Importers: nesting is capped, so a deeply nested file can't overflow the stack

Image Trace: gradients grown over noise and soft rims

Cargo.lock

@@ -3640,9 +3640,9 @@ dependencies = [
 
 [[package]]
 name = "ruzstd"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a252f5e20f038fe7b4ea53e073e65398d652c864cc162fc77c56c2f13717b888"
+checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
 dependencies = [
  "twox-hash",
 ]
@@ -4510,6 +4510,7 @@ dependencies = [
  "raw-window-handle",
  "rfd",
  "serde_json",
+ "socket2",
  "vectorcraft-engine",
  "vectorcraft-text",
  "vectorcraft-ui-egui",
@@ -4654,6 +4655,7 @@ dependencies = [
  "vectorcraft-pdf",
  "vectorcraft-plugins",
  "vectorcraft-render",
+ "vectorcraft-scriptcheck",
  "vectorcraft-svg",
  "vectorcraft-testkit",
  "vectorcraft-text",
@@ -4689,6 +4691,7 @@ version = "0.10.0"
 dependencies = [
  "flate2",
  "proptest",
+ "rustix 1.1.5",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
@@ -4822,6 +4825,13 @@ dependencies = [
  "weezl",
 ]
 
+[[package]]
+name = "vectorcraft-scriptcheck"
+version = "0.10.0"
+dependencies = [
+ "proptest",
+]
+
 [[package]]
 name = "vectorcraft-svg"
 version = "0.10.0"

Cargo.toml

@@ -37,6 +37,7 @@ vectorcraft-eps = { path = "crates/eps" }
 vectorcraft-metafile = { path = "crates/metafile" }
 vectorcraft-plugins = { path = "crates/plugins" }
 vectorcraft-affinity = { path = "crates/affinity" }
+vectorcraft-scriptcheck = { path = "crates/scriptcheck" }
 
 # foundation
 kurbo = { version = "0.13", features = ["serde"] }
@@ -65,8 +66,9 @@ skrifa = "0.47"
 harfrust = "0.13"
 linesweeper = "0.5"
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
+rustix = { version = "1.1", default-features = false }
 # Zstandard decoder (pure Rust, builds for wasm32 too): the editing copy an EPS carries of its art.
-ruzstd = { version = "0.9", default-features = false, features = ["std"] }
+ruzstd = { version = "0.9.1", default-features = false, features = ["std"] }
 jpeg-encoder = { version = "0.6", default-features = false, features = ["std"] }
 gif = { version = "0.14", default-features = false, features = ["std", "raii_no_panic"] }
 # CMYK image samples (vectorcraft-doc's cmyk module): the image crate's own TIFF and JPEG

ROADMAP.md

@@ -6,7 +6,7 @@
 
 **Stage: alpha** · next: beta, ~13 points (ready for real work ~62% → ~75%, and reliable `.ai` exchange) and ~170–270 h away
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (community PRs and fixes of late 2026-10-12: type that does not fit its frame is reported, #1471; Tabs panel drags, #1458; template layers in Outline view, #1486; dialog slider rails, #1483; Direct Selection anchor precedence, #1508; print-size images, #1517; French catalog complete again, #1511; headline numbers unchanged; Image Trace colour and photo presets, measured in `docs/image-trace-quality.md`, headline numbers unchanged; community PRs and fixes of 2026-10-12: Split Into Grid options, #1462; Transform Objects and Reflect across an angle, #1448 and #1460; Pathfinder on a group, #1450; unknown parameter keys refused, #1442; grayscale TIFFs with alpha, #1466 in part; many-object edits, #1429 in part; headline numbers unchanged; Image Trace places edges to a fraction of a pixel, measured in `docs/image-trace-quality.md`, headline numbers unchanged; Transform dialogs preview and the transform tools act on direct-selected anchors, #1412 and #1408; `.ai` compound path paint, #1410, overprint, #1388, and text-only PDF parts, #1387; community PRs: strokes wider than their shape, corner drags without the bounding box, pasted pictures, compound paths in `document.inspect`, MCP guide; headline numbers unchanged; community PRs: `.ai` editing-data follow-ups (gradient stops, type of objects with an appearance, short area-type frames), PDF bleed with editing data, dialog keyboard focus, art flush with an artboard, font rescan, symbol instance redraw, `--control` port check; headline numbers unchanged; Rectangular Grid and Polar Grid tool options, #1377 in part; `.ai` files with placed (linked) pictures open from their editing data, #1264; community PRs: `.ai` and PDF bleed and editing-data import, gradient shapes imported as paths, ruler origin, Align To, Live Corners corner selection; headline numbers unchanged; G2: Film Grain added; Photoshop effects 29/57; 28 filters remain; community PRs: graph designs, Graph Data worksheet and Graph Type options; Align both centres; Pen endpoint fixes; earlier: Effect › Brush Strokes landed: Photoshop-style filters 28 of 57, raster effects 40% → 48%; `.ai` gradients, meshes and artboard names from the editing data; headline numbers unchanged; `.ai` art styles and clipping fills from the editing data; headline numbers unchanged; `editingData: "always"`; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (verified PngSuite downloads, #1729; synthetic control-input budgets, #1709; merges of 2026-10-14: anchor Align and Distribute, #1636; Direct Selection fixes, #1674, #1666, #1743; Escape while typing, #1686; Pen clicks and a Precise Cursors command, #1663; Expand on repeats, #1756; Roughen and Scribble, #1643, #1648; file and input hardening, #1776–#1783, #1786, #1807; MCP limits and envelope, #1727, #1728; Image Trace levelling and Flat Logo on scans, #1647, #1657; a guide's position in the Transform panel is a convenience, not a parity claim, #1659; headline numbers unchanged; later merges of 2026-10-13: SVG import of CSS transforms, percentage lengths in symbols, Inkscape flowed text and pages, #1565, #1596, #1568, #1601; Warp Arc, #1578; Pathfinder Trim, Merge and Crop strokes, #1570; saves to folders that refuse the temporary file, #1620 in part; OpenType stylistic sets, #1607; intersect Smart Guides, #1602 in part; headline numbers unchanged; control transport deadlines, #1726; Image Trace edges, strokes, memory and three new options, measured in `docs/image-trace-quality.md`, headline numbers unchanged; community PRs and fixes of 2026-10-13: Polish interface, #1498; compact native saves, #1492; PDF and EPS paste as vector art, #1499; `.ai`, PDF, EPS and SVG import fixes, #1528, #1530, #1531, #1544, #1551, #1553; guide objects, #1534; Join after Average, #1533; Keyboard Shortcuts lists commands outside the menus, #1539; headline numbers unchanged; community PRs and fixes of late 2026-10-12: type that does not fit its frame is reported, #1471; Tabs panel drags, #1458; template layers in Outline view, #1486; dialog slider rails, #1483; Direct Selection anchor precedence, #1508; print-size images, #1517; French catalog complete again, #1511; headline numbers unchanged; Image Trace colour and photo presets, measured in `docs/image-trace-quality.md`, headline numbers unchanged; community PRs and fixes of 2026-10-12: Split Into Grid options, #1462; Transform Objects and Reflect across an angle, #1448 and #1460; Pathfinder on a group, #1450; unknown parameter keys refused, #1442; grayscale TIFFs with alpha, #1466 in part; many-object edits, #1429 in part; headline numbers unchanged; Image Trace places edges to a fraction of a pixel, measured in `docs/image-trace-quality.md`, headline numbers unchanged; Transform dialogs preview and the transform tools act on direct-selected anchors, #1412 and #1408; `.ai` compound path paint, #1410, overprint, #1388, and text-only PDF parts, #1387; community PRs: strokes wider than their shape, corner drags without the bounding box, pasted pictures, compound paths in `document.inspect`, MCP guide; headline numbers unchanged; community PRs: `.ai` editing-data follow-ups (gradient stops, type of objects with an appearance, short area-type frames), PDF bleed with editing data, dialog keyboard focus, art flush with an artboard, font rescan, symbol instance redraw, `--control` port check; headline numbers unchanged; Rectangular Grid and Polar Grid tool options, #1377 in part; `.ai` files with placed (linked) pictures open from their editing data, #1264; community PRs: `.ai` and PDF bleed and editing-data import, gradient shapes imported as paths, ruler origin, Align To, Live Corners corner selection; headline numbers unchanged; G2: Film Grain added; Photoshop effects 29/57; 28 filters remain; community PRs: graph designs, Graph Data worksheet and Graph Type options; Align both centres; Pen endpoint fixes; earlier: Effect › Brush Strokes landed: Photoshop-style filters 28 of 57, raster effects 40% → 48%; `.ai` gradients, meshes and artboard names from the editing data; headline numbers unchanged; `.ai` art styles and clipping fills from the editing data; headline numbers unchanged; `editingData: "always"`; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
 
 VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adobe Illustrator workflow. It runs
 on macOS, Windows, Linux, FreeBSD and the web (WASM), and agents can drive all of it over MCP, the CLI and a JSON
@@ -125,10 +125,20 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap
 
 ## Progress log
 
+- 2026-10-13: PngSuite downloads use pinned HTTPS files and a SHA-256 manifest; no archive extraction (#1729).
+
 | Date | What landed |
 |---|---|
+| 2026-10-13 | Synthetic control input has finite click/drag counts and pending-event limits, checked before queue mutation; control-channel bursts yield after 64 requests per frame (#1709). |
+| 2026-10-14 | Align and Distribute act on the anchor points selected with Direct Selection: the points of one path align to each other, not to the artboard, and Distribute spaces them (#1641, fixes #1636; aligning to a key anchor is still missing). Delete removes every selected anchor of a closed path (it used to remove the wrong ones), removes objects selected whole along with the selected anchors of others, and keeps the remainder selected so a second Delete removes it (#1674). In isolation mode Direct Selection and Group Selection pick only inside the isolated object (#1666). Escape cancels a Direct Selection drag (#1803, #1743). Escape while typing ends the edit, keeps the type selected and switches to the Selection tool (#1802, #1686, #1656). A filled Pencil path keeps a stroke of None (#1804, part of #1679). With the Pen, a press that moves under 3 screen pixels is a click (a corner without handles), and a Precise Cursors command toggles the existing preference and can take a shortcut (#1663). The [ and ] keys reach the Blob Brush, the Eraser and the Symbolism tools in the app (#1734, part of #1661). In the Pathfinder panel a group selected alone counts its nested shapes, so an expanded stroked object keeps the Shape Modes enabled (#1642, #1635). Object › Expand turns radial, grid and mirror repeats into groups of their instances (#1765, #1756). Select › Same matches type on its characters' fill and stroke (#1746, #1737). Fields commit what was typed when you click away or move to another field, as Enter does; Escape still discards it (#1787). Up and Down move through the command search results and Enter runs the highlighted one (#1798, #1757). Slider rails show on Medium Dark (#1808, #1662). On Windows the custom title bar's window stays truly borderless, so the pointer lines up with what is drawn on systems where the hidden caption offset it (#1791, #1758; awaiting the reporter's confirmation). Tool cursors are painted into the window on Wayland (#1652; not run on Linux, #1645 stays open until confirmed). Roughen with Smooth keeps turn-backs smooth instead of making cusps that draw as spikes (#1646, #1643). Scribble draws one zig-zag per region, with no lines across holes and notches; convex shapes are unchanged (#1651, #1648). EPS import: a stitched shading keeps its hard colour changes (#1654, #1653). WMF/EMF import refuses an oversized embedded PNG or JPEG from its header, before any pixels are decoded (#1776). PDF open no longer takes exponential time on a crafted name tree with shared nodes when it looks for the editing data (#1781). The size limits on a native file's embedded data also apply to files read from memory, not only streamed ones (#1783). Saving over a private file on Unix no longer leaves a readable temporary copy beside it while the file is written (#1778). An Export for Screens suffix can no longer place files outside the export folder (#1777). Package refuses a folder where it would overwrite the open document or one of its linked files (#1786). ruzstd 0.9.1 fixes a decompression bomb (RUSTSEC-2026-0344) reachable from EPS/`.ai` and Affinity import (#1807). File Info dates are stamped only after a save succeeds, so a failed save no longer changes them (#1774). Linked files that change during a drag are updated after the drag instead of being missed (#1773). Scatter graph data near the largest number is refused with a message instead of hanging the app (#1780). One very long Liquify stroke segment can no longer create an unbounded number of dabs (#1779). A drag whose last preview failed is no longer recorded as a committed command in the journal that actions and scripts read (#1775). Tests: text import fuzzing no longer searches installed fonts (#1785). Tests: render tests that add fonts no longer race the frame cache tests (#1795). `text.create`, `text.createInPath` and the MCP `add_text` tool take `justify`, so point type can be centred on or end at its point (#1752, #1748). Control replies are written through a 64 KiB buffer: a 10 MB `document.inspect` reply over loopback on Windows takes 0.25 s instead of 36 s (#1684). MCP limits: 16 MiB lines, 64-message batches, 256-step `command_batch` with 8 MiB of kept results and 256 MiB control replies (#1764, fixes #1727). MCP requires the JSON-RPC 2.0 envelope and matches control replies by id, and an app refusal without an id reports the app's reason (#1768, fixes #1728). The MCP server reconnects to the app before a call when the connection was closed or holds stray bytes, after an app restart or an idle expiry (#1739). Image Trace, measured in `image-trace-quality.md`: snap Curves To Lines moves no end of a line by more than 1.6 px, so long lines a degree or two off stay as the image has them (#1647: Technical Drawing's largest distance 4.21 px to 1.46); flat Logo takes the tones a scan's uneven paper makes of one colour for one colour (#1657: on scans 470 paths and 21 px off to 8.5 paths and 0.09 px). No headline number movLine truncated
+| 2026-10-13 | SVGs that move objects with a CSS transform (`translate(100px, 0)`, `rotate(45deg)`) or style type with the `font` shorthand import as drawn (#1565). SVG symbols whose shapes use percentage lengths import at the size and place they are drawn, the percentages being of the symbol's `viewBox` (#1596). Inkscape's flowed text (`flowRoot`) opens as area type in its rectangle, a paragraph per `flowPara`, instead of being dropped, and a region that can't be read is left out with a warning (#1569, fixes #1568). The warning for an unsupported SVG filter names the filter, its primitives and the object, and says the object is drawn without it (#1599, fixes #1598). The pages of an Inkscape multi-page SVG become artboards, named by their labels (#1603, fixes #1601). SVG export with CSS classes or style entities stays fast in documents with many distinct styles (#1567). PDF and `.ai` import: evenly letter-spaced or tightened type on a path keeps its length along the path instead of closing up to the font's advances (#1586), and type on a path whose stroke is written glyph by glyph comes in as one text object with its stroke, not one object per glyph (#1585). The ICC profiles embedded in JPEG, TIFF and PSD exports have every tag on a 4-byte boundary (ICC.1 §7.1.2), so strict readers accept them (#1589, fixes #1584). GIF, PNG-8 and other indexed exports find each pixel's palette colour through an index instead of a scan, with identical output (#1576). Saving to a network drive on macOS falls back to a plain fsync when the share refuses a full flush (#1625, part of #1620; not confirmed on a real share), and a save still succeeds when a folder refuses the temporary file, the rename over the document or copying permissions: the content is written elsewhere first and copied in, and a failed copy keeps the temporary file and names it (#1649, part of #1620). A document opened by a relative path finds its relatively linked images, and `vectorcraft-cli convert` lists what reading the input left out as `importWarnings` (#1606, fixes #1604). A zero-length subpath draws its round cap as a dot and its projecting cap as a square, so dots in imported `.ai` and SVG files show (#1619, fixes #1613). Pathfinder's Trim, Merge and Crop remove the objects' strokes, and Merge joins same-fill objects whatever their strokes were, as the public Pathfinder page describes (#1572, fixes #1570). Offset Path with an inset larger than the shapes says the offset leaves nothing, instead of asking to select paths (#1591, fixes #1590). The Symbols panel's New Symbol opens Symbol Options to name the symbol first, and Alt-click skips it (#1566, fixes #1560). Tool flyouts are as wide as their longest translated name and shortcut need, so names no longer run into shortcuts in Spanish and other languages (#1650, fixes #1616). Smart Guides: a point drawn with the Pen or a shape tool, and an anchor dragged with Direct Selection, snaps to where paths and ruler guides cross, labelled "intersect" (#1658, part of #1602; a moved selection's own anchors don't). The Transform panel shows a selected ruler guide's X or Y, and typing a value moves it (#1659, part of #1597). This is not established by the documentation we could find: the public help pages on guides, rulers and the Transform, Control and Properties panels (read again on 2026-10-14) describe selecting and dragging unlocked guides and the panels' X and Y for a selection, not a guide's position in a panel, and the one public statement of it is a user's [community answer](https://community.adobe.com/questions-652/adding-a-new-custom-guide-785586), which is not documentation. It is kept as a convenience pending the owner's decision, with no parity claim and nothing counted towards a score. Select Behind (Ctrl/Cmd-click) tests each object once, so a deep stack of overlapping objects no longer slows it; same objects in the same order (#1571). Commands that take `ids` run on the objects given with nothing selected, over MCP, the control channel and the CLI too (#1577, fixes #1575). Zig Zag spaces its ridges evenly along each segment, so lines and curves get a regular wave in Corner and Smooth (#1558). Warp › Arc (the effect and Envelope › Make with Warp) bends in the object's real proportions: a circular arc with concentric edges and no fold-over at 100%, so Arc on art that isn't square draws differently from before (#1581, fixes #1578). `effect.apply` and `effect.setParams` give an error for a misspelt or wrongly typed effect parameter instead of running the effect with its default (#1623, #1592). Area type in a non-rectangular shape moves a word too wide for the top lines down to the first line that holds it instead of breaking it (#1617, fixes #1615). Stylistic sets (ss01–ss20), stylistic and titling alternates, proportional and lining figures, and superscript and subscript glyphs can be turned on as OpenType features of a character style (`text.setStyle {features}`), and the OpenType panel kLine truncated
+| 2026-10-13 | Control sockets close after bounded idle, partial-line and reply-write waits, returning their connection slot (#1726); existing command processing timeout remains separate. |
+| 2026-10-13 | Image Trace: neighbouring colours share one fitted edge (gaps between them 22 to 50 px of area down to under 2), a 16 megapixel photo traces in 0.9 GB (was 3.9), stroked centre lines lie in the middle of their ink at its width (0.30 to 0.05 px off, 18 to 3 anchors a stroke), nearly level lines are levelled, more sharp corners are kept; new: Ignore Color, the Auto Color and Outline presets, and the Shapes, Auto Grouping and Gradients options (off by default) ([`docs/image-trace-quality.md`](docs/image-trace-quality.md)). |
+| 2026-10-13 | The interface is available in Polish (`pl`): menus, panels, dialogs and messages, with one/few/many plurals; AI-drafted, native review pending (#1498). Native documents with a lot of path data (traced or generated art, in layers, symbols or patterns) are saved as compact JSON, about a fifth of the size; small documents stay pretty-printed (#1492). Paste takes a PDF or EPS another app copied as editable vector art: from the macOS pasteboard (with SVG), EPS on Windows beside PDF, and `.eps` files copied in a file manager, with the new command `clipboard.importEps` (#1538, fixes #1499). Opening or placing a file with an image too large to decode says so, and the Links panel shows it on the row (#1540, part of #1479). Import: a multi-artboard `.ai` with notes beside its artboards opens from its editing data, a page's art past its artboard no longer lying over the page before it (#1528); a `.ai` gradient whose stops are listed upwards keeps each midpoint on the stop that starts its part of the ramp (#1530); SVG text on a path follows basic shapes (circle, ellipse, rect, line, polyline, polygon) as their SVG 2 equivalent paths (#1531, fixes #1527); PDFs whose alpha soft masks are drawn as images import with the mask instead of empty art (#1551); EPS and PostScript type set in Type 42 (TrueType) fonts imports at its size instead of 1000 times too large (#1553); PDF and EPS import keep a clipping path whose bounding box covers the page but whose shape doesn't (#1544, fixes #1542). Make Compound Path on a group (such as outlined type) keeps the paint of its backmost path instead of drawing nothing, and compound paths joined into one keep their holes (#1537). Live Corners: a round corner next to a curved side curves smoothly instead of sticking out of the shape, and the Smooth tool smooths only the stretch of path under the drag (#1547, fixes #1512). Join merges the selected anchor points that lie on one another, as after Average, into one anchor (#1582, fixes #1533). Guides: Lock Guides also locks the objects made into guides: they can't be selected, moved or deleted (#1543); they are drawn in the guide colour and style of Preferences, and a dragged selection snaps to ruler guides with Smart Guides on (#1583, fixes #1534). Edit › Keyboard Shortcuts lists Edit › Duplicate and the other commands that are in no menu but run without parameters (panel-menu commands such as Break Link to Symbol), so they can be given shortcuts (#1549, #1580, fixes #1539). Raster effects (blur, shadow, glow, grain) drawn after a pattern, radial or freeform gradient fill export at their place and size (#1541, fixes #1536). Fonts: the font scan on Linux also reads the folders fontconfig's configuration lists, such as TeX fonts under `/usr/share/texmf/fonts` (#1548, fixes #1529; not verified on Linux). |
 | 2026-10-13 | Image Trace's colour presets trace flat art with its own colours however many are asked for (noise no longer shatters it: 16 Colors 70 → 4 paths on the harness's flat art; no slivers of in-between colour along anti-aliased edges), and the photo presets trace a photo into smooth tones without specks or hairlines (High Fidelity Photo 3,653 → 121 paths, colour error 2.30 → 1.75; 16 megapixels traced where 4 were refused) ([`docs/image-trace-quality.md`](docs/image-trace-quality.md)). |
 | 2026-10-13 | Image Trace traces anti-aliased and blurred images to a fraction of a pixel in Black and White, Grayscale and Color, with corners put back, straight edges as lines and round outlines as circles; a harness measures every preset before and after ([`docs/image-trace-quality.md`](docs/image-trace-quality.md)): outlines 0.31 → 0.09 px off on average (Default), 0.27 → 0.06 (Black and White Logo). |
+| 2026-10-13 | Effect › 3D and Materials: the light takes the documented Intensity, Rotation, Height, Softness and Ambient Light (to 200 %) and can shine from behind the object, for every 3D type; effects saved with the earlier direction are lit exactly as before. |
+| 2026-10-13 | Effect › 3D and Materials: Perspective is the documented 0°–160° angle for every 3D type, Revolve included; effects saved with the earlier 0–100 % strength look exactly as before. |
 | 2026-10-13 | Effect › 3D and Materials: Inflate takes Twist, Taper and Cap (Hollow leaves the back open), as the 3D docs list for every type. |
 | 2026-10-12 | Effect › 3D and Materials: Extrude & Bevel (depth, twist, taper, solid or hollow caps, five bevel shapes with repeat, spacing, inside and both sides), Inflate (volume, both sides) and Rotate, with Position presets and the rotation and light gizmos; live, exported as vector faces, expandable (#1407). |
 | 2026-10-12 | `convert --editing-data` (`editingData: "always"`) opens a `.ai` from its editing data even where its page, which can be older, draws differently, with a note. |
@@ -155,6 +165,10 @@ The full pre-standard record of what landed is kept in [docs/roadmap.md](docs/ro
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-13 | minor | Pinned PngSuite HTTPS files verified by SHA-256 before publication; bounded downloads replace archive extraction (#1729). Scores and hours unchanged. |
+| 2026-10-13 | minor | Bounded synthetic control input (#1709): counts and queued events validated before mutation; control-channel bursts yield between frames. Scores and hours unchanged. |
+| 2026-10-14 | minor | Progress log row for the merges of 2026-10-14 (#1641–#1808 as listed there) and Image Trace's #1647 and #1657; the 2026-10-13 row now says that a guide's position in the Transform panel (#1659) is not established by the documentation found and is kept as a convenience pending the owner's decision; headline numbers unchanged. |
+| 2026-10-13 | minor | Control transport deadlines (#1726): idle and partial clients and blocked replies release connection slots; parity scores and estimates unchanged. |
 | 2026-10-10 | minor | Method aligned with the standard, no new evidence: full ready for real work is the additive weighted sum, ~62%; hours per audience; beta ~13 points away |
 | 2026-10-10 | minor | Added the essentials-user readiness score (~75%) |
 | 2026-10-10 | minor | Ready for real work re-examined against the issue tracker and user feedback: 50% → 55% (full), 65% mainstream added; see target-app-parity.md |

apps/vectorcraft-cli/src/main.rs

@@ -93,7 +93,8 @@ USAGE:
       precision (1–7, default 3). OUT may not be IN when reading
       IN left things out (hidden text, art or layers it could not read; the notes say which) unless
       --replace-lossy is given. --editing-data opens a .ai from its editing copy even where that
-      draws differently from its PDF part (which can be older), as long as it can be read.
+      draws differently from its PDF part (which can be older), as long as it can be read. The
+      result has the export's warnings, and importWarnings for what reading IN left out.
 
   vectorcraft-cli info FILE
       Print a JSON summary: the import warnings (what didn't come in as it was, such as an EPS
@@ -237,19 +238,24 @@ fn convert(args: &[String]) -> Result<(), String> {
     }
     let [input, output] = <[String; 2]>::try_from(files).map_err(|_| "convert needs IN and OUT")?;
     let mut h = Headless::new();
-    if editing_data {
+    let opened = if editing_data {
         let params = json!({"path": input, "editingData": "always"});
-        h.call("engine.execute", json!({"command": "document.open", "params": params})).map_err(|e| format!("open {input}: {e}"))?;
+        h.call("engine.execute", json!({"command": "document.open", "params": params})).map_err(|e| format!("open {input}: {e}"))?
     } else {
-        h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?;
-    }
+        h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?
+    };
     // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
     // PSD).
     let mut params = json!({"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
     if let Some(decimals) = decimals {
         params["decimals"] = json!(decimals);
     }
-    let r = h.call("engine.execute", json!({"command": "document.export", "params": params})).map_err(|e| format!("export {output}: {e}"))?;
+    let mut r = h.call("engine.execute", json!({"command": "document.export", "params": params})).map_err(|e| format!("export {output}: {e}"))?;
+    // What reading the input left out (a missing linked file, an unsupported filter…) matters as
+    // much as what writing the output did.
+    if let (Some(w), Some(out)) = (opened.get("warnings").filter(|w| w.as_array().is_some_and(|a| !a.is_empty())), r.as_object_mut()) {
+        out.insert("importWarnings".into(), w.clone());
+    }
     outln!("{r}");
     Ok(())
 }

apps/vectorcraft-cli/tests/fileio.rs

@@ -99,3 +99,19 @@ fn info_reports_why_an_eps_read_partly() {
     assert!(w.contains("`frobnicate`"), "{v}");
     assert_eq!(v["kinds"]["Path"], 1, "{v}");
 }
+
+/// #1604: convert reports what reading the input left out (here a missing linked image) as
+/// importWarnings, next to the export's own warnings.
+#[test]
+fn convert_reports_import_warnings() {
+    let svg = tmp("missing-link.svg");
+    std::fs::write(
+        &svg,
+        r#"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="40"><image width="40" height="40" href="nowhere-to-be-found.png"/></svg>"#,
+    )
+    .unwrap();
+    let png = tmp("missing-link.png");
+    let out: Value = serde_json::from_str(ok(&["convert", &svg, &png]).trim()).unwrap();
+    let w = out["importWarnings"].as_array().unwrap_or_else(|| panic!("{out}"));
+    assert!(w.iter().any(|w| w.as_str().unwrap().contains("nowhere-to-be-found.png")), "{out}");
+}

apps/vectorcraft/Cargo.toml

@@ -80,3 +80,7 @@ wayland-protocols = { version = "0.32", features = ["client"] }
 [build-dependencies]
 # Icon + VERSIONINFO for vectorcraft.exe; build.rs only uses it when targeting Windows.
 winresource = "0.1"
+
+[dev-dependencies]
+# Bound socket buffers in real loopback transport deadline regressions.
+socket2 = { workspace = true }

apps/vectorcraft/src/control_deadlines.rs

@@ -0,0 +1,85 @@
+//! Absolute transport budgets, independent of the time spent executing a request.
+
+use std::io::{self, Read, Write};
+use std::net::TcpStream;
+use std::time::{Duration, Instant};
+
+fn deadline(budget: Duration) -> io::Result<Instant> {
+    Instant::now().checked_add(budget).ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "control transport deadline out of range"))
+}
+
+fn remaining(until: Option<Instant>) -> io::Result<Duration> {
+    until
+        .and_then(|d| d.checked_duration_since(Instant::now()))
+        .filter(|d| !d.is_zero())
+        .ok_or_else(|| io::Error::new(io::ErrorKind::TimedOut, "control transport deadline exceeded"))
+}
+
+pub(super) struct DeadlineReader {
+    stream: TcpStream,
+    idle: Duration,
+    line: Duration,
+    until: Option<Instant>,
+    waiting_for_first_byte: bool,
+}
+
+impl DeadlineReader {
+    pub(super) fn new(stream: TcpStream, idle: Duration, line: Duration) -> Self {
+        Self { stream, idle, line, until: None, waiting_for_first_byte: false }
+    }
+
+    pub(super) fn begin_line(&mut self, buffered: bool) -> io::Result<()> {
+        // A partial next request already in BufReader must not get an idle budget too.
+        self.waiting_for_first_byte = !buffered;
+        self.until = Some(deadline(if buffered { self.line } else { self.idle })?);
+        Ok(())
+    }
+}
+
+impl Read for DeadlineReader {
+    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        if buf.is_empty() {
+            return Ok(0);
+        }
+        self.stream.set_read_timeout(Some(remaining(self.until)?))?;
+        let n = self.stream.read(buf)?;
+        if n > 0 && self.waiting_for_first_byte {
+            self.until = Some(deadline(self.line)?);
+            self.waiting_for_first_byte = false;
+        }
+        Ok(n)
+    }
+}
+
+pub(super) struct DeadlineWriter {
+    stream: TcpStream,
+    budget: Duration,
+    until: Option<Instant>,
+}
+
+impl DeadlineWriter {
+    pub(super) fn new(stream: TcpStream, budget: Duration) -> Self {
+        Self { stream, budget, until: None }
+    }
+
+    pub(super) fn begin_reply(&mut self) -> io::Result<()> {
+        self.until = Some(deadline(self.budget)?);
+        Ok(())
+    }
+}
+
+impl Write for DeadlineWriter {
+    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+        if buf.is_empty() {
+            return Ok(0);
+        }
+        // Each partial write gets the remaining budget, never a fresh full timeout.
+        self.stream.set_write_timeout(Some(remaining(self.until)?))?;
+        self.stream.write(buf)
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        self.stream.set_write_timeout(Some(remaining(self.until)?))?;
+        self.stream.flush()
+    }
+}

apps/vectorcraft/src/control_server.rs

@@ -7,7 +7,7 @@
 //! bounded ([`MAX_LINE`]) and so is the number of open connections ([`MAX_CONNECTIONS`]); junk
 //! never reaches the UI thread. See `docs/control-protocol.md`.
 
-use std::io::{BufRead, BufReader, Read, Write};
+use std::io::{BufRead, BufReader, BufWriter, Read, Write};
 use std::net::{TcpListener, TcpStream};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
@@ -17,11 +17,30 @@ use std::time::Duration;
 use serde_json::{Value, json};
 use vectorcraft_ui_egui::ControlRequest;
 
+#[path = "control_deadlines.rs"]
+mod deadlines;
+use deadlines::{DeadlineReader, DeadlineWriter};
+
 /// Longest accepted request line (bytes, without the newline). Requests are small JSON objects;
 /// anything longer is refused and the connection closed.
 pub const MAX_LINE: usize = 4 * 1024 * 1024;
 /// Connections served at once; further ones get an error line and are closed.
 pub const MAX_CONNECTIONS: usize = 16;
+/// Size in bytes of the buffer that [`write_line`] writes a reply line through.
+const REPLY_CHUNK: usize = 64 * 1024;
+
+#[derive(Clone, Copy)]
+struct ConnectionTimeouts {
+    idle: Duration,
+    line: Duration,
+    write: Duration,
+}
+
+impl Default for ConnectionTimeouts {
+    fn default() -> Self {
+        Self { idle: Duration::from_secs(300), line: Duration::from_secs(30), write: Duration::from_secs(60) }
+    }
+}
 
 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     let (tx, rx) = channel::<ControlRequest>();
@@ -39,31 +58,77 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
 
 fn accept_loop(listener: TcpListener, tx: Sender<ControlRequest>, ctx: egui::Context) {
     let open = Arc::new(AtomicUsize::new(0));
-    for mut stream in listener.incoming().flatten() {
-        if open.fetch_add(1, Ordering::SeqCst) >= MAX_CONNECTIONS {
-            open.fetch_sub(1, Ordering::SeqCst);
+    for stream in listener.incoming().flatten() {
+        let Some(slot) = acquire_slot(&open) else {
+            let mut out = DeadlineWriter::new(stream, ConnectionTimeouts::default().write);
             // Best effort: the connection is dropped either way, and a peer that can't read the reason loses nothing.
-            let _ = writeln!(stream, "{}", json!({"ok": false, "error": "too many control connections"}));
+            if out.begin_reply().is_ok() {
+                let _ = write_line(&mut out, &json!({"ok": false, "error": "too many control connections"}));
+            }
             continue;
+        };
+        if let Err(e) = spawn_connection(stream, tx.clone(), ctx.clone(), slot, ConnectionTimeouts::default()) {
+            eprintln!("vectorcraft: control worker failed to start: {e}");
         }
-        let tx = tx.clone();
-        let ctx = ctx.clone();
-        let open = Arc::clone(&open);
-        std::thread::spawn(move || {
-            serve(stream, &tx, &ctx);
-            open.fetch_sub(1, Ordering::SeqCst);
-        });
     }
 }
 
-fn serve(stream: TcpStream, tx: &Sender<ControlRequest>, ctx: &egui::Context) {
+struct ConnectionSlot(Arc<AtomicUsize>);
+
+fn acquire_slot(open: &Arc<AtomicUsize>) -> Option<ConnectionSlot> {
+    let mut n = open.load(Ordering::SeqCst);
+    loop {
+        if n >= MAX_CONNECTIONS {
+            return None;
+        }
+        match open.compare_exchange_weak(n, n + 1, Ordering::SeqCst, Ordering::SeqCst) {
+            Ok(_) => return Some(ConnectionSlot(Arc::clone(open))),
+            Err(current) => n = current,
+        }
+    }
+}
+
+impl Drop for ConnectionSlot {
+    fn drop(&mut self) {
+        // Each successful acquisition creates exactly one non-cloneable guard.
+        self.0.fetch_sub(1, Ordering::SeqCst);
+    }
+}
+
+fn spawn_connection(
+    stream: TcpStream,
+    tx: Sender<ControlRequest>,
+    ctx: egui::Context,
+    slot: ConnectionSlot,
+    timeouts: ConnectionTimeouts,
+) -> std::io::Result<std::thread::JoinHandle<()>> {
+    std::thread::Builder::new().name("vectorcraft-control".into()).spawn(move || {
+        let _slot = slot;
+        serve_socket(stream, timeouts, |method, params| {
+            let (req, rrx) = ControlRequest::new(method, params);
+            tx.send(req).ok()?;
+            ctx.request_repaint();
+            Some(rrx.recv_timeout(Duration::from_secs(60)).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"})))
+        });
+    })
+}
+
+fn serve_socket(stream: TcpStream, timeouts: ConnectionTimeouts, handle: impl FnMut(String, Value) -> Option<Value>) {
     let Ok(read) = stream.try_clone() else { return };
-    serve_lines(read, stream, |method, params| {
-        let (req, rrx) = ControlRequest::new(method, params);
-        tx.send(req).ok()?;
-        ctx.request_repaint();
-        Some(rrx.recv_timeout(Duration::from_secs(60)).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"})))
-    });
+    let read = DeadlineReader::new(read, timeouts.idle, timeouts.line);
+    // Replies reach the writer in [`REPLY_CHUNK`] pieces ([`write_line`]), so checking the remaining
+    // budget costs one socket option call per piece, not one per JSON token.
+    let out = DeadlineWriter::new(stream, timeouts.write);
+    serve_lines_with(
+        read,
+        out,
+        handle,
+        |reader| {
+            let buffered = !reader.buffer().is_empty();
+            reader.get_mut().begin_line(buffered)
+        },
+        DeadlineWriter::begin_reply,
+    );
 }
 
 /// One parsed line.
@@ -109,7 +174,11 @@ fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize) -
     buf.clear();
     // `take` bounds the bytes buffered for one line: a peer can't make us allocate more than `max`.
     let limit = u64::try_from(max).unwrap_or(u64::MAX).saturating_add(1);
-    let n = reader.take(limit).read_until(b'\n', buf).map_err(|e| e.to_string())?;
+    let n = reader.take(limit).read_until(b'\n', buf).map_err(|e| match e.kind() {
+        // The line's deadline ran out (Windows reports it as TimedOut, Unix as WouldBlock).
+        std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock => "request line not completed in time; closing the connection".to_string(),
+        _ => e.to_string(),
+    })?;
     if n == 0 {
         return Ok(false);
     }
@@ -127,15 +196,39 @@ fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize) -
     Ok(true)
 }
 
+/// Write `v` and a newline to `out` through a buffer of [`REPLY_CHUNK`] bytes, then flush `out`.
+fn write_line(out: &mut impl Write, v: &Value) -> std::io::Result<()> {
+    let mut out = BufWriter::with_capacity(REPLY_CHUNK, out);
+    writeln!(out, "{v}")?;
+    out.flush()
+}
+
 /// Serve requests from `read`, answering on `out`, until the peer closes, sends something that is
 /// not a request, or `handle` returns `None` (app gone). `handle` gets `(method, params)` and
 /// returns the reply object (the request's `id` is added here).
-fn serve_lines<R: Read, W: Write>(read: R, mut out: W, mut handle: impl FnMut(String, Value) -> Option<Value>) {
+#[cfg(test)]
+fn serve_lines<R: Read, W: Write>(read: R, out: W, handle: impl FnMut(String, Value) -> Option<Value>) {
+    serve_lines_with(read, out, handle, |_| Ok(()), |_| Ok(()));
+}
+
+fn serve_lines_with<R: Read, W: Write>(
+    read: R,
+    mut out: W,
+    mut handle: impl FnMut(String, Value) -> Option<Value>,
+    mut begin_line: impl FnMut(&mut BufReader<R>) -> std::io::Result<()>,
+    mut begin_reply: impl FnMut(&mut W) -> std::io::Result<()>,
+) {
     let mut reader = BufReader::new(read);
     let mut buf = Vec::new();
     loop {
+        if begin_line(&mut reader).is_err() {
+            return;
+        }
         let reject = match read_bounded_line(&mut reader, &mut buf, MAX_LINE) {
             Ok(false) => return,
+            // Nothing of a line arrived (the idle wait ran out, or the peer is gone): close without
+            // a word. A line nobody asked for would be read as the reply to the client's next request.
+            Err(_) if buf.is_empty() => return,
             Err(e) => e,
             Ok(true) => match parse_line(&buf) {
                 Line::Blank => continue,
@@ -145,7 +238,7 @@ fn serve_lines<R: Read, W: Write>(read: R, mut out: W, mut handle: impl FnMut(St
                     if let Some(o) = r.as_object_mut() {
                         o.insert("id".into(), id);
                     }
-                    if writeln!(out, "{r}").and_then(|()| out.flush()).is_err() {
+                    if begin_reply(&mut out).and_then(|()| write_line(&mut out, &r)).is_err() {
                         return;
                     }
                     continue;
@@ -153,7 +246,7 @@ fn serve_lines<R: Read, W: Write>(read: R, mut out: W, mut handle: impl FnMut(St
             },
         };
         // Best effort: the connection closes either way, and a peer that can't read the reason loses nothing.
-        let _ = writeln!(out, "{}", json!({"ok": false, "error": reject})).and_then(|()| out.flush());
+        let _ = begin_reply(&mut out).and_then(|()| write_line(&mut out, &json!({"ok": false, "error": reject})));
         return;
     }
 }
@@ -162,6 +255,164 @@ fn serve_lines<R: Read, W: Write>(read: R, mut out: W, mut handle: impl FnMut(St
 mod tests {
     use super::*;
 
+    fn short_timeouts() -> ConnectionTimeouts {
+        ConnectionTimeouts { idle: Duration::from_millis(150), line: Duration::from_millis(120), write: Duration::from_millis(150) }
+    }
+
+    fn socket_fixture(
+        timeouts: ConnectionTimeouts,
+        handle: impl FnMut(String, Value) -> Option<Value> + Send + 'static,
+    ) -> (TcpStream, Receiver<()>, std::thread::JoinHandle<()>) {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (finished, done) = channel();
+        let worker = std::thread::spawn(move || {
+            let (stream, _) = listener.accept().unwrap();
+            socket2::SockRef::from(&stream).set_send_buffer_size(4096).unwrap();
+            serve_socket(stream, timeouts, handle);
+            finished.send(()).unwrap();
+        });
+        let client = TcpStream::connect(addr).unwrap();
+        socket2::SockRef::from(&client).set_recv_buffer_size(4096).unwrap();
+        client.set_read_timeout(Some(Duration::from_secs(3))).unwrap();
+        (client, done, worker)
+    }
+
+    fn expect_socket_deadline(client: TcpStream, done: Receiver<()>, worker: std::thread::JoinHandle<()>) {
+        let stopped = done.recv_timeout(Duration::from_secs(3)).is_ok();
+        // Always unblock the old implementation too, so a failed regression leaves no worker behind.
+        let _ = client.shutdown(std::net::Shutdown::Both);
+        drop(client);
+        worker.join().unwrap();
+        assert!(stopped, "the server retained a stalled connection beyond its transport deadline");
+    }
+
+    #[test]
+    fn idle_control_socket_releases_its_worker() {
+        let (client, done, worker) = socket_fixture(short_timeouts(), |_, _| panic!("no request expected"));
+        expect_socket_deadline(client, done, worker);
+    }
+
+    /// An idle connection is closed without a line: a client that sends its next request late
+    /// must not find an error waiting where its reply should be.
+    #[test]
+    fn idle_expiry_closes_without_writing_a_line() {
+        let (mut client, done, worker) = socket_fixture(short_timeouts(), |_, _| panic!("no request expected"));
+        let mut got = Vec::new();
+        client.read_to_end(&mut got).unwrap();
+        assert_eq!(String::from_utf8_lossy(&got), "", "the app wrote to an idle connection");
+        expect_socket_deadline(client, done, worker);
+    }
+
+    /// A line that stalls is refused in words a client's author can act on, not the system's.
+    #[test]
+    fn stalled_control_line_is_refused_with_the_reason() {
+        let (mut client, done, worker) = socket_fixture(short_timeouts(), |_, _| panic!("incomplete requests must not execute"));
+        client.write_all(b"{\"method\":").unwrap();
+        let mut line = String::new();
+        BufReader::new(client.try_clone().unwrap()).read_line(&mut line).unwrap();
+        assert_eq!(
+            serde_json::from_str::<Value>(&line).unwrap(),
+            json!({"ok": false, "error": "request line not completed in time; closing the connection"})
+        );
+        expect_socket_deadline(client, done, worker);
+    }
+
+    #[test]
+    fn partial_control_line_releases_its_worker() {
+        let (mut client, done, worker) = socket_fixture(short_timeouts(), |_, _| panic!("incomplete requests must not execute"));
+        client.write_all(b"{\"method\":").unwrap();
+        expect_socket_deadline(client, done, worker);
+    }
+
+    #[test]
+    fn trickled_control_line_has_an_absolute_deadline() {
+        let (mut client, done, worker) = socket_fixture(short_timeouts(), |_, _| panic!("incomplete requests must not execute"));
+        client.write_all(b"{").unwrap();
+        let mut writer = client.try_clone().unwrap();
+        let stop = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let writing = Arc::clone(&stop);
+        let trickle = std::thread::spawn(move || {
+            while !writing.load(Ordering::SeqCst) {
+                if writer.write_all(b" ").is_err() {
+                    break;
+                }
+                std::thread::sleep(Duration::from_millis(20));
+            }
+        });
+        let stopped = done.recv_timeout(Duration::from_secs(3)).is_ok();
+        stop.store(true, Ordering::SeqCst);
+        // Both socket copies belong to this fixture; shutdown cleans up the baseline failure as well.
+        let _ = client.shutdown(std::net::Shutdown::Both);
+        trickle.join().unwrap();
+        worker.join().unwrap();
+        assert!(stopped, "trickled bytes restarted the line's deadline");
+    }
+
+    #[test]
+    fn a_nonreading_control_peer_cannot_retain_the_writer() {
+        let payload = "x".repeat(2 * 1024 * 1024);
+        let (mut client, done, worker) = socket_fixture(short_timeouts(), move |_, _| Some(json!({"ok": true, "result": payload})));
+        client.write_all(b"{\"method\":\"large\"}\n").unwrap();
+        expect_socket_deadline(client, done, worker);
+    }
+
+    #[test]
+    fn persistent_control_requests_get_fresh_transport_deadlines() {
+        let timeouts = ConnectionTimeouts { idle: Duration::from_secs(2), ..short_timeouts() };
+        let (mut client, done, worker) = socket_fixture(timeouts, |_, _| {
+            // Application processing is not transport time; begin the reply budget afterwards.
+            std::thread::sleep(Duration::from_millis(200));
+            Some(json!({"ok": true}))
+        });
+        let mut reader = BufReader::new(client.try_clone().unwrap());
+        for id in [1, 2] {
+            writeln!(client, "{}", json!({"id": id, "method": "inspect"})).unwrap();
+            let mut line = String::new();
+            reader.read_line(&mut line).unwrap();
+            assert_eq!(serde_json::from_str::<Value>(&line).unwrap(), json!({"id": id, "ok": true}));
+        }
+        client.shutdown(std::net::Shutdown::Write).unwrap();
+        done.recv_timeout(Duration::from_secs(3)).unwrap();
+        worker.join().unwrap();
+    }
+
+    #[test]
+    fn buffered_partial_control_line_also_expires() {
+        let (mut client, done, worker) = socket_fixture(short_timeouts(), |_, _| Some(json!({"ok": true})));
+        client.write_all(b"{\"id\":1,\"method\":\"inspect\"}\n{").unwrap();
+        let mut line = String::new();
+        BufReader::new(client.try_clone().unwrap()).read_line(&mut line).unwrap();
+        assert_eq!(serde_json::from_str::<Value>(&line).unwrap()["id"], 1);
+        expect_socket_deadline(client, done, worker);
+    }
+
+    #[test]
+    fn timed_out_worker_returns_its_connection_slot() {
+        let open = Arc::new(AtomicUsize::new(0));
+        let held: Vec<_> = (0..MAX_CONNECTIONS - 1).map(|_| acquire_slot(&open).unwrap()).collect();
+        let slot = acquire_slot(&open).unwrap();
+        assert!(acquire_slot(&open).is_none());
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let client = TcpStream::connect(listener.local_addr().unwrap()).unwrap();
+        let (stream, _) = listener.accept().unwrap();
+        let (tx, _rx) = channel();
+        let worker = spawn_connection(stream, tx, egui::Context::default(), slot, short_timeouts()).unwrap();
+        let start = std::time::Instant::now();
+        while open.load(Ordering::SeqCst) == MAX_CONNECTIONS && start.elapsed() < Duration::from_secs(3) {
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        let released = open.load(Ordering::SeqCst) < MAX_CONNECTIONS;
+        // Clean up an old implementation that never returned its slot as well.
+        let _ = client.shutdown(std::net::Shutdown::Both);
+        worker.join().unwrap();
+        assert!(released, "the deadline did not free capacity for the next client");
+        let replacement = acquire_slot(&open).expect("a new client can reserve the freed slot");
+        drop(replacement);
+        drop(held);
+        assert_eq!(open.load(Ordering::SeqCst), 0);
+    }
+
     fn run(input: &[u8]) -> (Vec<Value>, Vec<String>) {
         let mut out = Vec::new();
         let mut calls = Vec::new();
@@ -173,6 +424,37 @@ mod tests {
         (replies, calls)
     }
 
