.execute("document.export", &json!({"format": "pdf", "preserveEditing": false})).unwrap()));
+    assert_dated(&pdf, CREATED..=CREATED, now);
+}
+
+#[test]
+fn a_pdf_compatible_ai_is_created_with_the_document_and_modified_when_it_is_written() {
+    let mut s = created_at(json!(CREATED));
+    let path = std::env::temp_dir().join(format!("vc-fileinfo-created-{}.ai", std::process::id()));
+    let (saved, now) = written(|| s.execute("document.save", &json!({"path": path.to_string_lossy()})));
+    saved.unwrap();
+    let ai = std::fs::read(&path).unwrap();
+    let _ = std::fs::remove_file(&path);
+    assert_dated(&ai, CREATED..=CREATED, now);
+    assert_eq!(s.doc().unwrap().doc.metadata.created, Some(CREATED), "the save keeps the creation date");
+}
+
+#[test]
+fn a_pdf_of_a_document_without_a_creation_date_is_dated_when_it_is_written() {
+    let mut s = created_at(Value::Null);
+    assert_eq!(s.doc().unwrap().doc.metadata.created, None);
+    let (pdf, now) = written(|| b64(&s.execute("document.exportPdf", &json!({})).unwrap()));
+    assert_dated(&pdf, now.clone(), now);
+    let xmp = vectorcraft_pdf::file_info(&pdf, None).unwrap();
+    assert_eq!(xmp.created, xmp.modified, "created and modified at the same time of writing");
+}
+
 #[test]
 fn a_pdf_compatible_ai_opens_with_the_file_info_of_its_xmp_packet() {
     use vectorcraft_testkit::pdf::{PdfPage, first_extra, pdf_with_catalog};

crates/engine/src/tests_freeform.rs

@@ -84,6 +84,57 @@ fn new_stops_recolour_the_points() {
     assert_eq!((f.points[0].color.to_hex(), f.points.last().unwrap().color.to_hex()), ("#ff0000".into(), "#0000ff".into()));
 }
 
+/// A CMYK color's inks.
+fn inks(c: Color) -> [f32; 4] {
+    match c {
+        Color::Cmyk { c, m, y, k } => [c, m, y, k],
+        c => panic!("a CMYK color expected: {c:?}"),
+    }
+}
+
+/// Cyan and black inks only, adding up to one.
+fn cyan_and_black(c: Color) -> bool {
+    let [c, m, y, k] = inks(c);
+    m.abs() < 1e-5 && y.abs() < 1e-5 && (c + k - 1.0).abs() < 1e-5
+}
+
+#[test]
+fn cmyk_stops_recolor_the_points_with_inks() {
+    let cyan_to_black = json!([{"offset": 0, "color": {"c": 1, "m": 0, "y": 0, "k": 0}}, {"offset": 1, "color": {"c": 0, "m": 0, "y": 0, "k": 1}}]);
+    let (mut s, id) = freeform_rect();
+    run(&mut s, "paint.editGradient", json!({"stops": cyan_to_black}));
+    let f = points(&s, id);
+    let n = f.points.len();
+    for (i, p) in f.points.iter().enumerate() {
+        let k = i as f32 / (n - 1) as f32;
+        let [c, m, y, kk] = inks(p.color);
+        assert!((c - (1.0 - k)).abs() < 1e-5 && m.abs() < 1e-5 && y.abs() < 1e-5 && (kk - k).abs() < 1e-5, "point {i}: {:?}", p.color);
+    }
+    // A CMYK gradient switched to freeform places points with inks.
+    let mut s = session();
+    let id = shape(&mut s, "shape.rectangle", 100.0, 100.0, 100.0, 100.0);
+    run(&mut s, "paint.setFill", json!({"gradient": {"kind": "linear", "stops": cyan_to_black}}));
+    run(&mut s, "paint.editGradient", json!({"kind": "freeform"}));
+    assert!(points(&s, id).points.iter().all(|p| cyan_and_black(p.color)), "{:?}", points(&s, id).points);
+}
+
+#[test]
+fn points_added_between_cmyk_points_take_inks() {
+    let (mut s, id) = freeform_rect();
+    let n = points(&s, id).points.len();
+    for i in 0..n {
+        let c = if i % 2 == 0 { json!({"c": 1, "m": 0, "y": 0, "k": 0}) } else { json!({"c": 0, "m": 0, "y": 0, "k": 1}) };
+        run(&mut s, "paint.freeform.setPoint", json!({"index": i, "color": c}));
+    }
+    run(&mut s, "paint.freeform.addLine", json!({"points": [0, 1]}));
+    let i = run(&mut s, "paint.freeform.splitLine", json!({"line": 0, "segment": 0}))["index"].as_u64().unwrap() as usize;
+    let split = points(&s, id).points[i].color;
+    assert!(cyan_and_black(split), "the split point: {split:?}");
+    let i = run(&mut s, "paint.freeform.addPoint", json!({"at": [150, 150]}))["index"].as_u64().unwrap() as usize;
+    let added = points(&s, id).points[i].color;
+    assert!(cyan_and_black(added), "the added point: {added:?}");
+}
+
 #[test]
 fn transforms_and_warps_move_the_points() {
     let (mut s, id) = freeform_rect();

crates/engine/src/tests_legacy_ai.rs

@@ -3,6 +3,7 @@
 
 use serde_json::{Value, json};
 
+use super::tests_menucmds::place_undecodable_png;
 use super::*;
 use crate::tests_links::Folder;
 
@@ -191,6 +192,58 @@ fn art_under_transparent_art_stays_in_its_own_layer() {
     assert!(d.layers.iter().all(|l| l.children().is_some_and(|c| c.len() == 1)), "{:?}", d.layers);
 }
 