+    /// Counts the `write` calls made on it and keeps the bytes they write.
+    #[derive(Default)]
+    struct Writes {
+        calls: usize,
+        bytes: Vec<u8>,
+    }
+
+    impl Write for Writes {
+        fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+            self.calls += 1;
+            self.bytes.extend_from_slice(buf);
+            Ok(buf.len())
+        }
+
+        fn flush(&mut self) -> std::io::Result<()> {
+            Ok(())
+        }
+    }
+
+    /// A reply shaped like `document.inspect`'s for a layer of `n` squares in rows of 200.
+    fn inspect_reply(n: u64) -> Value {
+        let paths: Vec<Value> = (0..n)
+            .map(|k| {
+                let (x, y) = ((k % 200) as f64 * 20.0, (k / 200) as f64 * 20.0);
+                json!({"anchors": 4, "bounds": {"height": 10.0, "width": 10.0, "x": x, "y": y}, "closed": true, "fill": "#f4a261",
+                    "id": k + 2, "kind": "Path", "locked": false, "name": "<Path>", "stroke": "None", "strokeWidth": 0.0, "visible": true})
+            })
+            .collect();
+        json!({"ok": true, "result": {"layers": [{"children": paths, "id": 1, "kind": "Layer", "name": "Layer 1"}]}})
+    }
+
     #[test]
     fn requests_are_answered_in_order_with_ids() {
         let (r, calls) = run(b"{\"id\":1,\"method\":\"a\"}\n\n{\"id\":2,\"method\":\"b\",\"params\":{}}\r\n{\"method\":\"c\"}");
@@ -183,6 +465,25 @@ mod tests {
         assert_eq!(r[2]["id"], Value::Null);
     }
 
+    #[test]
+    fn replies_are_written_in_few_large_writes() {
+        for reply in [json!({"ok": true, "result": null}), inspect_reply(2_000)] {
+            let mut out = Writes::default();
+            let mut once = Some(reply.clone());
+            serve_lines(&b"{\"id\":1,\"method\":\"document.inspect\"}\n"[..], &mut out, |_, _| once.take());
+            let mut want = reply;
+            want["id"] = json!(1);
+            let text = String::from_utf8(out.bytes).unwrap();
+            // The writer receives the bytes that `writeln!(out, "{want}")` writes, in at most one write per 4 KiB.
+            assert_eq!(text, format!("{want}\n"));
+            assert!(out.calls <= text.len().div_ceil(4096), "{} writes for {} bytes", out.calls, text.len());
+        }
+        // A refusal is one write as well.
+        let mut out = Writes::default();
+        serve_lines(&b"hello\n"[..], &mut out, |_, _| None);
+        assert_eq!(out.calls, 1);
+    }
+
     #[test]
     fn http_request_closes_before_the_body_runs() {
         // A browser's cross-origin `fetch` POST: the request line is rejected and the
@@ -263,6 +564,37 @@ mod tests {
         assert!(lines[1].contains("closing the connection"));
     }
 
+    #[test]
+    fn ten_inspect_replies_for_10000_objects_arrive_within_20_s() {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let addr = listener.local_addr().unwrap();
+        let reply = inspect_reply(10_000);
+        let mut want = reply.clone();
+        want["id"] = json!(1);
+        let want = format!("{want}\n");
+        std::thread::spawn(move || {
+            let (s, _) = listener.accept().unwrap();
+            let read = s.try_clone().unwrap();
+            serve_lines(read, s, |_, _| Some(reply.clone()));
+        });
+        // The client sends each request line and reads its reply line through a `BufReader`, as `vectorcraft_mcp::Remote` does.
+        let (tx, rx) = channel();
+        std::thread::spawn(move || {
+            let mut c = TcpStream::connect(addr).unwrap();
+            let mut read = BufReader::new(c.try_clone().unwrap());
+            let mut lines = vec![];
+            for _ in 0..10 {
+                c.write_all(b"{\"id\":1,\"method\":\"document.inspect\"}\n").unwrap();
+                let mut line = String::new();
+                read.read_line(&mut line).unwrap();
+                lines.push(line);
+            }
+            tx.send(lines).ok();
+        });
+        let lines = rx.recv_timeout(Duration::from_secs(20)).unwrap_or_else(|_| panic!("ten replies did not arrive within 20 s"));
+        assert!(lines.iter().all(|l| *l == want), "a reply differs from the bytes `writeln!` writes");
+    }
+
     #[test]
     fn extra_connections_are_refused() {
         let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();

apps/vectorcraft/src/main.rs

@@ -45,6 +45,7 @@ mod printing;
 #[cfg(all(windows, not(target_vendor = "win7")))]
 mod system_fonts;
 mod window;
+mod window_frame;
 mod xwayland;
 
 use vectorcraft_engine::Session;
@@ -62,6 +63,8 @@ struct App {
     graphics_lost: bool,
     /// Frames the UI has run (see [`end_before_teardown`]).
     frames: u64,
+    /// Keeps the custom title bar's window borderless (Windows, #1758).
+    window_frame: Option<window_frame::WindowFrameFn>,
 }
 
 impl eframe::App for App {
@@ -72,6 +75,11 @@ impl eframe::App for App {
         file_access::unconfined(|| self.logic_frame(ctx, frame));
     }
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
+        // winit gives the window its caption back when it changes the window's flags (maximize,
+        // restore, …): take it off again before the frame is laid out (#1758).
+        if let Some(window_frame) = self.window_frame.as_mut() {
+            window_frame();
+        }
         #[cfg(target_os = "macos")]
         if self.app.services.native_menu.is_some() {
             mac_menu::raw_input_hook(raw);
@@ -489,6 +497,8 @@ fn start_pick(request: PickRequest, parent: &Parent, ui: &egui::Context) -> Opti
 
 /// The host's services; `ui` is woken when a file dialog answers.
 fn services(parent: Parent, ui: egui::Context) -> Services {
+    use winit::raw_window_handle::{HasWindowHandle as _, RawWindowHandle};
+    let wayland = parent.as_ref().and_then(|w| w.window_handle().ok()).is_some_and(|h| matches!(h.as_raw(), RawWindowHandle::Wayland(_)));
     let (p1, p2, p3, p4, p5) = (parent.clone(), parent.clone(), parent.clone(), parent.clone(), parent);
     Services {
         pick_open: Some(Box::new(move |pick: &FilePick| pick_now(PickRequest::Open(pick.clone()), &p1).into_iter().next())),
@@ -498,6 +508,7 @@ fn services(parent: Parent, ui: egui::Context) -> Services {
         // dialogs run the window's events while they are open.
         start_pick: cfg!(unix).then(|| Box::new(move |request: PickRequest| start_pick(request, &p5, &ui)) as vectorcraft_ui_egui::picks::StartPick),
         dialogs_are_sheets: cfg!(target_os = "macos"),
+        wayland,
         read: Some(Box::new(|p: &str| std::fs::read(p).map_err(|e| e.to_string()))),
         write: Some(Box::new(write_file)),
         // Background Save and Export write from a worker thread.
@@ -855,7 +866,9 @@ fn main() -> std::process::ExitCode {
                 // The first frame is due from now (`gpu::watch_first_frame`).
                 #[cfg(feature = "wgpu")]
                 created.ready();
-                Ok(Box::new(App { app, graphics_loss, graphics_lost: false, frames: 0 }))
+                // The content and the pointer stay aligned on Windows (#1758).
+                let window_frame = window_frame::service(cc, custom_titlebar);
+                Ok(Box::new(App { app, graphics_loss, graphics_lost: false, frames: 0, window_frame }))
             }),
         )
     });

apps/vectorcraft/src/window_frame.rs

@@ -0,0 +1,75 @@
+//! Keeps the custom title bar's undecorated window truly borderless on Windows (#1758).
+//!
+//! winit 0.30 gives an undecorated window the `WS_CAPTION | WS_BORDER` styles and hides the
+//! non-client area by spreading the client rect over it (`WM_NCCALCSIZE`). On some systems the
+//! desktop compositor still reserves that frame for the window surface: the content is drawn
+//! offset by the caption and border while the pointer keeps the un-offset client coordinates, so
+//! it no longer points at what is drawn under it (rust-windowing/winit#2419; PhotoCraft fixed the
+//! same in storytold/photocraft#2401). [`service`] strips the two styles and has Windows
+//! recalculate the frame; winit puts them back whenever it changes the window flags (maximize,
+//! restore, …), so the returned guard runs every frame.
+
+/// Run once per frame; a no-op once the window is borderless.
+pub type WindowFrameFn = Box<dyn FnMut()>;
+
+pub use platform::service;
+
+#[cfg(all(windows, feature = "wgpu"))]
+mod platform {
+    use eframe::wgpu::rwh::{HasWindowHandle, RawWindowHandle};
+    use winsafe::{HWND, HwndPlace, POINT, SIZE, co};
+
+    /// A guard that keeps the window borderless each frame, or `None` with the system title bar
+    /// (the window is decorated) or when its handle can't be found.
+    pub fn service(cc: &eframe::CreationContext<'_>, custom_titlebar: bool) -> Option<super::WindowFrameFn> {
+        if !custom_titlebar {
+            return None;
+        }
+        let target = match cc.window_handle().ok()?.as_raw() {
+            RawWindowHandle::Win32(h) => h.hwnd.get(),
+            _ => return None,
+        };
+        let hwnd = find_window(target)?;
+        strip(&hwnd);
+        Some(Box::new(move || strip(&hwnd)))
+    }
+
+    /// The top-level window with the given raw handle: `EnumWindows` hands out real `HWND`s, so
+    /// this needs no `unsafe` to wrap a raw one.
+    fn find_window(target: isize) -> Option<HWND> {
+        let mut found = None;
+        let _ = winsafe::EnumWindows(|hwnd| {
+            if hwnd.ptr() as isize == target {
+                found = Some(hwnd);
+                false
+            } else {
+                true
+            }
+        });
+        found
+    }
+
+    /// Removes `WS_CAPTION` (which includes `WS_BORDER`) and has Windows recalculate the frame;
+    /// the sizing border stays, so edge resizing and snapping keep working.
+    fn strip(hwnd: &HWND) {
+        let style = hwnd.style();
+        let without = style & !(co::WS::CAPTION | co::WS::BORDER);
+        if without.raw() == style.raw() {
+            return;
+        }
+        hwnd.set_style(without);
+        let _ = hwnd.SetWindowPos(
+            HwndPlace::None,
+            POINT::new(),
+            SIZE::new(),
+            co::SWP::FRAMECHANGED | co::SWP::NOMOVE | co::SWP::NOSIZE | co::SWP::NOZORDER | co::SWP::NOACTIVATE,
+        );
+    }
+}
+
+#[cfg(not(all(windows, feature = "wgpu")))]
+mod platform {
+    pub fn service(_cc: &eframe::CreationContext<'_>, _custom_titlebar: bool) -> Option<super::WindowFrameFn> {
+        None
+    }
+}

contributors/people.toml

@@ -93,3 +93,8 @@ sync_github_name = true
 [people.switch87]
 real_name = "Gert Pellin"
 sync_github_name = false
+
+[people.lewandowskit]
+real_name = "Tomasz Lewandowski"
+display_name = "Tomasz Lewandowski"
+sync_github_name = false

crates/affinity/Cargo.toml

@@ -17,7 +17,7 @@ synth = []
 crc32fast = { workspace = true }
 flate2 = { workspace = true }
 image = { workspace = true }
-ruzstd = "0.9"
+ruzstd = "0.9.1"
 
 [dev-dependencies]
 proptest = { workspace = true }

crates/cad/src/import.rs

@@ -214,6 +214,7 @@ pub fn import(bytes: &[u8], o: &ImportOptions) -> Result<Imported, String> {
     let (mut document, mut warnings) = build::Build::new(&d, o).run(layout, natural, ratio)?;
     document.units = if o.fit { unit } else { o.unit.unwrap_or(unit) };
     warnings.extend(damaged);
+    document.limit_depth_noting(&mut warnings);
     Ok(Imported { document, warnings })
 }
 

crates/cad/src/import/tests.rs

@@ -651,6 +651,27 @@ fn inserts_become_symbol_instances_with_their_transform() {
     assert_eq!(stroke_rgb(art), [255, 0, 0, 255], "the block's own colour");
 }
 
+#[test]
+fn an_insert_is_measured_clicked_and_marqueed_by_its_blocks_art() {
+    let inserts = [(0, "INSERT"), (8, "Doors"), (2, "Door"), (10, "100"), (20, "50"), (41, "2"), (42, "3"), (50, "90")];
+    let doc = open(&with_door(DOOR_LINE, &inserts), &points()).document;
+    let [inst] = &leaves(&doc)[..] else { panic!() };
+    let h = height(&doc);
+    // The line, 20 units up from the insertion point: a box with no width at x 100. The 20 × 20
+    // square placed by the insert's transform would be a 60 × 40 box from x 70 to 130.
+    let b = doc.bounds_of(&[inst.id], false).unwrap();
+    assert!(close(b, Rect::new(100.0, h - 70.0, 100.0, h - 50.0), 1e-9), "{b:?}");
+    // A click 25 pt right of the line, inside that square's box, selects nothing; one on the line
+    // selects the insert.
+    let hit = |x: f64| vectorcraft_doc::hit::hit_test(&doc, Point::new(x, h - 60.0), vectorcraft_doc::hit::HitOptions::default()).map(|h| h.leaf);
+    assert_eq!(hit(125.0), None);
+    assert_eq!(hit(100.0), Some(inst.id));
+    // A marquee beside the line leaves it out; one across it takes it.
+    let marquee = |r: Rect| vectorcraft_doc::hit::marquee(&doc, r, None, false);
+    assert!(marquee(Rect::new(115.0, h - 65.0, 125.0, h - 55.0)).is_empty());
+    assert_eq!(marquee(Rect::new(90.0, h - 62.0, 110.0, h - 58.0)), vec![inst.id]);
+}
+
 #[test]
 fn by_block_colours_make_a_symbol_per_look() {
     // The block's line takes the insert's colour: red and green make two symbols; a third red

crates/cad/src/scene.rs

@@ -8,7 +8,7 @@ use std::io::Cursor;
 
 use kurbo::PathEl;
 use vectorcraft_color::Paint;
-use vectorcraft_doc::{AppearanceItem, Dash, Document, ImageObject, Node, NodeKind, StrokeLayer, TextKind, TextObject, Unit};
+use vectorcraft_doc::{AppearanceItem, Dash, Document, ImageObject, Node, NodeKind, StrokeLayer, SymbolBoxes, TextKind, TextObject, Unit};
 use vectorcraft_effects::stroke;
 use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect};
 
@@ -158,6 +158,9 @@ struct LayerFlags {
 
 pub(crate) struct Scene<'a> {
     doc: &'a Document,
+    /// The art boxes of `doc`'s symbols, which the walk measures symbol instances by when it
+    /// crops to the region ([`SymbolBoxes::quick`]).
+    symbols: SymbolBoxes<'a>,
     o: &'a DxfOptions,
     /// Document space → drawing units (y up, origin at the region's bottom-left).
     to_dxf: Affine,
@@ -192,6 +195,7 @@ impl<'a> Scene<'a> {
         let r = o.region;
         Self {
             doc,
+            symbols: doc.symbol_boxes().quick(),
             o,
             to_dxf: Affine::new([k, 0.0, 0.0, -k, -r.x0 * k, r.y1 * k]),
             k,
@@ -271,7 +275,7 @@ impl<'a> Scene<'a> {
             return;
         }
         if self.o.crop && !layer {
-            match n.visual_bounds() {
+            match n.visual_bounds_with(&self.symbols) {
                 Some(b) if !overlaps(b, self.o.region) => return,
                 None if !n.is_container() => return,
                 _ => {}

crates/cad/src/tests.rs

@@ -125,6 +125,18 @@ fn every_version_declares_its_acadver_and_is_well_formed() {
     assert_eq!(DxfVersion::from_id("2019"), None);
 }
 
+#[test]
+fn r12_viewport_has_no_duplicate_group_codes() {
+    let d = shapes_doc();
+    let out = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
+    let vport = table(&out, "VPORT").into_iter().find(|o| kind(o) == "VPORT").expect("VPORT table record");
+    let codes: Vec<i32> = vport.iter().map(|pair| pair.0).collect();
+    let unique: std::collections::HashSet<_> = codes.iter().collect();
+    assert_eq!(unique.len(), codes.len(), "R12 VPORT record has duplicate group codes: {vport:?}");
+    let z = vport.iter().find(|pair| pair.0 == 36).map(|pair| pair.1.trim().parse::<f64>().unwrap());
+    assert_eq!(z, Some(1.0), "the view direction looks down the z axis");
+}
+
 #[test]
 fn lines_are_lwpolylines_curves_splines_and_fills_hatches() {
     let d = shapes_doc();
@@ -442,3 +454,14 @@ fn crop_leaves_out_art_outside_the_region() {
     assert_eq!(kinds(&export(&d, &o).unwrap()), ["SPLINE"]);
     assert_eq!(kinds(&export(&d, &DxfOptions { crop: false, ..o }).unwrap()).len(), 4);
 }
+
+#[test]
+fn crop_keeps_an_instance_whose_art_reaches_the_region() {
+    // The symbol's red rectangle, (100, 50) to (140, 90), drawn from (-50, -50): on the artboard,
+    // while the 20 × 20 square around the origin, moved to (-60, -60) to (-40, -40), is off it.
+    let mut d = doc_with(|d| vec![Node::new(d.alloc_id(), NodeKind::SymbolInstance { symbol: "Far".into(), xf: Affine::translate((-50.0, -50.0)) })]);
+    let art = path(&mut d, shapes::rectangle(Rect::new(100.0, 50.0, 140.0, 90.0)), Paint::solid(Color::rgb(1.0, 0.0, 0.0)), Paint::None, 0.0);
+    d.symbols.push(vectorcraft_doc::Symbol { name: "Far".into(), art: Arc::new(art) });
+    let o = DxfOptions { crop: true, ..opts(&d) };
+    assert!(!kinds(&export(&d, &o).unwrap()).is_empty());
+}

crates/cad/src/writer.rs

@@ -441,7 +441,8 @@ impl Drawing {
         c.xy(13, 0.0, 0.0);
         c.xy(14, 1.0, 1.0);
         c.xy(15, 10.0, 10.0);
-        c.xyz(16, 0.0, 0.0);
+        // The view direction looks down the z axis: (0, 0, 1), each code once.
+        c.xy(16, 0.0, 0.0);
         c.num(36, 1.0);
         c.xyz(17, 0.0, 0.0);
         let (w, h) = ((x1 - x0).abs(), (y1 - y0).abs());

crates/color/src/cms/icc.rs

@@ -249,7 +249,7 @@ pub(super) fn builtin_rgb_bytes(name: &str) -> Result<Vec<u8>, CmsError> {
 
 /// Encode `p` as an ICC file. The creation date is fixed so exports are reproducible.
 pub(super) fn encode(p: &ColorProfile) -> Result<Vec<u8>, CmsError> {
-    let mut bytes = p.encode().map_err(|e| CmsError::BadProfile(format!("{e:?}")))?;
+    let mut bytes = aligned(p.encode().map_err(|e| CmsError::BadProfile(format!("{e:?}")))?);
     // Header bytes 24..36: year, month, day, hours, minutes, seconds (u16 each).
     if let Some(date) = bytes.get_mut(24..36) {
         date.copy_from_slice(&[2026u16, 1, 1, 0, 0, 0].map(u16::to_be_bytes).concat());
@@ -257,6 +257,55 @@ pub(super) fn encode(p: &ColorProfile) -> Result<Vec<u8>, CmsError> {
     Ok(bytes)
 }
 
+/// `icc` with every tagged element starting on a 4-byte boundary, padded with zeros, as ICC.1
+/// §7.1.2 requires (moxcms packs them, so a 62-byte `desc` left the next tag unaligned, #1584).
+/// Tags that share data keep sharing it. A profile whose tag table doesn't read is returned as it is.
+fn aligned(icc: Vec<u8>) -> Vec<u8> {
+    const TABLE: usize = 128;
+    let be = |b: &[u8], at: usize| b.get(at..at + 4).map(|v| u32::from_be_bytes([v[0], v[1], v[2], v[3]]) as usize);
+    let Some(n) = be(&icc, TABLE).filter(|n| *n <= 1000) else { return icc };
+    let data_start = TABLE + 4 + 12 * n;
+    let mut entries = Vec::with_capacity(n);
+    for i in 0..n {
+        let e = TABLE + 4 + 12 * i;
+        let (Some(off), Some(size)) = (be(&icc, e + 4), be(&icc, e + 8)) else { return icc };
+        if off < data_start || off.checked_add(size).is_none_or(|end| end > icc.len()) {
+            return icc;
+        }
+        entries.push((off, size));
+    }
+    if entries.iter().all(|(off, _)| off.is_multiple_of(4)) && icc.len().is_multiple_of(4) {
+        return icc;
+    }
+    let mut out = icc.get(..data_start).map(<[u8]>::to_vec).unwrap_or_default();
+    let mut moved: Vec<((usize, usize), usize)> = Vec::new();
+    let mut order: Vec<usize> = (0..n).collect();
+    order.sort_by_key(|&i| entries[i].0);
+    for i in order {
+        let (off, size) = entries[i];
+        let at = match moved.iter().find(|(k, _)| *k == (off, size)) {
+            Some((_, at)) => *at,
+            None => {
+                out.resize(out.len().next_multiple_of(4), 0);
+                let at = out.len();
+                out.extend_from_slice(&icc[off..off + size]);
+                moved.push(((off, size), at));
+                at
+            }
+        };
+        let e = TABLE + 4 + 12 * i + 4;
+        out[e..e + 4].copy_from_slice(&(at as u32).to_be_bytes());
+    }
+    out.resize(out.len().next_multiple_of(4), 0);
+    let len = out.len() as u32;
+    out[0..4].copy_from_slice(&len.to_be_bytes());
+    // The profile ID (an MD5 of the old bytes) no longer matches: zero is "not computed".
+    if let Some(id) = out.get_mut(84..100) {
+        id.fill(0);
+    }
+    out
+}
+
 fn text_tag(s: &str) -> Option<ProfileText> {
     Some(ProfileText::Localizable(vec![LocalizableString::new("en".into(), "US".into(), s.into())]))
 }

crates/color/src/cms/tests_icc.rs

@@ -111,3 +111,26 @@ fn black_point_compensation_maps_the_darkest_ink_to_rgb_black() {
     let abs = |bpc| icc_cmyk(bpc).cmyk_to_rgb(rich, Intent::AbsoluteColorimetric);
     assert_eq!(abs(true), abs(false));
 }
+
+/// #1584: the profiles written here (built-in RGB spaces) have every tag on a 4-byte boundary and
+/// a size that is a multiple of 4 (ICC.1 §7.1.2), and still read back as the same space.
+#[test]
+fn written_profiles_align_their_tags() {
+    for name in [super::SRGB, super::DISPLAY_P3, super::WIDE_GAMUT_RGB, super::PROPHOTO_RGB] {
+        let icc = super::icc_bytes(name).unwrap();
+        let be = |at: usize| u32::from_be_bytes([icc[at], icc[at + 1], icc[at + 2], icc[at + 3]]) as usize;
+        assert_eq!(be(0), icc.len(), "{name}: header size");
+        assert_eq!(icc.len() % 4, 0, "{name}: {} bytes", icc.len());
+        let n = be(128);
+        for i in 0..n {
+            let (off, size) = (be(132 + 12 * i + 4), be(132 + 12 * i + 8));
+            assert_eq!(off % 4, 0, "{name}: tag {i} at {off}");
+            assert!(off + size <= icc.len());
+        }
+        let back = moxcms::ColorProfile::new_from_slice(&icc).unwrap();
+        let orig = moxcms::ColorProfile::new_srgb();
+        if name == super::SRGB {
+            assert_eq!((back.red_colorant, back.green_colorant, back.blue_colorant), (orig.red_colorant, orig.green_colorant, orig.blue_colorant));
+        }
+    }
+}

crates/doc/src/clipnest.rs

@@ -24,8 +24,10 @@ pub struct Clip {
 }
 
 /// Deepest nesting of clips, and of groups, an importer records ([`nest`] goes one level deeper
-/// for each): deeper ones are left out.
-pub const MAX_NEST: usize = 128;
+/// for each): deeper ones are left out. As deep as a document's objects may nest
+/// ([`crate::MAX_DEPTH`]) under a layer, around the art; clips in groups that deep together are
+/// merged by [`Document::limit_depth`].
+pub const MAX_NEST: usize = crate::MAX_DEPTH - 2;
 
 /// The warning for clips left out for nesting deeper than [`MAX_NEST`].
 pub fn deep_clips() -> String {

crates/doc/src/depth.rs

@@ -0,0 +1,588 @@
+//! How deep objects may nest.
+//!
+//! The tree is walked by recursion everywhere (drawing, bounds, hit tests, saving, exporting), so
+//! a tree of unbounded depth overflows the stack: an abort no guard catches. No document deeper
+//! than [`MAX_DEPTH`] is ever kept, nor one whose symbols and patterns draw deeper than
+//! [`MAX_DRAWN_DEPTH`] (a symbol holding an instance of itself, or a pattern painting its own
+//! tile, draws without end): importers and the native reader merge deeper objects into the group
+//! around them and leave such instances and paints out
+//! ([`Document::limit_depth`], with [`merged_note`] and [`symbols_note`] as their warnings), and
+//! the engine refuses an edit that would nest deeper ([`Document::too_deep`]).
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use vectorcraft_color::Paint;
+
+use crate::{Document, Node, NodeKind};
+
+/// The deepest an object may be: a top-level layer is 1 deep, what it holds 2, and so on (the art
+/// of an opacity mask is one deeper than the object it masks). A symbol's or pattern's art counts
+/// from 1 again.
+///
+/// A native file writes three levels of JSON for each level of objects, and its reader stops at
+/// 128 levels: 32 leaves the deepest object 29 of them for its own data, so every document that
+/// can be made can be saved and opened again.
+pub const MAX_DEPTH: usize = 32;
+
+/// The deepest an object may be drawn: as [`MAX_DEPTH`], the art of a symbol counted under its
+/// instance and a pattern's tile under the object it paints (and what those use, under them).
+/// Symbols a few objects deep nest in one another dozens deep within it.
+pub const MAX_DRAWN_DEPTH: usize = 4 * MAX_DEPTH;
+
+/// The warning of a file whose objects were nested deeper than [`MAX_DEPTH`].
+pub fn merged_note() -> String {
+    format!("objects nested more than {MAX_DEPTH} deep were merged into the group around them")
+}
+
+/// The warning of a file with symbols or patterns that use themselves or are drawn deeper than
+/// [`MAX_DRAWN_DEPTH`].
+pub fn symbols_note() -> String {
+    format!(
+        "symbol instances and pattern paints inside their own symbol or pattern, or drawn more than {MAX_DRAWN_DEPTH} objects deep, were left out"
+    )
+}
+
+/// Run `f` where recursion has room: on a thread of its own with a 16 MB stack (the main thread
+/// has 1 MB on Windows), or here where there are no threads (the web) or none can be started. For
+/// readers whose recursion is capped but heavy; a panic in `f` goes on to the caller.
+pub fn with_deep_stack<T: Send>(f: impl Fn() -> T + Sync) -> T {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let threaded = std::thread::scope(|s| {
+            let thread = std::thread::Builder::new().stack_size(16 << 20).spawn_scoped(s, &f).ok()?;
+            Some(thread.join().unwrap_or_else(|panic| std::panic::resume_unwind(panic)))
+        });
+        if let Some(done) = threaded {
+            return done;
+        }
+    }
+    f()
+}
+
+/// Is anything in `now` (each `depth` deep) deeper than [`MAX_DEPTH`], or `over` (given its
+/// depth)? Without recursion: the trees may be of any depth. With `before` (the same list before
+/// an edit, within the caps), only what the edit changed is looked at: a subtree still shared with
+/// it, in the same place, is as it was.
+fn deeper(now: &[Arc<Node>], before: Option<&[Arc<Node>]>, depth: usize, over: &dyn Fn(&Node, usize) -> bool) -> bool {
+    type Pending<'a> = Vec<(&'a Node, Option<&'a Node>, usize)>;
+    fn push<'a>(stack: &mut Pending<'a>, now: &'a [Arc<Node>], before: Option<&'a [Arc<Node>]>, depth: usize) {
+        for (i, n) in now.iter().enumerate() {
+            let was = before.and_then(|b| b.get(i));
+            if !was.is_some_and(|w| Arc::ptr_eq(w, n)) {
+                stack.push((n, was.map(|w| &**w), depth));
+            }
+        }
+    }
+    let mut stack = vec![];
+    push(&mut stack, now, before, depth);
+    while let Some((n, was, d)) = stack.pop() {
+        if d > MAX_DEPTH || over(n, d) {
+            return true;
+        }
+        if let Some(ch) = n.children() {
+            push(&mut stack, ch, was.and_then(Node::children).map(Vec::as_slice), d + 1);
+        }
+        if let Some(m) = &n.extras().mask {
+            let was = was.and_then(|w| w.extras().mask.as_ref()).map(|m| std::slice::from_ref(&m.art));
+            push(&mut stack, std::slice::from_ref(&m.art), was, d + 1);
+        }
+    }
+    false
+}
+
+/// [`deeper`] for the nesting alone.
+fn nested_deeper(now: &[Arc<Node>], depth: usize) -> bool {
+    deeper(now, None, depth, &|_, _| false)
+}
+
+/// Merge what is deeper than [`MAX_DEPTH`] in `nodes` (each `depth` deep) into the group around
+/// it: a container at the cap is replaced by what it holds (a clipping group's clipping path and
+/// an opacity mask too deep are left out); what it held stays hidden or locked as it was. Returns
+/// whether anything changed. Recurses no deeper than the cap.
+fn limit(nodes: &mut Vec<Arc<Node>>, depth: usize) -> bool {
+    let mut changed = false;
+    let mut i = 0;
+    while let Some(n) = nodes.get_mut(i) {
+        if !nested_deeper(std::slice::from_ref(n), depth) {
+            i += 1;
+            continue;
+        }
+        changed = true;
+        let n = Arc::make_mut(n);
+        if n.extras().mask.as_ref().is_some_and(|m| nested_deeper(std::slice::from_ref(&m.art), depth + 1)) {
+            n.extras_mut().mask = None;
+        }
+        if depth < MAX_DEPTH {
+            if let Some(ch) = n.children_mut() {
+                limit(ch, depth + 1);
+            }
+            i += 1;
+            continue;
+        }
+        let clip = matches!(n.kind, NodeKind::Group { clip: true, .. } | NodeKind::Layer { clip: true, .. });
+        let (visible, locked) = (n.visible, n.locked);
+        let mut held = n.children_mut().map(std::mem::take).unwrap_or_default();
+        if clip && !held.is_empty() {
+            held.remove(0);
+        }
+        for c in &mut held {
+            if (!visible && c.visible) || (locked && !c.locked) {
+                let c = Arc::make_mut(c);
+                c.visible &= visible;
+                c.locked |= locked;
+            }
+        }
+        // What it held takes its place, and is looked at in its turn.
+        nodes.splice(i..=i, held);
+    }
+    changed
+}
+
+/// A symbol (`false`) or a pattern (`true`) of the document, by name: what art draws by name, an
+/// instance its symbol's art and a pattern paint its tile's.
+type Def<'a> = (bool, &'a str);
+
+/// How deep each symbol's and pattern's art is drawn, the art of the symbols and patterns it uses
+/// included (drawn under the object that uses them): `None` for one that uses itself, in its art
+/// or through what that uses, or is drawn deeper than [`MAX_DRAWN_DEPTH`].
+type Heights<'a> = HashMap<Def<'a>, Option<usize>>;
+
+/// What `n` itself draws by name: the symbol it is an instance of, the patterns that paint it.
+fn uses(n: &Node) -> impl Iterator<Item = Def<'_>> {
+    let symbol = match &n.kind {
+        NodeKind::SymbolInstance { symbol, .. } => Some((false, symbol.as_str())),
+        _ => None,
+    };
+    let patterns = crate::swatches::node_paints(n).filter_map(|p| match p {
+        Paint::Pattern { pattern, .. } => Some((true, pattern.as_str())),
+        _ => None,
+    });
+    symbol.into_iter().chain(patterns)
+}
+
+/// [`Heights`] of the document's symbols and patterns. Without recursion: they may use one
+/// another in a chain of any length. Their own art is within [`MAX_DEPTH`].
+fn heights(doc: &Document) -> Heights<'_> {
+    // Each one's own depth, and what its art uses with the deepest use of each.
+    type Own<'a> = (usize, Vec<(Def<'a>, usize)>);
+    let arts = (doc.symbols.iter().map(|s| ((false, s.name.as_str()), std::slice::from_ref(&s.art))))
+        .chain(doc.patterns.iter().map(|p| ((true, p.name.as_str()), &p.art[..])));
+    let mut own: HashMap<Def, Own> = HashMap::new();
+    for (def, art) in arts {
+        let (mut deepest, mut used) = (0, HashMap::<Def, usize>::new());
+        let mut stack: Vec<(&Node, usize)> = art.iter().map(|n| (&**n, 1)).collect();
+        while let Some((n, d)) = stack.pop() {
+            deepest = deepest.max(d);
+            for u in uses(n) {
+                let at = used.entry(u).or_default();
+                *at = (*at).max(d);
+            }
+            stack.extend(n.children().into_iter().flatten().chain(n.extras().mask.as_ref().map(|m| &m.art)).map(|c| (&**c, d + 1)));
+        }
+        // (The first of two of one name is the one drawn.)
+        own.entry(def).or_insert((deepest, used.into_iter().collect()));
+    }
+    // Depth first over what uses what. One met again while it is being worked out (`None` in its
+    // entry) uses itself.
+    let mut found: HashMap<Def, Option<Option<usize>>> = HashMap::new();
+    let starts: Vec<Def> = own.keys().copied().collect();
+    for start in starts {
+        if found.contains_key(&start) {
+            continue;
+        }
+        // (which, the next of its uses to look at, the deepest found so far: `None` once it can't be drawn)
+        let mut path: Vec<(Def, usize, Option<usize>)> = vec![(start, 0, own.get(&start).map(|o| o.0))];
+        found.insert(start, None);
+        while let Some(&(def, next, deepest)) = path.last() {
+            let used = own.get(&def).map_or(&[][..], |o| &o.1);
+            let Some(&(other, at)) = used.get(next) else {
+                // Everything it uses is worked out.
+                let deepest = deepest.filter(|d| *d <= MAX_DRAWN_DEPTH);
+                found.insert(def, Some(deepest));
+                path.pop();
+                if let Some((user, next, held)) = path.last_mut() {
+                    let at = own.get(user).and_then(|o| o.1.get(next.wrapping_sub(1))).map_or(1, |u| u.1);
+                    *held = held.zip(deepest).map(|(h, d)| h.max(at + d));
+                }
+                continue;
+            };
+            let known = found.get(&other).copied();
+            if known.is_none() && own.contains_key(&other) {
+                found.insert(other, None);
+            }
+            let Some((_, next, deepest)) = path.last_mut() else { break };
+            *next += 1;
+            match known {
+                // Not in the document: it draws nothing.
+                None if !own.contains_key(&other) => {}
+                None => path.push((other, 0, own.get(&other).map(|o| o.0))),
+                Some(Some(Some(d))) => *deepest = deepest.map(|h| h.max(at + d)),
+                // It uses itself (it is on the way down here), or can't be drawn.
+                Some(None | Some(None)) => *deepest = None,
+            }
+        }
+    }
+    found.into_iter().map(|(def, h)| (def, h.flatten())).collect()
+}
+
+/// Can't `used`, by an object `depth` deep, be drawn there?
+fn undrawable(heights: &Heights, used: Def, depth: usize) -> bool {
+    heights.get(&used).is_some_and(|h| h.is_none_or(|h| depth + h > MAX_DRAWN_DEPTH))
+}
+
+/// Take out of `nodes` (each `depth` deep) the uses `bad` picks (given the depth of the object):
+/// an instance goes, a pattern paint becomes no paint. Returns whether anything changed. For trees
+/// within [`MAX_DEPTH`].
+fn strip(nodes: &mut Vec<Arc<Node>>, depth: usize, bad: &dyn Fn(Def, usize) -> bool) -> bool {
+    let any = |n: &Node, d: usize| uses(n).any(|u| bad(u, d));
+    let before = nodes.len();
+    nodes.retain(|n| !matches!(&n.kind, NodeKind::SymbolInstance { symbol, .. } if bad((false, symbol.as_str()), depth)));
+    let mut changed = nodes.len() != before;
+    for n in nodes.iter_mut() {
+        if !deeper(std::slice::from_ref(n), None, depth, &any) {
+            continue;
+        }
+        changed = true;
+        let n = Arc::make_mut(n);
+        if uses(n).any(|u| bad(u, depth)) {
+            for p in crate::swatches::node_paints_mut(n) {
+                if matches!(p, Paint::Pattern { pattern, .. } if bad((true, pattern.as_str()), depth)) {
+                    *p = Paint::None;
+                }
+            }
+        }
+        // An opacity mask whose art is such an instance goes with it.
+        let mut mask = n.extras().mask.as_ref().map(|m| vec![m.art.clone()]);
+        if let Some(art) = &mut mask
+            && strip(art, depth + 1, bad)
+        {
+            match art.pop() {
+                Some(art) => {
+                    if let Some(m) = n.extras_mut().mask.as_mut() {
+                        m.art = art;
+                    }
+                }
+                None => n.extras_mut().mask = None,
+            }
+        }
+        if let Some(ch) = n.children_mut() {
+            strip(ch, depth + 1, bad);
+        }
+    }
+    changed
+}
+
+impl Document {
+    /// Is anything nested deeper than [`MAX_DEPTH`], or drawn deeper than [`MAX_DRAWN_DEPTH`]
+    /// (a symbol or pattern that uses itself is)? With `before` (this document before an edit,
+    /// itself within the caps), only what the edit changed is looked at.
+    pub fn too_deep(&self, before: Option<&Document>) -> bool {
+        fn symbol(d: &Document, i: usize) -> Option<&[Arc<Node>]> {
+            d.symbols.get(i).map(|s| std::slice::from_ref(&s.art))
+        }
+        fn pattern(d: &Document, i: usize) -> Option<&[Arc<Node>]> {
+            d.patterns.get(i).map(|p| &p.art[..])
+        }
+        let nested = |_: &Node, _: usize| false;
+        if (0..self.symbols.len()).any(|i| symbol(self, i).is_some_and(|art| deeper(art, before.and_then(|b| symbol(b, i)), 1, &nested)))
+            || (0..self.patterns.len()).any(|i| pattern(self, i).is_some_and(|art| deeper(art, before.and_then(|b| pattern(b, i)), 1, &nested)))
+        {
+            return true;
+        }
+        if self.symbols.is_empty() && self.patterns.is_empty() {
+            return deeper(&self.layers, before.map(|b| &b.layers[..]), 1, &nested);
+        }
+        let heights = heights(self);
+        if heights.values().any(Option::is_none) {
+            return true;
+        }
+        // Symbols and patterns draw as deep as before when none changed; else every use of them
+        // is looked at again.
+        let same = |x: &[Arc<Node>], y: &[Arc<Node>]| x.len() == y.len() && x.iter().zip(y).all(|(x, y)| Arc::ptr_eq(x, y));
+        let before = before.filter(|b| {
+            b.symbols.len() == self.symbols.len()
+                && b.patterns.len() == self.patterns.len()
+                && b.symbols.iter().zip(&self.symbols).all(|(x, y)| x.name == y.name && Arc::ptr_eq(&x.art, &y.art))
+                && b.patterns.iter().zip(&self.patterns).all(|(x, y)| x.name == y.name && same(&x.art, &y.art))
+        });
+        let over = |n: &Node, d: usize| uses(n).any(|u| undrawable(&heights, u, d));
+        deeper(&self.layers, before.map(|b| &b.layers[..]), 1, &over)
+    }
+
+    /// [`Self::limit_depth`] → whether objects were merged, and whether uses of symbols and
+    /// patterns were left out.
+    fn limit_depths(&mut self) -> (bool, bool) {
+        let mut merged = limit(&mut self.layers, 1);
+        for s in &mut self.symbols {
+            // The art itself is 1 deep, so it stays the one object it is.
+            let mut art = vec![s.art.clone()];
+            if limit(&mut art, 1)
+                && let Some(one) = art.pop()
+            {
+                s.art = one;
+                merged = true;
+            }
+        }
+        for p in &mut self.patterns {
+            merged |= limit(&mut p.art, 1);
+        }
+        if self.symbols.is_empty() && self.patterns.is_empty() {
+            return (merged, false);
+        }
+        // The symbols and patterns that can't be drawn lose what their art uses: each is then as
+        // deep as its own art, and what uses it can be drawn.
+        let (symbols, patterns): (Vec<usize>, Vec<usize>) = {
+            let heights = heights(self);
+            let bad = |def: Def| heights.get(&def).is_some_and(Option::is_none);
+            (
+                (0..self.symbols.len()).filter(|i| self.symbols.get(*i).is_some_and(|s| bad((false, s.name.as_str())))).collect(),
+                (0..self.patterns.len()).filter(|i| self.patterns.get(*i).is_some_and(|p| bad((true, p.name.as_str())))).collect(),
+            )
+        };
+        let mut left_out = !(symbols.is_empty() && patterns.is_empty());
+        let all = |_: Def, _: usize| true;
+        for i in symbols {
+            let Some(s) = self.symbols.get_mut(i) else { continue };
+            let mut art = vec![s.art.clone()];
+            strip(&mut art, 1, &all);
+            // (An instance alone was the whole art: an empty group stands in.)
+            s.art = art.pop().unwrap_or_else(|| Arc::new(Node::group(s.art.id, vec![])));
+        }
+        for i in patterns {
+            if let Some(p) = self.patterns.get_mut(i) {
+                strip(&mut p.art, 1, &all);
+            }
+        }
+        // Then the uses drawn too deep where they are.
+        let mut layers = self.layers.clone();
+        left_out |= {
+            let heights = heights(self);
+            strip(&mut layers, 1, &|used, depth| undrawable(&heights, used, depth))
+        };
+        self.layers = layers;
+        (merged, left_out)
+    }
+
+    /// Bring the document within the caps: merge the objects nested deeper than [`MAX_DEPTH`]
+    /// into the group around them, and leave out the uses of symbols and patterns that can't be
+    /// drawn (inside their own symbol or pattern, or deeper than [`MAX_DRAWN_DEPTH`]). What an
+    /// importer does to what it read. Returns whether anything changed.
+    pub fn limit_depth(&mut self) -> bool {
+        let (merged, left_out) = self.limit_depths();
+        merged || left_out
+    }
+
+    /// [`Self::limit_depth`], adding [`merged_note`] and [`symbols_note`] to an importer's
+    /// `warnings` for what it did.
+    pub fn limit_depth_noting(&mut self, warnings: &mut Vec<String>) {
+        let (merged, left_out) = self.limit_depths();
+        warnings.extend(merged.then(merged_note));
+        warnings.extend(left_out.then(symbols_note));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{NodeId, OpacityMask};
+
+    /// One path in `levels` groups, each holding a second path beside the next group.
+    fn nested(levels: usize) -> Arc<Node> {
+        let mut id = 0;
+        let mut next = || {
+            id += 1;
+            NodeId(id)
+        };
+        let path = |id| Arc::new(Node::path(id, Default::default(), Default::default()));
+        let mut inner = path(next());
+        for _ in 0..levels {
+            inner = Arc::new(Node::group(next(), vec![inner, path(next())]));
+        }
+        inner
+    }
+
+    fn doc(art: Arc<Node>) -> Document {
+        let mut d = Document::new(100.0, 100.0);
+        if let Some(ch) = d.layers.first_mut().and_then(|l| Arc::make_mut(l).children_mut()) {
+            ch.push(art);
+        }
+        d
+    }
+
+    #[test]
+    fn a_document_at_the_cap_is_left_alone() {
+        // The layer, the groups and the path in them: MAX_DEPTH deep.
+        let mut d = doc(nested(MAX_DEPTH - 2));
+        let before = d.clone();
+        assert!(!d.too_deep(None));
+        assert!(!d.limit_depth());
+        assert_eq!(d, before);
+    }
+
+    #[test]
+    fn deeper_objects_are_merged_into_the_group_around_them() {
+        for levels in [MAX_DEPTH - 1, MAX_DEPTH + 5, 100_000] {
+            let mut d = doc(nested(levels));
+            assert!(d.too_deep(None), "{levels}");
+            assert!(d.limit_depth(), "{levels}");
+            assert!(!d.too_deep(None), "{levels}");
+            // Every path is kept, under the layer and the groups down to the cap.
+            assert_eq!(d.node_count(), 1 + (MAX_DEPTH - 2) + (levels + 1), "{levels}");
+            assert!(!d.limit_depth(), "nothing more to merge");
+        }
+    }
+
+    #[test]
+    fn a_clipping_path_and_a_mask_too_deep_are_left_out_and_hidden_art_stays_hidden() {
+        let mut inner = Node::new(NodeId(9000), NodeKind::Group { children: vec![nested(0), nested(0)], clip: true });
+        inner.visible = false;
+        let mut art = Arc::new(inner);
+        for i in 0..MAX_DEPTH {
+            art = Arc::new(Node::group(NodeId(9001 + i as u64), vec![art]));
+        }
+        let mut masked = Node::group(NodeId(8000), vec![]);
+        masked.extras_mut().mask = Some(Box::new(OpacityMask::new((*nested(MAX_DEPTH)).clone(), true)));
+        let mut d = doc(art);
+        if let Some(ch) = d.layers.first_mut().and_then(|l| Arc::make_mut(l).children_mut()) {
+            ch.push(Arc::new(masked));
+        }
+        assert!(d.limit_depth());
+        assert!(!d.too_deep(None));
+        let mut leaves = vec![];
+        d.walk(|n| {
+            if n.children().is_none() {
+                leaves.push(n.visible);
+            }
+        });
+        assert_eq!(leaves, [false], "the clipping path is gone, what it clipped is still hidden");
+        assert!(d.node(NodeId(8000)).is_some_and(|n| n.extras().mask.is_none()));
+    }
+
+    #[test]
+    fn an_edit_is_checked_by_what_it_changed() {
+        let before = doc(nested(MAX_DEPTH - 2));
+        let mut wrapped = before.clone();
+        if let Some(ch) = wrapped.layers.first_mut().and_then(|l| Arc::make_mut(l).children_mut()) {
+            let all = std::mem::take(ch);
+            ch.push(Arc::new(Node::group(NodeId(7000), all)));
+        }
+        assert!(wrapped.too_deep(Some(&before)), "the same art, one deeper");
+        let mut beside = before.clone();
+        if let Some(ch) = beside.layers.first_mut().and_then(|l| Arc::make_mut(l).children_mut()) {
+            ch.push(nested(3));
+        }
+        assert!(!beside.too_deep(Some(&before)));
+        assert!(!before.too_deep(Some(&before)));
+    }
+
+    #[test]
+    fn symbols_and_patterns_are_limited_too() {
+        let mut d = Document::new(10.0, 10.0);
+        d.symbols.push(crate::Symbol { name: "s".into(), art: nested(MAX_DEPTH + 3) });
+        assert!(d.too_deep(None));
+        assert!(d.limit_depth());
+        assert!(!d.too_deep(None));
+        assert!(d.symbols.first().is_some_and(|s| s.art.children().is_some()), "still one object");
+    }
+
+    fn instance(id: u64, of: &str) -> Arc<Node> {
+        Arc::new(Node::new(NodeId(id), NodeKind::SymbolInstance { symbol: of.into(), xf: Default::default() }))
+    }
+
+    /// `count` symbols, each `levels` groups around an instance of the next; the last one's of `last`.
+    fn symbols(count: usize, levels: usize, last: &str) -> Document {
+        let mut d = doc(instance(1, "s0"));
+        for i in 0..count {
+            let mut art = instance(2, &if i + 1 < count { format!("s{}", i + 1) } else { last.to_string() });
+            for _ in 0..levels {
+                art = Arc::new(Node::group(NodeId(3), vec![art]));
+            }
+            d.symbols.push(crate::Symbol { name: format!("s{i}"), art });
+        }
+        d
+    }
+
+    fn instances(d: &Document) -> usize {
+        let mut n = 0;
+        let mut count = |x: &Node| n += usize::from(matches!(x.kind, NodeKind::SymbolInstance { .. }));
+        d.walk(&mut count);
+        d.symbols.iter().for_each(|s| s.art.walk(&mut count));
+        n
+    }
+
+    #[test]
+    fn symbols_in_symbols_are_drawn_only_so_deep() {
+        // Three objects deep each (two groups and the instance), under the instance on the layer.
+        let fits = MAX_DRAWN_DEPTH / 3 - 1;
+        let mut d = symbols(fits, 2, "none");
+        assert!(!d.too_deep(None) && !d.limit_depth());
+        let mut d = symbols(fits + 2, 2, "none");
+        assert!(d.too_deep(None));
+        let before = instances(&d);
+        assert!(d.limit_depth() && !d.too_deep(None));
+        assert!(instances(&d) < before && instances(&d) > 0, "only the instances drawn too deep go");
+        // A chain of any length is measured, not walked by recursion.
+        let mut d = symbols(100_000, 0, "none");
+        assert!(d.too_deep(None) && d.limit_depth() && !d.too_deep(None));
+    }
+
+    #[test]
+    fn a_symbol_holding_itself_loses_the_instance() {
+        for (count, last) in [(1, "s0"), (3, "s0"), (3, "s1")] {
+            let mut d = symbols(count, 1, last);
+            assert!(d.too_deep(None), "{count} {last}");
+            let mut warnings = vec![];
+            d.limit_depth_noting(&mut warnings);
+            assert_eq!(warnings, [symbols_note()]);
+            assert!(!d.too_deep(None), "{count} {last}");
+            assert!(d.symbols.iter().all(|s| s.art.children().is_some()), "the art is still a group");
+        }
+        // An edit that makes one hold itself is seen, whatever else stayed as it was.
+        let before = symbols(2, 1, "none");
+        let mut after = before.clone();
+        after.symbols[1].art = Arc::new(Node::group(NodeId(9), vec![instance(8, "s0")]));
+        assert!(!before.too_deep(None) && after.too_deep(Some(&before)));
+    }
+
+    /// A path painted with the pattern named `with`.
+    fn painted(id: u64, with: &str) -> Arc<Node> {
+        let fill = Paint::Pattern { pattern: with.into(), xf: Default::default() };
+        Arc::new(Node::path(NodeId(id), Default::default(), crate::Appearance::basic(fill, Paint::None, 0.0)))
+    }
+
+    fn pattern_fills(d: &Document) -> usize {
+        let mut n = 0;
+        d.visit_paints(&mut |p| n += usize::from(matches!(p, Paint::Pattern { .. })));
+        n
+    }
+
+    #[test]
+    fn a_pattern_painting_its_own_tile_loses_the_paint() {
+        // One that paints its own tile; two that paint each other's; one in a symbol it holds.
+        let itself = |d: &mut Document| d.patterns.push(crate::PatternDef::new("p", vec![painted(2, "p")]));
+        let each_other = |d: &mut Document| {
+            d.patterns.push(crate::PatternDef::new("p", vec![painted(2, "q")]));
+            d.patterns.push(crate::PatternDef::new("q", vec![painted(3, "p")]));
+        };
+        let through_a_symbol = |d: &mut Document| {
+            d.patterns.push(crate::PatternDef::new("p", vec![instance(2, "s")]));
+            d.symbols.push(crate::Symbol { name: "s".into(), art: painted(3, "p") });
+        };
+        for make in [&itself as &dyn Fn(&mut Document), &each_other, &through_a_symbol] {
+            let mut d = doc(painted(1, "p"));
+            make(&mut d);
+            assert!(d.too_deep(None));
+            let mut warnings = vec![];
+            d.limit_depth_noting(&mut warnings);
+            assert_eq!(warnings, [symbols_note()]);
+            assert!(!d.too_deep(None));
+            assert_eq!(pattern_fills(&d), 1, "the object on the layer keeps its pattern");
+        }
+        // A pattern whose tile is painted with another is fine.
+        let mut d = doc(painted(1, "p"));
+        d.patterns.push(crate::PatternDef::new("p", vec![painted(2, "q")]));
+        d.patterns.push(crate::PatternDef::new("q", vec![painted(3, "none")]));
+        assert!(!d.too_deep(None) && !d.limit_depth());
+    }
+}

crates/doc/src/hit.rs

@@ -1,9 +1,11 @@
 //! Hit testing over the document tree.
 
+use std::collections::HashSet;
+
 use vectorcraft_geom::hit::{fill_contains, stroke_contains};
 use vectorcraft_geom::{Point, Rect};
 
-use crate::{Document, Node, NodeId, NodeKind};
+use crate::{Document, Node, NodeId, NodeKind, SymbolBoxes};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum HitKind {
@@ -83,6 +85,79 @@ pub fn hit_test_visible(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit
 /// first: what clicks there select, one below the other (Cmd/Ctrl-click selects behind).
 pub fn objects_at(doc: &Document, p: Point, opt: HitOptions, scope: Option<NodeId>) -> Vec<NodeId> {
     let opt = HitOptions { scope: scope.or(opt.scope), ..opt };
+    // Normally one hit test per *object* suffices: layers and sublayers aren't selectable,
+    // while a group (including a clipping group) is selected as one object. Repeatedly
+    // searching the full tree for each hit made a stack of n overlapping paths O(n^2).
+    // Isolation and Edit Contents change where selection groups begin; keep the original
+    // traversal for those cases rather than change their Select Behind semantics.
+    if opt.scope.is_some() {
+        return objects_at_repeated(doc, p, opt, scope);
+    }
+    let mut tops = Vec::new();
+    let mut seen = HashSet::new();
+    let symbols = doc.symbol_boxes();
+    for layer in doc.layers.iter().rev() {
+        // Malformed files may contain non-layer roots; let the general traversal handle them.
+        if !layer.is_layer() {
+            return objects_at_repeated(doc, p, opt, scope);
+        }
+        if !layer.visible || layer.locked || layer.is_template() || doc.pattern_edit.as_ref().is_some_and(|e| e.layer != layer.id) {
+            continue;
+        }
+        if !objects_at_layer(layer, p, opt, &symbols, &mut tops, &mut seen) {
+            // An envelope in Edit Contents may expose objects *within* a top-level group.
+            // The repeated traversal handles that mixed hierarchy precisely.
+            return objects_at_repeated(doc, p, opt, scope);
+        }
+    }
+    tops
+}
+
+/// One traversal through a layer and its sublayers. Each selectable object's subtree is
+/// inspected once (only until its first hit). `false` asks the caller to use the general
+/// algorithm for an envelope whose contents are currently being edited. Symbol instances are
+/// measured by their art ([`Node::geometric_bounds_with`]).
+fn objects_at_layer(layer: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes, tops: &mut Vec<NodeId>, seen: &mut HashSet<NodeId>) -> bool {
+    let Some(children) = layer.children() else { return true };
+    if layer.clips() && children.first().is_some_and(|clip| !clip_contains(clip, p)) {
+        return true;
+    }
+    let opt = if matches!(layer.kind, NodeKind::Layer { preview: false, .. }) { HitOptions { outline: true, ..opt } } else { opt };
+    for (i, c) in children.iter().enumerate().rev() {
+        if !may_hit(layer, i, c, p, opt, symbols, true) || seen.contains(&c.id) {
+            continue;
+        }
+        if c.is_layer() {
+            if !objects_at_layer(c, p, opt, symbols, tops, seen) {
+                return false;
+            }
+            continue;
+        }
+        // Editing an envelope selects its contents rather than the containing object. Even
+        // when nested in a group, the old traversal may select both a member and the group.
+        if c.is_container() {
+            let mut editing = false;
+            c.walk(&mut |n| editing |= edits_contents(n));
+            if editing {
+                return false;
+            }
+        }
+        let skip = |id| seen.contains(&id);
+        let mut chain = Vec::new();
+        let hit = match &c.kind {
+            NodeKind::Group { .. } => hit_children(c, p, opt, symbols, &skip, &mut chain, true).is_some(),
+            NodeKind::Blend { .. } => hit_children(c, p, opt, symbols, &skip, &mut chain, true).is_some() || hit_leaf(c, p, opt, symbols).is_some(),
+            _ => hit_leaf(c, p, opt, symbols).is_some(),
+        };
+        if hit && seen.insert(c.id) {
+            tops.push(c.id);
+        }
+    }
+    true
+}
+
+/// The general selection order also handles isolation and nested Edit Contents.
+fn objects_at_repeated(doc: &Document, p: Point, opt: HitOptions, scope: Option<NodeId>) -> Vec<NodeId> {
     let mut tops: Vec<NodeId> = vec![];
     // Each round leaves out the objects found so far (and everything inside them).
     while let Some(top) = hit_test_skipping(doc, p, opt, &|id| tops.contains(&id), true).map(|h| h.top_object(scope)) {
@@ -94,13 +169,15 @@ pub fn objects_at(doc: &Document, p: Point, opt: HitOptions, scope: Option<NodeI
     tops
 }
 
-/// [`hit_test`] passing over the nodes `skip` names (and their contents).
+/// [`hit_test`] passing over the nodes `skip` names (and their contents). Symbol instances are
+/// measured by their art ([`Node::geometric_bounds_with`]).
 fn hit_test_skipping(doc: &Document, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool, editable_only: bool) -> Option<Hit> {
     let finish = |mut h: Hit| {
         h.contents_of = h.ancestry.iter().rev().copied().find(|a| doc.node(*a).is_some_and(edits_contents));
         h.layers = h.ancestry.iter().take_while(|a| doc.node(**a).is_some_and(Node::is_layer)).count();
         h
     };
+    let symbols = doc.symbol_boxes();
     // Isolation mode: only what is inside the isolated container hits. The art around it is
     // locked, and clicks pass through it (#833).
     if editable_only
@@ -109,12 +186,12 @@ fn hit_test_skipping(doc: &Document, p: Point, opt: HitOptions, skip: &dyn Fn(No
         && let Some(mut chain) = doc.ancestry(scope)
     {
         if isolated.is_container() {
-            return hit_children(isolated, p, opt, skip, &mut chain, editable_only).map(finish);
+            return hit_children(isolated, p, opt, &symbols, skip, &mut chain, editable_only).map(finish);
         }
         // A single object isolated (a path, an image…): only it hits, among its siblings.
         chain.pop();
         let parent = chain.last().and_then(|id| doc.node(*id))?;
-        return hit_children(parent, p, opt, &|id| id != scope || skip(id), &mut chain, editable_only).map(finish);
+        return hit_children(parent, p, opt, &symbols, &|id| id != scope || skip(id), &mut chain, editable_only).map(finish);
     }
     let mut chain = Vec::new();
     for layer in doc.layers.iter().rev() {
@@ -127,7 +204,7 @@ fn hit_test_skipping(doc: &Document, p: Point, opt: HitOptions, skip: &dyn Fn(No
         }
         chain.push(layer.id);
         let opt = if matches!(layer.kind, NodeKind::Layer { preview: false, .. }) { HitOptions { outline: true, ..opt } } else { opt };
-        if let Some(h) = hit_children(layer, p, opt, skip, &mut chain, editable_only) {
+        if let Some(h) = hit_children(layer, p, opt, &symbols, skip, &mut chain, editable_only) {
             return Some(finish(h));
         }
         chain.pop();
@@ -150,10 +227,29 @@ fn clip_contains(clip: &Node, p: Point) -> bool {
     clip.clip_shapes(Some(&frame)).iter().any(|(bp, rule)| fill_contains(bp, *rule, p))
 }
 
+/// Can a click at `p` hit `c`, the child `i` of `parent`, or something inside it? Not when it is
+/// hidden, when it can't be edited (`editable_only`), when it is the part of a Shaper group that
+/// isn't shown, or when `p` is outside its reach.
+fn may_hit(parent: &Node, i: usize, c: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes, editable_only: bool) -> bool {
+    let source_isolated = |n: &Node| n.children().and_then(|children| children.first()).is_some_and(|source| Some(source.id) == opt.scope);
+    if parent.extras().shaper.is_some() && (i == 0) != source_isolated(parent) {
+        return false;
+    }
+    // Read-only samples can read locked/template art; hidden art never participates.
+    if !c.visible || editable_only && (c.locked || c.is_template()) {
+        return false;
+    }
+    // (An envelope's content sits where it was, not where the envelope draws it.)
+    edits_contents(c)
+        || c.extras().shaper.is_some() && source_isolated(c)
+        || c.reach_bounds_with(symbols).is_none_or(|b| b.inflate(opt.tol, opt.tol).contains(p))
+}
+
 fn hit_children(
     parent: &Node,
     p: Point,
     opt: HitOptions,
+    symbols: &SymbolBoxes,
     skip: &dyn Fn(NodeId) -> bool,
     chain: &mut Vec<NodeId>,
     editable_only: bool,
@@ -167,36 +263,21 @@ fn hit_children(
         return None;
     }
     for (i, c) in children.iter().enumerate().rev() {
-        if parent.extras().shaper.is_some() {
-            let construction = children.first().is_some_and(|source| Some(source.id) == opt.scope);
-            if (i == 0) != construction {
-                continue;
-            }
-        }
-        // Read-only samples can read locked/template art; hidden art never participates.
-        if !c.visible || editable_only && (c.locked || c.is_template()) || skip(c.id) {
-            continue;
-        }
-        // (An envelope's content sits where it was, not where the envelope draws it.)
-        if !(edits_contents(c)
-            || c.extras().shaper.is_some() && c.children().and_then(|children| children.first()).is_some_and(|source| Some(source.id) == opt.scope))
-            && let Some(b) = c.reach_bounds()
-            && !b.inflate(opt.tol, opt.tol).contains(p)
-        {
+        if !may_hit(parent, i, c, p, opt, symbols, editable_only) || skip(c.id) {
             continue;
         }
         chain.push(c.id);
         let hit = match &c.kind {
             // A sublayer whose Preview is off is clicked in outline, like an outline view.
-            NodeKind::Layer { preview: false, .. } => hit_children(c, p, HitOptions { outline: true, ..opt }, skip, chain, editable_only),
-            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, skip, chain, editable_only),
+            NodeKind::Layer { preview: false, .. } => hit_children(c, p, HitOptions { outline: true, ..opt }, symbols, skip, chain, editable_only),
+            NodeKind::Layer { .. } | NodeKind::Group { .. } => hit_children(c, p, opt, symbols, skip, chain, editable_only),
             // Edit Contents: the envelope's content hits, undistorted.
-            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, skip, chain, editable_only),
+            NodeKind::Envelope { editing: true, .. } => hit_children(c, p, opt, symbols, skip, chain, editable_only),
             // A blend's key objects first (Direct and Group Selection pick them); its steps hit
             // as the blend.
-            NodeKind::Blend { .. } => hit_children(c, p, opt, skip, chain, editable_only)
-                .or_else(|| hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 })),
-            _ => hit_leaf(c, p, opt).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 }),
+            NodeKind::Blend { .. } => hit_children(c, p, opt, symbols, skip, chain, editable_only)
+                .or_else(|| hit_leaf(c, p, opt, symbols).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 })),
+            _ => hit_leaf(c, p, opt, symbols).map(|kind| Hit { leaf: c.id, ancestry: chain.clone(), kind, contents_of: None, layers: 1 }),
         };
         if hit.is_some() {
             return hit;
@@ -216,7 +297,7 @@ fn hit_stroke(n: &Node, bp: &vectorcraft_geom::BezPath, rule: vectorcraft_geom::
     stroke_contains(bp, 0.0, opt.tol, p).then_some(HitKind::Outline)
 }
 
-fn hit_leaf(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
+fn hit_leaf(n: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes) -> Option<HitKind> {
     match &n.kind {
         NodeKind::Path { path, rule, .. } => {
             let bp = path.to_bezpath();
@@ -246,8 +327,8 @@ fn hit_leaf(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
         | NodeKind::PlacedDocument(_)
         | NodeKind::SymbolInstance { .. }
         | NodeKind::Blend { .. }
-        | NodeKind::Envelope { .. } => n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds),
-        NodeKind::Repeat(r) => r.expand().iter().find_map(|g| hit_any(g, p, opt)),
+        | NodeKind::Envelope { .. } => n.geometric_bounds_with(symbols).filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds),
+        NodeKind::Repeat(r) => r.expand().iter().find_map(|g| hit_any(g, p, opt, symbols)),
         NodeKind::Mesh(m) => {
             let bp = m.outline().to_bezpath();
             if stroke_contains(&bp, 0.0, opt.tol, p) {
@@ -282,14 +363,15 @@ fn on_type_path(n: &Node, t: &crate::TextObject, p: Point, tol: f64) -> bool {
 }
 
 /// Hit anywhere in an evaluated subtree (groups recurse; leaves use [`hit_leaf`]).
-fn hit_any(n: &Node, p: Point, opt: HitOptions) -> Option<HitKind> {
+fn hit_any(n: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes) -> Option<HitKind> {
     match &n.kind {
-        NodeKind::Group { children, .. } => children.iter().rev().find_map(|c| hit_any(c, p, opt)),
-        _ => hit_leaf(n, p, opt),
+        NodeKind::Group { children, .. } => children.iter().rev().find_map(|c| hit_any(c, p, opt, symbols)),
+        _ => hit_leaf(n, p, opt, symbols),
     }
 }
 
-/// Objects (children of layers, or of `scope` in isolation mode) touched by a marquee rect.
+/// Objects (children of layers, or of `scope` in isolation mode) touched by a marquee rect. Symbol
+/// instances are measured by their art ([`Node::geometric_bounds_with`]).
 pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) -> Vec<NodeId> {
     let mut out = Vec::new();
     let tops: Vec<&std::sync::Arc<Node>> = match scope.and_then(|s| doc.node(s)) {
@@ -320,38 +402,44 @@ pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) ->
         }
         out
     }
-    fn touches(n: &Node, r: Rect) -> bool {
+    fn touches(n: &Node, s: &SymbolBoxes, r: Rect) -> bool {
         match &n.kind {
             NodeKind::Path { path, .. } => vectorcraft_geom::hit::intersects_rect(path, r),
             NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Compound { children, .. } => {
-                children.iter().any(|c| c.visible && touches(c, r))
+                children.iter().any(|c| c.visible && touches(c, s, r))
             }
-            _ => n.geometric_bounds().is_some_and(|b| b.intersect(r).area() > 0.0 || r.contains(b.origin())),
+            // A box with no width or no height (an instance of a symbol that draws a straight
+            // line) is touched where the marquee crosses it.
+            _ => n.geometric_bounds_with(s).is_some_and(|b| {
+                let crosses = (b.width() == 0.0 || b.height() == 0.0) && b.x0 <= r.x1 && r.x0 <= b.x1 && b.y0 <= r.y1 && r.y0 <= b.y1;
+                b.intersect(r).area() > 0.0 || r.contains(b.origin()) || crosses
+            }),
         }
     }
-    fn collect_leaves(n: &Node, r: Rect, out: &mut Vec<NodeId>) {
+    fn collect_leaves(n: &Node, s: &SymbolBoxes, r: Rect, out: &mut Vec<NodeId>) {
         match &n.kind {
             NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } => {
                 for c in children {
                     if c.visible && !c.locked {
-                        collect_leaves(c, r, out);
+                        collect_leaves(c, s, r, out);
                     }
                 }
             }
             _ => {
-                if touches(n, r) {
+                if touches(n, s, r) {
                     out.push(n.id);
                 }
             }
         }
     }
+    let symbols = doc.symbol_boxes();
     for t in tops {
         if !t.visible || t.locked {
             continue;
         }
         if leaves {
-            collect_leaves(t, r, &mut out);
-        } else if touches(t, r) {
+            collect_leaves(t, &symbols, r, &mut out);
+        } else if touches(t, &symbols, r) {
             out.push(t.id);
         }
     }
@@ -619,6 +707,167 @@ world",
         assert!(at(90.0, None).is_empty());
     }
 
+    /// Many overlapping paths: Select Behind must list each exactly once, front to back.
+    /// This is quadratic with repeated full-document hit tests, but linear in tree size with
+    /// the per-object walk.
+    #[test]
+    fn objects_at_large_overlapping_stack() {
+        let mut d = Document::new(100.0, 100.0);
+        let layer = d.layers[0].id;
+        let mut ids = Vec::new();
+        for _ in 0..256 {
+            let id = d.alloc_id();
+            d.insert(Some(layer), usize::MAX, Node::path(id, shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art())).unwrap();
+            ids.push(id);
+        }
+        ids.reverse();
+        assert_eq!(objects_at(&d, Point::new(25.0, 25.0), HitOptions::default(), None), ids);
+    }
+
+    /// Match the original skip-and-retest algorithm for normal groups, sublayers, clipping,
+    /// invisibility, and path/outline-only settings.
+    #[test]
+    fn objects_at_one_pass_matches_repeated_hits() {
+        let mut d = Document::new(200.0, 200.0);
+        let layer = d.layers[0].id;
+        let add = |d: &mut Document, parent, bounds| {
+            let id = d.alloc_id();
+            d.insert(Some(parent), usize::MAX, Node::path(id, shapes::rectangle(bounds), Appearance::default_art())).unwrap();
+            id
+        };
+        add(&mut d, layer, Rect::new(0.0, 0.0, 60.0, 60.0));
+        let sub = d.alloc_id();
+        d.insert(Some(layer), usize::MAX, Node::layer(sub, "Sublayer", crate::LayerColor::Preset(2))).unwrap();
+        add(&mut d, sub, Rect::new(0.0, 0.0, 60.0, 60.0));
+        let group = d.alloc_id();
+        d.insert(Some(layer), usize::MAX, Node::group(group, Vec::new())).unwrap();
+        add(&mut d, group, Rect::new(0.0, 0.0, 60.0, 60.0));
+        add(&mut d, group, Rect::new(5.0, 5.0, 60.0, 60.0));
+        let clip = d.alloc_id();
+        let mask = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(5.0, 5.0, 45.0, 45.0)), Appearance::default_art());
+        let content = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 80.0, 80.0)), Appearance::default_art());
+        let mut clipping = Node::group(clip, vec![Arc::new(mask), Arc::new(content)]);
+        clipping.set_clips(true);
+        d.insert(Some(layer), usize::MAX, clipping).unwrap();
+        for (point, opt) in [
+            (Point::new(25.0, 25.0), HitOptions::default()),
+            (Point::new(3.0, 25.0), HitOptions::default()),
+            (Point::new(25.0, 25.0), HitOptions { outline: true, ..Default::default() }),
+            (Point::new(6.0, 25.0), HitOptions { path_only: true, ..Default::default() }),
+            (Point::new(100.0, 100.0), HitOptions::default()),
+        ] {
+            assert_eq!(objects_at(&d, point, opt, None), objects_at_repeated(&d, point, opt, None), "point={point:?}, opt={opt:?}");
+        }
+        if let NodeKind::Layer { preview, .. } = &mut d.node_mut(sub).unwrap().kind {
+            *preview = false;
+        }
+        let p = Point::new(25.0, 25.0);
+        let opt = HitOptions::default();
+        assert_eq!(objects_at(&d, p, opt, None), objects_at_repeated(&d, p, opt, None));
+        d.node_mut(group).unwrap().locked = true;
+        assert_eq!(objects_at(&d, p, opt, None), objects_at_repeated(&d, p, opt, None));
+    }
+
+    /// Documents built at random (nested groups, sublayers, clipping groups, compound paths, blends
+    /// of nothing, hidden and locked objects, outline layers): Select Behind lists the same objects
+    /// in the same order as the hit test repeated over what is left.
+    #[test]
+    fn objects_at_matches_repeated_hits_on_random_documents() {
+        let mut seed = 0x9e37_79b9_u32;
+        let mut next = move |n: u32| {
+            seed ^= seed << 13;
+            seed ^= seed >> 17;
+            seed ^= seed << 5;
+            seed % n
+        };
+        fn fill(d: &mut Document, parent: NodeId, depth: u32, next: &mut impl FnMut(u32) -> u32) {
+            for _ in 0..2 + next(4) {
+                let id = d.alloc_id();
+                let (x, y) = (f64::from(next(60)), f64::from(next(60)));
+                let rect = Rect::new(x, y, x + 10.0 + f64::from(next(50)), y + 10.0 + f64::from(next(50)));
+                let appearance = if next(4) == 0 { Appearance::default() } else { Appearance::default_art() };
+                let mut n = match next(if depth < 3 { 8 } else { 4 }) {
+                    4 | 5 => Node::group(id, Vec::new()),
+                    6 => Node::layer(id, "Sublayer", crate::LayerColor::Preset(2)),
+                    7 => {
+                        let mut g = Node::group(id, Vec::new());
+                        g.set_clips(true);
+                        g
+                    }
+                    _ => Node::path(id, shapes::rectangle(rect), appearance),
+                };
+                n.visible = next(8) != 0;
+                n.locked = next(8) == 0;
+                if let NodeKind::Layer { preview, .. } = &mut n.kind {
+                    *preview = next(3) != 0;
+                }
+                let container = n.is_container();
+                // A sublayer belongs in a layer; in a group it is a group like another to the hit test.
+                d.insert(Some(parent), usize::MAX, n).unwrap();
+                if container {
+                    fill(d, id, depth + 1, next);
+                }
+            }
+        }
+        for round in 0..200 {
+            let mut d = Document::new(120.0, 120.0);
+            let layer = d.layers[0].id;
+            fill(&mut d, layer, 0, &mut next);
+            for _ in 0..12 {
+                let p = Point::new(f64::from(next(120)), f64::from(next(120)));
+                let opt = HitOptions { outline: next(5) == 0, path_only: next(5) == 0, ..Default::default() };
+                assert_eq!(objects_at(&d, p, opt, None), objects_at_repeated(&d, p, opt, None), "round {round}, {p:?}, {opt:?}");
+            }
+        }
+    }
+
+    /// Select Behind finds a symbol instance by its symbol's art, as a click does: art from
+    /// (100, 60) to (140, 80), outside the 20 × 20 square around the origin, drawn where it lies by
+    /// one instance and 100 pt lower by an instance in a group.
+    #[test]
+    fn objects_at_finds_symbol_instances_by_their_art() {
+        let mut d = Document::new(200.0, 200.0);
+        let art = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(100.0, 60.0, 140.0, 80.0)), Appearance::default_art());
+        d.symbols.push(crate::Symbol { name: "Far".into(), art: Arc::new(art) });
+        let (layer, top, inner, group) = (d.layers[0].id, d.alloc_id(), d.alloc_id(), d.alloc_id());
+        let instance =
+            |id, dy: f64| Node::new(id, NodeKind::SymbolInstance { symbol: "Far".into(), xf: vectorcraft_geom::Affine::translate((0.0, dy)) });
+        d.insert(Some(layer), 0, instance(top, 0.0)).unwrap();
+        d.insert(Some(layer), 1, Node::group(group, vec![Arc::new(instance(inner, 100.0))])).unwrap();
+        let opt = HitOptions::default();
+        for (x, y, want) in [(120.0, 70.0, vec![top]), (120.0, 170.0, vec![group]), (0.0, 0.0, vec![]), (0.0, 100.0, vec![])] {
+            let p = Point::new(x, y);
+            assert_eq!(objects_at(&d, p, opt, None), want, "{p:?}");
+            assert_eq!(objects_at_repeated(&d, p, opt, None), want, "{p:?}");
+        }
+    }
+
+    /// Edit Contents can expose descendants of a top-level group: preserve the original
+    /// selection order by falling back to the general hit traversal.
+    #[test]
+    fn objects_at_edit_contents_uses_general_order() {
+        let mut d = Document::new(100.0, 100.0);
+        let layer = d.layers[0].id;
+        let inner = |id| Arc::new(Node::path(id, shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art()));
+        let (a, b) = (d.alloc_id(), d.alloc_id());
+        let e = Node::new(
+            d.alloc_id(),
+            NodeKind::Envelope {
+                content: vec![inner(a), inner(b)],
+                kind: Box::new(crate::live::EnvelopeKind::Warp { style: "arc".to_string(), bend: 0.0, h: 0.0, v: 0.0, horizontal: true }),
+                fidelity: 100.0,
+                editing: true,
+                options: Default::default(),
+                frame: Box::new(vectorcraft_geom::Affine::IDENTITY),
+            },
+        );
+        d.insert(Some(layer), usize::MAX, e).unwrap();
+        let p = Point::new(25.0, 25.0);
+        let opt = HitOptions::default();
+        assert_eq!(objects_at(&d, p, opt, None), objects_at_repeated(&d, p, opt, None));
+        assert_eq!(objects_at(&d, p, opt, None), vec![b, a]);
+    }
+
     #[test]
     fn locked_and_hidden_skip() {
         let mut d = Document::new(200.0, 200.0);

crates/doc/src/lib.rs

@@ -11,6 +11,7 @@ pub mod blend;
 pub mod clipnest;
 pub mod cmyk;
 pub mod corners;
+pub mod depth;
 pub mod graph;
 pub mod hit;
 mod id_index;
@@ -43,9 +44,12 @@ pub mod shaper;
 pub mod slices;
 pub mod style_libs;
 pub mod swatches;
+mod symbols;
+pub use symbols::SymbolBoxes;
 pub mod text;
 pub mod trace;
 pub mod variables;
+pub mod xml_id;
 
 use std::collections::BTreeMap;
 use std::sync::Arc;
@@ -76,6 +80,7 @@ pub use appearance::{
 };
 pub use assets::ExportAsset;
 pub use corners::LiveCorners;
+pub use depth::MAX_DEPTH;
 pub use graph::{
     GraphDesign, GraphKind, GraphSpec, LabelStyles, MAX_GRAPH_CATEGORIES, MAX_GRAPH_SERIES, PiePosition, PieSort, SeriesPaint, TickLength,
     ValueAxisSide,
@@ -1207,33 +1212,36 @@ impl Document {
             _ => LAYER_COLORS[0].1,
         }
     }
-    /// Union of the geometric bounds of `ids`.
+    /// Union of the geometric bounds of `ids` (their visual bounds when `visual`), with symbol
+    /// instances measured by their art ([`Node::geometric_bounds_with`]).
     pub fn bounds_of(&self, ids: &[NodeId], visual: bool) -> Option<Rect> {
-        ids.iter()
-            .filter_map(|id| self.node(*id))
-            .fold(None, |acc, n| vectorcraft_geom::union_opt(acc, if visual { n.visual_bounds() } else { n.geometric_bounds() }))
+        let symbols = self.symbol_boxes();
+        ids.iter().filter_map(|id| self.node(*id)).fold(None, |acc, n| {
+            vectorcraft_geom::union_opt(acc, if visual { n.visual_bounds_with(&symbols) } else { n.geometric_bounds_with(&symbols) })
+        })
     }
-    /// Bounds of all art.
+    /// Visual bounds of all art, with symbol instances measured by their art.
     pub fn art_bounds(&self) -> Option<Rect> {
-        self.layers.iter().fold(None, |acc, l| vectorcraft_geom::union_opt(acc, l.visual_bounds()))
+        let symbols = self.symbol_boxes();
+        self.layers.iter().fold(None, |acc, l| vectorcraft_geom::union_opt(acc, l.visual_bounds_with(&symbols)))
     }
     /// Artboard index containing point `p` (topmost = last).
     pub fn artboard_at(&self, p: Point) -> Option<usize> {
         self.artboards.iter().rposition(|a| a.rect.contains(p))
     }
     /// The art that moves with an artboard at `rect`: top-level objects (children of layers and
-    /// sublayers) lying entirely inside it. Locked and hidden objects and layers stay put unless
-    /// `locked_and_hidden` (Selection & Anchor Display › Move Locked and Hidden Artwork with
-    /// Artboard).
+    /// sublayers) lying entirely inside it, with symbol instances measured by their art. Locked and
+    /// hidden objects and layers stay put unless `locked_and_hidden` (Selection & Anchor Display ›
+    /// Move Locked and Hidden Artwork with Artboard).
     pub fn art_on_artboard(&self, rect: Rect, locked_and_hidden: bool) -> Vec<NodeId> {
         // Art drawn flush with the artboard can end up a rounding error outside it (a background
         // 3e-14 pt past the top edge, #1295): a millionth of a point is far below anything visible.
         let rect = rect.inflate(1e-6, 1e-6);
-        fn collect(n: &Node, rect: Rect, all: bool, out: &mut Vec<NodeId>) {
+        fn collect(n: &Node, s: &SymbolBoxes, rect: Rect, all: bool, out: &mut Vec<NodeId>) {
             for c in n.children().into_iter().flatten().filter(|c| c.rides_with_artboard(all)) {
                 if c.is_layer() {
-                    collect(c, rect, all, out);
-                } else if let Some(b) = c.geometric_bounds()
+                    collect(c, s, rect, all, out);
+                } else if let Some(b) = c.geometric_bounds_with(s)
                     // Inside it, edges included: art flush with the right or bottom edge is on it too
                     // (`Rect::contains` leaves those out, #890).
                     && b.x0 >= rect.x0
@@ -1245,9 +1253,10 @@ impl Document {
                 }
             }
         }
+        let symbols = self.symbol_boxes();
         let mut art = vec![];
         for l in self.layers.iter().filter(|l| l.rides_with_artboard(locked_and_hidden)) {
-            collect(l, rect, locked_and_hidden, &mut art);
+            collect(l, &symbols, rect, locked_and_hidden, &mut art);
         }
         art
     }
@@ -1562,6 +1571,17 @@ mod tests {
         }
     }
 
+    #[test]
+    fn art_on_artboard_measures_a_symbol_instance_by_its_art() {
+        let mut d = Document::new(612.0, 792.0);
+        let art = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::default_art());
+        d.symbols.push(Symbol { name: "Box".into(), art: Arc::new(art) });
+        let (layer, id) = (d.layers[0].id, d.alloc_id());
+        d.insert(Some(layer), 0, Node::new(id, NodeKind::SymbolInstance { symbol: "Box".into(), xf: Affine::translate((2.0, 2.0)) })).unwrap();
+        // The art, (2, 2) to (12, 12), lies inside; the 20 × 20 square, (-8, -8) to (12, 12), doesn't.
+        assert_eq!(d.art_on_artboard(Rect::new(0.0, 0.0, 15.0, 15.0), false), vec![id]);
+    }
+
     #[test]
     fn find_and_paths() {
         let (d, a, b) = doc_with_rects();

crates/doc/src/live.rs

@@ -318,8 +318,10 @@ impl WarpStyle {
     }
 }
 
-/// The warp map on normalised coordinates: `b` = bend (-1..1), `dh`/`dv` = distortion (-1..1).
-pub fn warp_point(style: WarpStyle, b: f64, dh: f64, dv: f64, x: f64, y: f64) -> (f64, f64) {
+/// The warp map on normalised coordinates: `b` = bend (-1..1), `dh`/`dv` = distortion (-1..1);
+/// `aspect` is the box's half-height over its half-width along the warp (Arc bends in real
+/// proportions).
+pub fn warp_point(style: WarpStyle, b: f64, dh: f64, dv: f64, aspect: f64, x: f64, y: f64) -> (f64, f64) {
     use WarpStyle::*;
     let t = (y + 1.0) / 2.0; // 0 at top, 1 at bottom
     let par = 1.0 - x * x; // parabola: 1 at centre, 0 at sides
@@ -328,14 +330,18 @@ pub fn warp_point(style: WarpStyle, b: f64, dh: f64, dv: f64, x: f64, y: f64) ->
             if b.abs() < 1e-6 {
                 (x, y)
             } else {
-                // Bend the centre line into a circular arc of equal length (sweep = |b|·180°).
+                // Bend the centre line into a circular arc of equal length (sweep = |b|·180°), in
+                // the box's real proportions (lengths in half-widths, so y counts `aspect` each):
+                // the edges are concentric arcs, and one that would pass the centre stops there
+                // instead of folding over (#1578).
+                let k = if aspect.is_finite() && aspect > 0.0 { aspect } else { 1.0 };
                 let sweep = b.abs() * PI;
                 let r0 = 2.0 / sweep;
-                let yy = if b > 0.0 { y } else { -y };
+                let yy = if b > 0.0 { y } else { -y } * k;
                 let a = x / r0;
-                let r = r0 - yy;
+                let r = (r0 - yy).max(0.0);
                 let (s, c) = a.sin_cos();
-                let (nx, ny) = (r * s, r0 - r * c);
+                let (nx, ny) = (r * s, (r0 - r * c) / k);
                 (nx, if b > 0.0 { ny } else { -ny })
             }
         }
@@ -1122,9 +1128,9 @@ fn surface_of<'a>(kind: &'a EnvelopeKind, src: Rect, frame: Affine) -> Box<dyn F
             Box::new(move |u: f64, v: f64| {
                 let (x, y) = (2.0 * u - 1.0, 2.0 * v - 1.0);
                 let (x2, y2) = if horizontal {
-                    warp_point(st, b, dh, dv, x, y)
+                    warp_point(st, b, dh, dv, hh / hw.max(1e-9), x, y)
                 } else {
-                    let (a, b2) = warp_point(st, b, dh, dv, y, x);
+                    let (a, b2) = warp_point(st, b, dh, dv, hw / hh.max(1e-9), y, x);
                     (b2, a)
                 };
                 frame * Point::new(c.x + x2 * hw, c.y + y2 * hh)
@@ -1699,11 +1705,23 @@ pub fn subtree_has_live(n: &Node) -> bool {
     any
 }
 
-/// Largest stroke outset in a subtree (for visual bounds of envelopes).
-pub(crate) fn max_outset(nodes: &[Arc<Node>]) -> f64 {
+/// Largest stroke outset in a subtree (for visual bounds of envelopes). With `symbols`, the
+/// outsets in the art of the symbols its instances show count too
+/// ([`crate::symbols::ArtBox::reach`]), grown by [`crate::SymbolBoxes::brush_pad`]. In boxes made
+/// by [`crate::SymbolBoxes::without_art_strokes`], the outsets in the art do not count, and the pad
+/// does.
+pub(crate) fn max_outset(nodes: &[Arc<Node>], symbols: Option<&crate::SymbolBoxes>) -> f64 {
     let mut o = 0.0f64;
     for n in nodes {
-        n.walk(&mut |c| o = o.max(c.appearance.outset()));
+        n.walk(&mut |c| {
+            o = o.max(c.appearance.outset());
+            if let (Some(s), NodeKind::SymbolInstance { symbol, .. }) = (symbols, &c.kind)
+                && let Some(art) = s.art(symbol)
+            {
+                let reach = if s.art_strokes() { art.reach } else { 0.0 };
+                o = o.max(reach + s.brush_pad(symbol));
+            }
+        });
     }
     o
 }
@@ -1711,6 +1729,31 @@ pub(crate) fn max_outset(nodes: &[Arc<Node>]) -> f64 {
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    /// #1578: Arc bends in the box's real proportions. In half-width units (y scaled by the
+    /// aspect), the top and bottom edges are concentric circles about the bend's centre, at their
+    /// real distance from the centre line; an inner edge that would pass the centre stops there.
+    #[test]
+    fn arc_warp_is_round_in_real_proportions() {
+        for (aspect, b) in [(0.25, 0.1), (0.25, 0.5), (0.25, 1.0), (1.0, 0.5), (2.0, 0.3)] {
+            let r0 = 2.0 / (b * PI);
+            for (y, r) in [(-1.0, r0 + aspect), (1.0, (r0 - aspect).max(0.0))] {
+                for i in 0..=10 {
+                    let x = -1.0 + 0.2 * f64::from(i);
+                    let (nx, ny) = warp_point(WarpStyle::Arc, b, 0.0, 0.0, aspect, x, y);
+                    let d = nx.hypot(ny * aspect - r0);
+                    assert!((d - r).abs() < 1e-9, "aspect {aspect}, bend {b}, y {y}, x {x}: {d} vs {r}");
+                }
+            }
+        }
+        // At 100 % on a square the inner edge meets at the centre instead of folding over.
+        let (nx, _) = warp_point(WarpStyle::Arc, 1.0, 0.0, 0.0, 1.0, 0.8, 1.0);
+        assert!(nx.abs() < 1e-12);
+        // A square bent less than that is what it always was.
+        let (nx, ny) = warp_point(WarpStyle::Arc, 0.5, 0.0, 0.0, 1.0, 0.5, 0.25);
+        let (r0, a) = (4.0 / PI, 0.5 / (4.0 / PI));
+        assert!((nx - (r0 - 0.25) * a.sin()).abs() < 1e-12 && (ny - (r0 - (r0 - 0.25) * a.cos())).abs() < 1e-12);
+    }
     use vectorcraft_geom::shapes;
 
     fn rect_node(x: f64, y: f64, w: f64, h: f64, c: Color) -> Arc<Node> {

crates/doc/src/node.rs

@@ -11,6 +11,7 @@ use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect};
 use crate::appearance::Appearance;
 use crate::live::{BlendSpec, EnvelopeKind, GradientMesh, Outliner};
 use crate::pattern::RepeatSpec;
+use crate::symbols::{SYMBOL_SQUARE, SymbolBoxes};
 use crate::text::TextObject;
 