+/// #2687's file: a circle filled with a radial gradient from white to #1b2a6b, and a square filled
+/// with a linear one.
+const RADIAL_AND_LINEAR: &str = r##"<svg xmlns="http://www.w3.org/2000/svg" width="400" height="200" viewBox="0 0 400 200">
+  <defs>
+    <radialGradient id="r" cx="0.5" cy="0.5" r="0.5"><stop offset="0" stop-color="#ffffff"/><stop offset="1" stop-color="#1b2a6b"/></radialGradient>
+    <linearGradient id="l" x1="0" y1="0" x2="1" y2="0"><stop offset="0" stop-color="#ffffff"/><stop offset="1" stop-color="#1b2a6b"/></linearGradient>
+  </defs>
+  <circle cx="100" cy="100" r="80" fill="url(#r)"/>
+  <rect x="220" y="20" width="160" height="160" fill="url(#l)"/>
+</svg>"##;
+
+/// A radial gradient is written with its highlight, `0 0 0 0 Bh` at the center (§3.5.5, §3.5.6).
+/// #2687's file had none, and the reference app drew the circle in its outer color. The linear one
+/// has none. Both open again with their type, stops and place.
+#[test]
+fn a_radial_gradient_is_written_with_its_highlight() {
+    let mut s = Session::new();
+    let svg = vectorcraft_format::base64_encode(RADIAL_AND_LINEAR.as_bytes());
+    s.execute("document.open", &json!({"name": "t_radial.svg", "dataBase64": svg})).unwrap();
+    let r = s.execute("file.saveCopy", &json!({"format": "ai", "aiVersion": "7"})).unwrap();
+    let text = String::from_utf8(vectorcraft_format::base64_decode(r["dataBase64"].as_str().unwrap()).unwrap()).unwrap();
+    assert!(text.contains("\n%AI5_BeginGradient: (Gradient)\n(Gradient) 1 2 Bd\n[\n"), "{text}");
+    assert!(text.contains("\nBb\n0 0 0 0 Bh\n1 (Gradient) 100 100 0 80 1 0 0 1 0 0 Bg\nf\n0 BB\n"), "{text}");
+    assert!(text.contains("\nBb\n1 (Gradient 2) 220 180 0 160 1 0 0 1 0 0 Bg\nf\n0 BB\n"), "{text}");
+    assert_eq!(text.matches(" Bh\n").count(), 1, "{text}");
+    s.execute("document.open", &json!({"name": "t.ai", "dataBase64": r["dataBase64"]})).unwrap();
+    let d = &s.doc().unwrap().doc;
+    let mut found = vec![];
+    d.walk(|n| {
+        if let vectorcraft_color::Paint::Gradient(g) = n.appearance.fill_paint() {
+            found.push(*g);
+        }
+    });
+    let [radial, linear] = found.as_slice() else { panic!("{found:#?}") };
+    let navy = vectorcraft_color::Color::rgb(27.0 / 255.0, 42.0 / 255.0, 107.0 / 255.0);
+    use vectorcraft_color::GradientKind::{Linear, Radial};
+    for (g, kind, start, end) in [(radial, Radial, (100.0, 100.0), (180.0, 100.0)), (linear, Linear, (220.0, 20.0), (380.0, 20.0))] {
+        assert_eq!(g.gradient.kind, kind);
+        let [a, b] = g.gradient.stops.as_slice() else { panic!("{g:?}") };
+        assert_eq!((a.offset, b.offset, a.color), (0.0, 1.0, vectorcraft_color::Color::rgb(1.0, 1.0, 1.0)), "{g:?}");
+        assert!(b.color.to_rgb().iter().zip(navy.to_rgb()).all(|(x, y)| (x - y).abs() < 1e-3), "{g:?}");
+        let geom = g.geom.unwrap();
+        assert!((geom.start.x - start.0).abs() < 1e-3 && (geom.start.y - start.1).abs() < 1e-3, "{geom:?}");
+        assert!((geom.end.x - end.0).abs() < 1e-3 && (geom.end.y - end.1).abs() < 1e-3 && geom.focal.is_none(), "{geom:?}");
+    }
+    // White at the center, #1b2a6b at the edge.
+    for ((x, y), want) in [((100.0, 100.0), [255, 255, 255]), ((100.0, 21.0), [27, 42, 107])] {
+        let got = colour_at(d, x, y);
+        assert!(got.iter().zip(want).all(|(a, b)| a.abs_diff(b) <= 8), "{got:?} at {x}, {y}");
+    }
+}
+
 /// A `w`×`h` PNG of one colour (`rgba`), 72 ppi.
 fn png(w: u32, h: u32, rgba: [u8; 4]) -> Vec<u8> {
     let mut out = vec![];
@@ -262,6 +315,47 @@ fn a_transparent_image_is_flattened_with_the_art_under_it_which_stays() {
     assert_eq!(colour_at(page, 10.0, 20.0), [255, 0, 0], "the square outside the image");
 }
 
+/// How many of reply `r`'s warnings say that an image couldn't be decoded, as raster exports do.
+fn undecoded_notes(r: &Value) -> usize {
+    warnings(r).iter().filter(|w| *w == "an image couldn't be decoded and is missing from the picture").count()
+}
+
+#[test]
+fn a_flattened_image_that_cant_be_decoded_is_noted_once() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 200, "height": 100})).unwrap();
+    s.execute("artboard.new", &json!({"x": 0, "y": 0, "width": 200, "height": 100, "name": "B"})).unwrap();
+    let cut = place_undecodable_png(&mut s);
+    s.execute("transparency.set", &json!({"ids": [cut.0], "opacity": 50})).unwrap();
+    // Both artboards flatten it.
+    let r = s.execute("file.saveCopy", &json!({"format": "ai", "aiVersion": "7"})).unwrap();
+    assert_eq!(r["files"].as_array().map(Vec::len), Some(2), "{r}");
+    assert!(warnings(&r).iter().any(|w| w.contains("flattened with the art under them")), "{r}");
+    assert_eq!(undecoded_notes(&r), 1, "{r}");
+}
+
+#[test]
+fn an_image_that_cant_be_decoded_with_an_expanded_effect_is_noted() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 200, "height": 100})).unwrap();
+    let cut = place_undecodable_png(&mut s);
+    s.execute("effect.apply", &json!({"effect": "blur.gaussian", "params": {"radius": 3}, "ids": [cut.0]})).unwrap();
+    // Left out rather than flattened: only expanding the blur draws it.
+    let r = s.execute("file.saveCopy", &json!({"format": "ai", "aiVersion": "7", "transparentImages": "omit"})).unwrap();
+    assert_eq!(undecoded_notes(&r), 1, "{r}");
+}
+
+#[test]
+fn images_that_decode_give_no_decode_note() {
+    let mut s = shadow_over_square();
+    s.execute("effect.apply", &json!({"effect": "blur.gaussian", "params": {"radius": 3}})).unwrap(); // the blue image
+    for mode in ["flatten", "omit"] {
+        let r = s.execute("file.saveCopy", &json!({"format": "ai", "aiVersion": "7", "transparentImages": mode})).unwrap();
+        assert!(warnings(&r).iter().any(|w| w.contains("transparent images")), "{r}");
+        assert_eq!(undecoded_notes(&r), 0, "{r}");
+    }
+}
+
 #[test]
 fn transparent_images_can_be_left_out_and_opacity_makes_one_transparent() {
     let mut s = shadow_over_square();
@@ -277,6 +371,65 @@ fn transparent_images_can_be_left_out_and_opacity_makes_one_transparent() {
     assert_eq!(v["options"]["transparentImages"]["value"], "flatten", "{v}");
 }
 
+/// #2692's file, an image clipped to a circle inside a circle's stroke, and #2830's, an image with
+/// see-through pixels (which the save flattens into an image inside a clipping group), each with
+/// an orange square on the next layer.
+const CLIPPED_IMAGE: &str = r##"<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="400" height="200" viewBox="0 0 400 200">
+  <defs><clipPath id="c1"><circle cx="100" cy="100" r="70"/></clipPath></defs>
+  <g id="clipped-image">
+    <circle cx="100" cy="100" r="78" fill="none" stroke="#777777" stroke-width="4"/>
+    <g clip-path="url(#c1)"><image x="20" y="20" width="160" height="160" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAGklEQVR42mPMy8tjIAWwcHBwjGoY1TBMNQAAdtYC8NwTJdoAAAAASUVORK5CYII="/></g>
+  </g>
+  <g id="above"><rect x="220" y="20" width="160" height="160" fill="#f7941d"/></g>
+</svg>"##;
+const SEE_THROUGH_IMAGE: &str = r##"<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="400" height="200" viewBox="0 0 400 200">
+  <g id="alpha-image">
+    <image x="20" y="20" width="160" height="160" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAeElEQVR42mNgoBAwoguUlZX9x6ehq6uLEacBdXV1/4mxtampiRHDgLa2tv+kOL2qqooRbkBfX99/cvxfVFTEyMLAwMDAwcFBdiCOGjAYDIAnpHPnzpGUFoyMjBgxkvK1a9eIMkRLS4sRZ2a6d+8eXkOUlJQYGagJAOoJHMzSF7FXAAAAAElFTkSuQmCC"/>
+  </g>
+  <g id="above"><rect x="220" y="20" width="160" height="160" fill="#f7941d"/></g>
+</svg>"##;
+
+/// #2692 and #2830: the image inside a clipping group, clipped in the file or flattened by the
+/// save, is written as the version 7 specification shows one (§8.1, §8.4): the matrix with a space
+/// inside each bracket and the samples on comment lines of 60 hex digits, between `W n` and `Q`.
+/// A line `F`, which the specification's examples do not show, follows `%AI5_EndRaster`. The next
+/// layer follows with the square's exact lines, and the file opens again with both layers, the
+/// clipping group, the image, the square and, besides the clipping path, only the paths the SVG
+/// holds.
+#[test]
+fn a_clipped_or_flattened_image_is_written_as_the_specification_shows_it() {
+    for (svg, layer, paths) in [(CLIPPED_IMAGE, "clipped-image", 2), (SEE_THROUGH_IMAGE, "alpha-image", 1)] {
+        let mut s = Session::new();
+        s.execute("document.open", &json!({"name": "t.svg", "dataBase64": vectorcraft_format::base64_encode(svg.as_bytes())})).unwrap();
+        let r = s.execute("file.saveCopy", &json!({"format": "ai", "aiVersion": "7"})).unwrap();
+        let bytes = vectorcraft_format::base64_decode(r["dataBase64"].as_str().unwrap()).unwrap();
+        let text = String::from_utf8(bytes).unwrap();
+        let lines: Vec<&str> = text.lines().collect();
+        let xi: Vec<usize> = (0..lines.len()).filter(|i| lines[*i].ends_with(" XI")).collect();
+        assert_eq!(xi.len(), 1, "{text}");
+        let at = xi[0];
+        assert_eq!(lines[at - 2..at], ["%AI5_File:", "%AI5_BeginRaster"], "{layer}");
+        assert!(lines[at].starts_with("[ ") && lines[at].contains(" ] 0 0 "), "{}", lines[at]);
+        let end = at + lines[at..].iter().position(|l| *l == "%AI5_EndRaster").unwrap();
+        let (last, full) = lines[at + 1..end].split_last().unwrap();
+        assert!(full.iter().all(|l| l.len() == 61) && (2..=61).contains(&last.len()), "{layer}");
+        assert_eq!(lines[end + 1], "F", "{layer}");
+        assert!(text.contains("\nW\nn\n%AI5_File:\n") && text.contains("\n%AI5_EndRaster\nF\nQ\nLB\n%AI5_EndLayer--\n"), "{text}");
+        let square = "%AI5_BeginLayer\n1 1 1 1 0 0 1 255 79 79 Lb\n(above) Ln\n0 A\n0.9686 0.5804 0.1137 Xa\n0 O\n0 XR\n\
+                      220 180 m\n380 180 L\n380 20 L\n220 20 L\n220 180 L\nf\nLB\n%AI5_EndLayer--\n%%PageTrailer\n";
+        assert!(text.contains(square), "{text}");
+        s.execute("document.open", &json!({"name": "t.ai", "dataBase64": r["dataBase64"]})).unwrap();
+        let d = &s.doc().unwrap().doc;
+        assert_eq!(layer_names(d), [layer, "above"]);
+        assert_eq!(images(d), (1, 1), "{layer}");
+        let mut drawn = 0;
+        d.walk(|n| drawn += usize::from(matches!(n.kind, vectorcraft_doc::NodeKind::Path { clipping: false, .. })));
+        assert_eq!(drawn, paths, "{layer}");
+        assert_eq!(colour_at(d, 300.0, 100.0), [247, 148, 29], "{layer}");
+        assert_ne!(colour_at(d, 100.0, 100.0), [255, 255, 255], "{layer}");
+    }
+}
+
 #[test]
 fn a_range_saves_those_artboards_and_save_writes_them_again() {
     let dir = Folder::new("ai7-range");

crates/engine/src/tests_link_paths.rs

@@ -88,6 +88,86 @@ fn linked_files_on_other_computers_are_never_read() {
     assert!(s.link_stamps.keys().all(|(_, p)| !far.contains(p)), "{:?}", s.link_stamps.keys());
 }
 