 /// Stable per-document object id. Never reused.
@@ -977,6 +978,12 @@ impl Node {
             _ => format!("<{}>", self.kind_label()),
         }
     }
+
+    /// [`Self::display_name`], or its XML id when Preferences › Units › Identify Objects By is XML ID.
+    pub fn identify_label(&self, xml_id: bool) -> String {
+        let name = self.display_name();
+        if xml_id { crate::xml_id::from_object_name(&name) } else { name }
+    }
     /// Path data for path nodes.
     pub fn path_data(&self) -> Option<&PathData> {
         match &self.kind {
@@ -1004,52 +1011,101 @@ impl Node {
     }
     /// A quick box round everything the object can paint, for culling clicks: paths and compound
     /// paths grow their geometric bounds by the farthest their strokes can reach from any path
-    /// ([`Appearance::outset`]) instead of measuring along their shape.
+    /// ([`Appearance::outset`]) instead of measuring along their shape. Symbol instances are
+    /// measured as in [`Node::visual_bounds`].
     pub fn reach_bounds(&self) -> Option<Rect> {
+        self.reach(None)
+    }
+    /// [`Node::reach_bounds`] with symbol instances measured by their symbol's art box from
+    /// `symbols`. An instance that only moves its art is measured as the art's visual box moved,
+    /// and any other instance is measured as its geometric box ([`Node::geometric_bounds_with`])
+    /// grown by the farthest a stroke in the art can reach.
+    pub fn reach_bounds_with(&self, symbols: &SymbolBoxes) -> Option<Rect> {
+        symbols.quickly(|| self.reach(Some(symbols)))
+    }
+    /// The box of [`Node::reach_bounds`], or of [`Node::reach_bounds_with`] when `symbols` is given.
+    pub(crate) fn reach(&self, symbols: Option<&SymbolBoxes>) -> Option<Rect> {
         match &self.kind {
             NodeKind::Path { .. } | NodeKind::Compound { .. } => {
                 let o = self.appearance.outset();
-                self.geometric_bounds().map(|b| b.inflate(o, o))
+                self.geometric(symbols).map(|b| b.inflate(o, o))
             }
-            _ => self.visual_bounds(),
+            _ => self.visual(symbols),
         }
     }
-    /// Geometric bounds (no stroke), recursively. Clip groups are bounded by their clip path.
+    /// Geometric bounds (no stroke), recursively. Clip groups are bounded by their clip path. A
+    /// symbol instance is measured as its transform applied to the 20 × 20 square around the origin
+    /// that symbols made in the app keep their art in ([`Node::geometric_bounds_with`] measures
+    /// its art).
     pub fn geometric_bounds(&self) -> Option<Rect> {
+        self.geometric(None)
+    }
+    /// [`Node::geometric_bounds`] with each symbol instance measured as its transform applied to
+    /// its symbol's art box from `symbols`. An instance is measured as the square when its symbol
+    /// is missing, when its symbol or a symbol nested in its art holds an instance of itself, and
+    /// when symbols nest 32 deep in its art.
+    pub fn geometric_bounds_with(&self, symbols: &SymbolBoxes) -> Option<Rect> {
+        self.geometric(Some(symbols))
+    }
+    /// The box of [`Node::geometric_bounds`], or of [`Node::geometric_bounds_with`] when `symbols`
+    /// is given.
+    pub(crate) fn geometric(&self, symbols: Option<&SymbolBoxes>) -> Option<Rect> {
+        let union = |nodes: &[Arc<Node>]| nodes.iter().fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.geometric(symbols)));
         match &self.kind {
             NodeKind::Path { path, .. } => path.bounds(),
             NodeKind::Group { children, clip: true } | NodeKind::Layer { children, clip: true, .. } => {
-                children.first().and_then(|c| c.geometric_bounds())
+                children.first().and_then(|c| c.geometric(symbols))
             }
             NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Compound { children, .. } => children
                 .iter()
                 .skip(usize::from(self.extras().shaper.is_some()))
                 .filter(|c| c.visible || !matches!(self.kind, NodeKind::Layer { .. }))
-                .fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.geometric_bounds())),
+                .fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.geometric(symbols))),
             NodeKind::Text(t) => self.projected(t.bounds()),
             NodeKind::Image(im) => Some(im.xf.transform_rect_bbox(Rect::new(0.0, 0.0, im.width as f64, im.height as f64))),
-            NodeKind::SymbolInstance { xf, .. } => self.projected(Some(xf.transform_rect_bbox(Rect::new(-10.0, -10.0, 10.0, 10.0)))),
-            NodeKind::Blend { children, spec } => {
-                let b = crate::live::nodes_bounds(children);
-                vectorcraft_geom::union_opt(b, spec.spine.as_ref().and_then(|s| s.bounds()))
+            NodeKind::SymbolInstance { symbol, xf } => {
+                let art = symbols.and_then(|s| s.art(symbol)).map_or(SYMBOL_SQUARE, |a| a.geometric);
+                self.projected(Some(xf.transform_rect_bbox(art)))
             }
+            NodeKind::Blend { children, spec } => vectorcraft_geom::union_opt(union(children), spec.spine.as_ref().and_then(|s| s.bounds())),
             NodeKind::Envelope { content, kind, frame, .. } => crate::live::envelope_bounds(content, kind, **frame),
             NodeKind::Mesh(m) => m.bounds(),
-            NodeKind::Repeat(r) => r.bounds(),
+            // Each copy is measured where the repeat draws it: `RepeatSpec::transforms` lays the
+            // copies out by the source's bounds measured without the document.
+            NodeKind::Repeat(r) => r.copies_bounds(union(&r.source)?),
             NodeKind::PlacedDocument(p) => Some(p.bounds()),
         }
     }
     /// Visual bounds: what the object paints, its strokes included (paths and compound paths
-    /// measure theirs along their own shape, see [`Appearance::stroked_bounds`]).
+    /// measure theirs along their own shape, see [`Appearance::stroked_bounds`]). A symbol
+    /// instance is measured as in [`Node::geometric_bounds`], grown by its own strokes' reach
+    /// ([`Node::visual_bounds_with`] measures its art).
     pub fn visual_bounds(&self) -> Option<Rect> {
+        self.visual(None)
+    }
+    /// [`Node::visual_bounds`] with symbol instances measured by their symbol's art from
+    /// `symbols`, the strokes in it included. An instance that only moves its art is measured as
+    /// the art's visual box moved. Any other instance is measured as its art transformed by it with
+    /// the strokes at their own weight, as the renderer draws it, and never smaller than its
+    /// geometric box ([`Node::geometric_bounds_with`]). Instances inside symbol art are measured as
+    /// in [`Node::reach_bounds_with`]. In boxes made by [`SymbolBoxes::with_brush_art`], the box of
+    /// an instance whose art holds brushed strokes grows by as far as their brush art can paint. In
+    /// boxes made by [`SymbolBoxes::without_art_strokes`], an instance is measured as its art's
+    /// geometric box placed by its transform, grown by its own strokes.
+    pub fn visual_bounds_with(&self, symbols: &SymbolBoxes) -> Option<Rect> {
+        self.visual(Some(symbols))
+    }
+    /// The box of [`Node::visual_bounds`], or of [`Node::visual_bounds_with`] when `symbols` is
+    /// given.
+    pub(crate) fn visual(&self, symbols: Option<&SymbolBoxes>) -> Option<Rect> {
         match &self.kind {
             NodeKind::Group { children, clip: true } | NodeKind::Layer { children, clip: true, .. } => {
                 // A clipping path that paints (see `clip_paint`) strokes over the clip edge.
                 let clip = children.first()?;
                 if matches!(clip.kind, NodeKind::Path { .. } | NodeKind::Compound { .. } | NodeKind::Text(_)) {
-                    clip.visual_bounds()
+                    clip.visual(symbols)
                 } else {
-                    clip.geometric_bounds()
+                    clip.geometric(symbols)
                 }
             }
             NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } => {
@@ -1058,25 +1114,41 @@ impl Node {
                 children
                     .iter()
                     .skip(usize::from(self.extras().shaper.is_some()))
-                    .fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.visual_bounds()))
+                    .fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.visual(symbols)))
                     .map(|b| b.inflate(o, o))
             }
             NodeKind::Blend { children, spec } => {
-                let b = children.iter().fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.visual_bounds()));
-                let o = crate::live::max_outset(children);
+                let b = children.iter().fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.visual(symbols)));
+                let o = crate::live::max_outset(children, symbols);
                 vectorcraft_geom::union_opt(b, spec.spine.as_ref().and_then(|s| s.bounds()).map(|r| r.inflate(o, o)))
             }
             NodeKind::Envelope { content, .. } | NodeKind::Repeat(RepeatSpec { source: content, .. }) => {
-                let o = crate::live::max_outset(content);
-                self.geometric_bounds().map(|b| b.inflate(o, o))
+                let o = crate::live::max_outset(content, symbols);
+                self.geometric(symbols).map(|b| b.inflate(o, o))
             }
             NodeKind::Path { .. } | NodeKind::Compound { .. } => {
-                let b = self.geometric_bounds()?;
+                let b = self.geometric(symbols)?;
                 Some(self.appearance.stroked_bounds(b, || self.stroke_path().unwrap_or_default()))
             }
+            NodeKind::SymbolInstance { symbol, xf } => {
+                let b = match symbols.and_then(|s| Some((s, s.art(symbol)?))) {
+                    Some((s, art)) if !s.art_strokes() => xf.transform_rect_bbox(art.geometric),
+                    Some((_, art)) if moves_only(*xf) => xf.transform_rect_bbox(art.visual),
+                    Some((s, art)) => {
+                        let placed = xf.transform_rect_bbox(art.geometric);
+                        match s.placed_visual(symbol, *xf) {
+                            Some(v) => v.union(placed),
+                            None => placed.inflate(art.reach, art.reach),
+                        }
+                    }
+                    None => xf.transform_rect_bbox(SYMBOL_SQUARE),
+                };
+                let o = self.appearance.outset() + symbols.map_or(0.0, |s| s.brush_pad(symbol));
+                self.projected(Some(b)).map(|b| b.inflate(o, o))
+            }
             _ => {
                 let o = self.appearance.outset();
-                self.geometric_bounds().map(|b| b.inflate(o, o))
+                self.geometric(symbols).map(|b| b.inflate(o, o))
             }
         }
     }

crates/doc/src/orient.rs

@@ -5,7 +5,7 @@
 
 use vectorcraft_geom::{Affine, Point, Rect, Vec2, normalize_deg, union_opt};
 
-use crate::{Document, Node, NodeId, NodeKind};
+use crate::{Document, Node, NodeId, NodeKind, SymbolBoxes};
 
 /// Angles closer than this (degrees) are the same.
 const EPS_DEG: f64 = 1e-6;
@@ -86,11 +86,12 @@ pub fn transformed_angle(angle: f64, a: Affine) -> f64 {
 
 impl Node {
     /// Bounds of this object as `a` would place it (geometric, or `visual` with its strokes),
-    /// without changing it.
-    pub fn bounds_in(&self, a: Affine, visual: bool) -> Option<Rect> {
+    /// without changing it, symbol instances measured by their art from `symbols`
+    /// ([`Node::geometric_bounds_with`]).
+    pub fn bounds_in(&self, symbols: &SymbolBoxes, a: Affine, visual: bool) -> Option<Rect> {
         match &self.kind {
             NodeKind::Group { children, clip: false } => {
-                let b = children.iter().fold(None, |acc, c| union_opt(acc, c.bounds_in(a, visual)));
+                let b = children.iter().fold(None, |acc, c| union_opt(acc, c.bounds_in(symbols, a, visual)));
                 // The group's own strokes paint around its members (as in `visual_bounds`).
                 let o = if visual { self.appearance.outset() } else { 0.0 };
                 b.map(|b| b.inflate(o, o))
@@ -98,12 +99,12 @@ impl Node {
             NodeKind::Group { children, clip: true } => {
                 let clip = children.first()?;
                 let stroked = matches!(clip.kind, NodeKind::Path { .. } | NodeKind::Compound { .. } | NodeKind::Text(_));
-                clip.bounds_in(a, visual && stroked)
+                clip.bounds_in(symbols, a, visual && stroked)
             }
             _ => {
                 let mut n = self.clone();
                 n.transform(a, false);
-                if visual { n.visual_bounds() } else { n.geometric_bounds() }
+                if visual { n.visual_bounds_with(symbols) } else { n.geometric_bounds_with(symbols) }
             }
         }
     }
@@ -117,14 +118,16 @@ impl Document {
         if angles.all(|a| normalize_deg(a - first).abs() <= EPS_DEG) { first } else { 0.0 }
     }
     /// The bounding box of `ids` square to their shared angle ([`Document::bbox_angle`]):
-    /// geometric bounds, or `visual` with their strokes.
+    /// geometric bounds, or `visual` with their strokes, symbol instances measured by their art
+    /// ([`Document::bounds_of`]).
     pub fn oriented_bounds(&self, ids: &[NodeId], visual: bool) -> Option<OrientedBox> {
         let angle = self.bbox_angle(ids);
         if angle == 0.0 {
             return self.bounds_of(ids, visual).map(OrientedBox::aligned);
         }
         let to_local = OrientedBox { angle, rect: Rect::ZERO }.to_doc().inverse();
-        let rect = ids.iter().filter_map(|id| self.node(*id)).fold(None, |acc, n| union_opt(acc, n.bounds_in(to_local, visual)))?;
+        let symbols = self.symbol_boxes();
+        let rect = ids.iter().filter_map(|id| self.node(*id)).fold(None, |acc, n| union_opt(acc, n.bounds_in(&symbols, to_local, visual)))?;
         Some(OrientedBox { angle, rect })
     }
 }
@@ -192,4 +195,19 @@ mod tests {
         d.move_node(id, Some(g), 0).unwrap();
         assert_eq!(d.oriented_bounds(&[g], false).unwrap().angle, 0.0);
     }
+
+    #[test]
+    fn oriented_bounds_hug_a_rotated_symbol_instances_art() {
+        let mut d = Document::new(500.0, 500.0);
+        let bar = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 40.0, 10.0)), Appearance::default_art());
+        d.symbols.push(crate::Symbol { name: "Bar".into(), art: std::sync::Arc::new(bar) });
+        let (l, id) = (d.layers[0].id, d.alloc_id());
+        d.insert(Some(l), 0, Node::new(id, NodeKind::SymbolInstance { symbol: "Bar".into(), xf: Affine::translate((100.0, 100.0)) })).unwrap();
+        let c = Point::new(120.0, 105.0);
+        d.node_mut(id).unwrap().transform(Affine::translate(c.to_vec2()) * rot(30.0) * Affine::translate(-c.to_vec2()), false);
+        let b = d.oriented_bounds(&[id], false).unwrap();
+        assert!(close(b.angle, 30.0));
+        assert!(close(b.rect.width(), 40.0) && close(b.rect.height(), 10.0), "the bar, not the 20 × 20 square: {b:?}");
+        assert!(b.center().distance(c) < 1e-9);
+    }
 }

crates/doc/src/pattern.rs

@@ -516,8 +516,12 @@ impl RepeatSpec {
     }
     /// Geometric bounds of all instances.
     pub fn bounds(&self) -> Option<Rect> {
-        let b = self.source_bounds()?;
-        self.transforms().into_iter().fold(None, |acc, m| vectorcraft_geom::union_opt(acc, Some(m.transform_rect_bbox(b))))
+        self.copies_bounds(self.source_bounds()?)
+    }
+    /// The bounds of all instances of a source measuring `source`, each placed by its transform
+    /// ([`Self::transforms`]).
+    pub(crate) fn copies_bounds(&self, source: Rect) -> Option<Rect> {
+        self.transforms().into_iter().fold(None, |acc, m| vectorcraft_geom::union_opt(acc, Some(m.transform_rect_bbox(source))))
     }
     /// Apply a document transform (source + arrangement parameters).
     pub fn transform(&mut self, a: Affine, scaling: impl Into<crate::node::Scaling>) {

crates/doc/src/swatches.rs

@@ -224,7 +224,7 @@ fn item_paint_mut(it: &mut AppearanceItem) -> &mut Paint {
 }
 
 /// The paints a node holds itself (not its children): appearance items, then text runs.
-fn node_paints(n: &Node) -> impl Iterator<Item = &Paint> {
+pub(crate) fn node_paints(n: &Node) -> impl Iterator<Item = &Paint> {
     let runs = match &n.kind {
         NodeKind::Text(t) => t.runs.as_slice(),
         _ => &[],
@@ -233,7 +233,7 @@ fn node_paints(n: &Node) -> impl Iterator<Item = &Paint> {
 }
 
 /// Mutable [`node_paints`], in the same order.
-fn node_paints_mut(n: &mut Node) -> impl Iterator<Item = &mut Paint> {
+pub(crate) fn node_paints_mut(n: &mut Node) -> impl Iterator<Item = &mut Paint> {
     let runs = match &mut n.kind {
         NodeKind::Text(t) => t.runs.as_mut_slice(),
         _ => &mut [],

crates/doc/src/symbols.rs

@@ -0,0 +1,565 @@
+//! Symbol instances measured by their symbol's art: [`SymbolBoxes`] looks each symbol's art up in
+//! the document and measures it once, and an instance's bounds are its art's box placed by the
+//! instance's transform ([`Node::geometric_bounds_with`]).
+
+use std::cell::{Cell, RefCell};
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+
+use vectorcraft_geom::{Affine, Rect};
+
+use crate::{AppearanceItem, Document, Node, NodeKind, SYMBOL_HALF};
+
+/// The box a symbol instance is measured by when its symbol's art has no box
+/// ([`SymbolBoxes::art`]), and in [`Node::geometric_bounds`]: the 20 × 20 square around the origin
+/// that symbols made in the app keep their art in.
+pub(crate) const SYMBOL_SQUARE: Rect = Rect::new(-SYMBOL_HALF, -SYMBOL_HALF, SYMBOL_HALF, SYMBOL_HALF);
+
+/// Instances of a symbol whose art holds symbols nested this many deep are measured by
+/// [`SYMBOL_SQUARE`] instead of their art.
+const MAX_DEPTH: usize = 32;
+
+/// Most effect reaches one set of boxes measures for transforms that place the art of symbols
+/// holding instances: past it, an estimate stands in ([`SymbolBoxes::effects_reach`]).
+const MAX_REACHES: usize = 4096;
+
+/// A symbol's art measured in symbol space.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) struct ArtBox {
+    /// The art's geometric bounds.
+    pub(crate) geometric: Rect,
+    /// The art's visual bounds (its strokes included), never smaller than `geometric`.
+    pub(crate) visual: Rect,
+    /// The farthest any stroke in the art can paint from its path ([`crate::Appearance::outset`]).
+    pub(crate) reach: f64,
+    /// Whether the art, or the art of a symbol an instance in it shows, has a visible effect.
+    pub(crate) effects: bool,
+    /// The widest stroke of the objects with a visible brushed stroke in the art, or in the art
+    /// of a symbol an instance in it shows: `None` when no object there has one.
+    pub(crate) brush: Option<f64>,
+}
+
+/// The art boxes of a document's symbols, which [`Node::geometric_bounds_with`],
+/// [`Node::visual_bounds_with`] and [`Node::reach_bounds_with`] measure symbol instances by. Each
+/// symbol's art is measured the first time an instance of it is measured; make a new one after the
+/// symbols change.
+pub struct SymbolBoxes<'a> {
+    doc: &'a Document,
+    /// The art boxes measured so far, by symbol name (`None` for a symbol whose instances are
+    /// measured by [`SYMBOL_SQUARE`]).
+    measured: RefCell<HashMap<String, Option<ArtBox>>>,
+    /// How deep symbols nest in the art of each symbol checked so far, by symbol name
+    /// ([`Self::depth`]).
+    depths: RefCell<HashMap<String, Option<usize>>>,
+    /// Set while symbol art or a click's box is measured, and always in boxes made by
+    /// [`Self::quick`]: instances are then measured by their art boxes alone
+    /// ([`Self::placed_visual`] returns `None`).
+    quick: Cell<bool>,
+    /// Set in boxes made by [`Self::with_brush_art`], and cleared while symbol art is measured
+    /// ([`Self::brush_pad`]).
+    brush_art: Cell<bool>,
+    /// Cleared in boxes made by [`Self::without_art_strokes`], and set while symbol art is
+    /// measured ([`Self::art_strokes`]).
+    art_strokes: Cell<bool>,
+    /// The effect reaches measured so far, by symbol name and the bits of the linear part of the
+    /// transform that places the art ([`Self::effects_reach`]).
+    reaches: RefCell<HashMap<(String, [u64; 4]), f64>>,
+    /// How many of them are of symbols whose art holds instances.
+    holders: Cell<usize>,
+    /// The farthest effect reach measured so far for each symbol.
+    farthest: RefCell<HashMap<String, f64>>,
+    /// The effect reach of each symbol's art with no transform, measured past [`MAX_REACHES`]
+    /// ([`Self::unplaced_reach`]).
+    unplaced: RefCell<HashMap<String, f64>>,
+}
+
+impl Document {
+    /// [`SymbolBoxes`] for this document's symbols, none measured yet.
+    pub fn symbol_boxes(&self) -> SymbolBoxes<'_> {
+        SymbolBoxes {
+            doc: self,
+            measured: RefCell::default(),
+            depths: RefCell::default(),
+            quick: Cell::new(false),
+            brush_art: Cell::new(false),
+            art_strokes: Cell::new(true),
+            reaches: RefCell::default(),
+            holders: Cell::new(0),
+            farthest: RefCell::default(),
+            unplaced: RefCell::default(),
+        }
+    }
+}
+
+impl<'a> SymbolBoxes<'a> {
+    /// The document whose symbols these are.
+    pub fn document(&self) -> &'a Document {
+        self.doc
+    }
+
+    /// Makes these boxes measure every symbol instance as [`Node::reach_bounds_with`] does, by its
+    /// art box alone. An instance that scales or turns stroked art then measures a little larger
+    /// than with [`Node::visual_bounds_with`], and its art is not transformed to measure it.
+    pub fn quick(self) -> Self {
+        self.quick.set(true);
+        self
+    }
+
+    /// Makes these boxes grow the visual box of each symbol instance whose art holds brushed
+    /// strokes by as far as their brush art can paint past it ([`Self::brush_pad`]). The visual
+    /// boxes of the groups, layers and live objects that hold such an instance grow with it.
+    pub fn with_brush_art(self) -> Self {
+        self.brush_art.set(true);
+        self
+    }
+
+    /// Makes these boxes measure the visual box of each symbol instance without the strokes in
+    /// its art: the art's geometric box placed by the instance's transform, grown by the
+    /// instance's own strokes. The strokes in the art keep their weight when the instance scales.
+    /// The visual boxes of the groups, layers and live objects that hold an instance do not include
+    /// those strokes either.
+    pub fn without_art_strokes(self) -> Self {
+        self.art_strokes.set(false);
+        self
+    }
+
+    /// Whether instances are measured with the strokes in their art: false in boxes made by
+    /// [`Self::without_art_strokes`], except while symbol art is measured.
+    pub(crate) fn art_strokes(&self) -> bool {
+        self.art_strokes.get()
+    }
+
+    /// The art box of the symbol named `name`, with the instances in the art measured by their own
+    /// art boxes. Returns `None` when [`Self::depth`] is `None` and when the art has no finite
+    /// bounds: instances of the symbol are then measured by [`SYMBOL_SQUARE`].
+    pub(crate) fn art(&self, name: &str) -> Option<ArtBox> {
+        if let Some(b) = self.measured.borrow().get(name) {
+            return *b;
+        }
+        let b = self.measure_art(name, |art| self.in_art(|| art_box(art, self))).flatten();
+        self.measured.borrow_mut().insert(name.to_string(), b);
+        b
+    }
+
+    /// Runs `measure` on the art of the symbol named `name`. Returns `None` when [`Self::depth`]
+    /// is `None`, without running it.
+    pub fn measure_art<R>(&self, name: &str, measure: impl FnOnce(&Arc<Node>) -> R) -> Option<R> {
+        self.depth(name)?;
+        let sym = self.doc.symbols.iter().find(|s| s.name == name)?;
+        Some(measure(&sym.art))
+    }
+
+    /// The geometric box of the art of the symbol named `name` in symbol space, with the instances
+    /// in the art measured by their own art boxes. `None` when [`Self::art`] is `None`: instances of
+    /// the symbol are then measured by [`SYMBOL_SQUARE`].
+    pub fn art_bounds(&self, name: &str) -> Option<Rect> {
+        self.art(name).map(|a| a.geometric)
+    }
+
+    /// Whether the art of the symbol named `name`, or of a symbol an instance in it shows, has a
+    /// visible effect (raster or geometry, the object's own or a fill's or stroke's). False when
+    /// [`Self::art`] is `None`.
+    pub fn has_effects(&self, name: &str) -> bool {
+        self.art(name).is_some_and(|a| a.effects)
+    }
+
+    /// How far the effects in the art of the symbol named `name` paint past that art when a
+    /// transform with the linear part `linear` places it, as `measure` measures it for a linear
+    /// part. `measure` runs once for each symbol and linear part. For symbols whose art holds
+    /// instances, it runs [`MAX_REACHES`] times at most for these boxes. After that, a linear part
+    /// not measured yet takes the reach with no transform, times √2 and the larger of 1 and the
+    /// linear part's Frobenius norm, or the farthest reach measured for the symbol when that is
+    /// farther; `measure` runs once more for each of those symbols whose reach with no transform
+    /// was not measured yet. The estimate holds for effects that paint a fixed distance past the
+    /// art, or a distance in proportion to its size.
+    pub fn effects_reach(&self, name: &str, linear: [f64; 4], measure: &dyn Fn([f64; 4]) -> f64) -> f64 {
+        let key = (name.to_string(), linear.map(f64::to_bits));
+        if let Some(r) = self.reaches.borrow().get(&key) {
+            return *r;
+        }
+        let holder = self.depth(name) != Some(0);
+        if holder && self.holders.get() >= MAX_REACHES {
+            let norm = linear.iter().map(|v| v * v).sum::<f64>().sqrt();
+            let estimate = self.unplaced_reach(name, measure) * std::f64::consts::SQRT_2 * norm.max(1.0);
+            return self.farthest.borrow().get(name).map_or(estimate, |f| f.max(estimate));
+        }
+        if holder {
+            self.holders.set(self.holders.get() + 1);
+        }
+        let r = measure(linear);
+        self.reaches.borrow_mut().insert(key, r);
+        let mut farthest = self.farthest.borrow_mut();
+        let f = farthest.entry(name.to_string()).or_insert(r);
+        *f = f.max(r);
+        r
+    }
+
+    /// [`Self::effects_reach`] with no transform, measured once for each symbol, also past
+    /// [`MAX_REACHES`].
+    fn unplaced_reach(&self, name: &str, measure: &dyn Fn([f64; 4]) -> f64) -> f64 {
+        const IDENTITY: [f64; 4] = [1.0, 0.0, 0.0, 1.0];
+        if let Some(r) = self.reaches.borrow().get(&(name.to_string(), IDENTITY.map(f64::to_bits))) {
+            return *r;
+        }
+        if let Some(r) = self.unplaced.borrow().get(name) {
+            return *r;
+        }
+        let r = measure(IDENTITY);
+        self.unplaced.borrow_mut().insert(name.to_string(), r);
+        r
+    }
+
+    /// The widest stroke of the objects with a visible brushed stroke in the art of the symbol
+    /// named `name`, or in the art of a symbol an instance in it shows. `None` when no object there
+    /// has one, and when [`Self::art`] is `None`.
+    pub fn brush_width(&self, name: &str) -> Option<f64> {
+        self.art(name)?.brush
+    }
+
+    /// How far the visual box of an instance of the symbol named `name` grows in boxes made by
+    /// [`Self::with_brush_art`]: `16 × max(w, 1) + 8` for the widest stroke `w` that
+    /// [`Self::brush_width`] finds, as far as the renderer grows the cull bounds of a brushed path
+    /// (`brush_fx::cull_bounds` in vectorcraft-render). 0 in other boxes, while symbol art is
+    /// measured, and when the art has no brushed stroke.
+    pub(crate) fn brush_pad(&self, name: &str) -> f64 {
+        if !self.brush_art.get() {
+            return 0.0;
+        }
+        self.brush_width(name).map_or(0.0, |w| 16.0 * w.max(1.0) + 8.0)
+    }
+
+    /// How deep symbols nest in the art of the symbol named `name`: 0 when the art holds no
+    /// instance of a symbol in the document, 1 when the symbols its instances show hold none, and
+    /// so on. Returns `None` when the document has no such symbol, when the symbol or a symbol
+    /// nested in its art holds an instance of itself at any depth, and when symbols nest
+    /// [`MAX_DEPTH`] deep: instances of the symbol are then measured by [`SYMBOL_SQUARE`]. The
+    /// answer depends only on the document's symbols.
+    fn depth(&self, name: &str) -> Option<usize> {
+        if let Some(d) = self.depths.borrow().get(name) {
+            return *d;
+        }
+        let mut learned = HashMap::new();
+        let d = self.find_depth(name, &mut learned);
+        let mut depths = self.depths.borrow_mut();
+        depths.extend(learned);
+        depths.insert(name.to_string(), d);
+        d
+    }
+
+    /// Finds [`Self::depth`] for the symbol named `name` by walking the symbols its art's instances
+    /// show, depth first, without recursing. `learned` collects what the walk finds out about the
+    /// other symbols it reaches: the depth of each one it walks to the end, and `None` for those on
+    /// the way down to a symbol that holds an instance of itself or nests too deep.
+    fn find_depth(&self, name: &str, learned: &mut HashMap<String, Option<usize>>) -> Option<usize> {
+        let art = |n: &str| self.doc.symbols.iter().find(|s| s.name == n).map(|s| &s.art);
+        // The symbols on the way down from `name`: each with the symbols its art shows that are
+        // still to be walked, and the deepest nesting found under it so far.
+        let mut path: Vec<(String, Vec<String>, usize)> = vec![(name.to_string(), shown(self.doc, art(name)?), 0)];
+        loop {
+            let (_, todo, _) = path.last_mut()?;
+            let Some(next) = todo.pop() else {
+                // Everything under it is walked.
+                let (done, _, d) = path.pop()?;
+                if d >= MAX_DEPTH {
+                    learned.insert(done, None);
+                    return give_up(&path, learned);
+                }
+                learned.insert(done, Some(d));
+                let Some((_, _, up)) = path.last_mut() else { return Some(d) };
+                *up = (*up).max(d + 1);
+                continue;
+            };
+            let known = learned.get(&next).copied().or_else(|| self.depths.borrow().get(&next).copied());
+            match known {
+                Some(Some(d)) => {
+                    if let Some((_, _, deepest)) = path.last_mut() {
+                        *deepest = (*deepest).max(d + 1);
+                    }
+                }
+                // It holds an instance of itself or nests too deep, and so does every symbol on
+                // the way down to it.
+                Some(None) => return give_up(&path, learned),
+                // A symbol that holds an instance of itself.
+                None if path.iter().any(|(n, ..)| *n == next) => return give_up(&path, learned),
+                // Symbols nested MAX_DEPTH deep under `name`.
+                None if path.len() >= MAX_DEPTH => return None,
+                None => {
+                    if let Some(a) = art(&next) {
+                        let todo = shown(self.doc, a);
+                        path.push((next, todo, 0));
+                    }
+                }
+            }
+        }
+    }
+
+    /// The visual bounds of symbol `name`'s art drawn as an instance with transform `xf` draws it,
+    /// its strokes at their own weight, the instances in it measured by their art boxes. `None`
+    /// when [`Self::depth`] is `None`, in boxes made by [`Self::quick`], and while symbol art or a
+    /// click's box is measured.
+    pub(crate) fn placed_visual(&self, name: &str, xf: Affine) -> Option<Rect> {
+        if self.quick.get() {
+            return None;
+        }
+        self.measure_art(name, |art| {
+            let mut art = (**art).clone();
+            art.transform(xf, false);
+            self.in_art(|| art.visual(Some(self)))
+        })
+        .flatten()
+    }
+
+    /// Runs `f` with instances measured by their art boxes alone.
+    pub(crate) fn quickly<R>(&self, f: impl FnOnce() -> R) -> R {
+        let was = self.quick.replace(true);
+        let r = f();
+        self.quick.set(was);
+        r
+    }
+
+    /// Runs `f` as symbol art is measured: instances measured by their art boxes alone, with the
+    /// strokes in their art, and without [`Self::brush_pad`], which the instance that shows the
+    /// art adds once.
+    fn in_art<R>(&self, f: impl FnOnce() -> R) -> R {
+        let pad = self.brush_art.replace(false);
+        let strokes = self.art_strokes.replace(true);
+        let r = self.quickly(f);
+        self.brush_art.set(pad);
+        self.art_strokes.set(strokes);
+        r
+    }
+}
+
+/// Records every symbol on `path` in `learned` as one whose instances are measured by
+/// [`SYMBOL_SQUARE`]. Returns `None`.
+fn give_up(path: &[(String, Vec<String>, usize)], learned: &mut HashMap<String, Option<usize>>) -> Option<usize> {
+    for (n, ..) in path {
+        learned.insert(n.clone(), None);
+    }
+    None
+}
+
+/// The names of the symbols of `doc` that the instances in `art` show, each once.
+fn shown(doc: &Document, art: &Node) -> Vec<String> {
+    let mut seen = HashSet::new();
+    let mut names = vec![];
+    art.walk(&mut |n| {
+        if let NodeKind::SymbolInstance { symbol, .. } = &n.kind
+            && seen.insert(symbol.as_str())
+            && doc.symbols.iter().any(|s| s.name == *symbol)
+        {
+            names.push(symbol.clone());
+        }
+    });
+    names
+}
+
+/// Measures symbol art `art`, with the instances in it measured by `symbols`.
+fn art_box(art: &Arc<Node>, symbols: &SymbolBoxes) -> Option<ArtBox> {
+    let finite = |r: &Rect| [r.x0, r.y0, r.x1, r.y1].iter().all(|v| v.is_finite());
+    let geometric = art.geometric(Some(symbols)).filter(finite)?;
+    let visual = art.visual(Some(symbols)).filter(finite).map_or(geometric, |v| v.union(geometric));
+    let reach = crate::live::max_outset(std::slice::from_ref(art), Some(symbols));
+    let mut effects = false;
+    let mut brush: Option<f64> = None;
+    art.walk(&mut |n| {
+        let mut own = n.appearance.effects.iter().chain(n.appearance.items.iter().flat_map(|i| i.effects().iter()));
+        effects |= own.any(|e| e.visible);
+        let strokes = || n.appearance.items.iter().filter_map(|i| if let AppearanceItem::Stroke(s) = i { Some(s) } else { None });
+        if strokes().any(|s| s.visible && s.brush.is_some()) {
+            brush = Some(strokes().fold(brush.unwrap_or(0.0), |w, s| w.max(s.width)));
+        }
+        if let NodeKind::SymbolInstance { symbol, .. } = &n.kind {
+            effects |= symbols.has_effects(symbol);
+            if let Some(w) = symbols.brush_width(symbol) {
+                brush = Some(brush.map_or(w, |b| b.max(w)));
+            }
+        }
+    });
+    Some(ArtBox { geometric, visual, reach, effects, brush })
+}
+
+#[cfg(test)]
+mod tests {
+    use vectorcraft_color::{Color, Paint};
+    use vectorcraft_geom::shapes;
+
+    use super::*;
+    use crate::{Appearance, Symbol};
+
+    /// A rectangle filled black, with a `stroke` pt black stroke (0: none).
+    fn rect(d: &mut Document, r: Rect, stroke: f64) -> Node {
+        let paint = if stroke > 0.0 { Paint::solid(Color::BLACK) } else { Paint::None };
+        Node::path(d.alloc_id(), shapes::rectangle(r), Appearance::basic(Paint::solid(Color::BLACK), paint, stroke))
+    }
+
+    fn instance(d: &mut Document, symbol: &str, xf: Affine) -> Node {
+        Node::new(d.alloc_id(), NodeKind::SymbolInstance { symbol: symbol.into(), xf })
+    }
+
+    /// Symbol `name` holding `art` in a group.
+    fn symbol(d: &mut Document, name: &str, art: Vec<Node>) {
+        let group = Node::group(d.alloc_id(), art.into_iter().map(Arc::new).collect());
+        d.symbols.push(Symbol { name: name.into(), art: Arc::new(group) });
+    }
+
+    #[test]
+    fn an_instance_measures_as_its_art_placed_by_its_transform() {
+        let mut d = Document::new(200.0, 200.0);
+        let bar = rect(&mut d, Rect::new(0.0, 0.0, 20.0, 10.0), 2.0);
+        symbol(&mut d, "Bar", vec![bar]);
+        let moved = instance(&mut d, "Bar", Affine::translate((20.0, 30.0)));
+        let scaled = instance(&mut d, "Bar", Affine::scale(3.0));
+        let s = d.symbol_boxes();
+        assert_eq!(moved.geometric_bounds_with(&s), Some(Rect::new(20.0, 30.0, 40.0, 40.0)));
+        // Without the document: the 20 × 20 square around the origin, moved.
+        assert_eq!(moved.geometric_bounds(), Some(Rect::new(10.0, 20.0, 30.0, 40.0)));
+        // The 2 pt stroke paints 1 pt around the bar.
+        assert_eq!(moved.visual_bounds_with(&s), Some(Rect::new(19.0, 29.0, 41.0, 41.0)));
+        assert_eq!(moved.reach_bounds_with(&s), moved.visual_bounds_with(&s));
+        // Scaled 3 times: the geometry scales, the stroke keeps its weight.
+        assert_eq!(scaled.geometric_bounds_with(&s), Some(Rect::new(0.0, 0.0, 60.0, 30.0)));
+        assert_eq!(scaled.visual_bounds_with(&s), Some(Rect::new(-1.0, -1.0, 61.0, 31.0)));
+        // A click's box: the geometric box grown by the farthest the stroke can reach (a mitered
+        // corner up to its miter limit).
+        let reach = d.symbols[0].art.children().unwrap()[0].appearance.outset();
+        assert_eq!(scaled.reach_bounds_with(&s), Some(Rect::new(0.0, 0.0, 60.0, 30.0).inflate(reach, reach)));
+    }
+
+    #[test]
+    fn missing_symbols_and_symbols_inside_themselves_measure_as_the_square() {
+        let mut d = Document::new(200.0, 200.0);
+        let missing = instance(&mut d, "Nowhere", Affine::translate((50.0, 50.0)));
+        assert_eq!(missing.geometric_bounds_with(&d.symbol_boxes()), Some(Rect::new(40.0, 40.0, 60.0, 60.0)));
+        // A symbol whose art holds an instance of itself 100 pt to the right, and a symbol whose
+        // art holds an instance of that one.
+        let square = rect(&mut d, Rect::new(0.0, 0.0, 10.0, 10.0), 0.0);
+        let inner = instance(&mut d, "Loop", Affine::translate((100.0, 0.0)));
+        symbol(&mut d, "Loop", vec![square.clone(), inner]);
+        let looped = instance(&mut d, "Loop", Affine::IDENTITY);
+        symbol(&mut d, "Holder", vec![square, looped]);
+        let outer = instance(&mut d, "Loop", Affine::IDENTITY);
+        let doubled = instance(&mut d, "Loop", Affine::scale(2.0));
+        let holder = instance(&mut d, "Holder", Affine::translate((50.0, 50.0)));
+        let s = d.symbol_boxes();
+        assert_eq!(outer.geometric_bounds_with(&s), Some(Rect::new(-10.0, -10.0, 10.0, 10.0)));
+        assert_eq!(outer.visual_bounds_with(&s), Some(Rect::new(-10.0, -10.0, 10.0, 10.0)));
+        assert_eq!(doubled.visual_bounds_with(&s), Some(Rect::new(-20.0, -20.0, 20.0, 20.0)));
+        assert_eq!(holder.geometric_bounds_with(&s), Some(Rect::new(40.0, 40.0, 60.0, 60.0)));
+    }
+
+    #[test]
+    fn nested_instances_measure_by_their_own_symbols_art() {
+        let mut d = Document::new(200.0, 200.0);
+        let dot = rect(&mut d, Rect::new(0.0, 0.0, 4.0, 4.0), 0.0);
+        symbol(&mut d, "Dot", vec![dot]);
+        let right = instance(&mut d, "Dot", Affine::translate((50.0, 0.0)));
+        let below = instance(&mut d, "Dot", Affine::translate((0.0, 50.0)));
+        symbol(&mut d, "Pair", vec![right, below]);
+        let pair = instance(&mut d, "Pair", Affine::translate((100.0, 100.0)));
+        assert_eq!(pair.geometric_bounds_with(&d.symbol_boxes()), Some(Rect::new(100.0, 100.0, 154.0, 154.0)));
+    }
+
+    #[test]
+    fn symbols_nested_32_deep_measure_as_the_square_whatever_was_measured_first() {
+        // A chain of 40 symbols, each holding a 1 × 1 square and an instance of the next one 1 pt to
+        // the right: symbols nest 39 deep in Link 0's art and 31 deep in Link 8's.
+        let mut d = Document::new(200.0, 200.0);
+        for i in 0..40 {
+            let unit = rect(&mut d, Rect::new(0.0, 0.0, 1.0, 1.0), 0.0);
+            let next = instance(&mut d, &format!("Link {}", i + 1), Affine::translate((1.0, 0.0)));
+            symbol(&mut d, &format!("Link {i}"), if i < 39 { vec![unit, next] } else { vec![unit] });
+        }
+        let link0 = instance(&mut d, "Link 0", Affine::IDENTITY);
+        let link7 = instance(&mut d, "Link 7", Affine::IDENTITY);
+        let link8 = instance(&mut d, "Link 8", Affine::IDENTITY);
+        let (square, chain) = (Some(Rect::new(-10.0, -10.0, 10.0, 10.0)), Some(Rect::new(0.0, 0.0, 32.0, 1.0)));
+        let s = d.symbol_boxes();
+        assert_eq!(link0.geometric_bounds_with(&s), square);
+        assert_eq!(link8.geometric_bounds_with(&s), chain);
+        assert_eq!(link7.geometric_bounds_with(&s), square);
+        let s = d.symbol_boxes();
+        assert_eq!(link8.geometric_bounds_with(&s), chain);
+        assert_eq!(link0.geometric_bounds_with(&s), square);
+    }
+
+    #[test]
+    fn brushed_strokes_are_found_in_the_art_and_in_nested_symbols_art() {
+        let mut d = Document::new(200.0, 200.0);
+        let mut line = rect(&mut d, Rect::new(0.0, 0.0, 10.0, 10.0), 3.0);
+        line.appearance.stroke_mut().unwrap().brush = Some("3 pt. Round".into());
+        symbol(&mut d, "Brushed", vec![line]);
+        let plain = rect(&mut d, Rect::new(0.0, 0.0, 10.0, 10.0), 5.0);
+        let inner = instance(&mut d, "Brushed", Affine::IDENTITY);
+        symbol(&mut d, "Holder", vec![plain.clone(), inner]);
+        symbol(&mut d, "Plain", vec![plain]);
+        let s = d.symbol_boxes();
+        assert_eq!(s.brush_width("Brushed"), Some(3.0));
+        assert_eq!(s.brush_width("Holder"), Some(3.0), "the 5 pt stroke has no brush");
+        assert_eq!(s.brush_width("Plain"), None);
+    }
+
+    #[test]
+    fn boxes_with_brush_art_grow_instances_of_brushed_art_once() {
+        let mut d = Document::new(200.0, 200.0);
+        // A line from (0, 40) to (0, 60) with a 1 pt brushed stroke, and a symbol whose art holds an
+        // instance of it.
+        let mut stroke = Appearance::basic(Paint::None, Paint::solid(Color::BLACK), 1.0);
+        stroke.stroke_mut().unwrap().brush = Some("3 pt. Round".into());
+        let line = Node::path(d.alloc_id(), shapes::line((0.0, 40.0).into(), (0.0, 60.0).into()), stroke);
+        symbol(&mut d, "Nib", vec![line]);
+        let inner = instance(&mut d, "Nib", Affine::IDENTITY);
+        symbol(&mut d, "Holder", vec![inner]);
+        let nib = instance(&mut d, "Nib", Affine::translate((-5.0, 0.0)));
+        let holder = instance(&mut d, "Holder", Affine::translate((-5.0, 0.0)));
+        let group = Node::group(d.alloc_id(), vec![Arc::new(nib.clone())]);
+        let repeat = Node::new(d.alloc_id(), NodeKind::Repeat(crate::RepeatSpec::mirror(vec![Arc::new(nib.clone())], 90.0, 10.0)));
+        let (plain, brushed) = (d.symbol_boxes(), d.symbol_boxes().with_brush_art());
+        // 16 × 1 + 8 for the 1 pt stroke.
+        for n in [&nib, &holder, &group, &repeat] {
+            let b = n.visual_bounds_with(&plain).unwrap();
+            assert_eq!(n.visual_bounds_with(&brushed), Some(b.inflate(24.0, 24.0)), "{}", n.kind_label());
+        }
+        assert_eq!(nib.geometric_bounds_with(&brushed), nib.geometric_bounds_with(&plain));
+    }
+
+    #[test]
+    fn effect_reaches_are_measured_once_for_each_linear_part_and_up_to_a_limit() {
+        // `Leaf` holds a square; `Holder` and `Other` each hold an instance of `Leaf`.
+        let mut d = Document::new(10.0, 10.0);
+        let square = rect(&mut d, Rect::new(0.0, 0.0, 1.0, 1.0), 0.0);
+        symbol(&mut d, "Leaf", vec![square]);
+        for name in ["Holder", "Other"] {
+            let leaf = instance(&mut d, "Leaf", Affine::IDENTITY);
+            symbol(&mut d, name, vec![leaf]);
+        }
+        let s = d.symbol_boxes();
+        let runs = &Cell::new(0);
+        // A measure that finds `reach` for every linear part.
+        let measure = |reach: f64| {
+            move |_: [f64; 4]| {
+                runs.set(runs.get() + 1);
+                reach
+            }
+        };
+        let unscaled = [1.0, 0.0, 0.0, 1.0];
+        assert_eq!(s.effects_reach("Holder", unscaled, &measure(3.0)), 3.0);
+        assert_eq!(s.effects_reach("Holder", unscaled, &measure(5.0)), 3.0, "measured once");
+        assert_eq!(runs.get(), 1);
+        for i in 1..MAX_REACHES {
+            s.effects_reach("Holder", [1.0, 0.0, 0.0, 1.0 + i as f64], &measure(1.0));
+        }
+        assert_eq!(runs.get(), MAX_REACHES);
+        // Past the limit: the reach with no transform, times √2 and the larger of 1 and the
+        // Frobenius norm (√8 for a scale of 2, √2 with no transform, √0.5 for a scale of 0.5). That
+        // reach is measured once more for a symbol not measured before.
+        let near = |a: f64, b: f64| (a - b).abs() < 1e-9;
+        assert!(near(s.effects_reach("Holder", [2.0, 0.0, 0.0, 2.0], &measure(9.0)), 12.0));
+        assert!(near(s.effects_reach("Other", unscaled, &measure(9.0)), 18.0));
+        assert!(near(s.effects_reach("Other", [0.5, 0.0, 0.0, 0.5], &measure(7.0)), 9.0 * std::f64::consts::SQRT_2));
+        assert_eq!(runs.get(), MAX_REACHES + 1);
+        // A symbol whose art holds no instance is measured past the limit too.
+        assert_eq!(s.effects_reach("Leaf", [2.0, 0.0, 0.0, 2.0], &measure(7.0)), 7.0);
+        assert_eq!(runs.get(), MAX_REACHES + 2);
+    }
+}