+/// The final path Windows gives a folder of the drive `Z:` mapped to `\\server\share`. The
+/// share's root folder has no trailing separator (`\\?\UNC\server\share`).
+fn on_share(folder: &str) -> Option<std::path::PathBuf> {
+    let rest = folder.get(2..)?.trim_start_matches(['\\', '/']).replace('/', "\\");
+    let root = r"\\?\UNC\server\share";
+    Some(if rest.is_empty() { root.into() } else { format!(r"{root}\{rest}").into() })
+}
+
+#[test]
+fn a_document_on_a_mapped_drive_is_on_the_share_behind_it() {
+    use crate::cmd::fileio::share_of;
+    // craft-docpath refuses a link on the share when the document is given by its drive letter.
+    let link = r"\\server\share\img\logo.png";
+    assert_eq!(craft_docpath::resolve(link, Some(std::path::Path::new(r"Z:\jobs\doc.vectorcraft"))), Err(craft_docpath::Refused::Network));
+    assert!(craft_docpath::resolve(link, Some(std::path::Path::new(r"\\server\share\jobs\doc.vectorcraft"))).is_ok());
+
+    // The document's path on the share, from its folder's final path.
+    let mut asked = vec![];
+    let mut ask = |folder: &str| {
+        asked.push(folder.to_string());
+        on_share(folder)
+    };
+    assert_eq!(share_of(r"Z:\jobs\doc.vectorcraft", &mut ask).as_deref(), Some(r"\\server\share\jobs\doc.vectorcraft"));
+    assert_eq!(share_of(r"Z:\doc.vectorcraft", &mut ask).as_deref(), Some(r"\\server\share\doc.vectorcraft"));
+    assert_eq!(share_of("Z:/jobs/doc.vectorcraft", &mut ask).as_deref(), Some(r"\\server\share\jobs\doc.vectorcraft"));
+    assert_eq!(asked, [r"Z:\jobs", r"Z:\", "Z:/jobs"]);
+    let unc = |p: &'static str| move |_: &str| Some(std::path::PathBuf::from(p));
+    assert_eq!(share_of(r"Z:\doc.vectorcraft", unc(r"\\?\unc\server\share\")).as_deref(), Some(r"\\server\share\doc.vectorcraft"));
+
+    // A folder on a local volume (also behind a `subst` drive), a folder that can't be opened,
+    // and a final path without a share name give no path on a share.
+    assert_eq!(share_of(r"C:\art\doc.vectorcraft", unc(r"\\?\C:\art")), None);
+    assert_eq!(share_of(r"S:\doc.vectorcraft", unc(r"\\?\D:\real")), None);
+    assert_eq!(share_of(r"Z:\gone\doc.vectorcraft", |_| None), None);
+    assert_eq!(share_of(r"Z:\doc.vectorcraft", unc(r"\\?\UNC\server")), None);
+    // A document given by its share, or not by a drive, is not looked up.
+    for doc in [
+        r"\\server\share\doc.vectorcraft",
+        r"\\?\Z:\doc.vectorcraft",
+        "/Users/a/doc.vectorcraft",
+        "doc.vectorcraft",
+        "Z:doc.vectorcraft",
+        r"Z:\jobs\",
+    ] {
+        assert_eq!(share_of(doc, |f: &str| panic!("{doc}: looked up {f}")), None, "{doc}");
+    }
+}
+
+#[cfg(windows)]
+#[test]
+fn links_on_a_mapped_drives_share_are_followed() {
+    use crate::cmd::fileio::{document_path_with, share_of};
+    let doc = Some(r"Z:\jobs\doc.vectorcraft");
+    let share = |d: &str| share_of(d, on_share);
+    // A link on the share behind the drive is followed; one on another share still isn't.
+    assert_eq!(document_path_with(r"\\server\share\img\logo.png", doc, share).as_deref(), Ok(r"\\server\share\img\logo.png"));
+    assert_eq!(document_path_with(r"\\SERVER\Share\logo.png", doc, share).as_deref(), Ok(r"\\SERVER\Share\logo.png"));
+    assert_eq!(document_path_with(r"\\other\share\logo.png", doc, share), Err(craft_docpath::Refused::Network));
+    assert_eq!(document_path_with("file://server/share/logo.png", doc, share), Err(craft_docpath::Refused::Network));
+    // On a local volume, the link stays refused.
+    assert_eq!(document_path_with(r"\\server\share\logo.png", doc, |_| None), Err(craft_docpath::Refused::Network));
+    // Links that were followed resolve as before, without looking the share up.
+    let unasked = |d: &str| -> Option<String> { panic!("looked up {d}") };
+    assert_eq!(document_path_with(r"img\logo.png", doc, unasked).as_deref(), Ok(r"Z:\jobs\img\logo.png"));
+    assert_eq!(document_path_with(r"D:\art\logo.png", doc, unasked).as_deref(), Ok(r"D:\art\logo.png"));
+}
+
+#[test]
+fn a_document_off_a_mapped_drive_keeps_its_path() {
+    use crate::cmd::fileio::share_path;
+    let dir = Folder::new("docpath-share");
+    // A folder on this computer's own disk, and one that doesn't exist.
+    assert_eq!(share_path(&dir.file("doc.vectorcraft")), None);
+    assert_eq!(share_path(&dir.file("gone/doc.vectorcraft")), None);
+    // Elsewhere than Windows, no document is looked up.
+    if cfg!(not(windows)) {
+        assert_eq!(share_path(r"Z:\jobs\doc.vectorcraft"), None);
+    }
+}
+
 #[test]
 fn svg_images_on_other_computers_are_never_read() {
     let dir = Folder::new("docpath-svg");

crates/engine/src/tests_links.rs

@@ -157,6 +157,42 @@ fn a_linked_photoshop_document_places_and_updates() {
     assert!(near(centre_colour(&s.doc().unwrap().doc), BLUE));
 }
 
+/// An uncompressed 24-bit `w`×`h` Targa file of one color.
+fn targa(w: u16, h: u16, rgb: [u8; 3]) -> Vec<u8> {
+    let mut f = vec![0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+    f.extend(w.to_le_bytes());
+    f.extend(h.to_le_bytes());
+    f.extend([24, 0]);
+    let [r, g, b] = rgb;
+    f.extend(std::iter::repeat_n([b, g, r], usize::from(w) * usize::from(h)).flatten());
+    f
+}
+
+/// A Targa file placed linked shows its pixels and updates when it changes, and a link can be
+/// relinked to one.
+#[test]
+fn a_linked_targa_file_places_updates_and_relinks() {
+    let dir = Folder::new("tga");
+    let pic = dir.file("art/photo.tga");
+    write(&pic, &targa(600, 300, RED));
+    let mut s = session();
+    let id = place(&mut s, &pic);
+    assert_eq!(image(&s, id).link.unwrap().path, pic);
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
+    write(&pic, &targa(400, 400, BLUE));
+    assert_eq!(s.execute("links.update", &json!({})).unwrap(), json!({"updated": [id.0], "missing": []}));
+    let im = image(&s, id);
+    assert_eq!((im.width, im.height), (400, 400));
+    assert!(near(centre_colour(&s.doc().unwrap().doc), BLUE));
+    let other = dir.file("other/red.vst");
+    write(&other, &targa(300, 100, RED));
+    let r = s.execute("links.relink", &json!({"ids": [id.0], "path": other})).unwrap();
+    assert_eq!(r, json!({"relinked": [id.0], "notFound": []}));
+    let im = image(&s, id);
+    assert_eq!((im.width, im.height, im.link.unwrap().path), (300, 100, other));
+    assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
+}
+
 #[test]
 fn the_relative_path_finds_the_file_after_the_folder_moves() {
     let a = Folder::new("move-a");

crates/engine/src/tests_live.rs

@@ -73,6 +73,13 @@ fn all_anchors(nodes: &[Node]) -> Vec<Point> {
     v
 }
 
+/// `cmd` with `p` fails with the error for `key`, which `p` gives as something other than a number.
+fn refuses_non_number(s: &mut Session, cmd: &str, p: &Value, key: &str) {
+    let r = s.execute(cmd, p);
+    let want = format!("`{key}` must be a number, not {}", p[key]);
+    assert!(matches!(&r, Err(EngineError::BadParams { msg, .. }) if *msg == want), "{cmd} {p}: {r:?}");
+}
+
 // ---------- Blend ----------
 
 #[test]
@@ -116,6 +123,54 @@ fn blend_steps_that_are_not_a_whole_number_are_refused() {
     assert_eq!(steps_of(&s, g).len(), 6);
 }
 
+/// Make refuses Specified Steps or Distance given as text or as another value that is not a number,
+/// and makes no blend; `steps: 8` as a number makes 8 steps.
+#[test]
+fn blend_make_refuses_a_number_given_as_text() {
+    let mut s = session();
+    let (a, b) = (rect(&mut s, 0.0, 0.0, 10.0, 10.0), rect(&mut s, 100.0, 0.0, 10.0, 10.0));
+    sel(&mut s, &[a, b]);
+    let n = undo_len(&s);
+    for (key, p) in [
+        ("steps", json!({"steps": "8"})),
+        ("distance", json!({"distance": "10"})),
+        ("value", json!({"spacing": "steps", "value": "3"})),
+        ("value", json!({"spacing": "distance", "value": [5]})),
+        ("distance", json!({"spacing": "distance", "distance": true})),
+    ] {
+        refuses_non_number(&mut s, "object.blend.make", &p, key);
+    }
+    assert_eq!(undo_len(&s), n, "nothing changed");
+    assert!(matches!(node(&s, a).kind, NodeKind::Path { .. }), "not blended");
+    let g = id_of(&s.execute("object.blend.make", &json!({"steps": 8})).unwrap());
+    assert_eq!(steps_of(&s, g).len(), 10);
+}
+
+/// Blend Options refuses Specified Steps or Distance given as text, for the selected blends and for
+/// the options new blends start with, and changes neither.
+#[test]
+fn blend_options_refuse_a_number_given_as_text() {
+    let mut s = session();
+    let (_, _, g) = blend(&mut s, json!({"steps": 3}));
+    let n = undo_len(&s);
+    let calls = [
+        ("steps", json!({"steps": "4"})),
+        ("value", json!({"spacing": "steps", "value": "4"})),
+        ("distance", json!({"distance": "20"})),
+        ("distance", json!({"spacing": "distance", "value": null, "distance": "20"})),
+    ];
+    for (key, p) in &calls {
+        refuses_non_number(&mut s, "object.blend.options", p, key);
+    }
+    assert_eq!((undo_len(&s), steps_of(&s, g).len()), (n, 5), "the blend kept its options");
+    s.execute("select.none", &json!({})).unwrap();
+    let defaults = s.prefs.blend_options;
+    for (key, p) in &calls {
+        refuses_non_number(&mut s, "object.blend.options", p, key);
+    }
+    assert_eq!(s.prefs.blend_options, defaults, "the options new blends start with stayed");
+}
+
 #[test]
 fn blend_mid_step_interpolates_geometry_and_colour() {
     let mut s = session();
@@ -479,6 +534,95 @@ fn envelope_options_and_edit_contents() {
     assert_eq!(s.doc().unwrap().selection.objects, vec![e]);
 }
 