crates/doc/src/xml_id.rs

@@ -0,0 +1,117 @@
+//! Object names ↔ XML IDs (Preferences › Units › Identify Objects By).
+//!
+//! Illustrator's public documentation: with XML ID selected, the Layers panel shows and edits
+//! names that conform to XML naming (letter, underscore or colon first; no spaces). Underscores
+//! stand for spaces and `_xHH_` / `_xHHHH_` escape other characters, as in `.ai` `AI10_ArtUID`
+//! values ([edit dynamic objects](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/edit-dynamic-objects.html)).
+
+/// An object name from its XML id: `_` is a space and `_xHH_` / `_xHHHH_` a character; ids made
+/// unique end with `_` and 20 or more digits (stripped).
+pub fn to_object_name(id: &str) -> String {
+    let id = strip_unique(id);
+    let mut out = String::with_capacity(id.len());
+    let mut rest = id;
+    while let Some(c) = rest.chars().next() {
+        if c == '_' {
+            if let Some((ch, n)) = escaped(rest) {
+                out.push(ch);
+                rest = rest.get(n..).unwrap_or_default();
+                continue;
+            }
+            out.push(' ');
+        } else {
+            out.push(c);
+        }
+        rest = rest.get(c.len_utf8()..).unwrap_or_default();
+    }
+    out
+}
+
+/// The XML id for an object name (the inverse of [`to_object_name`]).
+pub fn from_object_name(name: &str) -> String {
+    let mut out = String::with_capacity(name.len().saturating_mul(2));
+    for (i, c) in name.chars().enumerate() {
+        if c == ' ' {
+            out.push('_');
+        } else if c == '_' {
+            out.push_str("_x5F_");
+        } else if i == 0 && c.is_ascii_digit() {
+            out.push_str(&format!("_x{:X}_", u32::from(c)));
+        } else if c.is_alphanumeric() || c == '.' || c == '-' || c == ':' {
+            out.push(c);
+        } else {
+            out.push_str(&format!("_x{:X}_", u32::from(c)));
+        }
+    }
+    if out.is_empty() || !starts_name(&out) {
+        out.insert(0, '_');
+    }
+    out
+}
+
+/// Whether `id` is a usable XML ID for Identify Objects By › XML ID: non-empty, no whitespace,
+/// starts with a letter, `_` or `:`, and otherwise letters, digits, `.`, `-`, `_` or `:`.
+pub fn is_valid(id: &str) -> bool {
+    let id = id.trim();
+    if id.is_empty() || id.chars().any(char::is_whitespace) {
+        return false;
+    }
+    let mut chars = id.chars();
+    let Some(first) = chars.next() else {
+        return false;
+    };
+    if !(first.is_alphabetic() || first == '_' || first == ':') {
+        return false;
+    }
+    chars.all(|c| c.is_alphanumeric() || matches!(c, '_' | '.' | '-' | ':'))
+}
+
+fn starts_name(id: &str) -> bool {
+    id.starts_with(|c: char| c.is_alphabetic() || c == '_' || c == ':')
+}
+
+/// `_xHHHH_` at the start of `s`: the character and the escape's length.
+fn escaped(s: &str) -> Option<(char, usize)> {
+    let body = s.strip_prefix("_x")?;
+    let end = body.find('_')?;
+    let hex = body.get(..end)?;
+    if hex.is_empty() || hex.len() > 6 {
+        return None;
+    }
+    let c = char::from_u32(u32::from_str_radix(hex, 16).ok()?)?;
+    Some((c, end + 3))
+}
+
+/// `id` without the `_000…_` suffix that makes it unique.
+fn strip_unique(id: &str) -> &str {
+    let Some(body) = id.strip_suffix('_') else {
+        return id;
+    };
+    let Some(at) = body.rfind('_') else {
+        return id;
+    };
+    let digits = body.get(at + 1..).unwrap_or_default();
+    if digits.len() >= 20 && digits.bytes().all(|b| b.is_ascii_digit()) { body.get(..at).unwrap_or(id) } else { id }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn round_trip_ai_style_ids() {
+        for (name, id) in [
+            ("Layer 1", "Layer_1"),
+            ("My Rect #2", "My_Rect__x23_2"),
+            ("1abc (paren)", "_x31_abc__x28_paren_x29_"),
+            ("Ünï 日本", "Ünï_日本"),
+            ("a_b", "a_x5F_b"),
+        ] {
+            assert_eq!(from_object_name(name), id, "encode {name}");
+            assert_eq!(to_object_name(id), name, "decode {id}");
+        }
+        assert_eq!(to_object_name("S_00000092429200007574234970000005974767392385616558_"), "S");
+        assert!(is_valid("Layer_1") && is_valid("_x31_abc") && is_valid(":root"));
+        assert!(!is_valid("My Rect") && !is_valid("1abc") && !is_valid(""));
+    }
+}

crates/effects/src/lib.rs

@@ -200,29 +200,29 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             REVOLVE,
             "Revolve…",
             &["Effect", "3D and Materials"],
-            "{angle: degrees (0..360, 360), offset: pt (0..100000, 0), edge: left|right, rotationX: degrees (0), rotationY: degrees (0), rotationZ: degrees (0), perspective: % (0..100, 0), segments: integer (8..128, 64), shade: bool (true), lightAzimuth: degrees (-45), lightElevation: degrees (45), lightIntensity: % (80), ambient: % (25), expandVisibleOnly: bool (true, trim covered opaque solid surfaces only on Expand Appearance)}. Open paths create uncapped surfaces; intersecting profiles use approximate painter visibility.",
-            json!({"angle":360.0,"offset":0.0,"edge":"left","rotationX":0.0,"rotationY":0.0,"rotationZ":0.0,"perspective":0.0,"segments":64,"shade":true,"lightAzimuth":-45.0,"lightElevation":45.0,"lightIntensity":80.0,"ambient":25.0,"expandVisibleOnly":true}),
+            "{angle: degrees (0..360, 360), offset: pt (0..100000, 0), edge: left|right, rotationX: degrees (0), rotationY: degrees (0), rotationZ: degrees (0), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), segments: integer (8..128, 64), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth), expandVisibleOnly: bool (true, trim covered opaque solid surfaces only on Expand Appearance)}. Open paths create uncapped surfaces; intersecting profiles use approximate painter visibility.",
+            json!({"angle":360.0,"offset":0.0,"edge":"left","rotationX":0.0,"rotationY":0.0,"rotationZ":0.0,"perspectiveAngle":0.0,"segments":64,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0,"expandVisibleOnly":true}),
         ),
         g(
             EXTRUDE,
             "Extrude & Bevel…",
             &["Effect", "3D and Materials"],
-            "{depth: pt (0..2000, 50), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: hollow), bevel: none|classic|rounded|cove|step|ogee (none), bevelWidth: pt (0..1000, 4), bevelHeight: pt (0..1000, 4), bevelRepeat: integer (1..32, 1), bevelSpace: % (0..90, 0; flat between repeats), bevelInside: bool (false: added around the shape; true: carved into it), bevelBothSides: bool (false), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspective: % (0..100, 0), shade: bool (true), lightAzimuth: degrees (-45), lightElevation: degrees (45), lightIntensity: % (80), ambient: % (25)}. The front face is the art, extruded backwards about the centre of its bounds; painted with the top fill (else the top stroke).",
-            json!({"depth":50.0,"twist":0.0,"taper":100.0,"cap":true,"bevel":"none","bevelWidth":4.0,"bevelHeight":4.0,"bevelRepeat":1,"bevelSpace":0.0,"bevelInside":false,"bevelBothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspective":0.0,"shade":true,"lightAzimuth":-45.0,"lightElevation":45.0,"lightIntensity":80.0,"ambient":25.0}),
+            "{depth: pt (0..2000, 50), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: hollow), bevel: none|classic|rounded|cove|step|ogee (none), bevelWidth: pt (0..1000, 4), bevelHeight: pt (0..1000, 4), bevelRepeat: integer (1..32, 1), bevelSpace: % (0..90, 0; flat between repeats), bevelInside: bool (false: added around the shape; true: carved into it), bevelBothSides: bool (false), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. The front face is the art, extruded backwards about the centre of its bounds; painted with the top fill (else the top stroke).",
+            json!({"depth":50.0,"twist":0.0,"taper":100.0,"cap":true,"bevel":"none","bevelWidth":4.0,"bevelHeight":4.0,"bevelRepeat":1,"bevelSpace":0.0,"bevelInside":false,"bevelBothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
         ),
         g(
             INFLATE,
             "Inflate…",
             &["Effect", "3D and Materials"],
-            "{depth: pt (0..2000, 0; flat depth between front and back), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: no back, a shell open behind), volume: % (0..100, 50; 50 rounds the edge like a half sphere), bothSides: bool (false: flat back), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspective: % (0..100, 0), shade: bool (true), lightAzimuth: degrees (-45), lightElevation: degrees (45), lightIntensity: % (80), ambient: % (25)}. Painted with the top fill (else the top stroke).",
-            json!({"depth":0.0,"twist":0.0,"taper":100.0,"cap":true,"volume":50.0,"bothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspective":0.0,"shade":true,"lightAzimuth":-45.0,"lightElevation":45.0,"lightIntensity":80.0,"ambient":25.0}),
+            "{depth: pt (0..2000, 0; flat depth between front and back), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: no back, a shell open behind), volume: % (0..100, 50; 50 rounds the edge like a half sphere), bothSides: bool (false: flat back), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Painted with the top fill (else the top stroke).",
+            json!({"depth":0.0,"twist":0.0,"taper":100.0,"cap":true,"volume":50.0,"bothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
         ),
         g(
             ROTATE,
             "Rotate…",
             &["Effect", "3D and Materials"],
-            "{rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspective: % (0..100, 0), shade: bool (true), lightAzimuth: degrees (-45), lightElevation: degrees (45), lightIntensity: % (80), ambient: % (25)}. Turns the flat art in 3D about the centre of its bounds; every fill and stroke keeps its paint, shaded as one plane.",
-            json!({"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspective":0.0,"shade":true,"lightAzimuth":-45.0,"lightElevation":45.0,"lightIntensity":80.0,"ambient":25.0}),
+            "{rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Turns the flat art in 3D about the centre of its bounds; every fill and stroke keeps its paint, shaded as one plane.",
+            json!({"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
         ),
         g(
             "convertToShape.rectangle",
@@ -249,7 +249,7 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             "distort.freeDistort",
             "Free Distort…",
             DT,
-            "{corners: [[x,y]×4] new positions of the bounding-box corners TL, TR, BR, BL in unit box coordinates (identity [[0,0],[1,0],[1,1],[0,1]])}",
+            "{corners: [[x,y]×4] (new positions of the bounding-box corners TL, TR, BR, BL in unit box coordinates; identity [[0,0],[1,0],[1,1],[0,1]])}",
             json!({"corners": [[0.0, 0.0], [1.0, 0.0], [1.0, 1.0], [0.0, 1.0]]}),
         ),
         g("distort.puckerBloat", "Pucker & Bloat…", DT, "{amount: % (-200 pucker … 200 bloat, default 0)}", json!({"amount": 0.0})),
@@ -642,21 +642,64 @@ pub fn default_params(id: &str) -> Option<Value> {
     }
 }
 
-/// `params` layered over the defaults of `id` (unknown keys are kept).
+/// `params` layered over the defaults of `id` (unknown keys are kept), with the 3D effects'
+/// earlier `perspective` read as `perspectiveAngle` (see [`upgrade_params`]).
 pub fn merged_params(id: &str, params: &Value) -> Value {
     let mut out = match catalog_index().get(id).map(|e| &e.defaults) {
         Some(Value::Object(m)) => m.clone(),
         Some(_) => Map::new(),
         None => vectorcraft_plugins::effect::installed(id).map(|p| p.manifest().defaults()).unwrap_or_default(),
     };
-    if let Value::Object(p) = params {
-        for (k, v) in p {
-            out.insert(k.clone(), v.clone());
-        }
+    // Upgraded before the defaults are under it: a default angle is no angle given.
+    if let Value::Object(p) = upgrade_params(id, params) {
+        out.extend(p);
     }
     Value::Object(out)
 }
 
+/// `params` for effect `id` in their current form. The 3D effects took Perspective as a 0–100 %
+/// strength, `perspective`, before the documented 0°–160° angle, `perspectiveAngle`, and the light
+/// as `lightAzimuth` and `lightElevation` before the documented Rotation and Height
+/// (`lightRotation`, `lightHeight`, `lightBehind`). Earlier values (from a file or a script of
+/// then) become the current ones that show exactly the same, unless those are given too, which win.
+pub fn upgrade_params(id: &str, params: &Value) -> Value {
+    match params {
+        Value::Object(m) => {
+            let mut m = m.clone();
+            upgrade_perspective(id, &mut m);
+            upgrade_light(id, &mut m);
+            Value::Object(m)
+        }
+        other => other.clone(),
+    }
+}
+
+fn upgrade_light(id: &str, m: &mut Map<String, Value>) {
+    if !is_three_d(id) {
+        return;
+    }
+    let (azimuth, elevation) = (m.remove("lightAzimuth"), m.remove("lightElevation"));
+    if azimuth.is_none() && elevation.is_none() || m.contains_key("lightRotation") || m.contains_key("lightHeight") {
+        return;
+    }
+    let degrees = |v: Option<Value>, default: f64| v.and_then(|v| v.as_f64()).unwrap_or(default);
+    let (rotation, height, behind) = vectorcraft_three_d::light_from_azimuth_elevation(degrees(azimuth, -45.0), degrees(elevation, 45.0));
+    m.insert("lightRotation".into(), json!(rotation));
+    m.insert("lightHeight".into(), json!(height));
+    m.insert("lightBehind".into(), json!(behind));
+}
+
+fn upgrade_perspective(id: &str, m: &mut Map<String, Value>) {
+    if !is_three_d(id) {
+        return;
+    }
+    let Some(strength) = m.remove("perspective") else { return };
+    if !m.contains_key("perspectiveAngle") {
+        let angle = vectorcraft_three_d::perspective_from_strength(strength.as_f64().unwrap_or(0.0) / 100.0);
+        m.insert("perspectiveAngle".into(), json!(angle));
+    }
+}
+
 /// A new effect record with default parameters (overridden by `params`).
 pub fn new_effect(id: &str, params: &Value) -> Option<Effect> {
     if !catalog_index().contains_key(id) {

crates/effects/src/revolve.rs

@@ -29,11 +29,13 @@ pub fn revolve_options(p: &Value) -> Revolve {
         rotation_x: num(p, "rotationX", 0.0),
         rotation_y: num(p, "rotationY", 0.0),
         rotation_z: num(p, "rotationZ", 0.0),
-        perspective: num(p, "perspective", 0.0) / 100.0,
+        perspective: num(p, "perspectiveAngle", 0.0),
         segments: num(p, "segments", 64.0).clamp(8.0, 128.0) as usize,
-        light_azimuth: num(p, "lightAzimuth", -45.0),
-        light_elevation: num(p, "lightElevation", 45.0),
+        light_rotation: num(p, "lightRotation", vectorcraft_three_d::DEFAULT_LIGHT.0),
+        light_height: num(p, "lightHeight", vectorcraft_three_d::DEFAULT_LIGHT.1),
+        light_behind: flag(p, "lightBehind", false),
         light_intensity: num(p, "lightIntensity", 80.0) / 100.0,
+        light_softness: num(p, "lightSoftness", 0.0) / 100.0,
         ambient: num(p, "ambient", 25.0) / 100.0,
         shade: flag(p, "shade", true),
     }

crates/effects/src/solids.rs

@@ -61,10 +61,12 @@ pub fn view_options(p: &Value) -> View {
         rotation_x: num(p, "rotationX", ROTATION_PRESETS[6].1[0]),
         rotation_y: num(p, "rotationY", ROTATION_PRESETS[6].1[1]),
         rotation_z: num(p, "rotationZ", ROTATION_PRESETS[6].1[2]),
-        perspective: num(p, "perspective", 0.0) / 100.0,
-        light_azimuth: num(p, "lightAzimuth", -45.0),
-        light_elevation: num(p, "lightElevation", 45.0),
+        perspective: num(p, "perspectiveAngle", 0.0),
+        light_rotation: num(p, "lightRotation", vectorcraft_three_d::DEFAULT_LIGHT.0),
+        light_height: num(p, "lightHeight", vectorcraft_three_d::DEFAULT_LIGHT.1),
+        light_behind: flag(p, "lightBehind", false),
         light_intensity: num(p, "lightIntensity", 80.0) / 100.0,
+        light_softness: num(p, "lightSoftness", 0.0) / 100.0,
         ambient: num(p, "ambient", 25.0) / 100.0,
         shade: flag(p, "shade", true),
     }

crates/effects/src/stroke.rs

@@ -116,10 +116,36 @@ pub fn line_outline(line: &BezPath, st: &StrokeLayer, width: f64, tol: f64) -> B
             out.extend(dot_outline(&d.dots, width, st.cap, tol).iter());
             out
         }
-        (None, None) => plain_outline(line, &style(st, width), tol),
+        (None, None) => {
+            let mut out = plain_outline(line, &style(st, width), tol);
+            out.extend(dot_outline(&point_dots(line), width, st.cap, tol).iter());
+            out
+        }
     }
 }
 
+/// The subpaths of `line` that never leave their first point (`m` then `L` to the same point, as
+/// `.ai` files write dots, #1613), as dots: kurbo strokes nothing for them, where PDF and SVG
+/// viewers paint the cap. They lie along the x axis, which a projecting cap's square follows
+/// (SVG 2, "Path data": zero-length path segments).
+fn point_dots(line: &BezPath) -> Vec<Dot> {
+    let els = line.elements();
+    subpaths(line)
+        .into_iter()
+        .filter_map(|(r, _)| {
+            let sub = els.get(r)?;
+            let at = sub.first()?.end_point()?;
+            let still = sub.iter().all(|e| match e {
+                PathEl::MoveTo(p) | PathEl::LineTo(p) => *p == at,
+                PathEl::QuadTo(a, b) => *a == at && *b == at,
+                PathEl::CurveTo(a, b, c) => *a == at && *b == at && *c == at,
+                PathEl::ClosePath => true,
+            });
+            still.then_some(Dot { at, dir: kurbo::Vec2::new(1.0, 0.0), t: 0.0 })
+        })
+        .collect()
+}
+
 /// `line` stroked with `style`, to fill with the non-zero rule.
 ///
 /// kurbo offsets a closed subpath to both sides, as two contours. Once half the weight is more

crates/effects/src/stylize.rs

@@ -94,8 +94,25 @@ fn flatten(path: &PathData) -> Vec<Vec<Point>> {
     polys
 }
 
-/// Scribble (simplified): a single zig-zag hatching across the filled area at `angle`, outlined
-/// to `strokeWidth` so the fill paints it.
+/// Whether segment `p`–`q` properly crosses an edge of `polys`: its own ends, which lie on the
+/// outline, don't count, nor does running along an edge.
+fn crosses_outline(p: Point, q: Point, polys: &[Vec<Point>]) -> bool {
+    let (p, q) = (p.lerp(q, 1e-3), q.lerp(p, 1e-3));
+    let side = |a: Point, b: Point, c: Point| (b - a).cross(c - a);
+    // Strictly on opposite sides, beyond rounding noise (the sides are areas: length × length).
+    let apart = |s1: f64, s2: f64, eps: f64| (s1 > eps && s2 < -eps) || (s1 < -eps && s2 > eps);
+    let pq = (q - p).hypot();
+    polys.iter().any(|pl| {
+        pl.windows(2).any(|w| {
+            let (a, b) = (w[0], w[1]);
+            let eps = 1e-9 * pq * (b - a).hypot();
+            apart(side(p, q, a), side(p, q, b), eps) && apart(side(a, b, p), side(a, b, q), eps)
+        })
+    })
+}
+
+/// Scribble (simplified): a zig-zag hatching across the filled area at `angle`, one per region
+/// of the shape, outlined to `strokeWidth` so the fill paints it.
 pub fn scribble(path: &PathData, b: Rect, p: &Value) -> PathData {
     let angle = num(p, "angle", 30.0).to_radians();
     let overlap = num(p, "overlap", 0.0);
@@ -117,7 +134,16 @@ pub fn scribble(path: &PathData, b: Rect, p: &Value) -> PathData {
         return PathData::default();
     }
     let step = spacing.max((y1 - y0) / 2000.0);
-    let mut pts: Vec<Point> = vec![];
+    // One zig-zag per region (#1648): a span continues a chain of the previous row as long as the
+    // line from that row's end to this one's start stays inside the shape; otherwise it starts a
+    // chain of its own. So no line crosses a hole or a notch. In a convex shape that line always
+    // stays inside: one chain, as before.
+    struct Chain {
+        pts: Vec<Point>,
+        end: Point,
+        row: u64,
+    }
+    let mut chains: Vec<Chain> = vec![];
     let mut y = y0 + step / 2.0;
     let mut row = 0u64;
     while y < y1 {
@@ -131,29 +157,42 @@ pub fn scribble(path: &PathData, b: Rect, p: &Value) -> PathData {
             }
         }
         xs.sort_by(f64::total_cmp);
-        let mut spans: Vec<(f64, f64)> = xs.as_chunks::<2>().0.iter().map(|s| (s[0] - overlap, s[1] + overlap)).collect();
-        if row % 2 == 1 {
-            spans.reverse();
-        }
+        let spans: Vec<(f64, f64)> = xs.as_chunks::<2>().0.iter().map(|s| (s[0] - overlap, s[1] + overlap)).collect();
+        let open = chains.len();
         for (a, bx) in spans {
             let jitter = |k: u64| variation * noise(seed, row, k, 3);
             let (l, r) = (Point::new(a + jitter(0), y + jitter(1)), Point::new(bx + jitter(2), y + jitter(3)));
-            if row.is_multiple_of(2) {
-                pts.push(l);
-                pts.push(r);
-            } else {
-                pts.push(r);
-                pts.push(l);
+            let even = row.is_multiple_of(2);
+            let pair = if even { [l, r] } else { [r, l] };
+            // Un-jittered ends of the span in drawing order.
+            let (start, end) = if even { (Point::new(a, y), Point::new(bx, y)) } else { (Point::new(bx, y), Point::new(a, y)) };
+            // The nearest chain of the previous row that this span can join without leaving
+            // the shape.
+            let prev = row.checked_sub(1);
+            let pick = (0..open)
+                .filter(|&k| Some(chains[k].row) == prev && !crosses_outline(chains[k].end, start, &polys))
+                .min_by(|&i, &j| (chains[i].end - start).hypot().total_cmp(&(chains[j].end - start).hypot()));
+            match pick {
+                Some(k) => {
+                    let c = &mut chains[k];
+                    c.pts.extend(pair);
+                    (c.end, c.row) = (end, row);
+                }
+                None => chains.push(Chain { pts: pair.to_vec(), end, row }),
             }
         }
         row += 1;
         y += step;
     }
-    if pts.len() < 2 {
+    let lines: Vec<SubPath> = chains
+        .into_iter()
+        .filter(|c| c.pts.len() >= 2)
+        .map(|c| if curvy > 0.0 { catmull_rom(&c.pts, false, curvy * 2.0) } else { SubPath::polyline(&c.pts, false) })
+        .collect();
+    if lines.is_empty() {
         return PathData::default();
     }
-    let line = if curvy > 0.0 { catmull_rom(&pts, false, curvy * 2.0) } else { SubPath::polyline(&pts, false) };
-    let mut center = PathData::single(line);
+    let mut center = PathData::new(lines);
     center.transform(to_local);
     let stroke = kurbo::Stroke::new(width).with_join(kurbo::Join::Round).with_caps(kurbo::Cap::Round);
     let outline = kurbo::stroke(center.to_bezpath(), &stroke, &kurbo::StrokeOpts::default(), 0.05);

crates/effects/src/tests.rs

@@ -236,6 +236,44 @@ fn roughen_seed_changes_result_and_detail_adds_points() {
     assert!(bb.x0 > -8.0 && bb.x1 < 108.0);
 }
 
+#[test]
+fn catmull_rom_keeps_a_turn_back_smooth() {
+    // #1643: the path runs out to (10, 0) and turns back to (0.5, 0.2). The Catmull-Rom tangent
+    // `next - prev` is almost zero there; the anchor gets handles along the chords' bisector
+    // (here nearly perpendicular to them), collinear and as long as half the longer chord / 6.
+    let pts = [Point::new(0.0, 0.0), Point::new(10.0, 0.0), Point::new(0.5, 0.2), Point::new(10.0, 5.0)];
+    let sp = util::catmull_rom(&pts, false, 1.0);
+    let a = sp.anchors[1];
+    let (hin, hout) = (a.h_in - a.p, a.h_out - a.p);
+    assert!(close(hin.x, -hout.x, 1e-9) && close(hin.y, -hout.y, 1e-9), "collinear: {a:?}");
+    assert!(close(hout.hypot(), 0.5 * 10.0 / 6.0, 1e-3), "{a:?}");
+    assert!(hout.x.abs() < 0.05 * hout.hypot(), "across the chords: {a:?}");
+    // A regular turn keeps the plain Catmull-Rom tangent.
+    let pts = [Point::new(0.0, 0.0), Point::new(10.0, 0.0), Point::new(10.0, 10.0)];
+    let a = util::catmull_rom(&pts, false, 1.0).anchors[1];
+    let (got, want) = (a.h_out - a.p, (pts[2] - pts[0]) / 6.0);
+    assert!(close(got.x, want.x, 1e-12) && close(got.y, want.y, 1e-12), "{got:?} vs {want:?}");
+}
+
+#[test]
+fn roughen_smooth_makes_no_cusps() {
+    // #1643: wherever Roughen's jitter turns the path back, the smooth points stay smooth: no
+    // anchor's handles shrink below 1/12 of its longer chord (a cusp that PDF viewers miter).
+    let star = shapes::star(Point::new(150.0, 100.0), 70.0, 32.0, 5, 0.0);
+    for seed in 0..50 {
+        let out = run("distort.roughen", json!({"size": 3, "detail": 10, "seed": seed}), &star);
+        for sp in &out.subpaths {
+            let n = sp.anchors.len();
+            for i in 0..n {
+                let a = sp.anchors[i];
+                let (prev, next) = (sp.anchors[(i + n - 1) % n].p, sp.anchors[(i + 1) % n].p);
+                let chord = (a.p - prev).hypot().max((next - a.p).hypot());
+                assert!((a.h_out - a.p).hypot() >= chord / 12.0 - 1e-9, "seed {seed}: cusp at {:?}", a.p);
+            }
+        }
+    }
+}
+
 #[test]
 fn zigzag_ridge_count_and_amplitude() {
     let out = run("distort.zigZag", json!({"ridges": 4, "points": "corner", "size": 10}), &square());
@@ -354,6 +392,23 @@ fn twist_fixes_the_outer_circle_and_rotates_inside() {
     assert!((a.y - 50.0).abs() > 1.0, "near-centre points rotate: {a:?}");
 }
 
+#[test]
+fn scribble_does_not_cross_holes() {
+    // #1648: a U (opening at the top, the notch x 30..70, y 0..60). Rows (y 2.5, 7.5, ...) through the prongs have
+    // two spans; their zig-zags must stay apart instead of crossing the notch.
+    let u = [(0.0, 0.0), (30.0, 0.0), (30.0, 60.0), (70.0, 60.0), (70.0, 0.0), (100.0, 0.0), (100.0, 100.0), (0.0, 100.0)];
+    let u = PathData::single(SubPath::polyline(&u.map(|(x, y)| Point::new(x, y)), true));
+    let params = json!({"angle": 0, "variation": 0, "curviness": 0, "strokeWidth": 2, "spacing": 5});
+    let out = run("stylize.scribble", params, &u).to_bezpath();
+    for x in [40.0, 50.0, 60.0] {
+        for y in [12.5, 32.5, 52.5] {
+            assert_eq!(vectorcraft_geom::kurbo::Shape::winding(&out, Point::new(x, y)), 0, "scribble covers the notch at ({x}, {y})");
+        }
+    }
+    // The bar below the notch is still hatched.
+    assert_ne!(vectorcraft_geom::kurbo::Shape::winding(&out, Point::new(50.0, 82.5)), 0);
+}
+
 #[test]
 fn scribble_produces_filled_outline_inside_bounds() {
     let out = run("stylize.scribble", json!({}), &square());

crates/effects/src/tests_solids.rs

@@ -146,11 +146,85 @@ fn a_twisted_tapered_hollow_inflate_exports_and_expands() {
     assert!(ids.len() > 20, "{} nodes", ids.len());
 }
 
+/// Files and scripts from before the Perspective angle give `perspective` as a 0–100 % strength:
+/// each 3D effect draws it exactly as the angle that stands for it, an angle given too wins, and
+/// the current parameters carry only the angle.
+#[test]
+fn an_earlier_perspective_strength_draws_as_its_angle() {
+    let art = |n: &Node, id: &str| if id == crate::REVOLVE { crate::revolve_art(n) } else { solid_art(n) };
+    for id in SOLIDS.iter().copied().chain([crate::REVOLVE]) {
+        let view = |extra: Value| {
+            let mut p = json!({"rotationX": -25, "rotationY": 35, "rotationZ": 0, "depth": 80});
+            p.as_object_mut().unwrap().extend(extra.as_object().unwrap().clone());
+            p
+        };
+        let with = |params: Value| {
+            let mut n = square_node();
+            // As read from a file: the stored parameters, not a fresh effect's.
+            n.appearance.effects.push(Effect { id: id.into(), params, visible: true });
+            art(&n, id).unwrap().visual_bounds().unwrap()
+        };
+        let angle = vectorcraft_three_d::perspective_from_strength(0.6);
+        let old = with(view(json!({"perspective": 60})));
+        let new = with(view(json!({"perspectiveAngle": angle})));
+        let none = with(view(json!({})));
+        for (a, b) in [(old.x0, new.x0), (old.y0, new.y0), (old.x1, new.x1), (old.y1, new.y1)] {
+            assert!((a - b).abs() < 1e-9, "{id}: {old:?} against {new:?}, none {none:?}");
+        }
+        assert!((old.width() - none.width()).abs() > 1.0 || (old.height() - none.height()).abs() > 1.0, "{id}: perspective shows");
+        assert_eq!(with(view(json!({"perspective": 60, "perspectiveAngle": 0}))), none, "{id}: the angle wins");
+        let merged = crate::merged_params(id, &view(json!({"perspective": 60})));
+        assert!(merged.get("perspective").is_none() && (merged["perspectiveAngle"].as_f64().unwrap() - angle).abs() < 1e-12, "{id}");
+    }
+}
+
+/// Effects from before Rotation and Height set the light by azimuth and elevation: each 3D effect
+/// shades its faces exactly as with the Rotation, Height and side that stand for it.
+#[test]
+fn an_earlier_light_direction_shades_as_its_rotation_and_height() {
+    fn colours(n: &Node, out: &mut Vec<[f32; 3]>) {
+        if let Some(AppearanceItem::Fill(f)) = n.appearance.items.first()
+            && let Some(c) = f.paint.color()
+        {
+            out.push(c.to_rgb());
+        }
+        for c in n.children().into_iter().flatten() {
+            colours(c, out);
+        }
+    }
+    for id in SOLIDS.iter().copied().chain([crate::REVOLVE]) {
+        for (azimuth, elevation) in [(-45.0, 45.0), (150.0, -30.0), (60.0, 80.0), (-120.0, 10.0)] {
+            let with = |light: Value| {
+                let mut p = json!({"rotationX": -25, "rotationY": 35, "rotationZ": 0, "depth": 60, "lightSoftness": 0});
+                p.as_object_mut().unwrap().extend(light.as_object().unwrap().clone());
+                let mut n = square_node();
+                n.appearance.effects.push(Effect { id: id.into(), params: p, visible: true });
+                let art = if id == crate::REVOLVE { crate::revolve_art(&n) } else { solid_art(&n) }.unwrap();
+                let mut out = vec![];
+                colours(&art, &mut out);
+                out
+            };
+            let (r, h, behind) = vectorcraft_three_d::light_from_azimuth_elevation(azimuth, elevation);
+            let old = with(json!({"lightAzimuth": azimuth, "lightElevation": elevation}));
+            let new = with(json!({"lightRotation": r, "lightHeight": h, "lightBehind": behind}));
+            assert!(!old.is_empty() && old.len() == new.len(), "{id}");
+            for (a, b) in old.iter().zip(&new) {
+                assert!(a.iter().zip(b).all(|(a, b)| (a - b).abs() < 1e-6), "{id} {azimuth} {elevation}: {a:?} against {b:?}");
+            }
+        }
+        let merged = crate::merged_params(id, &json!({"lightAzimuth": 90, "lightElevation": 0}));
+        assert!(
+            merged.get("lightAzimuth").is_none() && merged["lightHeight"].as_f64().unwrap().abs() < 1e-9 && merged["lightBehind"] == json!(false),
+            "{id}: {merged}"
+        );
+    }
+}
+
 #[test]
 fn effects_before_it_shape_the_solid_and_effects_after_it_bend_the_result() {
     let mut n = square_node();
     n.appearance.effects.push(fx("path.offsetPath", json!({"offset": 20})));
-    n.appearance.effects.push(fx(EXTRUDE, json!({"rotationX": 0, "rotationY": 0, "rotationZ": 0, "perspective": 0})));
+    n.appearance.effects.push(fx(EXTRUDE, json!({"rotationX": 0, "rotationY": 0, "rotationZ": 0, "perspectiveAngle": 0})));
     // Straight on, the extrusion shows its front: the offset square.
     let b = solid_art(&n).unwrap().visual_bounds().unwrap();
     assert!((b.width() - 140.0 - 0.75).abs() < 1e-6, "{b:?}");

crates/effects/src/util.rs

@@ -72,7 +72,7 @@ pub fn seg_cubic(sp: &SubPath, i: usize) -> CubicBez {
 /// Non-linear path mapping (shared with live envelopes in `vectorcraft-doc`).
 pub use vectorcraft_doc::live::map_nonlinear;
 
-/// Smooth subpath through `pts` (Catmull-Rom tangents).
+/// Smooth subpath through `pts` (Catmull-Rom tangents, see [`turn_tangent`] for sharp turns).
 pub fn catmull_rom(pts: &[Point], closed: bool, tension: f64) -> SubPath {
     let n = pts.len();
     if n < 3 {
@@ -82,13 +82,38 @@ pub fn catmull_rom(pts: &[Point], closed: bool, tension: f64) -> SubPath {
         .map(|i| {
             let prev = if i == 0 { if closed { pts[n - 1] } else { pts[0] } } else { pts[i - 1] };
             let next = if i == n - 1 { if closed { pts[0] } else { pts[n - 1] } } else { pts[i + 1] };
-            let t: Vec2 = (next - prev) * (tension / 6.0);
+            let t: Vec2 = turn_tangent(prev, pts[i], next) * (tension / 6.0);
             Anchor::with_handles(pts[i], pts[i] - t, pts[i] + t)
         })
         .collect();
     SubPath::new(anchors, closed)
 }
 
+/// The Catmull-Rom tangent `next − prev` at `p`. Where the path turns back sharply, `next`
+/// nearly meets `prev` and that tangent shrinks to nothing: the anchor would be a cusp, which
+/// PDF viewers draw with a miter spike (#1643). So it is kept at least half as long as the
+/// longer chord, and there it follows the bisector of the two chords (the perpendicular of the
+/// incoming one when the path reverses exactly): the turn becomes a round hairpin. Turns of
+/// less than about 150° keep the plain Catmull-Rom tangent.
+fn turn_tangent(prev: Point, p: Point, next: Point) -> Vec2 {
+    let t = next - prev;
+    let (a, b) = (p - prev, next - p);
+    let floor = 0.5 * a.hypot().max(b.hypot());
+    if t.hypot() >= floor {
+        return t;
+    }
+    let unit = |v: Vec2| {
+        let l = v.hypot();
+        if l > 1e-12 { v / l } else { Vec2::ZERO }
+    };
+    let (u, v) = (unit(a), unit(b));
+    let mut d = unit(u + v);
+    if d == Vec2::ZERO {
+        d = Vec2::new(-u.y, u.x);
+    }
+    if d == Vec2::ZERO { t } else { d * floor }
+}
+
 /// Unit normal (left of travel direction in y-down coordinates) of cubic `c` at `t`.
 pub fn normal_at(c: &CubicBez, t: f64) -> Vec2 {
     let eps = 1e-4;

crates/effects/src/warp.rs

@@ -22,10 +22,10 @@ pub fn warp(path: &PathData, b: Rect, style: WarpStyle, p: &Value) -> PathData {
     let f = |q: Point| {
         let (x, y) = ((q.x - c.x) / hw, (q.y - c.y) / hh);
         let (x2, y2) = if vertical {
-            let (a, b2) = warp_point(style, bend, dh, dv, y, x);
+            let (a, b2) = warp_point(style, bend, dh, dv, hw / hh, y, x);
             (b2, a)
         } else {
-            warp_point(style, bend, dh, dv, x, y)
+            warp_point(style, bend, dh, dv, hh / hw, x, y)
         };
         Point::new(c.x + x2 * hw, c.y + y2 * hh)
     };

crates/engine/Cargo.toml

@@ -26,6 +26,7 @@ vectorcraft-eps = { workspace = true }
 vectorcraft-metafile = { workspace = true }
 vectorcraft-plugins = { workspace = true }
 vectorcraft-affinity = { workspace = true }
+vectorcraft-scriptcheck = { workspace = true }
 image = { workspace = true }
 flate2 = { workspace = true }
 kurbo = { workspace = true }

crates/engine/src/cmd/buildcmds.rs

@@ -120,7 +120,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Make",
             ["Object", "Image Trace"],
             None,
-            "{id?: image or Image Trace group (default: selection), preset?: name (imageTrace.presets), params?: {mode: \"blackAndWhite\"|\"grayscale\"|\"color\"|\"logo\", threshold: 0-255, palette: \"limited\"|\"fullTone\"|\"automatic\"|\"documentLibrary\" (color mode; limited: the `colors` best colours, fullTone: as many as the tones need, more with colorDetail, automatic: flat art with its own colours, else fullTone, documentLibrary: at most `colors` of the library's colours, as they are), colors: 2-256, colorDetail: 0-100 (fullTone, automatic), library: \"document\" (the document's swatches) or a swatch library id or name (swatch.library.list; documentLibrary), paths: 0-100, corners: 0-100, noise: px, method: \"abutting\"|\"overlapping\", ignoreWhite (leave out white areas), ignoreColor?: \"#rrggbb\" (with ignoreWhite: the colour left out instead of white), snapCurvesToLines, shapes: false (filled outlines that are a circle, an ellipse, a rectangle or a regular polygon come out as that live shape), autoGrouping: false (each path that has others inside it is grouped with them), fills: true, strokes: false (Create: lines up to strokeWidth wide become stroked centre lines; without fills, wider areas become stroked outlines), strokeWidth: px (10), logoColors?: [\"#rrggbb\"…] (mode logo: flat-colour logos only; colours found automatically or named here, white is always its own colour, at most ten; noise = areas under noise/10 px ignored; edges to a fraction of a pixel, sharp corners restored, lines and circles snapped; enclosed transparent areas are painted white unless ignoreWhite makes them holes; fills/strokes are ignored; gradients and photos are refused)}, view?: as imageTrace.setView (default: the traced object's own, else tracingResult), ids?: [id…] (instead of id)} → {id, paths, anchors, colors}",
+            "{id?: image or Image Trace group (default: selection), preset?: name (imageTrace.presets), enhanced?: false (the preset's enhanced version: with Auto Grouping, and with Shapes in all but High Fidelity Photo; Flat Logo has none and is traced as it is), params?: {mode: \"blackAndWhite\"|\"grayscale\"|\"color\"|\"logo\", threshold: 0-255, palette: \"limited\"|\"fullTone\"|\"automatic\"|\"documentLibrary\" (color mode; limited: the `colors` best colours, fullTone: as many as the tones need, more with colorDetail, automatic: flat art with its own colours, else fullTone, documentLibrary: at most `colors` of the library's colours, as they are), colors: 2-256, colorDetail: 0-100 (fullTone, automatic), library: \"document\" (the document's swatches) or a swatch library id or name (swatch.library.list; documentLibrary), paths: 0-100, corners: 0-100, noise: px, method: \"abutting\"|\"overlapping\", ignoreWhite (leave out white areas), ignoreColor?: \"#rrggbb\" (with ignoreWhite: the colour left out instead of white), snapCurvesToLines, shapes: false (filled outlines that are a circle, an ellipse, a rectangle or a regular polygon come out as that live shape), autoGrouping: false (each path that has others inside it is grouped with them), gradients: false (grayscale and color: an area whose colour changes evenly along one direction is one path with a linear gradient fill), fills: true, strokes: false (Create: lines up to strokeWidth wide become stroked centre lines; without fills, wider areas become stroked outlines), strokeWidth: px (10), logoColors?: [\"#rrggbb\"…] (mode logo: flat-colour logos only; colours found automatically or named here, white is always its own colour, at most ten; noise = areas under noise/10 px ignored; edges to a fraction of a pixel, sharp corners restored, lines and circles snapped; enclosed transparent areas are painted white unless ignoreWhite makes them holes; fills/strokes are ignored; gradients and photos are refused)}, view?: as imageTrace.setView (default: the traced object's own, else tracingResult), ids?: [id…] (instead of id)} → {id, paths, anchors, colors}",
             has_selection_or_ids,
             |s, p| trace_make(s, p, false)
         ),
@@ -160,8 +160,8 @@ pub fn specs() -> Vec<CommandSpec> {
             has_selection_or_ids,
             trace_set_view
         ),
-        cmd!(query "imageTrace.presets", "Image Trace Presets", [], None, "{} → {presets: [{name, params}]}", always, |_, _| {
-            Ok(json!({ "presets": tr::presets().into_iter().map(|(n, p)| json!({ "name": n, "params": p })).collect::<Vec<_>>() }))
+        cmd!(query "imageTrace.presets", "Image Trace Presets", [], None, "{} → {presets: [{name, params, enhanced: the params of the preset's enhanced version, null if it has none}]}", always, |_, _| {
+            Ok(json!({ "presets": tr::presets().into_iter().map(|(n, p)| json!({ "name": n, "params": p, "enhanced": tr::enhanced_preset(n) })).collect::<Vec<_>>() }))
         }),
     ]
 }
@@ -657,7 +657,10 @@ fn view_param(cmd: &str, p: &Value) -> Result<Option<TraceView>> {
 
 fn trace_params(p: &Value) -> Result<tr::TraceParams> {
     let name = str_param(p, "preset").unwrap_or("Default");
-    let base = tr::preset(name).ok_or_else(|| bad("imageTrace.make", format!("unknown preset `{name}` (see imageTrace.presets)")))?;
+    let enhanced = p.get("enhanced").and_then(Value::as_bool).unwrap_or(false);
+    // (A preset without an enhanced version is traced as it is.)
+    let base = enhanced.then(|| tr::enhanced_preset(name)).flatten().or_else(|| tr::preset(name));
+    let base = base.ok_or_else(|| bad("imageTrace.make", format!("unknown preset `{name}` (see imageTrace.presets)")))?;
     let Some(over) = p.get("params").filter(|v| !v.is_null()) else { return Ok(base) };
     let mut v = serde_json::to_value(&base).map_err(|e| EngineError::Other(e.to_string()))?;
     let (Some(o), Some(src)) = (v.as_object_mut(), over.as_object()) else { return Err(bad("imageTrace.make", "params must be an object")) };
@@ -727,9 +730,20 @@ fn traced_shape(shape: tr::TracedShape, xf: vectorcraft_geom::Affine) -> LiveSha
     live
 }
 