+/// The warp's `bend`, and `h` and `v` by those keys or by their long names, given as text.
+fn warp_numbers_as_text() -> [(&'static str, Value); 5] {
+    [
+        ("bend", json!({"bend": "40"})),
+        ("h", json!({"h": "10"})),
+        ("v", json!({"v": "-10"})),
+        ("horizontalDistortion", json!({"horizontalDistortion": "10"})),
+        ("verticalDistortion", json!({"verticalDistortion": "10%"})),
+    ]
+}
+
+/// Make with Warp refuses a bend or distortion given as text, and makes no envelope.
+#[test]
+fn envelope_make_with_warp_refuses_a_number_given_as_text() {
+    let mut s = session();
+    let a = text_rect(&mut s);
+    sel(&mut s, &[a]);
+    let n = undo_len(&s);
+    for (key, p) in warp_numbers_as_text() {
+        refuses_non_number(&mut s, "object.envelope.makeWithWarp", &p, key);
+    }
+    assert_eq!(undo_len(&s), n, "nothing changed");
+    assert!(matches!(node(&s, a).kind, NodeKind::Path { .. }), "not enveloped");
+}
+
+/// Reset with Warp refuses a bend or distortion given as text, and the envelope keeps its warp.
+#[test]
+fn envelope_reset_with_warp_refuses_a_number_given_as_text() {
+    let mut s = session();
+    let a = text_rect(&mut s);
+    sel(&mut s, &[a]);
+    let e = id_of(&s.execute("object.envelope.makeWithWarp", &json!({"style": "arc", "bend": 50})).unwrap());
+    let (before, n) = (node(&s, e), undo_len(&s));
+    for (key, p) in warp_numbers_as_text() {
+        refuses_non_number(&mut s, "object.envelope.resetWithWarp", &p, key);
+    }
+    assert_eq!((node(&s, e), undo_len(&s)), (before, n), "nothing changed");
+}
+
+/// Make with Mesh refuses rows or columns given as text, and makes no envelope.
+#[test]
+fn envelope_make_with_mesh_refuses_a_number_given_as_text() {
+    let mut s = session();
+    let a = text_rect(&mut s);
+    sel(&mut s, &[a]);
+    let n = undo_len(&s);
+    for (key, p) in [("rows", json!({"rows": "3"})), ("cols", json!({"cols": "3"})), ("columns", json!({"rows": 2, "columns": "3"}))] {
+        refuses_non_number(&mut s, "object.envelope.makeWithMesh", &p, key);
+    }
+    assert_eq!(undo_len(&s), n, "nothing changed");
+    assert!(matches!(node(&s, a).kind, NodeKind::Path { .. }), "not enveloped");
+}
+
+/// Reset with Mesh refuses rows or columns given as text, and the envelope keeps its mesh.
+#[test]
+fn envelope_reset_with_mesh_refuses_a_number_given_as_text() {
+    let mut s = session();
+    let a = text_rect(&mut s);
+    sel(&mut s, &[a]);
+    let e = id_of(&s.execute("object.envelope.makeWithMesh", &json!({"rows": 2, "cols": 2})).unwrap());
+    let (before, n) = (node(&s, e), undo_len(&s));
+    for (key, p) in [("rows", json!({"rows": "3"})), ("cols", json!({"cols": "3"})), ("columns", json!({"columns": "3", "maintainShape": false}))] {
+        refuses_non_number(&mut s, "object.envelope.resetWithMesh", &p, key);
+    }
+    assert_eq!((node(&s, e), undo_len(&s)), (before, n), "nothing changed");
+}
+
+/// Envelope Options refuses a fidelity, bend or distortion given as text, for the selected
+/// envelope and for the options new envelopes get, and changes neither.
+#[test]
+fn envelope_options_refuse_a_number_given_as_text() {
+    let mut s = session();
+    let a = text_rect(&mut s);
+    sel(&mut s, &[a]);
+    let e = id_of(&s.execute("object.envelope.makeWithWarp", &json!({"style": "arc", "bend": 50})).unwrap());
+    let (before, n) = (node(&s, e), undo_len(&s));
+    let mut calls = vec![("fidelity", json!({"fidelity": "80", "antiAlias": false}))];
+    calls.extend(warp_numbers_as_text());
+    for (key, p) in &calls {
+        refuses_non_number(&mut s, "object.envelope.options", p, key);
+    }
+    assert_eq!((node(&s, e), undo_len(&s)), (before, n), "nothing changed");
+    s.execute("select.none", &json!({})).unwrap();
+    for (key, p) in &calls {
+        refuses_non_number(&mut s, "object.envelope.options", p, key);
+    }
+    assert_eq!(s.envelope_defaults, None, "the options new envelopes get stayed");
+}
+
 #[test]
 fn envelope_renders_distorted() {
     let mut s = session();
@@ -634,6 +778,46 @@ fn mesh_commands_refuse_an_index_or_count_that_is_not_a_whole_number() {
     assert_eq!(mesh_of(&s, a).points[4].p, Point::new(40.0, 60.0));
 }
 
+/// Create Gradient Mesh refuses rows, columns or a highlight given as text, and an `at` that is not
+/// two numbers, and makes no mesh; `at: [50, 40]` with a null highlight makes one.
+#[test]
+fn mesh_create_refuses_a_number_given_as_text() {
+    let mut s = session();
+    let a = rect(&mut s, 0.0, 0.0, 100.0, 100.0);
+    sel(&mut s, &[a]);
+    let n = undo_len(&s);
+    for (key, p) in [
+        ("rows", json!({"rows": "3"})),
+        ("cols", json!({"cols": "2"})),
+        ("columns", json!({"columns": "2"})),
+        ("highlight", json!({"appearance": "center", "highlight": "50"})),
+    ] {
+        refuses_non_number(&mut s, "object.mesh.create", &p, key);
+    }
+    for at in [json!(["50", "40"]), json!([50]), json!(50), json!({"x": 50, "y": 40})] {
+        let r = s.execute("object.mesh.create", &json!({ "at": at }));
+        assert!(matches!(&r, Err(EngineError::BadParams { msg, .. }) if msg == "`at` must be [x, y]"), "{at}: {r:?}");
+    }
+    assert_eq!(undo_len(&s), n, "nothing changed");
+    assert!(matches!(node(&s, a).kind, NodeKind::Path { .. }), "still a path");
+    s.execute("object.mesh.create", &json!({"at": [50, 40], "highlight": null})).unwrap();
+    assert_eq!((mesh_of(&s, a).rows, mesh_of(&s, a).cols), (2, 2));
+}
+
+/// Set Mesh Point Color refuses an opacity given as text, and the point keeps its color and opacity.
+#[test]
+fn mesh_set_point_color_refuses_an_opacity_given_as_text() {
+    let mut s = session();
+    let a = rect(&mut s, 0.0, 0.0, 100.0, 100.0);
+    sel(&mut s, &[a]);
+    s.execute("object.mesh.create", &json!({"rows": 1, "cols": 1})).unwrap();
+    let (before, n) = (mesh_of(&s, a), undo_len(&s));
+    for p in [json!({"id": a.0, "index": 3, "color": "#00ff00", "opacity": "0.5"}), json!({"id": a.0, "index": 3, "opacity": "50%"})] {
+        refuses_non_number(&mut s, "object.mesh.setPointColor", &p, "opacity");
+    }
+    assert_eq!((mesh_of(&s, a), undo_len(&s)), (before, n), "nothing changed");
+}
+
 #[test]
 fn mesh_create_at_point_single_undo() {
     let mut s = session();

crates/engine/src/tests_menucmds.rs

@@ -83,6 +83,13 @@ fn close(a: f64, b: f64) -> bool {
     (a - b).abs() < 1e-6
 }
 
+/// `cmd` with `p` fails with the error for `key`, which `p` gives as something other than a number.
+fn refuses_non_number(s: &mut Session, cmd: &str, p: &Value, key: &str) {
+    let r = s.execute(cmd, p);
+    let want = format!("`{key}` must be a number, not {}", p[key]);
+    assert!(matches!(&r, Err(EngineError::BadParams { msg, .. }) if *msg == want), "{cmd} {p}: {r:?}");
+}
+
 // ---------- Object → Lock / Hide ----------
 
 #[test]
@@ -399,6 +406,29 @@ fn transform_each_refuses_a_reference_or_seed_that_is_not_a_whole_number() {
     assert_eq!(bounds(&s, a), Rect::new(0.0, 0.0, 50.0, 50.0));
 }
 