+/// The gradient fill for a linear gradient the tracer found (in the image's pixels), placed in the
+/// document by `xf`.
+fn traced_gradient(g: &tr::TracedGradient, xf: vectorcraft_geom::Affine) -> Paint {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = g.stops.iter().map(|&(at, c)| GradientStop::new(at as f32, Color::rgb8(c[0], c[1], c[2]))).collect();
+    let mut paint = GradientPaint::new(Gradient { kind: GradientKind::Linear, stops });
+    paint.geom = Some(GradientGeom { start: xf * g.start, end: xf * g.end, aspect: 1.0, focal: None });
+    Paint::Gradient(Box::new(paint))
+}
+
 /// Auto Grouping: `nodes` (one per traced path, bottom-most first) with each path that has others
-/// inside it (`parents`, as the tracer gives them) in a group with them: the path, then what is
-/// inside it. Without parents, the nodes as they are.
+/// inside it (`parents`, as the tracer gives them) in a group with them, in the order they had:
+/// abutting paths painted in another order would show a seam where they meet. Without parents,
+/// the nodes as they are.
 fn grouped(d: &mut Document, nodes: Vec<Node>, parents: &[Option<usize>]) -> Vec<Arc<Node>> {
     let n = nodes.len();
     let mut inside: Vec<Vec<usize>> = vec![vec![]; n];
@@ -751,8 +765,14 @@ fn grouped(d: &mut Document, nodes: Vec<Node>, parents: &[Option<usize>]) -> Vec
     let mut built: Vec<Option<Arc<Node>>> = vec![None; n];
     for &i in order.iter().rev() {
         let Some(node) = nodes.get_mut(i).and_then(Option::take) else { continue };
-        let within: Vec<Arc<Node>> = inside.get(i).into_iter().flatten().filter_map(|&c| built.get_mut(c)?.take()).collect();
-        let made = if within.is_empty() { node } else { Node::group(d.alloc_id(), std::iter::once(Arc::new(node)).chain(within).collect()) };
+        let mut within: Vec<(usize, Arc<Node>)> = inside.get(i).into_iter().flatten().filter_map(|&c| Some((c, built.get_mut(c)?.take()?))).collect();
+        let made = if within.is_empty() {
+            node
+        } else {
+            within.push((i, Arc::new(node)));
+            within.sort_by_key(|m| m.0);
+            Node::group(d.alloc_id(), within.into_iter().map(|m| m.1).collect())
+        };
         if let Some(slot) = built.get_mut(i) {
             *slot = Some(Arc::new(made));
         }
@@ -768,12 +788,11 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
     let mut params = trace_params(p)?;
     let view = view_param(C, p)?;
     let params_json = serde_json::to_value(&params).map_err(|e| EngineError::Other(e.to_string()))?;
-    // The preset's name if the parameters are exactly that preset's, else "Custom".
+    // The preset's name if the parameters are exactly that preset's or its enhanced version's,
+    // else "Custom".
     let named = str_param(p, "preset").unwrap_or("Default");
-    let preset_label = match tr::preset(named) {
-        Some(b) if serde_json::to_value(&b).ok().as_ref() == Some(&params_json) => named.to_string(),
-        _ => "Custom".to_string(),
-    };
+    let is = |b: Option<tr::TraceParams>| b.and_then(|b| serde_json::to_value(&b).ok()).as_ref() == Some(&params_json);
+    let preset_label = if is(tr::preset(named)) || is(tr::enhanced_preset(named)) { named.to_string() } else { "Custom".to_string() };
     let roots = root_ids(s, p)?;
     // The image (inside a trace group, or selected directly).
     let (target, img) = {
@@ -835,12 +854,13 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
             }
             // A library colour fills with the swatch's own colour (its model kept).
             let color = library.iter().find(|(rgb, _)| *rgb == tp.color).map_or_else(|| Color::rgb8(tp.color[0], tp.color[1], tp.color[2]), |l| l.1);
-            let paint = Paint::solid(color);
+            // Gradients: a path the tracer found to be a linear gradient is filled with it.
+            let paint = tp.gradient.as_ref().map_or_else(|| Paint::solid(color), |g| traced_gradient(g, xf));
             n.appearance = match tp.stroke {
-                // Traced lines: round ends and corners, as drawn lines have.
+                // Traced lines: round corners, and ends round or square as the tracer found them.
                 Some(width) => Appearance {
                     items: vec![AppearanceItem::Stroke(StrokeLayer {
-                        cap: LineCap::Round,
+                        cap: if tp.square_caps { LineCap::Square } else { LineCap::Round },
                         join: LineJoin::Round,
                         ..StrokeLayer::new(paint, width * unit)
                     })],

crates/engine/src/cmd/create.rs

@@ -74,7 +74,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Create Text",
             [],
             None,
-            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, area?: {width, height, fit?: none|autoHeight|shrinkText, fitMinPercent?}, placeholder?: bool (fill it with placeholder text instead, as the Type tools do with prefs placeholderText), leadingModel?: \"romanBaseline\"|\"emBoxTop\", charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (default: emBoxTop and emBoxCenter while the interface is in Japanese, else romanBaseline)} → {id, overflow?: [id] (area type whose text doesn't fit its frame: the lines past it aren't drawn; left out when it fits)}; new area type gets Auto Size (fit autoHeight) when the autoSizeAreaType preference is on",
+            "{x, y, text, vertical?: bool = false, size?: pt, font?: family, style?, color?, area?: {width, height, fit?: none|autoHeight|shrinkText, fitMinPercent?}, placeholder?: bool (fill it with placeholder text instead, as the Type tools do with prefs placeholderText), justify?: \"auto\" (default: the start of each paragraph's direction)|\"left\"|\"center\"|\"right\"|\"justifyAll\" (point type: aligned on x, so \"center\" centres each line on the point and \"right\" ends it there; text.setStyle changes it later), leadingModel?: \"romanBaseline\"|\"emBoxTop\", charAlign?: \"romanBaseline\"|\"emBoxTop\"|\"emBoxCenter\"|\"emBoxBottom\"|\"icfTop\"|\"icfBottom\" (default: emBoxTop and emBoxCenter while the interface is in Japanese, else romanBaseline)} → {id, overflow?: [id] (area type whose text doesn't fit its frame: the lines past it aren't drawn; left out when it fits)}; new area type gets Auto Size (fit autoHeight) when the autoSizeAreaType preference is on",
             has_doc,
             text_create
         ),
@@ -519,12 +519,16 @@ pub(crate) fn new_type_para() -> vectorcraft_doc::ParaStyle {
     }
 }
 
-/// The leading model and character alignment new type starts with (`t`'s paragraph and runs):
-/// `leadingModel` and `charAlign` from `p`, else em box top to top and em box centre while the
+/// The paragraph alignment, leading model and character alignment new type starts with (`t`'s
+/// paragraph and runs): `justify` from `p` (else as [`new_type_para`] left it), `leadingModel`
+/// and `charAlign` from `p`, else em box top to top and em box centre while the
 /// interface is in Japanese (#432), else the Roman baseline for both. Noted in the journal, so a
 /// replay sets the same whatever the interface.
 pub(crate) fn new_type_alignment(s: &mut Session, p: &Value, cmd: &str, t: &mut TextObject) -> Result<()> {
     use vectorcraft_doc::{CharAlign, LeadingModel};
+    if let Some(j) = str_param(p, "justify") {
+        t.para.justify = super::typecmd::justify_param(j).ok_or_else(|| bad(cmd, "justify must be auto|left|center|right|justifyAll"))?;
+    }
     let japanese = s.japanese_interface();
     let leading = match p.get("leadingModel").filter(|v| !v.is_null()) {
         Some(v) => match v.as_str() {

crates/engine/src/cmd/distortcmds.rs

@@ -24,7 +24,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Width Point",
             [],
             None,
-            "{id, t: 0..1 (fraction of the path length), left, right: side widths in pt, index?: width point to edit or move, adjustAdjoining?: bool (with index: the nearest points either side change their widths in proportion)} → {index}. Without index a point already at t is replaced; a point moved onto another one's t joins it as a discontinuous point (on the side it came from), so the width steps there. Creates a uniform profile first if needed",
+            "{id, t: 0..1 (fraction of the path length), left, right: side widths in pt, index?: width point to edit or move, adjustAdjoining?: bool (the nearest points either side change their widths in proportion, using the sampled widths for a new point)} → {index}. Without index a point already at t is replaced; a point moved onto another one's t joins it as a discontinuous point (on the side it came from), so the width steps there. Creates a uniform profile first if needed",
             has_doc,
             width_point_set
         ),
@@ -311,8 +311,13 @@ fn width_point_set(s: &mut Session, p: &Value) -> Result<Value> {
                 }
             }
             None => {
+                let old = adjust.then(|| prof.at(t));
                 prof.points.retain(|q| (q.0 - t).abs() > SAME_T);
-                place(&mut prof.points, pt, true)
+                let i = place(&mut prof.points, pt, true);
+                if let Some((left, right)) = old {
+                    adjust_adjoining(&mut prof.points, i, (t, left, right), pt);
+                }
+                i
             }
         };
         st.profile = Some(prof);

crates/engine/src/cmd/draw2.rs

@@ -615,7 +615,10 @@ fn freehand(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let sp = fit_freehand(&pts, tol, closed);
     let fill = if bool_or(p, "fill", false) { s.paint.fill.clone() } else { Paint::None };
-    let mut look = s.new_art_look(fill, stroke_paint(s), s.paint.stroke_width.max(0.1));
+    // A pencil path with a fill keeps a stroke of None (#1679); only one that would show nothing
+    // gets black. A brush is its stroke.
+    let stroke = if brush || fill.is_none() { stroke_paint(s) } else { s.paint.stroke.clone() };
+    let mut look = s.new_art_look(fill, stroke, s.paint.stroke_width.max(0.1));
     if let Some(st) = look.appearance.stroke_mut() {
         st.pressure = pressure;
     }

crates/engine/src/cmd/edit.rs

@@ -128,7 +128,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Clear",
             ["Edit"],
             Some("Delete"),
-            "{ids?} delete the objects `ids`, else the selection (direct-selected anchors, else objects, else ruler guides)",
+            "{ids?} delete the objects `ids`, else the selection (fully selected objects and direct-selected anchors together, else ruler guides)",
             has_selection_or_guides,
             clear
         ),
@@ -169,7 +169,7 @@ fn doc_node(s: &mut Session, p: &Value) -> Result<Value> {
     let doc = &s.doc()?.doc;
     let n = doc.node(id).ok_or(EngineError::NoNode(id))?;
     opts.compound_member = doc.parent_of(id).and_then(|p| doc.node(p)).is_some_and(|p| matches!(p.kind, vectorcraft_doc::NodeKind::Compound { .. }));
-    if summary { Ok(inspect::node_summary_opts(n, opts)) } else { Ok(serde_json::to_value(n).unwrap_or(Value::Null)) }
+    if summary { Ok(inspect::node_summary_opts(n, opts, &doc.symbol_boxes())) } else { Ok(serde_json::to_value(n).unwrap_or(Value::Null)) }
 }
 
 /// `depth` / `childLimit` for a summary read: absent (or null) means no limit.
@@ -368,7 +368,7 @@ fn cut(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn clear(s: &mut Session, p: &Value) -> Result<Value> {
     let explicit = if p.get("ids").is_some() { Some(checked_ids_param(s, p, "ids", "edit.clear")?) } else { None };
-    // Direct-selected anchors or segments: remove those components instead of whole objects.
+    // Direct-selected anchors or segments: remove those, and any objects selected whole with them.
     if explicit.is_none() && !s.doc()?.selection.anchors.is_empty() {
         return super::path::delete_anchors(s, p);
     }

crates/engine/src/cmd/effectcmd.rs

@@ -280,6 +280,20 @@ fn move_effect(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "ids": ids_json(&ids), "index": index, "item": item.flatten() }))
 }
 
+/// The ids of the effects `effect.setParams` with `p` edits, for the check of their parameters
+/// (none when `p` doesn't say which: running it reports why).
+pub(crate) fn set_params_effects(s: &Session, p: &Value) -> Vec<String> {
+    const C: &str = "effect.setParams";
+    let (Ok(index), Ok(item), Ok(ids), Ok(st)) = (index_param(p, "index", C), item_target(s, p, C), appearance_targets(s, p), s.doc()) else {
+        return vec![];
+    };
+    let effect = |id: &NodeId| {
+        let ap = &st.doc.node(*id)?.appearance;
+        Some(ap.effects_at(item.effects_item(ap, C).ok()?)?.get(index)?.id.clone())
+    };
+    ids.iter().filter_map(effect).collect()
+}
+
 fn set_params(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "effect.setParams";
     let index = index_param(p, "index", C)?;
@@ -297,8 +311,8 @@ fn set_params(s: &mut Session, p: &Value) -> Result<Value> {
             && visible != Some(false)
         {
             let mut prospective = effects::merged_params(&e.id, &e.params);
-            if let (Some(cur), Some(new)) = (prospective.as_object_mut(), params.as_object()) {
-                cur.extend(new.clone());
+            if let (Some(cur), Value::Object(new)) = (prospective.as_object_mut(), effects::upgrade_params(&e.id, &params)) {
+                cur.extend(new);
             }
             if e.id == effects::REVOLVE {
                 effects::validate_revolve(n, &prospective).map_err(|e| bad(C, e))?;
@@ -309,14 +323,15 @@ fn set_params(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let ids = edit_effects(s, p, item, C, "Effect Options", &format!("{C}: no effect at index {index}"), |fx| {
         let Some(e) = fx.get_mut(index) else { return false };
-        if let (Value::Object(new), cur) = (&params, &mut e.params) {
+        if let (Value::Object(new), cur) = (effects::upgrade_params(&e.id, &params), &mut e.params) {
             if !cur.is_object() {
                 *cur = effects::merged_params(&e.id, &Value::Null);
             }
+            // Earlier parameters (a Perspective strength, a light by azimuth and elevation) take
+            // their current form first, so the new values replace them and the rest is kept.
+            *cur = effects::upgrade_params(&e.id, cur);
             if let Value::Object(m) = cur {
-                for (k, v) in new {
-                    m.insert(k.clone(), v.clone());
-                }
+                m.extend(new);
             }
         }
         if let Some(v) = visible {
@@ -566,7 +581,7 @@ mod tests {
             for other in ["threeD.revolve", "threeD.extrude", "threeD.rotate"] {
                 assert!(s.execute("effect.apply", &json!({"effect": other, "ids": [id.0], "item": null})).is_err(), "{effect} + {other}");
             }
-            s.execute("effect.setParams", &json!({"index": 0, "params": {"rotationY": 50, "depth": 120}, "ids": [id.0], "item": null})).unwrap();
+            s.execute("effect.setParams", &json!({"index": 0, "params": {"rotationY": 50, "rotationX": 10}, "ids": [id.0], "item": null})).unwrap();
             assert_ne!(effects::solid_art(&node(&s, id)).unwrap(), art, "{effect}: options change the art");
             assert!(s.execute("effect.setParams", &json!({"index": 0, "params": {"bevel": "nope"}, "ids": [id.0], "item": null})).is_err());
             let svg = s.execute("document.serialize", &json!({"format": "svg"})).unwrap();
@@ -588,6 +603,50 @@ mod tests {
         assert!(err.to_string().contains("requires a path"), "{err}");
     }
 
+    /// Scripts from before the Perspective angle give `perspective` as a 0–100 % strength: it is
+    /// stored as the angle that shows the same view, and a later angle replaces an earlier strength.
+    #[test]
+    fn an_earlier_perspective_strength_is_set_as_its_angle() {
+        let (mut s, id) = session_with_rect();
+        s.execute("effect.apply", &json!({"effect": effects::EXTRUDE, "ids": [id.0], "item": null, "params": {"perspective": 60}})).unwrap();
+        let params = |s: &Session| node(s, id).appearance.effects[0].params.clone();
+        let angle_of = |pct: f64| effects::merged_params(effects::EXTRUDE, &json!({"perspective": pct}))["perspectiveAngle"].as_f64().unwrap();
+        let angle = angle_of(60.0);
+        assert!((angle - 30.12).abs() < 0.01, "{angle}");
+        assert!(
+            params(&s).get("perspective").is_none() && (params(&s)["perspectiveAngle"].as_f64().unwrap() - angle).abs() < 1e-12,
+            "{}",
+            params(&s)
+        );
+        s.execute("effect.setParams", &json!({"index": 0, "params": {"perspective": 100}, "ids": [id.0], "item": null})).unwrap();
+        assert!((params(&s)["perspectiveAngle"].as_f64().unwrap() - angle_of(100.0)).abs() < 1e-12);
+        // A file of then: the strength stored; setting an angle replaces it.
+        std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).node_mut(id).unwrap().appearance.effects[0].params =
+            json!({"depth": 50, "perspective": 60});
+        s.execute("effect.setParams", &json!({"index": 0, "params": {"perspectiveAngle": 120}, "ids": [id.0], "item": null})).unwrap();
+        assert_eq!(params(&s), json!({"depth": 50, "perspectiveAngle": 120}));
+    }
+
+    /// Scripts from before Rotation and Height give the light by `lightAzimuth` and
+    /// `lightElevation`: stored as the same light; a later Height keeps that light's Rotation.
+    #[test]
+    fn an_earlier_light_direction_is_set_as_rotation_and_height() {
+        let (mut s, id) = session_with_rect();
+        s.execute(
+            "effect.apply",
+            &json!({"effect": effects::ROTATE, "ids": [id.0], "item": null, "params": {"lightAzimuth": 180, "lightElevation": 0}}),
+        )
+        .unwrap();
+        let params = |s: &Session| node(s, id).appearance.effects[0].params.clone();
+        // Straight from behind the object, level with it.
+        assert!(params(&s).get("lightAzimuth").is_none() && params(&s).get("lightElevation").is_none(), "{}", params(&s));
+        assert_eq!((params(&s)["lightHeight"].as_f64().unwrap().round(), &params(&s)["lightBehind"]), (90.0, &json!(true)));
+        std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).node_mut(id).unwrap().appearance.effects[0].params =
+            json!({"lightAzimuth": 90, "lightElevation": 0});
+        s.execute("effect.setParams", &json!({"index": 0, "params": {"lightHeight": 60}, "ids": [id.0], "item": null})).unwrap();
+        assert_eq!(params(&s), json!({"lightRotation": 0.0, "lightHeight": 60, "lightBehind": false}));
+    }
+
     fn effects_for_test(s: &Session, id: NodeId) -> vectorcraft_doc::Node {
         effects::revolve_art(&node(s, id)).unwrap()
     }

crates/engine/src/cmd/expand.rs

@@ -1,5 +1,5 @@
 //! Object → Expand: live shapes, type and effects (Object), strokes (Stroke) and gradient fills
-//! (Fill) into plain art in one undo step. Placed documents (Object) become editable copies of the
+//! (Fill) into plain art in one undo step; blends and repeats become groups of their steps and instances. Placed documents (Object) become editable copies of the
 //! art they show, their resources joining the document. A linear or radial gradient fill becomes a
 //! gradient mesh, or solid strips / concentric ellipses, inside a clip group shaped like the object; a freeform
 //! gradient becomes a mesh shaped like the object. Create Gradient Mesh shares the sampling.
@@ -37,7 +37,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Expand…",
             ["Object"],
             None,
-            "{object?: true (type → outlines, live shapes → paths, effects baked, blends → groups of their steps, envelopes → their distorted content, placed documents → editable copies of their art, as placing the file without link gives, its symbols, patterns, swatches and images joining the document), fill?: true (gradient fills → `gradient` art), stroke?: true (strokes → filled outlines), gradient?: \"objects\" (default: `steps` solid strips, concentric ellipses for radial gradients) | \"mesh\" (a gradient mesh); both in a clip group shaped like the object (freeform gradients always become a mesh shaped like it), steps?: 1..1000 (255)} one undo step → {ids}",
+            "{object?: true (type → outlines, live shapes → paths, effects baked, blends → groups of their steps, repeats → groups of their instances, envelopes → their distorted content, placed documents → editable copies of their art, as placing the file without link gives, its symbols, patterns, swatches and images joining the document), fill?: true (gradient fills → `gradient` art), stroke?: true (strokes → filled outlines), gradient?: \"objects\" (default: `steps` solid strips, concentric ellipses for radial gradients) | \"mesh\" (a gradient mesh); both in a clip group shaped like the object (freeform gradients always become a mesh shaped like it), steps?: 1..1000 (255)} one undo step → {ids}",
             has_selection,
             expand
         ),
@@ -106,6 +106,8 @@ struct Expandable {
     blends: bool,
     /// Placed documents (Object expands them into the art they show).
     placed: bool,
+    /// Repeats (Object expands them into groups of their instances).
+    repeats: bool,
 }
 
 impl Expandable {
@@ -120,6 +122,7 @@ impl Expandable {
                 e.envelope |= matches!(c.kind, NodeKind::Envelope { .. });
                 e.blends |= matches!(c.kind, NodeKind::Blend { .. });
                 e.placed |= matches!(c.kind, NodeKind::PlacedDocument(_));
+                e.repeats |= matches!(c.kind, NodeKind::Repeat(_));
                 e.stroke |= shape && !c.appearance.stroke_paint().is_none();
                 e.fill |= match &c.kind {
                     NodeKind::Text(t) => t.runs.iter().any(|r| matches!(r.style.fill, Paint::Gradient(_))),
@@ -131,7 +134,7 @@ impl Expandable {
     }
 
     fn object(&self) -> bool {
-        self.text || self.live || self.effects || self.envelope || self.blends || self.placed
+        self.text || self.live || self.effects || self.envelope || self.blends || self.placed || self.repeats
     }
 }
 
@@ -164,6 +167,11 @@ fn expand(s: &mut Session, p: &Value) -> Result<Value> {
         let roots = selected_roots(s)?;
         s.edit("Expand", |d, _| super::live::expand_blends(d, &roots).map(|_| ()))?;
     }
+    // Repeats too: their instances are copies of art that expands below.
+    if object && e.repeats {
+        let roots = selected_roots(s)?;
+        s.edit("Expand", |d, _| super::patterncmds::expand_repeats(d, &roots).map(|_| ()))?;
+    }
     if object && e.effects {
         let _ = run_raw(s, "effect.expandAppearance", &json!({}));
     }

crates/engine/src/cmd/fileio/affinity.rs

@@ -32,6 +32,7 @@ pub(super) fn import(name: &str, bytes: &[u8]) -> Result<Imported> {
         Ok(d) => {
             let mut b = Builder { doc: Document::new(0.0, 0.0), warnings: Vec::new(), k: 72.0 / d.dpi, layer: 0 };
             b.document(&d)?;
+            b.doc.limit_depth_noting(&mut b.warnings);
             let mut warnings = d.warnings.iter().map(|w| format!("Affinity: not imported or approximated: {w}.")).collect::<Vec<_>>();
             warnings.extend(b.warnings.iter().map(|w| format!("Affinity: {w}.")));
             Ok(Imported { doc: b.doc, warnings, preview_only: false })

crates/engine/src/cmd/fileio/encode.rs

@@ -175,6 +175,8 @@ struct RasterOptions {
     layers: Option<bool>,
     max_editability: Option<bool>,
     hidden_layers: Option<bool>,
+    /// Appearance of Black › Printing / Exporting (`prefs.blackOutput`); agents can set it here too.
+    rich_black: Option<bool>,
 }
 
 impl RasterOptions {
@@ -239,6 +241,7 @@ impl RasterOptions {
                 hidden_layers: self.hidden_layers.unwrap_or(false),
                 embed_icc,
             },
+            rich_black: self.rich_black.unwrap_or(false),
         })
     }
 }

crates/engine/src/cmd/fileio/export.rs

@@ -5,20 +5,23 @@ use std::collections::HashSet;
 use std::sync::Arc;
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Document, Node, NodeId, NodeKind};
+use vectorcraft_doc::{Document, Node, NodeId, NodeKind, SymbolBoxes};
 
 use crate::DocState;
 
 use super::super::*;
 use super::encode::single_artboard;
-use super::{ARTBOARD_PARAMS, Format, default_name, encode, encode_all, encode_with_warnings, merge, writable, write_encoded, write_or_return};
+use super::{
+    ARTBOARD_PARAMS, Format, default_name, encode, encode_all, encode_with_warnings, merge, with_black_output, writable, write_encoded,
+    write_or_return,
+};
 
 pub(super) fn serialize(s: &mut Session, p: &Value) -> Result<Value> {
     let f = writable("document.serialize", Some(str_param(p, "format").unwrap_or("vectorcraft")), None)?;
     let expanded = expand_presets(s, "document.serialize", p)?;
-    let p = &*expanded;
-    let doc = &*source(s, f, p, "document.serialize")?;
-    let enc = encode_all(doc, f.id, p)?;
+    let p = with_black_output(s, &expanded);
+    let doc = &*source(s, f, &p, "document.serialize")?;
+    let enc = encode_all(doc, f.id, &p)?;
     let files = enc.named(doc, &default_name(doc, f.extensions[0]));
     let (main, linked) = files.split_at(enc.files.len());
     // Text formats come back as text; an SVG in UTF-16 or ISO 8859-1 also as its bytes.
@@ -50,9 +53,9 @@ pub(super) fn export(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let f = writable("document.export", str_param(p, "format"), path)?;
     let expanded = expand_presets(s, "document.export", p)?;
-    let p = &*expanded;
-    let doc = &*source(s, f, p, "document.export")?;
-    let enc = encode_all(doc, f.id, p)?;
+    let p = with_black_output(s, &expanded);
+    let doc = &*source(s, f, &p, "document.export")?;
+    let enc = encode_all(doc, f.id, &p)?;
     write_encoded(path, &default_name(doc, f.extensions[0]), doc, &enc, json!({ "format": f.id, "warnings": enc.warnings }))
 }
 
@@ -92,21 +95,29 @@ fn selected_part(n: &Node, keep: &HashSet<NodeId>) -> Option<Node> {
 
 /// `doc` with only the art over `rect` (an artboard): objects whose visual bounds miss it are left
 /// out, at any depth of layers and sublayers, and objects that reach it stay whole (the file's
-/// bounds clip them), as DXF's crop leaves them. A clipping layer keeps every object, its clipping
-/// path among them. An artboard's file then holds its own art, not a whole document of artboards.
+/// bounds clip them), as DXF's crop leaves them. Symbol instances are measured by their art, and
+/// the box of one whose art holds brushed strokes grows by as far as their brush art can paint
+/// ([`SymbolBoxes::with_brush_art`]). An object that holds a symbol instance also stays when what
+/// the canvas paints for it reaches `rect` ([`vectorcraft_render::painted_bounds`]: the effects in
+/// the symbols' art and its own effects). A clipping layer keeps every object, its clipping path
+/// among them. An artboard's file then holds its own art, not a whole document of artboards.
 pub(super) fn art_over(doc: &Document, rect: vectorcraft_geom::Rect) -> Document {
-    fn kept(n: &Arc<Node>, rect: vectorcraft_geom::Rect) -> Option<Arc<Node>> {
+    fn kept(n: &Arc<Node>, doc: &Document, symbols: &SymbolBoxes, rect: vectorcraft_geom::Rect) -> Option<Arc<Node>> {
         if matches!(n.kind, NodeKind::Layer { clip: false, .. }) {
             let mut layer = Node::clone(n);
             let children = layer.children_mut()?;
-            *children = children.iter().filter_map(|c| kept(c, rect)).collect();
+            *children = children.iter().filter_map(|c| kept(c, doc, symbols, rect)).collect();
             return Some(Arc::new(layer));
         }
         let over = |b: vectorcraft_geom::Rect| b.x0 <= rect.x1 && rect.x0 <= b.x1 && b.y0 <= rect.y1 && rect.y0 <= b.y1;
-        n.visual_bounds().is_none_or(over).then(|| n.clone())
+        let mut holds_instance = false;
+        n.walk(&mut |c| holds_instance |= matches!(c.kind, NodeKind::SymbolInstance { .. }));
+        let painted = || holds_instance && vectorcraft_render::painted_bounds(doc, n).is_some_and(over);
+        (n.visual_bounds_with(symbols).is_none_or(over) || painted()).then(|| n.clone())
     }
+    let symbols = doc.symbol_boxes().with_brush_art();
     let mut d = doc.clone();
-    d.layers = doc.layers.iter().filter_map(|l| kept(l, rect)).collect();
+    d.layers = doc.layers.iter().filter_map(|l| kept(l, doc, &symbols, rect)).collect();
     d
 }
 
@@ -152,10 +163,12 @@ fn selection(s: &mut Session, cmd: &str) -> Result<(Document, vectorcraft_geom::
 }
 
 /// Objects `ids` of `doc` alone on one layer (in that order, back to front), with one artboard
-/// named `name`: their visual bounds (`None` when they have none).
+/// named `name`: their visual bounds, symbol instances measured by their art (`None` when they
+/// have none).
 pub(crate) fn isolated(doc: &Document, ids: &[NodeId], name: &str) -> Option<(Document, vectorcraft_geom::Rect)> {
     let nodes: Vec<Arc<Node>> = ids.iter().filter_map(|id| doc.node(*id).cloned().map(Arc::new)).collect();
-    let bounds = nodes.iter().filter_map(|n| n.visual_bounds()).reduce(|a, b| a.union(b))?;
+    let symbols = doc.symbol_boxes();
+    let bounds = nodes.iter().filter_map(|n| n.visual_bounds_with(&symbols)).reduce(|a, b| a.union(b))?;
     let mut d = single_artboard(doc, bounds, name);
     let mut layer = Node::layer(d.alloc_id(), name, vectorcraft_doc::LayerColor::Preset(0));
     if let Some(ch) = layer.children_mut() {
@@ -175,11 +188,11 @@ pub(super) fn export_selection(s: &mut Session, p: &Value) -> Result<Value> {
     let path = str_param(p, "path");
     let f = writable(C, str_param(p, "format"), path)?;
     let expanded = expand_presets(s, C, p)?;
-    let p = &*expanded;
+    let p = with_black_output(s, &expanded);
     let (d, bounds) = selection(s, C)?;
     // The encoder's warnings (options accepted but not applied, features approximated or left
     // out), as document.export reports them.
-    let (bytes, warnings) = encode_with_warnings(&d, f.id, &without_artboards(p))?;
+    let (bytes, warnings) = encode_with_warnings(&d, f.id, &without_artboards(&p))?;
     write_or_return(path, &bytes, json!({ "format": f.id, "warnings": warnings, "bounds": [bounds.x0, bounds.y0, bounds.width(), bounds.height()] }))
 }
 
@@ -201,7 +214,8 @@ pub(super) fn export_for_office(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, format!("no artboard {artboard} (0-based; the document has {})", doc.artboards.len())));
     }
     let background = if bool_or(p, "transparent", false) { "transparent" } else { "white" };
-    let bytes = encode(doc, "png", &json!({ "ppi": ppi, "background": background, "artboard": artboard }))?;
+    let opts = with_black_output(s, &json!({ "ppi": ppi, "background": background, "artboard": artboard }));
+    let bytes = encode(doc, "png", &opts)?;
     // The pixel size, from the PNG header.
     let side = |at: usize| bytes.get(at..at + 4).and_then(|b| b.try_into().ok()).map_or(0, u32::from_be_bytes);
     write_or_return(path, &bytes, json!({ "width": side(16), "height": side(20) }))

crates/engine/src/cmd/fileio/load.rs

@@ -9,6 +9,7 @@ use vectorcraft_geom::Affine;
 use super::super::*;
 use super::pdfimport::LoadOptions;
 use super::{Format, SAVE_FORMATS, absolute_path, file_stamp, format, format_for_name, psdread, read_file};
+use crate::cmd::links::Resolved;
 use crate::{EngineError, Prefs};
 
 /// A file read into a document, with its format and non-fatal import notes.
@@ -138,7 +139,8 @@ fn restore_or_import(
 /// (with a warning for each that can't be used).
 pub(crate) fn native_file(bytes: &[u8]) -> Result<(Document, vectorcraft_format::FileInfo, Vec<String>)> {
     let f = vectorcraft_format::load_file(bytes).map_err(err)?;
-    let warnings = super::native::install_profiles(f.profiles);
+    let mut warnings = super::native::install_profiles(f.profiles);
+    warnings.extend(f.depth_notes);
     Ok((f.doc, f.info, warnings))
 }
 
@@ -292,47 +294,67 @@ pub fn open_bytes(s: &mut Session, name: &str, bytes: &[u8], path: Option<String
 
 /// [`open_bytes`] with the `document.open` options in `p` ([`LoadOptions::from_params`]).
 pub fn open_bytes_with(s: &mut Session, name: &str, bytes: &[u8], path: Option<String>, p: &Value) -> Result<Value> {
-    open_read(s, read_for_open(name, bytes, p)?, path)
+    let update_links = s.prefs.update_links == "automatically";
+    open_read(s, read_for_open(name, bytes, path, p, update_links)?)
 }
 
 /// A file read for `document.open` but not opened yet ([`read_for_open`], [`open_read`]).
 pub struct ReadFile {
     loaded: Loaded,
     opts: LoadOptions,
+    /// Where the file was read from.
+    path: Option<String>,
+    /// What became of its linked files.
+    links: Resolved,
 }
 
-/// The first half of [`open_bytes_with`]: read and decode the file, which needs no session (an
-/// app may do it on another thread) → what [`open_read`] opens.
-pub fn read_for_open(name: &str, bytes: &[u8], p: &Value) -> Result<ReadFile> {
+#[cfg(test)]
+impl ReadFile {
+    /// The document as it was read, before it opens.
+    pub(crate) fn document(&self) -> &Document {
+        &self.loaded.doc
+    }
+}
+
+/// The first half of [`open_bytes_with`], which needs no session (an app may do it on another
+/// thread): read and decode the file, read its linked files and lay out its type → what
+/// [`open_read`] opens. The linked files are looked for from `path`, where the file was read from,
+/// and modified ones are read again when `update_links` (Preferences › File Handling › Update
+/// Links set to Automatically; see [`crate::cmd::links::resolve`]).
+pub fn read_for_open(name: &str, bytes: &[u8], path: Option<String>, p: &Value, update_links: bool) -> Result<ReadFile> {
     let opts = LoadOptions::from_params("document.open", p)?;
-    Ok(ReadFile { loaded: load_with(name, bytes, &opts)?, opts })
+    let mut loaded = load_with(name, bytes, &opts)?;
+    let links = crate::cmd::links::resolve(&mut loaded.doc, path.as_deref(), update_links);
+    Session::refresh_text_bounds(&mut loaded.doc);
+    Ok(ReadFile { loaded, opts, path, links })
 }
 
 /// The second half of [`open_bytes_with`]: open a file [`read_for_open`] read as the new active
-/// document (`path`: where it was read from) → `document.open`'s result.
-pub fn open_read(s: &mut Session, file: ReadFile, path: Option<String>) -> Result<Value> {
-    open_loaded(s, file.loaded, path, &file.opts, false)
+/// document → `document.open`'s result.
+pub fn open_read(s: &mut Session, file: ReadFile) -> Result<Value> {
+    open_loaded(s, file.loaded, file.links, file.path, &file.opts, false)
 }
 
 /// File → New from Template: any readable file (at `path`, if it is one: its links are looked for
 /// from there) as a new untitled document.
 pub fn open_template(s: &mut Session, name: &str, bytes: &[u8], path: Option<&str>) -> Result<Value> {
-    let loaded = load(name, bytes)?;
+    let mut loaded = load(name, bytes)?;
     if loaded.preview_only {
         return Err(err(
             "only this Affinity file's embedded preview could be read: use File › Open to see it with its warning, or export SVG or PDF from Affinity first",
         ));
     }
-    open_loaded(s, loaded, path.map(str::to_string), &LoadOptions::default(), true)
+    let links = crate::cmd::links::resolve(&mut loaded.doc, path, s.prefs.update_links == "automatically");
+    open_loaded(s, loaded, links, path.map(str::to_string), &LoadOptions::default(), true)
 }
 
-/// Make a loaded file the new active document; `opts` are the options it was read with.
-fn open_loaded(s: &mut Session, loaded: Loaded, path: Option<String>, opts: &LoadOptions, as_template: bool) -> Result<Value> {
+/// Make a loaded file the new active document; `links` is what became of its linked files, and
+/// `opts` are the options it was read with.
+fn open_loaded(s: &mut Session, loaded: Loaded, links: Resolved, path: Option<String>, opts: &LoadOptions, as_template: bool) -> Result<Value> {
     let Loaded { mut doc, format, warnings, restored, converted, .. } = loaded.with_grid_prefs(&s.prefs);
     // What reading the file left out of the document, if anything.
     let losses: Vec<String> = warnings.iter().filter(|w| is_loss(w)).cloned().collect();
     let source_path = path.clone().filter(|_| !losses.is_empty());
-    let links = crate::cmd::links::resolve(&mut doc, path.as_deref(), s.prefs.update_links == "automatically");
     // A template (saved by Save as Template, or an .ait/.vctemplate file) opens as a new untitled
     // document.
     let template = as_template || doc.template || matches!(format.id, "ait" | "template");
@@ -382,12 +404,16 @@ pub(crate) fn source<'a>(p: &'a Value, cmd: &str) -> Result<Source<'a>> {
 
 pub(super) fn open(s: &mut Session, p: &Value) -> Result<Value> {
     let src = source(p, "document.open")?;
-    open_bytes_with(s, src.name, &src.bytes, src.path.map(str::to_string), p)
+    // A relative path is the file in the working directory: its folder is where relative links
+    // are found (a bare file name has no folder of its own).
+    let path = src.path.map(super::absolute_path);
+    open_bytes_with(s, path.as_deref().unwrap_or(src.name), &src.bytes, path.clone(), p)
 }
 
 pub(super) fn new_from_template(s: &mut Session, p: &Value) -> Result<Value> {
     let src = source(p, "file.newFromTemplate")?;
-    open_template(s, src.name, &src.bytes, src.path)
+    let path = src.path.map(super::absolute_path);
+    open_template(s, path.as_deref().unwrap_or(src.name), &src.bytes, path.as_deref())
 }
 
 /// The most memory decoding one image may take: a 60 in print sheet at 300 ppi (18000 × 6600 px)

crates/engine/src/cmd/fileio/mod.rs

@@ -674,7 +674,7 @@ fn format_filters() -> impl Iterator<Item = (&'static str, &'static [&'static st
 
 /// Open-dialog filters: "All readable files" first, then one per readable format, then swatch
 /// libraries (which open in the library panel), Libraries panel libraries, flattener, PDF and print
-/// presets (imported).
+/// presets (imported), scripts (checked without running them) and plug-ins (installed).
 pub fn open_filters() -> impl Iterator<Item = (&'static str, &'static [&'static str])> {
     std::iter::once(("All readable files", OPEN_EXTS))
         .chain(format_filters())
@@ -683,6 +683,7 @@ pub fn open_filters() -> impl Iterator<Item = (&'static str, &'static [&'static
         .chain(std::iter::once(("Flattener presets", super::flatten::PRESET_EXTS)))
         .chain(std::iter::once(("PDF presets", super::pdfcmds::PRESET_EXTS)))
         .chain(std::iter::once(("Print presets", super::printpresets::PRESET_EXTS)))
+        .chain(std::iter::once(("Scripts", super::scripts::EXTS)))
         .chain(std::iter::once(("Plug-ins", super::plugin::EXTS)))
 }
 
@@ -766,6 +767,20 @@ pub(crate) fn read_file(path: &str) -> Result<Vec<u8>> {
     std::fs::read(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))
 }
 
+/// The first `max` bytes of the file at `path` (all of it when it is shorter). Anything but a
+/// regular file (a folder, a pipe, a device) is refused, also through a link.
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) fn read_file_head(path: &str, max: usize) -> Result<Vec<u8>> {
+    use std::io::Read;
+    may_read(path)?;
+    if !std::fs::metadata(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?.is_file() {
+        return Err(EngineError::Other(format!("{path}: not a file")));
+    }
+    let mut out = vec![];
+    std::fs::File::open(path).and_then(|f| f.take(max as u64).read_to_end(&mut out)).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    Ok(out)
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn write_file(path: &str, bytes: &[u8]) -> Result<()> {
     may_write(path)?;
@@ -794,7 +809,7 @@ pub(crate) fn write_new_file(path: &str, bytes: &[u8]) -> Result<()> {
     may_write(path)?;
     let err = |e: std::io::Error| EngineError::Other(format!("{path}: {e}"));
     let mut f = std::fs::OpenOptions::new().write(true).create_new(true).open(path).map_err(err)?;
-    let written = f.write_all(bytes).and_then(|()| f.sync_all());
+    let written = f.write_all(bytes).and_then(|()| vectorcraft_format::sync_file(&f));
     drop(f);
     written.map_err(|e| {
         // Best effort: the partly written file is all there is to clean up.
@@ -944,6 +959,11 @@ pub(crate) fn read_file(path: &str) -> Result<Vec<u8>> {
     Err(no_fs(path))
 }
 
+#[cfg(target_arch = "wasm32")]
+pub(crate) fn read_file_head(path: &str, _: usize) -> Result<Vec<u8>> {
+    Err(no_fs(path))
+}
+
 #[cfg(target_arch = "wasm32")]
 pub(crate) fn write_file(path: &str, _: &[u8]) -> Result<()> {
     Err(no_fs(path))
@@ -1032,6 +1052,12 @@ pub(crate) fn merge(mut a: Value, b: Value) -> Value {
     a
 }
 
+/// Appearance of Black › Printing / Exporting (#394): Output All Blacks as Rich Black makes RGB
+/// raster exports draw pure CMYK black as RGB black (`richBlack` on the encoder params).
+pub(crate) fn with_black_output(s: &Session, p: &Value) -> Value {
+    if s.prefs.black_output == "rich" { merge(p.clone(), json!({ "richBlack": true })) } else { p.clone() }
+}
+
 /// A file name for bytes handed back without a path: the document's title with `ext`.
 pub(crate) fn default_name(doc: &vectorcraft_doc::Document, ext: &str) -> String {
     let stem = std::path::Path::new(&doc.title).file_stem().map(|s| s.to_string_lossy().into_owned()).filter(|s| !s.is_empty());

crates/engine/src/cmd/fileio/save.rs

@@ -93,7 +93,10 @@ impl SavePlan {
 /// File Info's dates for a save to a file: the modified date (and the created date, when it has
 /// none) become `at`. Not an undo step.
 pub fn stamp_save_dates(st: &mut DocState, at: i64) {
-    let d = std::sync::Arc::make_mut(&mut st.doc);
+    stamp_doc_dates(std::sync::Arc::make_mut(&mut st.doc), at);
+}
+
+fn stamp_doc_dates(d: &mut Document, at: i64) {
     d.metadata.created.get_or_insert(at);
     d.metadata.modified = Some(at);
 }
@@ -296,6 +299,10 @@ pub struct SaveJob {
     params: Value,
     /// The document when the job was made: what counts as saved once the file is written.
     snapshot: Arc<Document>,
+    /// The live document `snapshot` was made from, and the date stamped on `snapshot` (not on the
+    /// live document until the file is written).
+    source: Arc<Document>,
+    stamped: Option<i64>,
     /// The artboards also saved to files of their own (`separateArtboards`).
     boards: Vec<usize>,
 }
@@ -417,24 +424,29 @@ pub(super) fn encode_ai(cmd: &str, f: &Format, doc: &Document, p: &Value) -> Res
     Ok(Encoded { warnings, ..Encoded::one(bytes) })
 }
 
-/// Snapshot the active document for `plan` (stamping File Info's dates when the file becomes the
-/// document's own). Bad options fail here, before anything is encoded.
+/// Snapshot the active document for `plan` (stamping File Info's dates on the snapshot when the
+/// file becomes the document's own; the live document gets them in [`SaveJob::finish`]). Bad
+/// options fail here, before anything is encoded.
 pub fn save_job(s: &mut Session, plan: SavePlan) -> Result<SaveJob> {
     // The web build, without a clock, leaves the dates unless given one.
-    if plan.path.is_some()
-        && plan.retargets()
-        && let Some(at) = clock_date(s, "modified", plan.modified)
-    {
-        stamp_save_dates(s.doc_mut()?, at);
-    }
-    job_for(s, s.doc()?, plan)
+    let at = if plan.path.is_some() && plan.retargets() { clock_date(s, "modified", plan.modified) } else { None };
+    job_for_stamped(s, s.doc()?, plan, at)
 }
 
 /// Snapshot `st` (any open document of `s`) for `plan`, without stamping dates (Data Recovery
 /// snapshots documents that aren't active).
 pub(crate) fn job_for(s: &Session, st: &DocState, plan: SavePlan) -> Result<SaveJob> {
+    job_for_stamped(s, st, plan, None)
+}
+
+fn job_for_stamped(s: &Session, st: &DocState, plan: SavePlan, stamped: Option<i64>) -> Result<SaveJob> {
     let cmd = plan.mode.command();
-    let own = doc_to_save(st, plan.format);
+    let mut own = doc_to_save(st, plan.format);
+    let mut snapshot = st.doc.clone();
+    if let Some(at) = stamped {
+        stamp_doc_dates(Arc::make_mut(&mut own), at);
+        stamp_doc_dates(Arc::make_mut(&mut snapshot), at);
+    }
     // A native file records its links' paths relative to where it is written.
     let relative = plan.path.as_deref().filter(|_| is_native(plan.format)).and_then(|p| crate::cmd::links::with_relative_paths(&own, p));
     let doc = relative.map_or(own, Arc::new);
@@ -455,7 +467,7 @@ pub(crate) fn job_for(s: &Session, st: &DocState, plan: SavePlan) -> Result<Save
         // Save keeps every artboard; exports may choose a subset instead.
         o.insert("range".into(), json!("all"));
     }
-    Ok(SaveJob { plan, doc, params, snapshot: st.doc.clone(), boards })
+    Ok(SaveJob { plan, doc, params, snapshot, source: st.doc.clone(), stamped, boards })
 }
 
 impl SaveJob {
@@ -593,6 +605,17 @@ impl SaveJob {
             st.save_options = self.plan.options;
             st.converted = false;
             st.recovered = false;
+            if let Some(at) = self.stamped {
+                if Arc::ptr_eq(&st.doc, &self.source) {
+                    st.doc = self.snapshot.clone();
+                } else {
+                    // Edited while the save ran: the dates still go on, the edits stay unsaved. The
+                    // undo history holds the document as it was before the dates, so that is the
+                    // saved state: undoing back to it leaves the document unmodified.
+                    stamp_save_dates(st, at);
+                    return st.mark_saved_as(&self.source);
+                }
+            }
             st.mark_saved_as(&self.snapshot);
         }
     }

crates/engine/src/cmd/fileio/screens.rs

@@ -15,7 +15,9 @@ use vectorcraft_geom::Rect;
 use super::super::*;
 use super::encode::single_artboard;
 use super::export::{isolated, without_artboards};
-use super::{ARTBOARD_PARAMS, ArtboardPick, Format, artboard_file_names, create_dir, encode, unique_file_names, writable, write_file};
+use super::{
+    ARTBOARD_PARAMS, ArtboardPick, Format, artboard_file_names, create_dir, encode, unique_file_names, with_black_output, writable, write_file,
+};
 
 const C: &str = "document.exportForScreens";
 
@@ -141,6 +143,12 @@ fn safe_name(s: &str) -> Option<String> {
     (!n.trim_matches('.').is_empty()).then_some(n)
 }
 
+/// Text that goes into a file name (prefix, suffix): path separators and `:` become `-`, so it can't
+/// start a folder or climb out of the export folder.
+fn file_part(s: &str) -> String {
+    s.chars().map(|c| if matches!(c, '/' | '\\' | ':') { '-' } else { c }).collect()
+}
+
 /// Keys of a format row that aren't encoder options.
 const ROW_KEYS: [&str; 7] = ["format", "scale", "ppi", "width", "height", "suffix", "folder"];
 
@@ -169,7 +177,7 @@ impl Row {
         let size = if format.raster { ScreenSize::of_row(row)? } else { ScreenSize::Scale(1.0) };
         let suffix = match str_param(row, "suffix") {
             Some(s) if !format.raster && is_size_suffix(s) => String::new(),
-            Some(s) => s.to_string(),
+            Some(s) => file_part(s),
             None => size.suffix(),
         };
         let folder = match str_param(row, "folder").and_then(safe_name) {
@@ -336,7 +344,7 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let subfolders = o.subfolders || o.preset.is_some();
     // A prefix names files, not folders.
-    let prefix: String = o.prefix.as_deref().unwrap_or("").chars().map(|c| if matches!(c, '/' | '\\' | ':') { '-' } else { c }).collect();
+    let prefix = file_part(o.prefix.as_deref().unwrap_or(""));
     let folder = o.folder.as_deref().filter(|f| !f.is_empty());
     if let Some(dir) = folder {
         create_dir(dir)?;
@@ -357,6 +365,8 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
         if subfolders { format!("{}/{file}", r.folder) } else { file }
     };
     let mut out = Output::default();
+    // Appearance of Black › Printing / Exporting for RGB raster rows.
+    let write = |doc: &Document, format: &str, options: &Value| encode(doc, format, &with_black_output(s, options));
     if o.full_document {
         let stem = safe_name(&super::file_stem(&doc.title)).unwrap_or_else(|| "Untitled".into());
         // The bounds of all visible art, as the one artboard of the files that aren't PDFs.
@@ -370,7 +380,7 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
                 // One page per artboard.
                 let mut options = r.options.clone();
                 options["range"] = json!("all");
-                encode(&doc, "pdf", &options)?
+                write(&doc, "pdf", &options)?
             } else {
                 if whole.is_none() {
                     let bounds =
@@ -379,7 +389,7 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
                 }
                 let Some(d) = whole.as_ref() else { continue };
                 let region = d.artboards.first().map_or(Rect::ZERO, |a| a.rect);
-                encode(d, r.format.id, &r.options_for(region, Some(0))?)?
+                write(d, r.format.id, &r.options_for(region, Some(0))?)?
             };
             out.put(folder, o.zip, name, bytes)?;
         }
@@ -397,7 +407,7 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
                 if !out.claim(&name) {
                     continue;
                 }
-                let bytes = encode(&d, r.format.id, &r.options_for(bounds, Some(0))?)?;
+                let bytes = write(&d, r.format.id, &r.options_for(bounds, Some(0))?)?;
                 out.put(folder, o.zip, name, bytes)?;
             }
         }
@@ -414,7 +424,7 @@ pub(crate) fn export(s: &mut Session, p: &Value) -> Result<Value> {
                 if !out.claim(&name) {
                     continue; // the same file from two identical rows
                 }
-                let bytes = encode(&doc, r.format.id, &r.options_for(region, Some(b))?)?;
+                let bytes = write(&doc, r.format.id, &r.options_for(region, Some(b))?)?;
                 out.put(folder, o.zip, name, bytes)?;
             }
         }

crates/engine/src/cmd/fileio/tests.rs

@@ -159,9 +159,10 @@ fn open_exts_cover_every_readable_format() {
     assert_eq!(filters[0], ("All readable files", OPEN_EXTS));
     assert_eq!(
         filters.len(),
-        7 + FORMATS.iter().filter(|f| f.read).count(),
-        "and swatch libraries, libraries, flattener, PDF and print presets, plug-ins"
+        8 + FORMATS.iter().filter(|f| f.read).count(),
+        "and swatch libraries, libraries, flattener, PDF and print presets, scripts, plug-ins"
     );
+    assert!(filters.contains(&("Scripts", crate::cmd::scripts::EXTS)), "File › Open checks scripts");
     assert_eq!(filters.last(), Some(&("Plug-ins", crate::cmd::plugin::EXTS)), "File › Open installs plug-ins");
 }
 
@@ -485,3 +486,44 @@ fn a_save_that_fails_while_streaming_leaves_the_file_as_it_was() {
     }
     let _ = std::fs::remove_dir_all(&d);
 }
+
+/// A save that fails leaves File Info's dates and the saved state alone; one that works stamps them.
+#[test]
+fn a_failed_save_does_not_stamp_the_documents_dates() {
+    let mut s = session(200.0, 100.0, 1);
+    s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 50, "height": 20})).unwrap();
+    let before = s.doc().unwrap().doc.metadata.clone();
+    let dirty = s.doc().unwrap().is_dirty();
+    let plan = save_plan(&s, SaveMode::SaveAs, &json!({"path": "/x/y.vectorcraft", "modified": 12345})).unwrap();
+    let e = save_with(&mut s, plan, |_, _| Err(EngineError::Other("disk full".into()))).unwrap_err();
+    assert_eq!(e.to_string(), "disk full");
+    let st = s.doc().unwrap();
+    assert_eq!(st.doc.metadata, before);
+    assert_eq!(st.is_dirty(), dirty);
+    // Options the encoder refuses: the same.
+    assert!(s.execute("file.saveAs", &json!({"path": "/x/y.vectorcraft", "version": 99, "modified": 12345})).is_err());
+    let st = s.doc().unwrap();
+    assert_eq!(st.doc.metadata, before);
+    assert_eq!(st.is_dirty(), dirty);
+    let plan = save_plan(&s, SaveMode::SaveAs, &json!({"path": "/x/y.vectorcraft", "modified": 12345})).unwrap();
+    save_with(&mut s, plan, |_, _| Ok(())).unwrap();
+    let st = s.doc().unwrap();
+    assert_eq!(st.doc.metadata.modified, Some(12345));
+    assert!(!st.is_dirty());
+    // Edited while the file is written (Background Save): the dates go on once it is, and the
+    // edit keeps the document modified.
+    let plan = save_plan(&s, SaveMode::SaveAs, &json!({"path": "/x/z.vectorcraft", "modified": 777})).unwrap();
+    let job = save_job(&mut s, plan).unwrap();
+    let uid = s.doc().unwrap().uid;
+    assert_eq!(s.doc().unwrap().doc.metadata.modified, Some(12345));
+    s.execute("shape.ellipse", &json!({"x": 0, "y": 0, "width": 50, "height": 50})).unwrap();
+    job.write(|_, _| Ok(())).unwrap();
+    job.complete(&mut s, uid);
+    let st = s.doc().unwrap();
+    assert_eq!(st.doc.metadata.modified, Some(777));
+    assert_eq!(st.path.as_deref(), Some("/x/z.vectorcraft"));
+    assert!(st.is_dirty());
+    // Undoing the edit is back at what the file holds.
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert!(!s.doc().unwrap().is_dirty());
+}

crates/engine/src/cmd/fileio/tests_raster.rs

@@ -106,6 +106,59 @@ fn screens_and_rasterize_take_anti_aliasing() {
     assert!(s.execute("object.rasterize", &json!({"antiAlias": "fuzzy"})).is_err());
 }
 
+/// Appearance of Black › Printing / Exporting (#394): Output All Blacks as Rich Black makes an
+/// RGB PNG of a CMYK document draw pure black ink as RGB black; Accurately (the default) shows it
+/// through the CMYK profile. `blackOnScreen` does not change the export; a rich black is the same
+/// either way.
+#[test]
+fn black_output_rich_draws_pure_cmyk_black_as_rgb_black_in_png() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 20, "height": 20, "colorMode": "cmyk"})).unwrap();
+    s.execute("paint.setStroke", &json!({"none": true})).unwrap();
+    s.execute("paint.setFill", &json!({"color": {"c": 0, "m": 0, "y": 0, "k": 1}})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 20, "height": 20})).unwrap();
+    let centre = |s: &mut Session| {
+        let png = rgba(&b64(&s.execute("document.export", &json!({"format": "png", "background": "white"})).unwrap()));
+        png.get_pixel(10, 10).0
+    };
+    let accurate = centre(&mut s);
+    let shown = vectorcraft_color::Color::cmyk(0.0, 0.0, 0.0, 1.0).to_rgba8(1.0);
+    assert!(accurate.iter().zip(shown).all(|(a, b)| a.abs_diff(b) <= 1), "accurate: {accurate:?}");
+    assert!(accurate[0] > 10, "accurate: dark grey, not RGB black");
+    s.execute("prefs.set", &json!({"key": "blackOnScreen", "value": "rich"})).unwrap();
+    assert_eq!(centre(&mut s), accurate, "blackOnScreen does not change exports");
+    s.execute("prefs.set", &json!({"key": "blackOutput", "value": "rich"})).unwrap();
+    assert_eq!(centre(&mut s), [0, 0, 0, 255], "rich: RGB black");
+    s.execute("select.all", &json!({})).unwrap();
+    s.execute("paint.setFill", &json!({"color": {"c": 0.6, "m": 0.4, "y": 0.4, "k": 1}})).unwrap();
+    let rich = centre(&mut s);
+    s.execute("prefs.set", &json!({"key": "blackOutput", "value": "accurate"})).unwrap();
+    assert_eq!(centre(&mut s), rich, "a rich black shows the same either way");
+}
+
+/// Output All Blacks as Rich Black reaches a CMYK document composed from ink planes (one with a
+/// blending mode) as it does one drawn directly, and leaves CMYK-model exports alone: only RGB
+/// output changes.
+#[test]
+fn black_output_rich_covers_ink_plane_documents_and_leaves_cmyk_exports_alone() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 40, "height": 20, "colorMode": "cmyk"})).unwrap();
+    s.execute("paint.setStroke", &json!({"none": true})).unwrap();
+    s.execute("paint.setFill", &json!({"color": {"c": 0, "m": 0, "y": 0, "k": 1}})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 20, "height": 20})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 30, "y": 0, "width": 10, "height": 20})).unwrap();
+    s.execute("transparency.set", &json!({"blendMode": "multiply"})).unwrap();
+    let png =
+        |s: &mut Session| rgba(&b64(&s.execute("document.export", &json!({"format": "png", "background": "white"})).unwrap())).get_pixel(10, 10).0;
+    let cmyk = |s: &mut Session, format: &str| b64(&s.execute("document.export", &json!({"format": format, "colorModel": "cmyk"})).unwrap());
+    let accurate = png(&mut s);
+    assert!(accurate[0] > 10, "accurate: dark grey, {accurate:?}");
+    let inks = [cmyk(&mut s, "tiff"), cmyk(&mut s, "jpg")];
+    s.execute("prefs.set", &json!({"key": "blackOutput", "value": "rich"})).unwrap();
+    assert_eq!(png(&mut s), [0, 0, 0, 255], "rich: RGB black through the ink planes too");
+    assert!(inks == [cmyk(&mut s, "tiff"), cmyk(&mut s, "jpg")], "CMYK exports keep the document's inks");
+}
+
 #[test]
 fn formats_list_the_raster_options() {
     let mut s = Session::new();

crates/engine/src/cmd/fileio/tests_screens.rs

@@ -105,6 +105,9 @@ fn density_buckets_go_into_sub_folders() {
     // A prefix names files, not folders.
     let r = export(&mut s, json!({"range": "2", "prefix": "../a\\b:", "formats": [{"format": "svg"}]}));
     assert_eq!(names(&r), ["..-a-b-Artboard-2.svg"]);
+    // So does a suffix: it can't open a folder or climb out of the export folder.
+    let r = export(&mut s, json!({"range": "2", "formats": [{"format": "svg", "suffix": "/../x\\..\\y"}, {"format": "png", "suffix": "-ok"}]}));
+    assert_eq!(names(&r), ["Artboard-2-..-x-..-y.svg", "Artboard-2-ok.png"]);
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -120,6 +123,35 @@ fn sub_folders_are_made_in_the_export_folder() {
     let _ = std::fs::remove_dir_all(dir);
 }
 
+/// #1713: whatever a suffix or prefix says (`..`, an absolute path, a drive, a share), every file
+/// lands directly in the export folder.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn a_hostile_suffix_or_prefix_stays_in_the_export_folder() {
+    let mut s = session(1);
+    let top = std::env::temp_dir().join(format!("vc-screens-escape-{}", std::process::id()));
+    let dir = top.join("out");
+    let folder = dir.to_string_lossy().replace('\\', "/");
+    for text in ["/../../up", "\\..\\up", "/etc/x", "C:\\Windows\\x", "\\\\server\\share\\x", "/..", ".."] {
+        for key in ["suffix", "prefix"] {
+            let mut p = json!({"folder": folder, "formats": [{"format": "svg"}]});
+            if key == "suffix" {
+                p["formats"][0][key] = json!(text);
+            } else {
+                p[key] = json!(text);
+            }
+            let r = export(&mut s, p);
+            let written = std::path::PathBuf::from(r["files"][0].as_str().unwrap());
+            assert!(written.is_file(), "{key} {text}");
+            assert_eq!(written.parent().unwrap().canonicalize().unwrap(), dir.canonicalize().unwrap(), "{key} {text}");
+        }
+    }
+    // Nothing beside the export folder, no folder inside it.
+    assert_eq!(std::fs::read_dir(&top).unwrap().count(), 1);
+    assert!(std::fs::read_dir(&dir).unwrap().all(|e| e.unwrap().path().is_file()));
+    let _ = std::fs::remove_dir_all(top);
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 #[test]
 fn a_zip_is_written_into_the_folder() {

crates/engine/src/cmd/graph.rs

@@ -890,13 +890,14 @@ fn generate(d: &mut Document, g: &GraphSpec) -> Vec<Arc<Node>> {
                 }
             } else {
                 // Scatter: a horizontal value axis too.
-                let (xl, xh, xs) = nice_axis(if xlo == f64::MAX { 0.0 } else { xlo.min(0.0) }, if xhi == f64::MIN { 1.0 } else { xhi }, g.ticks);
-                let mut x = xl;
-                while x <= xh + xs * 1e-6 {
+                // Like the value axis: finite, and a counted (capped) list of ticks, so data near f64::MAX can't loop forever.
+                let x_lo = if xlo == f64::MAX { 0.0 } else { xlo.min(0.0) };
+                let x_hi = if xhi == f64::MIN { 1.0 } else { xhi };
+                let (xl, xh, xs) = value_axis(g.ticks, None, None, x_lo, x_hi);
+                for x in tick_values(xl, xh, xs) {
                     let q = r.x0 + (x - xl) / (xh - xl) * r.width();
                     axes.push(b.line(Point::new(q, r.y1), Point::new(q, r.y1 + 4.0)));
                     axes.push(b.text(Role::Value, Point::new(q, r.y1 + 4.0 + vs * 1.1), &fmt_value(x), Justify::Center));
-                    x += xs;
                 }
                 for (si, s) in (0..nser).step_by(2).enumerate() {
                     let pts: Vec<Option<Point>> = (0..ncat)
@@ -2043,6 +2044,23 @@ mod tests {
         assert!((tallest(&s) - 74.0 * 10488.0 / 12000.0).abs() > 1.0);
     }
 
+    #[test]
+    fn a_scatter_x_axis_that_overflows_does_not_hang() {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 800, "height": 800})).unwrap();
+        // Finite x values whose rounded axis end is infinite: this used to add ticks forever. Now the
+        // command returns: points that far off the plot can't be drawn, which is an error.
+        let csv = ",y1,x1\nP,1,1.7e308\nQ,2,1.5e308";
+        let refused = |r: crate::Result<serde_json::Value>| assert!(r.unwrap_err().to_string().contains("exceed the canvas"));
+        refused(s.execute("graph.create", &json!({"type": "scatter", "x": 100, "y": 100, "width": 300, "height": 200, "csv": csv})));
+        // The same data through Graph Data, on an ordinary scatter graph: it stays as it was.
+        let axes = |s: &Session, id: NodeId| group(s.doc().unwrap().doc.node(id).unwrap(), "Axes").children().unwrap().len();
+        let id = make(&mut s, "scatter", ",y1,x1\nP,1,10\nQ,2,20");
+        let before = axes(&s, id);
+        refused(s.execute("graph.setData", &json!({"id": id.0, "csv": csv})));
+        assert_eq!(axes(&s, id), before);
+    }
+
     #[test]
     fn tick_values_end_on_the_maximum_and_never_run_away() {
         // Counted, not accumulated: an offset range keeps its last tick.

crates/engine/src/cmd/layer.rs

@@ -80,7 +80,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Layer Options…",
             ["Window", "Layers"],
             None,
-            "{ids?|id? (default: the highlighted rows, else the current layer), name?, visible?, locked?, template?, printable?, preview?, dimImages?: 0..100|false, color?: index 0..26|\"#rrggbb\"|preset name} Layer Options; rows that are not layers take name, visible and locked. Template on also locks the layer and dims its images to 50% (unless given); off unlocks it and stops dimming. One undo step",
+            "{ids?|id? (default: the highlighted rows, else the current layer), name? (with prefs.identifyObjectsBy xmlId: a valid XML ID, stored as the object name), visible?, locked?, template?, printable?, preview?, dimImages?: 0..100|false, color?: index 0..26|\"#rrggbb\"|preset name} Layer Options; rows that are not layers take name, visible and locked. Template on also locks the layer and dims its images to 50% (unless given); off unlocks it and stops dimming. One undo step",
             has_doc,
             set_props
         ),
@@ -297,7 +297,9 @@ fn layer_color_param(v: &Value) -> std::result::Result<LayerColor, String> {
 }
 
 /// Layer Options in `p` applied to layer or row `n` (validated first by [`check_options`]).
-fn apply_options(n: &mut Node, p: &Value) {
+/// `xml_id`: Preferences › Units › Identify Objects By › XML ID — `name` is an XML id and is
+/// stored as the object name ([`vectorcraft_doc::xml_id`]).
+fn apply_options(n: &mut Node, p: &Value, xml_id: bool) {
     if let Some(v) = str_param(p, "name") {
         if v.trim().is_empty() {
             // A layer keeps a name; an object goes back to its generated `<Kind>` one.
@@ -305,7 +307,8 @@ fn apply_options(n: &mut Node, p: &Value) {
                 n.name = None;
             }
         } else {
-            n.name = Some(v.chars().take(512).collect());
+            let name = if xml_id { vectorcraft_doc::xml_id::to_object_name(v) } else { v.to_string() };
+            n.name = Some(name.chars().take(512).collect());
         }
     }
     if let Some(v) = p.get("visible").and_then(Value::as_bool) {
@@ -354,7 +357,9 @@ fn apply_options(n: &mut Node, p: &Value) {
 }
 
 /// Bad values in Layer Options params, as an error for `cmd`.
-fn check_options(cmd: &str, p: &Value) -> Result<()> {
+/// `xml_id`: Preferences › Units › Identify Objects By › XML ID — a non-empty `name` must be a
+/// valid XML id.
+fn check_options(cmd: &str, p: &Value, xml_id: bool) -> Result<()> {
     if let Some(v) = p.get("color") {
         layer_color_param(v).map_err(|e| bad(cmd, e))?;
     }
@@ -368,6 +373,12 @@ fn check_options(cmd: &str, p: &Value) -> Result<()> {
     {
         return Err(bad(cmd, "`dimImages` is a percentage or false"));
     }
+    if xml_id
+        && let Some(name) = str_param(p, "name").filter(|n| !n.trim().is_empty())
+        && !vectorcraft_doc::xml_id::is_valid(name)
+    {
+        return Err(bad(cmd, "Identify Objects By is XML ID: the name must be a valid XML ID (start with a letter, underscore or colon; no spaces)"));
+    }
     Ok(())
 }
 
@@ -446,12 +457,13 @@ fn clip_toggle(s: &mut Session, p: &Value) -> Result<Value> {
 
 /// A new layer with the options in `p`, at `parent`/`index`; it becomes current and highlighted.
 fn add_layer(s: &mut Session, p: &Value, cmd: &str, label: &str, place: impl FnOnce(&Document) -> Result<(Option<NodeId>, usize)>) -> Result<Value> {
-    check_options(cmd, p)?;
+    let xml_id = s.prefs.identify_objects_by == "xmlId";
+    check_options(cmd, p, xml_id)?;
     let name = str_param(p, "name").filter(|n| !n.trim().is_empty()).map(str::to_string);
     let id = s.edit(label, |d, _| {
         let (parent, index) = place(d)?;
         let mut n = make_layer(d, name.as_deref());
-        apply_options(&mut n, p);
+        apply_options(&mut n, p, xml_id);
         Ok(d.insert(parent, index, n)?)
     })?;
     let st = s.doc_mut()?;
@@ -568,14 +580,15 @@ fn highlight(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn set_props(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "layer.setProps";
-    check_options(C, p)?;
+    let xml_id = s.prefs.identify_objects_by == "xmlId";
+    check_options(C, p, xml_id)?;
     let ids = rows_param(s, p, C)?;
     if ids.is_empty() {
         return Err(bad(C, "no rows"));
     }
     s.edit("Layer Options", |d, sel| {
         for id in &ids {
-            apply_options(d.node_mut(*id).ok_or(EngineError::NoNode(*id))?, p);
+            apply_options(d.node_mut(*id).ok_or(EngineError::NoNode(*id))?, p, xml_id);
         }
         sel.deselect_uneditable(d);
         Ok(())

crates/engine/src/cmd/menucmds.rs

@@ -2,6 +2,7 @@
 //! Bounding Box, Rasterize, Crop Image, Mask (an image), Create Trim Marks, Convert to Shape and
 //! Artboards → Convert / Rearrange. (Live blends are in `live.rs`.)
 
+use std::collections::{BTreeMap, BTreeSet, HashSet};
 use std::sync::Arc;
 
 use serde_json::{Value, json};
@@ -209,7 +210,9 @@ fn reset_bounding_box(s: &mut Session, _: &Value) -> Result<Value> {
 fn above(s: &mut Session, lock: bool) -> Result<Value> {
     let roots = selected_roots(s)?;
     let d = &s.doc()?.doc;
-    let mut hits: Vec<NodeId> = vec![];
+    // `selected` holds each selected object's visual bounds, by layer, with the index there of its
+    // ancestor directly inside the layer.
+    let mut selected: BTreeMap<NodeId, Vec<(usize, Rect)>> = BTreeMap::new();
     for id in &roots {
         let Some(layer) = d.layer_of(*id) else { continue };
         // The selected object's ancestor directly inside the layer.
@@ -218,12 +221,26 @@ fn above(s: &mut Session, lock: bool) -> Result<Value> {
         let top = anc.get(pos + 1).copied().unwrap_or(*id);
         let Some(b) = d.node(*id).and_then(|n| n.visual_bounds()) else { continue };
         let Some((_, idx, _)) = d.position(top) else { continue };
-        for n in d.children(Some(layer)).into_iter().flatten().skip(idx + 1) {
-            if roots.contains(&n.id) || hits.contains(&n.id) {
+        selected.entry(layer).or_default().push((idx, b));
+    }
+    // The loop walks up each layer once. Each object that is not selected and overlaps a selected
+    // object below it is locked (Lock) or hidden (Hide).
+    let roots: HashSet<NodeId> = roots.into_iter().collect();
+    let mut hits: BTreeSet<NodeId> = BTreeSet::new();
+    for (layer, mut below) in selected {
+        below.sort_by_key(|(idx, _)| *idx);
+        let mut below = below.into_iter().peekable();
+        // `under` holds the bounds of the selected objects below the object at `i`.
+        let mut under: Vec<Rect> = vec![];
+        for (i, n) in d.children(Some(layer)).into_iter().flatten().enumerate() {
+            while let Some((_, b)) = below.next_if(|(idx, _)| *idx < i) {
+                under.push(b);
+            }
+            if under.is_empty() || roots.contains(&n.id) {
                 continue;
             }
-            if n.visual_bounds().is_some_and(|nb| nb.intersect(b).area() > 0.0 || nb.contains(b.center())) {
-                hits.push(n.id);
+            if n.visual_bounds().is_some_and(|nb| under.iter().any(|b| nb.intersect(*b).area() > 0.0 || nb.contains(b.center()))) {
+                hits.insert(n.id);
             }
         }
     }

crates/engine/src/cmd/mod.rs

@@ -64,6 +64,7 @@ pub mod printtiling;
 pub mod rasterfx;
 mod recolor;
 pub mod recovery;
+pub mod scripts;
 mod select;
 pub(crate) mod shaper;
 pub(crate) mod slices;
@@ -278,6 +279,7 @@ pub fn command_specs() -> &'static [CommandSpec] {
         v.extend(printpresets::specs());
         v.extend(printtiling::specs());
         v.extend(plugin::specs());
+        v.extend(scripts::specs());
         v.extend(cut::specs());
         v.extend(halftone::specs());
         v.extend(perspgrid::specs());
@@ -491,6 +493,9 @@ pub use flatten::FlattenOptions;
 /// A built-in or saved flattener preset ([`crate::Prefs::flattener_presets`]).
 pub use flatten::FlattenerPreset;
 
+/// The shapes a group selected alone gives the Pathfinder panel.
+pub use pathops::shape_count;
+
 /// Command ids kept only so older scripts keep working: `(alias, the command it duplicates)`.
 /// They run as before but the command palette leaves them out (it lists the command once).
 pub const ALIASES: &[(&str, &str)] = &[("object.convertDocumentColorMode", "file.documentColorMode")];

crates/engine/src/cmd/object.rs

@@ -184,8 +184,8 @@ pub fn specs() -> Vec<CommandSpec> {
             "Distribute",
             ["Window", "Align"],
             None,
-            "{horizontal?: \"left\"|\"center\"|\"right\", vertical?: \"top\"|\"center\"|\"bottom\", bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)}",
-            has_multi,
+            "{horizontal?: \"left\"|\"center\"|\"right\", vertical?: \"top\"|\"center\"|\"bottom\", bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)} With anchor points selected (Direct Selection), the points are spaced evenly between the first and the last along the axis instead (#1636)",
+            can_distribute,
             distribute
         ),
         cmd!(
@@ -193,8 +193,8 @@ pub fn specs() -> Vec<CommandSpec> {
             "Distribute Spacing",
             ["Window", "Align"],
             None,
-            "{axis: \"horizontal\"|\"vertical\", spacing?: pt (the key object, select.key, stays put and the others are spaced from it), bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)}",
-            has_multi,
+            "{axis: \"horizontal\"|\"vertical\", spacing?: pt (the key object, select.key, stays put and the others are spaced from it), bounds?: \"preview\"|\"geometric\" (default: the Use Preview Bounds preference; preview bounds take in strokes), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles)} With anchor points selected (Direct Selection), the points are spaced evenly along the axis instead, or `spacing` apart from the first (#1636)",
+            can_distribute,
             distribute_spacing
         ),
         cmd!(
@@ -1262,9 +1262,61 @@ fn align_anchors(s: &mut Session, p: &Value, ids: &[NodeId], (h, v): (Option<&st
     ok()
 }
 
+/// Distribute needs two or more objects, or anchor points selected with Direct Selection (they
+/// may all be on one path).
+fn can_distribute(s: &Session) -> std::result::Result<(), String> {
+    if s.active().is_some_and(|st| !st.selection.anchors.is_empty()) { Ok(()) } else { has_multi(s) }
+}
+
+/// [`distribute`] and [`distribute_spacing`] of the selected anchor points (whole paths among them
+/// give all theirs): the points between the first and the last along the axis are spaced evenly,
+/// or `gap` apart from the first. A point has no size, so every Distribute option of an axis
+/// gives the same result.
+fn distribute_anchors(s: &mut Session, label: &str, horiz: bool, gap: Option<f64>) -> Result<Value> {
+    let targets = super::path::anchor_targets(s)?;
+    let d = &s.doc()?.doc;
+    let along = |q: Point| if horiz { q.x } else { q.y };
+    let mut pts: Vec<(NodeId, usize, usize, f64)> = targets
+        .iter()
+        .flat_map(|(id, refs)| {
+            refs.iter().filter_map(move |&(si, ai)| Some((*id, si, ai, along(d.node(*id)?.path_data()?.subpaths.get(si)?.anchors.get(ai)?.p))))
+        })
+        .collect();
+    pts.sort_by(|a, b| a.3.total_cmp(&b.3));
+    let (Some(first), Some(last)) = (pts.first().map(|q| q.3), pts.last().map(|q| q.3)) else {
+        return ok();
+    };
+    // Two points are the ends already; with a gap the second is placed from the first.
+    if pts.len() < if gap.is_some() { 2 } else { 3 } {
+        return ok();
+    }
+    let step = gap.unwrap_or((last - first) / (pts.len() - 1) as f64);
+    let moves: Vec<(NodeId, usize, usize, f64)> =
+        pts.iter().enumerate().map(|(i, &(id, si, ai, at))| (id, si, ai, first + step * i as f64 - at)).collect();
+    if moves.iter().all(|m| m.3.abs() <= 1e-9) {
+        return ok();
+    }
+    s.edit(label, |d, _| {
+        for &(id, si, ai, delta) in &moves {
+            if let Some(a) = super::path::path_mut(d, id)?.anchor_mut(si, ai) {
+                a.translate(if horiz { Vec2::new(delta, 0.0) } else { Vec2::new(0.0, delta) });
+            }
+        }
+        Ok(())
+    })?;
+    ok()
+}
+
 fn distribute(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = selected_roots(s)?;
     let preview = preview_bounds(s, p, "object.distribute")?;
+    // Anchor points selected with Direct Selection are distributed themselves, as Align aligns them.
+    if !s.doc()?.selection.anchors.is_empty() {
+        return match direction(p, "object.distribute")? {
+            (None, None) => Err(bad("object.distribute", "give horizontal or vertical")),
+            (h, _) => distribute_anchors(s, "Distribute", h.is_some(), None),
+        };
+    }
     let mut items = items_bounds(&s.doc()?.doc, &ids, preview);
     let (horiz, key): (bool, fn(&Rect, bool) -> f64) = match direction(p, "object.distribute")? {
         (Some(h), _) => (
@@ -1308,6 +1360,14 @@ fn distribute_spacing(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = selected_roots(s)?;
     let horiz = choice(p, "object.distributeSpacing", "axis", &["horizontal", "vertical"])? != Some("vertical");
     let preview = preview_bounds(s, p, "object.distributeSpacing")?;
+    let spacing = p
+        .get("spacing")
+        .filter(|v| !v.is_null())
+        .map(|v| v.as_f64().filter(|g| g.is_finite()).ok_or_else(|| bad("object.distributeSpacing", "`spacing` must be a number")))
+        .transpose()?;
+    if !s.doc()?.selection.anchors.is_empty() {
+        return distribute_anchors(s, "Distribute Spacing", horiz, spacing);
+    }
     let mut items = items_bounds(&s.doc()?.doc, &ids, preview);
     items.sort_by(|a, b| if horiz { a.1.x0.total_cmp(&b.1.x0) } else { a.1.y0.total_cmp(&b.1.y0) });
     let n = items.len();
@@ -1316,11 +1376,6 @@ fn distribute_spacing(s: &mut Session, p: &Value) -> Result<Value> {
     };
     let size = |r: &Rect| if horiz { r.width() } else { r.height() };
     let start = |r: &Rect| if horiz { r.x0 } else { r.y0 };
-    let spacing = p
-        .get("spacing")
-        .filter(|v| !v.is_null())
-        .map(|v| v.as_f64().filter(|g| g.is_finite()).ok_or_else(|| bad("object.distributeSpacing", "`spacing` must be a number")))
-        .transpose()?;
     let gap = match spacing {
         Some(g) => g,
         None => {
@@ -1351,9 +1406,17 @@ fn set_bounds(s: &mut Session, p: &Value) -> Result<Value> {
     let frame = d.oriented_bounds(&ids, false).ok_or_else(|| EngineError::Other("no bounds".into()))?;
     let g = frame.rect;
     // With Use Preview Bounds the values measure the visual box, whose margins around the
-    // geometric box (left, top, right, bottom) scale with the strokes or stay.
-    let v = if s.prefs.use_preview_bounds { d.oriented_bounds(&ids, true).map_or(g, |b| b.rect) } else { g };
-    let m = [g.x0 - v.x0, g.y0 - v.y0, v.x1 - g.x1, v.y1 - g.y1];
+    // geometric box (left, top, right, bottom) scale with the strokes or stay. The margins of
+    // `vs`, the visual box without the strokes in symbols' art, scale; those strokes keep their
+    // weight when an instance scales, so the rest of the margins stay.
+    let (v, vs) = if s.prefs.use_preview_bounds {
+        (d.oriented_bounds(&ids, true).map_or(g, |b| b.rect), scaling_box(d, &ids, &frame).unwrap_or(g))
+    } else {
+        (g, g)
+    };
+    let margins = |b: Rect| [g.x0 - b.x0, g.y0 - b.y0, b.x1 - g.x1, b.y1 - g.y1];
+    let (m, all) = (margins(vs), margins(v));
+    let fixed = [all[0] - m[0], all[1] - m[1], all[2] - m[2], all[3] - m[3]];
     let refi = p.get("reference").and_then(Value::as_u64).unwrap_or(4) as usize;
     let rp = vectorcraft_geom::reference_point(v, refi);
     let mut w = f64_or(p, "width", v.width());
@@ -1365,20 +1428,33 @@ fn set_bounds(s: &mut Session, p: &Value) -> Result<Value> {
             w = v.width() * h / v.height();
         }
     }
-    // The geometric scale that gives the visual size: margins grow by the strokes' scale `f`
-    // (exact for proportional scales, which scale the visual box alike).
+    // The geometric scale that gives the visual size: margins grow by the strokes' scale `f`. It is
+    // exact for proportional scales of one path; [`Spans::refit`] checks it, and solves for the
+    // scales where it misses.
     let strokes = bool_or(p, "strokes", s.prefs.scale_strokes);
     let ratio = |size: f64, geo: f64, margin: f64| if geo > 1e-9 { (size - margin) / geo } else { 1.0 };
     let f = |sx: f64, sy: f64| if strokes { (sx * sy).abs().sqrt() } else { 1.0 };
-    let (lx, ly) = (ratio(w, v.width(), 0.0), ratio(h, v.height(), 0.0));
+    // The strokes' scale `f0`: the size left after the margins in symbols' art, which stay, over
+    // `vs`, whose margins scale.
+    let (lx, ly) = (ratio(w - fixed[0] - fixed[2], vs.width(), 0.0), ratio(h - fixed[1] - fixed[3], vs.height(), 0.0));
     let f0 = f(if g.width() > 1e-9 { lx } else { 1.0 }, if g.height() > 1e-9 { ly } else { 1.0 });
-    let sx = ratio(w, g.width(), (m[0] + m[2]) * f0);
-    let sy = ratio(h, g.height(), (m[1] + m[3]) * f0);
+    // When a size of 0 or more is smaller than the margins and some of them stay, the geometry
+    // gets no width or height: the visual box is then as small as it can be. The margins in
+    // symbols' art stay, and so does every margin when strokes do not scale.
+    let fit = |size: f64, geo: f64, scaling: f64, kept: f64| {
+        let s = ratio(size, geo, scaling * f0 + kept);
+        let stays = if strokes { kept } else { scaling + kept };
+        if s < 0.0 && size >= 0.0 && stays > 0.0 { 0.0 } else { s }
+    };
+    let sx = fit(w, g.width(), m[0] + m[2], fixed[0] + fixed[2]);
+    let sy = fit(h, g.height(), m[1] + m[3], fixed[1] + fixed[3]);
     let scale = about(rp, Affine::scale_non_uniform(sx, sy));
     // Move the new visual box's reference point to x, y (default: where it was): the geometric
-    // box's reference point moves with the art, the margin from it to the visual one by `f`.
+    // box's reference point moves with the art, the margin from it to `vs`'s by `f`, and the
+    // margin from that one to the visual box's stays.
     let gp = vectorcraft_geom::reference_point(g, refi);
-    let new_rp = scale * gp + (rp - gp) * f(sx, sy);
+    let sp = vectorcraft_geom::reference_point(vs, refi);
+    let new_rp = scale * gp + (sp - gp) * f(sx, sy) + (rp - sp);
     // x, y place the reference point on the page.
     let page = frame.to_doc() * rp;
     // When every value given is the current one, the transform is the identity. Computing it can
@@ -1388,9 +1464,327 @@ fn set_bounds(s: &mut Session, p: &Value) -> Result<Value> {
         return apply_transform(s, "Transform", ids, Affine::IDENTITY, p, false);
     }
     let to = frame.to_local(Point::new(f64_or(p, "x", page.x), f64_or(p, "y", page.y)));
+    // The scales and the point above can miss the size or the reference point when the margins of
+    // the objects differ, the members of groups and the objects in symbols' art included, and with
+    // strokes that scale, when the sizes are out of proportion. The objects are then measured one
+    // by one ([`Spans::measure`]), and the scales solved for.
+    let solved = if s.prefs.use_preview_bounds && w >= 0.0 && h >= 0.0 {
+        Spans::measure(d, &ids, &frame, strokes).refit(rp, refi, [w, h], (sx, sy, new_rp))
+    } else {
+        None
+    };
+    let (scale, new_rp) = solved.map_or((scale, new_rp), |(sx, sy, at)| (about(rp, Affine::scale_non_uniform(sx, sy)), at));
     apply_transform(s, "Transform", ids, frame.conjugate(Affine::translate(to - new_rp) * scale), p, false)
 }
 
+/// The visual box of `ids` square to `frame`, as [`Document::oriented_bounds`] measures it, with
+/// symbol instances measured without the strokes in their art
+/// ([`vectorcraft_doc::SymbolBoxes::without_art_strokes`]).
+fn scaling_box(d: &Document, ids: &[NodeId], frame: &OrientedBox) -> Option<Rect> {
+    let symbols = d.symbol_boxes().without_art_strokes();
+    let to_local = frame.to_doc().inverse();
+    ids.iter().filter_map(|id| d.node(*id)).fold(None, |acc, n| {
+        let b = if frame.angle == 0.0 { n.visual_bounds_with(&symbols) } else { n.bounds_in(&symbols, to_local, true) };
+        vectorcraft_geom::union_opt(acc, b)
+    })
+}
+
+/// One axis of an object that [`set_bounds`] sizes, square to its frame: the geometric box runs
+/// from `lo` to `hi`, and the visual box reaches past each end (before, after) by a margin that
+/// scales with the strokes and one that stays.
+#[derive(Clone, Copy, Debug)]
+struct Span {
+    lo: f64,
+    hi: f64,
+    scaling: [f64; 2],
+    kept: [f64; 2],
+}
+
+impl Span {
+    /// The ends of the visual box after a scale by `s` about `c`, with the margins that scale
+    /// grown by `k`. A negative scale turns the box over, and its margins with it.
+    fn scaled(self, c: f64, s: f64, k: f64) -> (f64, f64) {
+        let ([sb, sa], [kb, ka]) = (self.scaling, self.kept);
+        let (before, after) = (sb * k + kb, sa * k + ka);
+        let (a, b) = (c + s * (self.lo - c), c + s * (self.hi - c));
+        if s < 0.0 { (b - after, a + before) } else { (a - before, b + after) }
+    }
+}
+
+/// The objects that [`set_bounds`] sizes, measured one by one square to its frame.
+struct Spans {
+    x: Vec<Span>,
+    y: Vec<Span>,
+    /// Whether strokes scale. The margins that scale grow by the square root of the product of the
+    /// two scales; with strokes that do not scale, every margin stays.
+    strokes: bool,
+}
+
+impl Spans {
+    /// The objects of `ids` that have a box, measured one by one as [`Document::oriented_bounds`]
+    /// measures them square to `frame`, each plain group member by member and each symbol instance
+    /// that [`open`] opens object by object in its art. Past [`MAX_SPANS`] parts, each object of
+    /// `ids` is measured as one. The margins of the visual box without the strokes in symbols' art
+    /// ([`scaling_box`]) scale with the strokes, and the rest stay. With `strokes` false, every
+    /// margin stays.
+    fn measure(d: &Document, ids: &[NodeId], frame: &OrientedBox, strokes: bool) -> Self {
+        let (symbols, without, art) = (d.symbol_boxes(), d.symbol_boxes().without_art_strokes(), d.symbol_boxes().quick());
+        let to_local = frame.to_doc().inverse();
+        let measure = |n: &Node, s: &vectorcraft_doc::SymbolBoxes, visual: bool| match (frame.angle == 0.0, visual) {
+            (true, false) => n.geometric_bounds_with(s),
+            (true, true) => n.visual_bounds_with(s),
+            (false, _) => n.bounds_in(s, to_local, visual),
+        };
+        let roots: Vec<&Node> = ids.iter().filter_map(|id| d.node(*id)).collect();
+        let mut parts = vec![];
+        if !roots.iter().all(|n| open(n, 0.0, d, &symbols, to_local, &mut parts)) {
+            parts = roots.iter().map(|n| Part::Object(n, 0.0)).collect();
+        }
+        let mut out = Self { x: vec![], y: vec![], strokes };
+        for part in parts {
+            let (g, v, vs) = match part {
+                Part::Object(n, grow) => {
+                    let Some(g) = measure(n, &symbols, false) else { continue };
+                    let v = measure(n, &symbols, true).unwrap_or(g).inflate(grow, grow);
+                    let vs = if strokes { measure(n, &without, true).unwrap_or(g).inflate(grow, grow) } else { g };
+                    (g, v, vs)
+                }
+                // Measured as the instance's own box measures its art (`Node::visual_bounds_with`):
+                // the strokes at their own weight, and the instances in it by their art boxes.
+                Part::Art(n, xf, grow, kept) => {
+                    let mut placed = n.clone();
+                    placed.transform(xf, false);
+                    let Some(g) = placed.geometric_bounds_with(&art) else { continue };
+                    let v = placed.visual_bounds_with(&art).map_or(g, |v| v.union(g)).inflate(kept + grow, kept + grow);
+                    let vs = if strokes { g.inflate(grow, grow) } else { g };
+                    (g, v, vs)
+                }
+            };
+            out.x.push(Span { lo: g.x0, hi: g.x1, scaling: [g.x0 - vs.x0, vs.x1 - g.x1], kept: [vs.x0 - v.x0, v.x1 - vs.x1] });
+            out.y.push(Span { lo: g.y0, hi: g.y1, scaling: [g.y0 - vs.y0, vs.y1 - g.y1], kept: [vs.y0 - v.y0, v.y1 - vs.y1] });
+        }
+        out
+    }
+
+    /// The visual box after a scale by `sx`, `sy` about `c`.
+    fn visual(&self, c: Point, sx: f64, sy: f64) -> Option<Rect> {
+        let k = if self.strokes { (sx * sy).abs().sqrt() } else { 1.0 };
+        let boxes = self.x.iter().zip(&self.y).map(|(x, y)| {
+            let ((x0, x1), (y0, y1)) = (x.scaled(c.x, sx, k), y.scaled(c.y, sy, k));
+            Rect::new(x0, y0, x1, y1)
+        });
+        boxes.reduce(|a, b| a.union(b))
+    }
+
+    /// The scales along x and y that give the visual box the size `size` with a scale about `c`,
+    /// or come as near to it as the margins that stay allow ([`Self::solve`]), and the point that
+    /// goes to the reference point's place: point `refi` of the visual box they give. Returns
+    /// `None`, which keeps `closed` (the scales and the point of [`set_bounds`]'s closed form), when
+    /// the scales of `closed` put point `refi` at the point of `closed` and either give the size
+    /// `size` or are the scales [`Self::solve`] finds, to within rounding (1e-12 of the largest
+    /// value compared, or of 1).
+    fn refit(&self, c: Point, refi: usize, size: [f64; 2], closed: (f64, f64, Point)) -> Option<(f64, f64, Point)> {
+        let ([w, h], (sx, sy, at)) = (size, closed);
+        let b = self.visual(c, sx, sy)?;
+        let p = vectorcraft_geom::reference_point(b, refi);
+        let tolerance = 1e-12 * [b.x0, b.y0, b.x1, b.y1, w, h, at.x, at.y].iter().fold(1.0, |m: f64, v| m.max(v.abs()));
+        let near = |a: f64, b: f64| (a - b).abs() <= tolerance;
+        let placed = near(p.x, at.x) && near(p.y, at.y);
+        if placed && near(b.width(), w) && near(b.height(), h) {
+            return None;
+        }
+        let (tx, ty) = self.solve(w, h);
+        let same = |a: f64, b: f64| (a - b).abs() <= 1e-12 * a.abs().max(b.abs()).max(1.0);
+        if placed && same(tx, sx) && same(ty, sy) {
+            return None;
+        }
+        let b = self.visual(c, tx, ty)?;
+        Some((tx, ty, vectorcraft_geom::reference_point(b, refi)))
+    }
+
+    /// The scales of 0 or more along x and y that give the visual box the size `w` × `h`, each
+    /// found by [`scale_across`]. With strokes that scale, the margins that scale grow by `k`,
+    /// found where it is the square root of the product of the two scales.
+    fn solve(&self, w: f64, h: f64) -> (f64, f64) {
+        let at = |k: f64| (scale_across(&self.x, k, w), scale_across(&self.y, k, h));
+        if !self.strokes {
+            return at(1.0);
+        }
+        // The scales get smaller as `k` grows, so the square root of their product minus `k` is at
+        // least 0 at `k` 0 and at most 0 at `k` equal to that root. Bisection finds the `k` between
+        // the two where it is 0.
+        let (sx, sy) = at(0.0);
+        let (mut lo, mut hi) = (0.0, (sx * sy).sqrt());
+        if hi.is_nan() || hi <= 0.0 {
+            return (sx, sy);
+        }
+        for _ in 0..200 {
+            let mid = lo + (hi - lo) / 2.0;
+            if mid <= lo || mid >= hi {
+                break;
+            }
+            let (sx, sy) = at(mid);
+            if (sx * sy).sqrt() > mid {
+                lo = mid;
+            } else {
+                hi = mid;
+            }
+        }
+        let miss = |k: f64| {
+            let (sx, sy) = at(k);
+            ((sx * sy).sqrt() - k).abs()
+        };
+        at(if miss(lo) < miss(hi) { lo } else { hi })
+    }
+}
+
+/// Most parts [`Spans::measure`] opens the objects it sizes into: past it, each object is one part.
+const MAX_SPANS: usize = 4096;
+
+/// What [`Spans::measure`] measures as one span.
+enum Part<'a> {
+    /// An object of the selection, or a member of a plain group in it, and the outset of the
+    /// strokes of the plain groups around it, which scale with its own.
+    Object(&'a Node, f64),
+    /// An object in the art of a symbol instance and the transform that places it square to the
+    /// frame. The outset of the strokes of the instance and of the plain groups around the instance
+    /// scales with the strokes; the outset of the strokes of the plain groups around the object in
+    /// the art stays, as the strokes in the art do.
+    Art(&'a Node, Affine, f64, f64),
+}
+
+/// Adds the parts that [`Spans::measure`] measures `n` by to `parts`, `grow` being the outset of
+/// the strokes of the plain groups around it ([`Part::Object`]). A plain group ([`opens`]) adds the
+/// parts of each member. A symbol instance without effects or an opacity mask of its own adds the
+/// objects of its art, with plain groups there opened too ([`Part::Art`]), when its symbol's art
+/// measures it, it is not in perspective, and its transform keeps the art square to the frame (a
+/// turned or slanted instance is measured by the box around its turned art box). Anything else is
+/// one part. Returns false when the parts pass [`MAX_SPANS`].
+fn open<'a>(n: &'a Node, grow: f64, d: &'a Document, symbols: &vectorcraft_doc::SymbolBoxes, to_local: Affine, parts: &mut Vec<Part<'a>>) -> bool {
+    if opens(n) {
+        match &n.kind {
+            NodeKind::Group { children, .. } => {
+                let grow = grow + n.appearance.outset();
+                return children.iter().all(|c| open(c, grow, d, symbols, to_local, parts));
+            }
+            NodeKind::SymbolInstance { symbol, xf } => {
+                let xf = to_local * *xf;
+                if n.projection().is_none()
+                    && square(xf)
+                    && symbols.art_bounds(symbol).is_some()
+                    && let Some(art) = d.symbols.iter().find(|s| s.name == *symbol)
+                {
+                    return open_art(&art.art, xf, grow + n.appearance.outset(), 0.0, parts);
+                }
+            }
+            _ => {}
+        }
+    }
+    parts.push(Part::Object(n, grow));
+    parts.len() <= MAX_SPANS
+}
+
+/// [`open`] for `n` in symbol art that `xf` places square to the frame: a plain group adds the parts
+/// of each member, and anything else, a symbol instance included, is one part. `kept` is the outset
+/// of the strokes of the plain groups around `n` in the art, and `grow` that of the instance and the
+/// plain groups around it.
+fn open_art<'a>(n: &'a Node, xf: Affine, grow: f64, kept: f64, parts: &mut Vec<Part<'a>>) -> bool {
+    if let NodeKind::Group { children, .. } = &n.kind
+        && opens(n)
+    {
+        let kept = kept + n.appearance.outset();
+        return children.iter().all(|c| open_art(c, xf, grow, kept, parts));
+    }
+    parts.push(Part::Art(n, xf, grow, kept));
+    parts.len() <= MAX_SPANS
+}
+
+/// Whether [`open`] opens `n`: a group without a clip, a Shaper construction, effects or an opacity
+/// mask of its own, or a symbol instance without effects or an opacity mask of its own.
+fn opens(n: &Node) -> bool {
+    let visible = |effects: &[vectorcraft_doc::Effect]| effects.iter().any(|e| e.visible);
+    let effects = visible(&n.appearance.effects) || n.appearance.items.iter().any(|i| visible(i.effects()));
+    let kind = match n.kind {
+        NodeKind::Group { clip, .. } => !clip && n.extras().shaper.is_none(),
+        NodeKind::SymbolInstance { .. } => true,
+        _ => false,
+    };
+    kind && !effects && n.extras().mask.is_none()
+}
+
+/// Whether `a` takes boxes square to the frame to boxes square to it: it scales, mirrors, turns by a
+/// quarter turn and moves, and nothing else, to within rounding.
+fn square(a: Affine) -> bool {
+    let [m0, m1, m2, m3, ..] = a.as_coeffs();
+    let tolerance = 1e-9 * [m0, m1, m2, m3].iter().fold(0.0, |m: f64, v| m.max(v.abs()));
+    m1.abs() <= tolerance && m2.abs() <= tolerance || m0.abs() <= tolerance && m3.abs() <= tolerance
+}
+
+/// The largest scale of 0 or more at which `spans`, with the margins that scale grown by `k`,
+/// reach across `size` together. Returns 1 when their geometric boxes reach 1e-9 or less across
+/// together, as the closed form in [`set_bounds`] does, and 0 when the spans reach farther than
+/// `size` at the scale 0.
+fn scale_across(spans: &[Span], k: f64, size: f64) -> f64 {
+    let o = spans.iter().map(|s| s.lo).fold(f64::INFINITY, f64::min);
+    let across = spans.iter().map(|s| s.hi).fold(f64::NEG_INFINITY, f64::max) - o;
+    // How far the spans reach together after a scale by `s` about `o`, and how fast that changes
+    // with `s`: the far geometric end minus the near one, of the objects that reach farthest at the
+    // two ends.
+    let reach = |s: f64| {
+        let (mut start, mut end, mut slope_start, mut slope_end) = (f64::INFINITY, f64::NEG_INFINITY, 0.0, 0.0);
+        for sp in spans {
+            let (a, b) = sp.scaled(o, s, k);
+            if a < start {
+                (start, slope_start) = (a, sp.lo - o);
+            }
+            if b > end {
+                (end, slope_end) = (b, sp.hi - o);
+            }
+        }
+        (end - start, slope_end - slope_start)
+    };
+    if across.is_nan() || across <= 1e-9 {
+        return 1.0;
+    }
+    let least = reach(0.0).0;
+    if least.is_nan() || least > size {
+        return 0.0;
+    }
+    // `reach` is convex in `s` and at most `size` at 0, so it equals `size` at one largest scale.
+    // Newton's method, started at a larger scale, reaches it one linear piece of `reach` at a
+    // time; bisection finishes the search when a step makes no progress.
+    let (mut lo, mut hi) = (0.0, size / across);
+    for _ in 0..64 {
+        if reach(hi).0 >= size {
+            break;
+        }
+        hi = 2.0 * hi + 1.0;
+    }
+    for _ in 0..64 {
+        let (r, slope) = reach(hi);
+        if r <= size {
+            return hi;
+        }
+        let next = hi - (r - size) / slope;
+        if next.is_nan() || next <= lo || next >= hi {
+            break;
+        }
+        hi = next;
+    }
+    for _ in 0..64 {
+        let mid = lo + (hi - lo) / 2.0;
+        if mid <= lo || mid >= hi {
+            break;
+        }
+        if reach(mid).0 <= size {
+            lo = mid;
+        } else {
+            hi = mid;
+        }
+    }
+    if size - reach(lo).0 <= reach(hi).0 - size { lo } else { hi }
+}
+
 fn expand_shape(s: &mut Session, _: &Value) -> Result<Value> {
     let ids = selected_roots(s)?;
     // With no live shape selected, the document and its undo history stay as they are.