+/// Transform Each refuses a scale, move or rotation given as text or as another value that is not a
+/// number, and the object stays as it was; numbers for the scales and the horizontal move transform it.
+#[test]
+fn transform_each_refuses_a_number_given_as_text() {
+    let mut s = session();
+    let a = rect(&mut s, 0.0, 0.0, 100.0, 100.0);
+    sel(&mut s, &[a]);
+    let before = (undo_len(&s), bounds(&s, a));
+    for (key, p) in [
+        ("scaleH", json!({"scaleH": "50"})),
+        ("scaleV", json!({"scaleH": 50, "scaleV": "50%"})),
+        ("moveH", json!({"moveH": "10"})),
+        ("moveV", json!({"moveH": 10, "moveV": [5]})),
+        ("rotate", json!({"rotate": "45"})),
+        ("rotate", json!({"moveH": 10, "rotate": true})),
+    ] {
+        refuses_non_number(&mut s, "object.transformEach", &p, key);
+        assert_eq!((undo_len(&s), bounds(&s, a)), before, "{p}");
+    }
+    s.execute("object.transformEach", &json!({"scaleH": 50, "scaleV": 50, "moveH": 10, "moveV": null})).unwrap();
+    assert_eq!(bounds(&s, a), Rect::new(35.0, 25.0, 85.0, 75.0));
+}
+
 /// #1910: Transform Each's Reflect X flips left-right; Reflect Y flips top-bottom (same as
 /// Effect › Distort › Transform and Illustrator's Transform Each checkboxes).
 #[test]
@@ -571,6 +601,22 @@ fn rasterize_replaces_selection_with_image() {
     assert_eq!(selected(&s), vec![img]);
 }
 
+/// Rasterize refuses a resolution given as text or as another value that is not a number, and the
+/// selected art stays as it was.
+#[test]
+fn rasterize_refuses_a_ppi_given_as_text() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0, 20.0, 40.0, 30.0);
+    sel(&mut s, &[a]);
+    let before = (undo_len(&s), node(&s, a));
+    for p in [json!({"ppi": "144"}), json!({"ppi": "300 ppi", "padding": 0}), json!({"ppi": [72]})] {
+        refuses_non_number(&mut s, "object.rasterize", &p, "ppi");
+        assert_eq!((undo_len(&s), node(&s, a)), before, "{p}");
+    }
+    let img = id_of(&s.execute("object.rasterize", &json!({"ppi": 144, "padding": 0})).unwrap());
+    assert!(matches!(node(&s, img).kind, NodeKind::Image(_)));
+}
+
 #[test]
 fn rasterize_says_when_an_image_could_not_be_decoded() {
     let mut s = session();
@@ -608,6 +654,25 @@ fn crop_image_to_rect() {
     assert!(s.execute("object.cropImage", &json!({})).is_err());
 }
 
+/// Crop Image refuses a `rect` that is not an array, such as text, and the image stays as it was; a
+/// null `rect` crops to the artboard as a missing one does.
+#[test]
+fn crop_image_refuses_a_rect_given_as_text() {
+    let mut s = session();
+    let a = rect(&mut s, -20.0, -20.0, 100.0, 100.0);
+    sel(&mut s, &[a]);
+    let img = id_of(&s.execute("object.rasterize", &json!({"ppi": 72})).unwrap());
+    let before = (undo_len(&s), node(&s, img));
+    for p in [json!({"rect": "0, 0, 20, 20"}), json!({"rect": {"x": 0, "y": 0, "width": 20, "height": 20}}), json!({"rect": 20})] {
+        let r = s.execute("object.cropImage", &p);
+        assert!(matches!(&r, Err(EngineError::BadParams { msg, .. }) if msg == "rect must be [x, y, width, height]"), "{p}: {r:?}");
+        assert_eq!((undo_len(&s), node(&s, img)), before, "{p}");
+    }
+    s.execute("object.cropImage", &json!({"rect": null})).unwrap();
+    let b = bounds(&s, img);
+    assert!(close(b.x0, 0.0) && close(b.y0, 0.0), "{b:?}");
+}
+
 #[test]
 fn crop_image_disabled_without_image() {
     let mut s = session();
@@ -656,6 +721,30 @@ fn trim_marks_around_selection() {
     assert!(close(b.x0, vb.x0 - 30.0) && close(b.y1, vb.y1 + 30.0), "{b:?} {vb:?}");
 }
 
+/// Create Trim Marks refuses an offset, length, bleed or weight given as text or as another value
+/// that is not a number, around the selection and around the artboards, and makes no marks.
+#[test]
+fn trim_marks_refuse_a_number_given_as_text() {
+    let mut s = session();
+    let a = rect(&mut s, 100.0, 100.0, 200.0, 100.0);
+    let calls = [
+        ("offset", json!({"offset": "10"})),
+        ("length", json!({"length": "20 pt"})),
+        ("bleed", json!({"style": "japanese", "bleed": "3"})),
+        ("weight", json!({"weight": true})),
+        ("offset", json!({"allArtboards": true, "offset": {"value": 10}})),
+    ];
+    for ids in [vec![a], vec![]] {
+        sel(&mut s, &ids);
+        let before = (undo_len(&s), s.doc().unwrap().doc.layers[0].children().unwrap().len());
+        for (key, p) in &calls {
+            refuses_non_number(&mut s, "object.createTrimMarks", p, key);
+            assert_eq!((undo_len(&s), s.doc().unwrap().doc.layers[0].children().unwrap().len()), before, "{p}");
+        }
+    }
+    s.execute("object.createTrimMarks", &json!({"offset": 10, "length": 20, "bleed": null})).unwrap();
+}
+
 // ---------- Convert to Shape ----------
 
 #[test]
@@ -791,6 +880,22 @@ fn rearrange_refuses_columns_that_are_not_a_whole_number() {
     assert_eq!((r["rows"].clone(), r["columns"].clone()), (json!(2), json!(1)));
 }
 
+/// Rearrange All Artboards refuses a spacing given as text or as another value that is not a number,
+/// and the artboards stay where they were.
+#[test]
+fn rearrange_refuses_a_spacing_given_as_text() {
+    let mut s = session();
+    s.execute("artboard.new", &json!({"x": 1000, "y": 0, "width": 400, "height": 300})).unwrap();
+    let boards = |s: &Session| s.doc().unwrap().doc.artboards.iter().map(|a| a.rect).collect::<Vec<_>>();
+    let before = (boards(&s), undo_len(&s));
+    for p in [json!({"spacing": "50"}), json!({"columns": 1, "spacing": "50 pt"}), json!({"layout": "row", "spacing": false})] {
+        refuses_non_number(&mut s, "artboard.rearrange", &p, "spacing");
+        assert_eq!((boards(&s), undo_len(&s)), before, "{p}");
+    }
+    s.execute("artboard.rearrange", &json!({"columns": 1, "spacing": 50})).unwrap();
+    assert_eq!(boards(&s)[1], Rect::new(0.0, 650.0, 400.0, 950.0));
+}
+
 /// Fit to Artwork Bounds fits each artboard it is given to the art on it, in one undo step: an
 /// object partly on an artboard counts for each artboard it overlaps, art flush with an edge from
 /// outside or on no artboard doesn't count, and an artboard with no art stays as it is.
@@ -1026,6 +1131,55 @@ fn select_same_paint_reads_type_characters() {
     assert_eq!(same(&mut s, t1, "select.same.fillAndStroke"), vec![t1, r]);
 }
 
+/// Select by Color needs no object to start from: it matches fills and strokes as
+/// `document.inspect` reports them, `#rrggbb`.
+#[test]
+fn select_color_matches_fill_and_stroke_without_a_selection() {
+    let mut s = session();
+    let [a, b, c] = [0.0, 20.0, 40.0].map(|x| rect(&mut s, x, 0.0, 10.0, 10.0));
+    let t = text(&mut s, "a");
+    fill(&mut s, a, "#000000");
+    fill(&mut s, t, "#000000");
+    // A grey as a PDF stores it reads as #fefefe.
+    s.execute("paint.setFill", &json!({"ids": [b.0], "color": [0.996, 0.996, 0.996]})).unwrap();
+    fill(&mut s, c, "#ff0000");
+    s.execute("paint.setStroke", &json!({"ids": [a.0, c.0], "color": "#0000ff"})).unwrap();
+    s.execute("select.none", &json!({})).unwrap();
+    let pick = |s: &mut Session, p: Value| {
+        s.execute("select.color", &p).unwrap();
+        let mut v = selected(s);
+        v.sort();
+        v
+    };
+    assert_eq!(pick(&mut s, json!({"fill": "#000000"})), vec![a, t]);
+    assert_eq!(pick(&mut s, json!({"fill": "#fefefe"})), vec![b]);
+    assert_eq!(pick(&mut s, json!({"stroke": "#0000ff"})), vec![a, c]);
+    assert_eq!(pick(&mut s, json!({"fill": "#000000", "stroke": "#0000ff"})), vec![a]);
+    // Select > Reselect repeats it.
+    s.execute("select.none", &json!({})).unwrap();
+    s.execute("select.reselect", &json!({})).unwrap();
+    assert_eq!(selected(&s), vec![a]);
+    // A compound path reads as its own paint, never its members'.
+    let outer = rect(&mut s, 100.0, 0.0, 50.0, 50.0);
+    let inner = rect(&mut s, 110.0, 10.0, 20.0, 20.0);
+    fill(&mut s, outer, "#000000");
+    fill(&mut s, inner, "#000000");
+    sel(&mut s, &[outer, inner]);
+    let compound = id_of(&s.execute("object.compoundPath.make", &json!({})).unwrap());
+    assert_eq!(pick(&mut s, json!({"fill": "#000000"})), vec![a, t, compound]);
+    fill(&mut s, compound, "#ff0000");
+    assert_eq!(pick(&mut s, json!({"fill": "#000000"})), vec![a, t]);
+    assert_eq!(pick(&mut s, json!({"fill": "#ff0000"})), vec![c, compound]);
+    // Type without characters reads as the default character fill, black.
+    let empty = text(&mut s, "x");
+    if let Some(NodeKind::Text(t)) = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).node_mut(empty).map(|n| &mut n.kind) {
+        t.runs.clear();
+    }
+    assert_eq!(pick(&mut s, json!({"fill": "#000000"})), vec![a, t, empty]);
+    assert!(s.execute("select.color", &json!({})).is_err());
+    assert!(s.execute("select.color", &json!({"fill": "not a colour"})).is_err());
+}
+
 #[test]
 fn select_direction_handles_selects_all_anchors() {
     let mut s = session();
@@ -1595,6 +1749,23 @@ fn change_case_variants() {
     assert!(s.execute("type.changeCase", &json!({"case": "weird"})).is_err());
 }
 
+/// Georgian has no word capitals: title and sentence case leave Mkhedruli lower case (and bring
+/// Mtavruli back to it) instead of capitalizing it; upper case still gives Mtavruli.
+#[test]
+fn change_case_leaves_georgian_uncapitalized() {
+    let mut s = session();
+    let t = text(&mut s, "ფენის სახელი. ახალი Layer");
+    sel(&mut s, &[t]);
+    s.execute("type.changeCase", &json!({"case": "title"})).unwrap();
+    assert_eq!(plain(&s, t), "ფენის სახელი. ახალი Layer");
+    s.execute("type.changeCase", &json!({"case": "sentence"})).unwrap();
+    assert_eq!(plain(&s, t), "ფენის სახელი. ახალი layer");
+    s.execute("type.changeCase", &json!({"case": "upper"})).unwrap();
+    assert_eq!(plain(&s, t), "ᲤᲔᲜᲘᲡ ᲡᲐᲮᲔᲚᲘ. ᲐᲮᲐᲚᲘ LAYER");
+    s.execute("type.changeCase", &json!({"case": "title"})).unwrap();
+    assert_eq!(plain(&s, t), "ფენის სახელი. ახალი Layer");
+}
+
 /// Change Case is one undo step, and Change Case to the case the text has already records no undo
 /// step: the step to redo stays and the document stays unmodified. It still replies with the
 /// objects.

crates/engine/src/tests_nativefile.rs

@@ -160,3 +160,20 @@ fn newer_keys_and_legacy_profiles_survive_open_and_save() {
     let v2 = json_of(&saved(&mut s, json!({"version": 2})));
     assert_eq!(v2["document"]["unknown"]["colorProfiles"]["rgb"], "sRGB IEC61966-2.1");
 }
+
+/// A save records the date the document was made in, so the same commands twice gave different
+/// bytes (#2880). A pinned date makes them identical — `file.new {created}` here, and
+/// `SOURCE_DATE_EPOCH` for an export that takes no date param.
+#[test]
+fn a_pinned_date_makes_saves_byte_identical() {
+    let once = |t: i64| {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 400, "height": 200, "created": t})).unwrap();
+        s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 100, "height": 50})).unwrap();
+        saved(&mut s, json!({}))
+    };
+    let at = 1_791_208_980;
+    assert_eq!(once(at), once(at), "the same document and date give the same bytes");
+    // The date really is in the bytes, so the comparison above is not vacuous.
+    assert_ne!(once(at), once(at + 1), "another date shows in the bytes");
+}