crates/engine/src/cmd/package.rs

@@ -343,6 +343,7 @@ fn package(s: &mut Session, p: &Value) -> Result<Value> {
     let warnings = std::mem::take(&mut collector.warnings);
     let fonts = collector.fonts;
     let links = collector.copies.len();
+    let copied_sources: Vec<String> = collector.copies.keys().cloned().collect();
 
     // The report.
     if let Some(info) = info {
@@ -357,6 +358,9 @@ fn package(s: &mut Session, p: &Value) -> Result<Value> {
     let mut out = json!({ "files": files, "links": links, "fonts": fonts, "missingLinks": missing, "skippedFonts": skipped, "warnings": warnings });
     match root {
         Some(root) => {
+            // Never replace the open document or a file it links to: the folder may be the document's own.
+            let sources: Vec<&str> = std::iter::once(doc_path.as_str()).chain(copied_sources.iter().map(String::as_str)).collect();
+            check_no_overwrite(&root, &entries, &sources)?;
             for (rel, bytes) in &entries {
                 let path = root.join(rel);
                 if let Some(dir) = path.parent() {
@@ -377,6 +381,21 @@ fn package(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(out)
 }
 
+/// An error when writing any of `entries` (paths relative to `root`) would replace one of the
+/// `sources` (compared by their real paths, so aliases and `..` don't hide a collision).
+fn check_no_overwrite(root: &Path, entries: &[Entry], sources: &[&str]) -> Result<()> {
+    let real: Vec<PathBuf> = sources.iter().filter_map(|s| std::fs::canonicalize(s).ok()).collect();
+    for (rel, _) in entries {
+        let path = root.join(rel);
+        if let Ok(dest) = std::fs::canonicalize(&path)
+            && real.contains(&dest)
+        {
+            return Err(bad(C, format!("`{}` would be overwritten by the package: choose a different folder or name", path.display())));
+        }
+    }
+    Ok(())
+}
+
 // ---------- zip archives ----------
 
 /// The MS-DOS time and date a zip entry records: now (UTC), else 1980-01-01.

crates/engine/src/cmd/params.rs

@@ -10,8 +10,10 @@
 //!
 //! Callers outside the app (the control channel, MCP, the CLI) are answered with a parameter error
 //! for a key the description doesn't name ([`check_params`]): a misspelt `widht` no longer runs the
-//! command with its default. [`Session::execute`] itself takes what it is given, so the journal of
-//! an older version still replays.
+//! command with its default. So are the `params` of an effect (#1592): `effect.apply` and
+//! `effect.setParams` answer a key the effect doesn't take, or a value of another type than its
+//! default, with a parameter error ([`check_effect_params`]). [`Session::execute`] itself takes
+//! what it is given, so the journal of an older version still replays.
 
 use serde_json::Value;
 
@@ -150,6 +152,12 @@ fn accepted(doc: &'static str, depth: usize) -> Option<Vec<&'static str>> {
     Some(keys)
 }
 
+/// Does the description `doc` name `key` as a parameter (its own keys, and those of the commands
+/// its `…` entries name)?
+pub(crate) fn takes_key(doc: &'static str, key: &str) -> bool {
+    doc_keys(doc).is_ok_and(|parsed| parsed.keys.contains(&key)) || accepted(doc, 0).is_some_and(|keys| keys.contains(&key))
+}
+
 /// The edits (insert, delete, replace, swap of neighbours) that turn `a` into `b`, ignoring case.
 fn distance(a: &str, b: &str) -> usize {
     let (a, b): (Vec<char>, Vec<char>) = (a.chars().map(|c| c.to_ascii_lowercase()).collect(), b.chars().map(|c| c.to_ascii_lowercase()).collect());
@@ -183,15 +191,56 @@ pub fn check_keys(id: &str, doc: &'static str, params: &Value) -> Result<()> {
         return Ok(());
     }
     let Some(keys) = accepted(doc, 0) else { return Ok(()) };
-    let Some(key) = given.keys().find(|k| !keys.contains(&k.as_str())) else { return Ok(()) };
-    Err(bad(
+    match given.keys().find(|k| !keys.contains(&k.as_str())) {
+        Some(key) => Err(unknown(id, key, &keys)),
+        None => Ok(()),
+    }
+}
+
+/// The parameter error of command `id` for `key`, which isn't one of `keys`: with the nearest of
+/// them, or all of them.
+fn unknown(id: &str, key: &str, keys: &[&str]) -> crate::EngineError {
+    bad(
         id,
-        match nearest(key, &keys) {
+        match nearest(key, keys) {
             Some(near) => format!("unknown parameter `{key}`; did you mean `{near}`?"),
             None if keys.is_empty() => format!("unknown parameter `{key}`; the command takes no parameters"),
             None => format!("unknown parameter `{key}`; the command takes: {}", keys.join(", ")),
         },
-    ))
+    )
+}
+
+/// `params` of built-in effect `effect`, as command `id` was given them (#1592): only keys the
+/// effect takes (those of its dialog defaults and of its params description), each of its
+/// default's type. Numbers out of range pass: the effect clamps them when it draws. An effect
+/// plug-in resolves its own against its manifest, and an unknown effect is the command's to report.
+pub fn check_effect_params(id: &str, effect: &str, params: &Value) -> Result<()> {
+    let Value::Object(given) = params else { return Ok(()) };
+    if effect.starts_with(vectorcraft_plugins::effect::PREFIX) {
+        return Ok(());
+    }
+    let Some(info) = vectorcraft_render::effects::effect_info(effect) else { return Ok(()) };
+    let defaults = info.defaults.as_object();
+    let mut keys: Vec<&str> = defaults.into_iter().flat_map(|d| d.keys().map(String::as_str)).collect();
+    // A description that doesn't parse names no more keys (the tests rule that out).
+    for key in doc_keys(info.params).map(|d| d.keys).unwrap_or_default() {
+        if !keys.contains(&key) {
+            keys.push(key);
+        }
+    }
+    for (key, v) in given {
+        if !keys.contains(&key.as_str()) {
+            return Err(unknown(id, key, &keys));
+        }
+        match defaults.and_then(|d| d.get(key)) {
+            Some(Value::Number(_)) if !v.is_number() => return Err(bad(id, format!("`{key}` must be a number"))),
+            Some(Value::Bool(_)) if !v.is_boolean() => return Err(bad(id, format!("`{key}` must be true or false"))),
+            // (A colour is also taken as `[r, g, b]` or as a colour object.)
+            Some(Value::String(_)) if v.is_number() || v.is_boolean() => return Err(bad(id, format!("`{key}` must be a string"))),
+            _ => {}
+        }
+    }
+    Ok(())
 }
 
 /// Commands whose params aren't checked yet (#1442): they read keys in ways the audit of the
@@ -327,10 +376,16 @@ pub const UNCHECKED: &[&str] = &[
     "webExport.settings",
 ];
 
-/// [`check_keys`] for an engine command, the steps of a `command.batch` included. A command the
-/// engine doesn't have passes: running it reports that.
+/// [`check_keys`] for an engine command, the steps of a `command.batch` included, and
+/// [`check_effect_params`] for the effect `effect.apply` adds. A command the engine doesn't have
+/// passes: running it reports that.
 pub fn check_params(id: &str, params: &Value) -> Result<()> {
     let Some(spec) = find_command(id) else { return Ok(()) };
+    if let ("effect.apply" | "appearance.addEffect", Some(effect), Some(given)) =
+        (id, params.get("effect").or_else(|| params.get("id")).and_then(Value::as_str), params.get("params"))
+    {
+        check_effect_params(id, effect, given)?;
+    }
     if UNCHECKED.contains(&id) {
         return Ok(());
     }
@@ -344,3 +399,18 @@ pub fn check_params(id: &str, params: &Value) -> Result<()> {
     }
     Ok(())
 }
+
+impl crate::Session {
+    /// [`check_params`], and [`check_effect_params`] for the effects `effect.setParams` edits in
+    /// this session's document (not as a step of a `command.batch`: what it edits is only there
+    /// once the steps before it ran).
+    pub fn check_params(&self, id: &str, params: &Value) -> Result<()> {
+        check_params(id, params)?;
+        if let ("effect.setParams", Some(given)) = (id, params.get("params")) {
+            for effect in super::effectcmd::set_params_effects(self, params) {
+                check_effect_params(id, &effect, given)?;
+            }
+        }
+        Ok(())
+    }
+}

crates/engine/src/cmd/path.rs

@@ -91,7 +91,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Delete Anchor Points",
             [],
             None,
-            "{} delete the direct-selected anchors and their segments, opening closed paths there (the Delete key)",
+            "{} delete the direct-selected anchors and their segments, opening closed paths there, and delete objects selected whole alongside them; what remains of a path stays selected, so a second Delete removes it (the Delete key)",
             has_anchors,
             delete_anchors
         ),
@@ -521,10 +521,27 @@ pub(crate) fn delete_anchors(s: &mut Session, _: &Value) -> Result<Value> {
     let st = s.doc()?;
     let sel = st.selection.anchors.clone();
     let segments = st.selection.segments.clone();
+    // Every anchor selected stores the path as an object, with no `anchors` entry. A marquee that
+    // also catches part of another path must still delete those whole objects.
+    let whole = st.selection.whole();
     s.edit("Clear", |d, selection| {
+        let targets: BTreeSet<NodeId> = whole.into_iter().filter(|id| d.node(*id).is_some_and(|n| !n.is_layer())).collect();
+        let whole_ids: Vec<NodeId> = targets
+            .iter()
+            .copied()
+            .filter(|id| !d.ancestry(*id).unwrap_or_default().iter().rev().skip(1).any(|ancestor| targets.contains(ancestor)))
+            .collect();
+        if !whole_ids.is_empty() {
+            d.remove_many(&whole_ids)?;
+        }
         let mut survivors = vec![];
-        let mut emptied = Beside::replacing(d, &sel.keys().copied().collect::<Vec<_>>());
+        let remaining: Vec<NodeId> = sel.keys().copied().filter(|id| d.node(*id).is_some()).collect();
+        let mut emptied = Beside::replacing(d, &remaining);
         for (id, set) in &sel {
+            // The path went with a fully selected group around it.
+            if d.node(*id).is_none() {
+                continue;
+            }
             let remove_node = {
                 let path = path_mut(d, *id)?;
                 if let Some(refs) = segments.get(id) {
@@ -538,39 +555,73 @@ pub(crate) fn delete_anchors(s: &mut Session, _: &Value) -> Result<Value> {
                         })
                         .collect();
                 } else {
-                    // Deleting an anchor from a closed path opens it there (Illustrator behaviour on Delete).
-                    for &(si, ai) in set.iter().rev() {
-                        if let Some(sp) = path.subpaths.get_mut(si)
-                            && ai < sp.anchors.len()
-                        {
-                            if sp.closed {
-                                sp.anchors.rotate_left(ai + 1);
-                                sp.anchors.pop();
-                                sp.closed = false;
-                            } else {
-                                sp.anchors.remove(ai);
-                            }
-                        }
-                    }
+                    // Remove every selected anchor against the original indexes. A closed path opens
+                    // across each deleted run and keeps the surviving stretches in their old order.
+                    path.subpaths = std::mem::take(&mut path.subpaths)
+                        .into_iter()
+                        .enumerate()
+                        .flat_map(|(si, sp)| {
+                            let gone = set.iter().filter_map(|&(s, ai)| (s == si).then_some(ai)).collect();
+                            without_anchors(sp, &gone)
+                        })
+                        .collect();
                 }
                 path.subpaths.retain(|s| s.anchors.len() >= 2);
                 path.subpaths.is_empty()
             };
             if remove_node {
                 emptied.put(d, *id, vec![])?;
-            } else if segments.contains_key(id) {
+            } else {
+                // The remainder is selected whole, so the next Delete removes it.
                 survivors.push(*id);
             }
         }
         emptied.finish(d)?;
-        // Another Delete removes the remaining path after a segment cut. Anchor Delete keeps
-        // its existing deselection behavior.
         selection.set(survivors);
         Ok(())
     })?;
     ok()
 }
 
+/// Remove anchors `removed`. An open path stays one path and joins across the gap. A closed path
+/// opens there: each stretch of anchors that were not deleted becomes its own open path, in the
+/// original order, including a stretch that wraps past the last anchor.
+fn without_anchors(sp: SubPath, removed: &BTreeSet<usize>) -> Vec<SubPath> {
+    let n = sp.anchors.len();
+    let gone: BTreeSet<usize> = removed.iter().copied().filter(|&i| i < n).collect();
+    if gone.is_empty() {
+        return vec![sp];
+    }
+    let keep = |anchors: Vec<Anchor>| (anchors.len() >= 2).then(|| SubPath::new(anchors, false));
+    if !sp.closed {
+        return keep(sp.anchors.into_iter().enumerate().filter(|(i, _)| !gone.contains(i)).map(|(_, a)| a).collect()).into_iter().collect();
+    }
+    let mut runs: Vec<Vec<Anchor>> = vec![];
+    let mut run = vec![];
+    for (i, anchor) in sp.anchors.into_iter().enumerate() {
+        if gone.contains(&i) {
+            if !run.is_empty() {
+                runs.push(std::mem::take(&mut run));
+            }
+        } else {
+            run.push(anchor);
+        }
+    }
+    // The anchors before the first deletion and after the last are one stretch.
+    if gone.contains(&0) {
+        if !run.is_empty() {
+            runs.push(run);
+        }
+    } else if !runs.is_empty() {
+        let head = runs.remove(0);
+        run.extend(head);
+        runs.insert(0, run);
+    } else if !run.is_empty() {
+        runs.push(run);
+    }
+    runs.into_iter().filter_map(keep).collect()
+}
+
 /// Remove connections, splitting open/closed contours into their surviving open runs.
 fn without_segments(sp: SubPath, removed: &BTreeSet<usize>) -> Vec<SubPath> {
     let cuts: BTreeSet<usize> = removed.iter().copied().filter(|&i| i < sp.segment_count()).collect();

crates/engine/src/cmd/pathops.rs

@@ -246,18 +246,32 @@ fn style_of(n: &Node) -> Style {
 /// Leaf shapes (paths, compound paths, text) of a subtree in paint order; guides and clipping
 /// paths are skipped.
 fn leaves(n: &Node, out: &mut Vec<Node>) {
+    each_leaf(n, &mut |l| out.push(l.clone()));
+}
+
+/// Calls `f` with each leaf shape of [`leaves`], in its order.
+fn each_leaf(n: &Node, f: &mut impl FnMut(&Node)) {
     match &n.kind {
         NodeKind::Path { guide: true, .. } | NodeKind::Path { clipping: true, .. } => {}
-        NodeKind::Path { .. } | NodeKind::Compound { .. } | NodeKind::Text(_) => out.push(n.clone()),
+        NodeKind::Path { .. } | NodeKind::Compound { .. } | NodeKind::Text(_) => f(n),
         NodeKind::Group { children, .. } | NodeKind::Layer { children, .. } => {
             for c in children {
-                leaves(c, out);
+                each_leaf(c, f);
             }
         }
         _ => {}
     }
 }
 
+/// How many shapes a Pathfinder operation takes from `n` selected alone: its leaf shapes, however
+/// deep its groups nest (an expanded stroke is a group inside the group, #1635).
+pub fn shape_count(n: &Node) -> usize {
+    // Counted without copying the shapes: the panel asks every frame.
+    let mut count = 0;
+    each_leaf(n, &mut |_| count += 1);
+    count
+}
+
 /// A node for `path`: a plain path for one subpath, else a compound path.
 pub(crate) fn shape_node(d: &mut Document, path: PathData, style_src: Option<&Node>) -> Node {
     let id = d.alloc_id();
@@ -383,10 +397,15 @@ fn run_pf(s: &mut Session, op: PathfinderOp) -> Result<Value> {
         let mut styles: Vec<Style> = vec![];
         let mut shapes: Vec<po::Shape> = vec![];
         let mut names: Vec<Option<String>> = vec![];
-        let mut push = |mut path: PathData, rule: FillRule, st: Style, name: Option<String>| {
+        let mut push = |mut path: PathData, rule: FillRule, mut st: Style, name: Option<String>| {
             if path.is_empty() {
                 return;
             }
+            // Trim, Merge and Crop remove any strokes (and Merge then merges by fill alone), as the
+            // public Pathfinder documentation describes.
+            if matches!(op, PathfinderOp::Trim | PathfinderOp::Merge | PathfinderOp::Crop) {
+                st.appearance.items.retain(|i| !matches!(i, AppearanceItem::Stroke(_)));
+            }
             if op == PathfinderOp::Divide && st.appearance.items.iter().any(|i| matches!(i, AppearanceItem::Fill(f) if !f.paint.is_none())) {
                 // Filled open contours keep their implicit closing edge. A zero-area line
                 // stays a cutter; normalised area also catches zero-signed-area self crossings.
@@ -498,6 +517,7 @@ fn offset_path(s: &mut Session, p: &Value) -> Result<Value> {
     let roots = selected_roots(s)?;
     let ids = s.edit("Offset Path", |d, sel| {
         let (mut out, mut above) = (vec![], vec![]);
+        let mut paths = false;
         for id in &roots {
             let Some(n) = d.node(*id).cloned() else { continue };
             let mut lv = vec![];
@@ -505,6 +525,7 @@ fn offset_path(s: &mut Session, p: &Value) -> Result<Value> {
             let mut made = vec![];
             for l in lv.iter().filter(|l| !matches!(l.kind, NodeKind::Text(_))) {
                 let Some((path, rule)) = node_path(l) else { continue };
+                paths = true;
                 let base = if matches!(l.kind, NodeKind::Compound { .. }) && path.is_closed() { po::normalize(&path, rule) } else { path };
                 let off = po::offset_path(&base, delta, join, miter);
                 if off.is_empty() {
@@ -527,6 +548,9 @@ fn offset_path(s: &mut Session, p: &Value) -> Result<Value> {
             out.push(new.id);
             above.push((*id, vec![new]));
         }
+        if out.is_empty() && paths {
+            return Err(EngineError::Other("Offset Path: the offset leaves nothing of the selected paths (an inset larger than the shapes)".into()));
+        }
         if out.is_empty() {
             return Err(EngineError::Other("Offset Path: select paths".into()));
         }

crates/engine/src/cmd/patterncmds.rs

@@ -708,28 +708,50 @@ fn fix_ids(d: &mut Document, n: &mut Node) {
 fn repeat_expand(s: &mut Session, _: &Value) -> Result<Value> {
     let reps = selected_repeats(s);
     let ids = s.edit("Expand Repeat", |d, sel| {
-        let mut out = vec![];
         for r in &reps {
-            let Some(n) = d.node(*r).cloned() else { continue };
-            let mut g = vectorcraft_doc::live::expanded_group(&n, None);
-
-            // The group keeps the repeat's id; every generated instance node gets a fresh one.
-            if let Some(ch) = g.children_mut() {
-                for c in ch.iter_mut() {
-                    fix_ids(d, Arc::make_mut(c));
-                }
-            }
-            let (par, idx, _) = d.position(*r).ok_or(EngineError::NoNode(*r))?;
-            d.remove(*r)?;
-            d.insert(par, idx, g)?;
-            out.push(*r);
+            expand_repeat(d, *r)?;
         }
-        sel.set(out.iter().copied());
-        Ok(out)
+        sel.set(reps.iter().copied());
+        Ok(reps.clone())
     })?;
     Ok(ids_json(&ids))
 }
 
+/// Repeat `r` replaced by a group of its instances, keeping its id and place; every generated
+/// instance node gets a fresh id.
+fn expand_repeat(d: &mut Document, r: NodeId) -> Result<()> {
+    let Some(n) = d.node(r).cloned() else { return Ok(()) };
+    let mut g = vectorcraft_doc::live::expanded_group(&n, None);
+    if let Some(ch) = g.children_mut() {
+        for c in ch.iter_mut() {
+            fix_ids(d, Arc::make_mut(c));
+        }
+    }
+    let (par, idx, _) = d.position(r).ok_or(EngineError::NoNode(r))?;
+    d.remove(r)?;
+    d.insert(par, idx, g)?;
+    Ok(())
+}
+
+/// Object › Expand: every repeat in the subtrees of `roots` becomes a group of its instances
+/// ([`expand_repeat`]), inner ones first so an outer repeat repeats plain art. Returns how many.
+pub(crate) fn expand_repeats(d: &mut Document, roots: &[NodeId]) -> Result<usize> {
+    let mut reps = vec![];
+    for r in roots {
+        if let Some(n) = d.node(*r) {
+            n.walk(&mut |c| {
+                if pattern::is_repeat(c) {
+                    reps.push(c.id);
+                }
+            });
+        }
+    }
+    for r in reps.iter().rev() {
+        expand_repeat(d, *r)?;
+    }
+    Ok(reps.len())
+}
+
 fn repeat_options(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "object.repeat.options";
     let reps = selected_repeats(s);

crates/engine/src/cmd/prefscmds.rs

@@ -351,6 +351,7 @@ pub const PREF_SPECS: &[PrefSpec] = &[
     p!("useCompression", "File Handling", "Files", "Use Compression", bool),
     // The W/H link of the Transform panel, the Properties panel and the Control bar
     p!("constrainProportions", "General", "Transform Panel", "Constrain Width and Height Proportions", bool),
+    p!("singleCornerRadius", "General", "Transform Panel", "Single Corner Radius", bool),
 ];
 
 pub fn spec(key: &str) -> Option<&'static PrefSpec> {

crates/engine/src/cmd/print.rs

@@ -128,7 +128,7 @@ fn print(s: &mut Session, p: &Value) -> Result<Value> {
     let flat = super::rasterfx::flatten_raster_effects(doc);
     let doc = flat.as_ref().unwrap_or(doc);
     // Print as Bitmap and the flattener preset (Advanced) render and flatten it first.
-    let prepared = super::printadvanced::prepare(PRINT, doc, &set, &s.prefs.flattener_presets)?;
+    let prepared = super::printadvanced::prepare(PRINT, doc, &set, &s.prefs.flattener_presets, s.prefs.black_output == "rich")?;
     let path = str_param(p, "path");
     if !postscript {
         let r = vectorcraft_pdf::print(prepared.as_ref().unwrap_or(doc), &PrintOptions { settings: set, ..Default::default() })

crates/engine/src/cmd/printadvanced.rs

@@ -30,7 +30,8 @@ pub(crate) fn flattener(cmd: &str, set: &PrintSettings, saved: &[FlattenerPreset
 
 /// `doc` as Print as Bitmap and the flattener preset of `set` print it (from `saved` presets), or
 /// `None` when neither applies. Print as Bitmap is for composite output.
-pub(crate) fn prepare(cmd: &str, doc: &Document, set: &PrintSettings, saved: &[FlattenerPreset]) -> Result<Option<Document>> {
+/// `rich_black`: Appearance of Black › Printing / Exporting › Output All Blacks as Rich Black.
+pub(crate) fn prepare(cmd: &str, doc: &Document, set: &PrintSettings, saved: &[FlattenerPreset], rich_black: bool) -> Result<Option<Document>> {
     let composite = set.output.mode == OutputMode::Composite;
     let bitmap = set.advanced.print_as_bitmap && composite;
     let flattener = flattener(cmd, set, saved)?;
@@ -39,7 +40,7 @@ pub(crate) fn prepare(cmd: &str, doc: &Document, set: &PrintSettings, saved: &[F
     }
     let printed = vectorcraft_pdf::printed_document(doc, set);
     if bitmap {
-        return bitmap_document(cmd, &printed, set).map(Some);
+        return bitmap_document(cmd, &printed, set, rich_black).map(Some);
     }
     let Some(mut o) = flattener else { return Ok(None) };
     // Composite overprints that were discarded or simulated aren't preserved either.
@@ -63,13 +64,13 @@ fn drop_guides(nodes: &mut Vec<Arc<Node>>) {
 /// `doc` (as it prints) with its art replaced by one image of each printed region (an artboard
 /// with its bleed, or all the art), at the document's raster effects resolution; regions where
 /// nothing is drawn get none.
-fn bitmap_document(cmd: &str, doc: &Document, set: &PrintSettings) -> Result<Document> {
+fn bitmap_document(cmd: &str, doc: &Document, set: &PrintSettings, rich_black: bool) -> Result<Document> {
     let regions = vectorcraft_pdf::print_regions(doc, set).map_err(|e| pdf_error(cmd, e))?;
     let bleed = set.bleed.of(doc);
     let mut art = doc.clone();
     drop_guides(&mut art.layers);
     let anti_alias = if doc.raster_effects.anti_alias { AntiAlias::Art } else { AntiAlias::None };
-    let opts = RenderOptions { skip_templates: true, anti_alias, ..Default::default() };
+    let opts = RenderOptions { skip_templates: true, anti_alias, rich_black, ..Default::default() };
     let mut out = doc.clone();
     let mut renderer = vectorcraft_render::Renderer::new();
     let mut images = vec![];

crates/engine/src/cmd/rasterfx.rs

@@ -173,7 +173,7 @@ pub(crate) fn effects_scale(doc: &Document) -> f64 {
 pub(crate) fn effect_image(out: &mut Document, whole: &Node, knockout: Option<&Node>, scale: f64) -> Option<Node> {
     // What it paints (its members' effects included), and how far its fills' and strokes' raster
     // effects reach beyond that.
-    let b = vectorcraft_render::painted_bounds(whole)?;
+    let b = vectorcraft_render::painted_bounds(out, whole)?;
     let look = out.raster_effects.clone();
     let reach = whole.appearance.items.iter().map(|i| effects::outset(i.effects(), b)).fold(0.0, f64::max) + 2.0 + look.add_around;
     let b = b.inflate(reach, reach);

crates/engine/src/cmd/scripts.rs

@@ -0,0 +1,159 @@
+//! `script.check`: a script written for the reference app (`.jsx`, `.jsxinc`, `.js`, or a compiled
+//! `.jsxbin`) checked without running any of it, by `vectorcraft-scriptcheck`: what kind of file it
+//! is, what it needs, its directives and includes, the platform features and document-model member
+//! chains it uses, the menu commands it runs, what it does outside the document, and its problems.
+//! With a path and `includes`, the files its `#include` lines name are read from inside its folder,
+//! each through the same checks as every other file a command reads.
+
+use serde_json::{Value, json};
+use vectorcraft_scriptcheck::{Limits, Loaded, Loader, Report};
+
+/// The ids a reply can hold, for the windows that show it.
+pub use vectorcraft_scriptcheck::{IncludeStatus, Need, OUTSIDE, PROBLEMS};
+
+use super::*;
+
+/// The extensions of the scripts File › Open shows a check for.
+pub const EXTS: &[&str] = &["jsx", "jsxinc", "jsxbin"];
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![cmd!(
+        query "script.check",
+        "Check Script",
+        [],
+        None,
+        "{path? | data?: the script's text | dataBase64?, name?: the file's name (default: the path's; with a path, only the reply's name), includes?: false (with a path: also check the files its #include lines name, inside the script's folder; not on the web)} check a script written for the reference app (.jsx, .jsxinc, .js, or a compiled .jsxbin) without running any of it → {name, kind: script|compiled|module|notText|tooLarge, needs: [language|dom|files|menuCommands|dialogs|hostOnly], lines, targets: [{value, app, instance?, version?, locale?, line, file?}], directives: [{name, value, line, form: \"#\"|\"//@\", file?}], includes: [{value, line, status: checked|missing|notFollowed|cycle|notRead|limit|unreadable, path?, file?}], features: [{id, count, lines}], dom: {members: [{path, count}], types: [{name, count}]}, menuCommands: {strings: [{value, count, lines}], dynamic}, outside: [{id: filesWritten|filesOpened|network|nativeCode|otherApps|environment|unseenCode|preferences, count, lines, modes?}], problems: [{code, line?, file?, detail?}], truncated} (file: the included file it is in; lines: at most 20 of the script's own, while counts include the included files; at most 8 MiB a file and 32 MiB in all, 64 included files 16 deep, 1,024 paths looked up for them, 1,000 entries a list, text echoed cut to 120 characters)",
+        always,
+        check
+    )]
+}
+
+/// The folder a script is in, which its included files are read from.
+struct Folder {
+    dir: std::path::PathBuf,
+    /// The folder with its links followed (none where the file system can't tell).
+    real: Option<std::path::PathBuf>,
+}
+
+impl Folder {
+    /// The folder of the script at `path`.
+    fn of(path: &str) -> Self {
+        let dir = std::path::Path::new(path).parent().filter(|d| !d.as_os_str().is_empty()).unwrap_or(std::path::Path::new("."));
+        Folder { real: std::fs::canonicalize(dir).ok(), dir: dir.to_path_buf() }
+    }
+}
+
+impl Loader for Folder {
+    fn load(&mut self, path: &str, max: usize) -> Loaded {
+        let file = self.dir.join(path);
+        // A link that leads out of the script's folder isn't followed.
+        if let (Some(real), Ok(target)) = (&self.real, std::fs::canonicalize(&file))
+            && !target.starts_with(real)
+        {
+            return Loaded::Refused;
+        }
+        let file = file.to_string_lossy();
+        if crate::file_access::check_read(&file).is_err() {
+            return Loaded::Refused;
+        }
+        super::fileio::read_file_head(&file, max).map_or(Loaded::Missing, Loaded::Bytes)
+    }
+}
+
+/// The bytes the base64 text `b64` holds, up to `max` and a few more: only the text they take is
+/// decoded.
+fn decode_head(b64: &str, max: usize) -> Option<Vec<u8>> {
+    let chars = max.div_ceil(3).saturating_mul(4);
+    let mut kept = 0usize;
+    let end = b64
+        .bytes()
+        .position(|b| {
+            kept += usize::from(!b.is_ascii_whitespace());
+            kept > chars
+        })
+        .unwrap_or(b64.len());
+    vectorcraft_format::base64_decode(b64.get(..end)?)
+}
+
+fn check(_: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "script.check";
+    let limits = Limits::default();
+    // One byte more than a file may have shows that the file is too large.
+    let max = limits.file_bytes.saturating_add(1);
+    let path = str_param(p, "path");
+    let bytes: std::borrow::Cow<[u8]> = match (path, str_param(p, "data"), str_param(p, "dataBase64")) {
+        (Some(path), ..) => super::fileio::read_file_head(path, max)?.into(),
+        (None, Some(text), _) => text.as_bytes().get(..max).unwrap_or(text.as_bytes()).into(),
+        (None, None, Some(b64)) => decode_head(b64, max).ok_or_else(|| bad(C, "bad dataBase64"))?.into(),
+        _ => return Err(bad(C, "give `path`, `data` or `dataBase64`")),
+    };
+    let name = super::fileio::file_name(str_param(p, "name").or(path).unwrap_or_default());
+    // With a path, the file is checked under its own name, which its includes are followed from;
+    // `name` names the reply.
+    let file = path.map(super::fileio::file_name).unwrap_or_else(|| name.clone());
+    let mut folder = path.filter(|_| bool_or(p, "includes", false)).map(Folder::of);
+    let report = vectorcraft_scriptcheck::check(&file, &bytes, folder.as_mut().map(|f| f as &mut dyn Loader), &limits);
+    Ok(report_json(&name, &report))
+}
+
+/// Object `v` with `key: value` added when there is a value.
+fn with(mut v: Value, key: &str, value: Option<impl serde::Serialize>) -> Value {
+    if let (Some(o), Some(x)) = (v.as_object_mut(), value) {
+        o.insert(key.into(), json!(x));
+    }
+    v
+}
+
+/// The reply for report `r` on the script `name`.
+fn report_json(name: &str, r: &Report) -> Value {
+    let targets: Vec<Value> = r
+        .targets
+        .iter()
+        .map(|t| {
+            let v = json!({"value": t.value, "app": t.app, "line": t.line});
+            let v = with(v, "instance", t.instance.as_deref());
+            let v = with(v, "version", t.version.as_deref());
+            let v = with(v, "locale", t.locale.as_deref());
+            with(v, "file", t.file.as_deref())
+        })
+        .collect();
+    let directives: Vec<Value> = r
+        .directives
+        .iter()
+        .map(|d| with(json!({"name": d.name, "value": d.value, "line": d.line, "form": d.form}), "file", d.file.as_deref()))
+        .collect();
+    let includes: Vec<Value> = r
+        .includes
+        .iter()
+        .map(|i| with(with(json!({"value": i.value, "line": i.line, "status": i.status.id()}), "path", i.path.as_deref()), "file", i.file.as_deref()))
+        .collect();
+    let features: Vec<Value> = r.features.iter().map(|f| json!({"id": f.id, "count": f.count, "lines": f.lines})).collect();
+    let members: Vec<Value> = r.members.iter().map(|m| json!({"path": m.name, "count": m.count})).collect();
+    let types: Vec<Value> = r.types.iter().map(|t| json!({"name": t.name, "count": t.count})).collect();
+    let strings: Vec<Value> = r.menu_strings.iter().map(|s| json!({"value": s.value, "count": s.count, "lines": s.lines})).collect();
+    let outside: Vec<Value> = r
+        .outside
+        .iter()
+        .map(|o| with(json!({"id": o.id, "count": o.count, "lines": o.lines}), "modes", Some(&o.modes).filter(|m| !m.is_empty())))
+        .collect();
+    let problems: Vec<Value> = r
+        .problems
+        .iter()
+        .map(|p| with(with(with(json!({"code": p.code}), "line", p.line), "file", p.file.as_deref()), "detail", p.detail.as_deref()))
+        .collect();
+    json!({
+        "name": name,
+        "kind": r.kind.id(),
+        "needs": r.needs.iter().map(|n| n.id()).collect::<Vec<_>>(),
+        "lines": r.lines,
+        "targets": targets,
+        "directives": directives,
+        "includes": includes,
+        "features": features,
+        "dom": {"members": members, "types": types},
+        "menuCommands": {"strings": strings, "dynamic": r.menu_dynamic},
+        "outside": outside,
+        "problems": problems,
+        "truncated": r.truncated,
+    })
+}

crates/engine/src/cmd/select.rs

@@ -6,6 +6,7 @@ use serde_json::{Value, json};
 use vectorcraft_color::Paint;
 use vectorcraft_doc::{Document, Node, NodeId, NodeKind};
 
+use super::wand::{fill_of, stroke_of};
 use super::*;
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -97,7 +98,7 @@ pub fn specs() -> Vec<CommandSpec> {
             has_selection,
             |s, _| {
                 let tint = s.prefs.select_same_tint_percent;
-                same(s, "select.same.fillColor", |a, b| same_paint(&a.appearance.fill_paint(), &b.appearance.fill_paint(), tint))
+                same(s, "select.same.fillColor", |a, b| same_paint(&fill_of(a), &fill_of(b), tint))
             }
         ),
         cmd!(
@@ -109,13 +110,13 @@ pub fn specs() -> Vec<CommandSpec> {
             has_selection,
             |s, _| {
                 let tint = s.prefs.select_same_tint_percent;
-                same(s, "select.same.strokeColor", |a, b| same_paint(&a.appearance.stroke_paint(), &b.appearance.stroke_paint(), tint))
+                same(s, "select.same.strokeColor", |a, b| same_paint(&stroke_of(a).0, &stroke_of(b).0, tint))
             }
         ),
         cmd!("select.same.strokeWeight", "Stroke Weight", ["Select", "Same"], None, "{}", has_selection, |s, _| same(
             s,
             "select.same.strokeWeight",
-            |a, b| (a.appearance.stroke_width() - b.appearance.stroke_width()).abs() < 1e-9
+            |a, b| (stroke_weight(a) - stroke_weight(b)).abs() < 1e-9
         )),
         cmd!(
             "select.same.fillAndStroke",
@@ -127,8 +128,7 @@ pub fn specs() -> Vec<CommandSpec> {
             |s, _| {
                 let tint = s.prefs.select_same_tint_percent;
                 same(s, "select.same.fillAndStroke", |a, b| {
-                    let (x, y) = (&a.appearance, &b.appearance);
-                    same_paint(&x.fill_paint(), &y.fill_paint(), tint) && same_paint(&x.stroke_paint(), &y.stroke_paint(), tint)
+                    same_paint(&fill_of(a), &fill_of(b), tint) && same_paint(&stroke_of(a).0, &stroke_of(b).0, tint)
                 })
             }
         ),
@@ -514,6 +514,13 @@ fn same_paint(a: &Paint, b: &Paint, tint: bool) -> bool {
     }
 }
 
+/// Select › Same › Stroke Weight: an unpainted stroke weighs nothing, as
+/// [`vectorcraft_doc::Appearance::stroke_width`] has it.
+fn stroke_weight(n: &Node) -> f64 {
+    let (paint, width) = stroke_of(n);
+    if paint.is_none() { 0.0 } else { width }
+}
+
 fn same(s: &mut Session, cmd: &str, eq: impl Fn(&Node, &Node) -> bool) -> Result<Value> {
     let st = s.doc()?;
     let refn = st.selection.objects.first().and_then(|id| st.doc.node(*id)).cloned().ok_or_else(|| bad(cmd, "nothing selected"))?;

crates/engine/src/cmd/textedit.rs

@@ -45,7 +45,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Area / Path Type",
             [],
             None,
-            "{path: id, mode: \"area\"|\"onPath\", text?: \"\", vertical?: bool = false, at?: [x, y] (on-path start: nearest point), size?, font?, style?, color? (as text.create), fit?: none|autoHeight|shrinkText, fitMinPercent? (area: as text.areaOptions; default autoHeight when the autoSizeAreaType preference is on), placeholder?: bool (placeholder text instead, as text.create), leadingModel?, charAlign? (as text.create)} turn a path into an area-type frame or a type-on-a-path baseline (the path's paint is dropped) → {id, overflow?: [id] (the text doesn't fit; left out when it fits)}",
+            "{path: id, mode: \"area\"|\"onPath\", text?: \"\", vertical?: bool = false, at?: [x, y] (on-path start: nearest point), size?, font?, style?, color? (as text.create), fit?: none|autoHeight|shrinkText, fitMinPercent? (area: as text.areaOptions; default autoHeight when the autoSizeAreaType preference is on), placeholder?: bool (placeholder text instead, as text.create), justify?, leadingModel?, charAlign? (as text.create)} turn a path into an area-type frame or a type-on-a-path baseline (the path's paint is dropped) → {id, overflow?: [id] (the text doesn't fit; left out when it fits)}",
             has_doc,
             create_in_path
         ),
@@ -230,7 +230,12 @@ pub(crate) fn features_param(p: &Value, cmd: &str) -> Result<Option<Vec<String>>
     let Some(v) = p.get("features").filter(|v| !v.is_null()) else { return Ok(None) };
     let tags: Vec<&str> = v.as_array().ok_or_else(|| bad(cmd, "features must be a list of tags"))?.iter().filter_map(Value::as_str).collect();
     if let Some(t) = tags.iter().find(|t| !vectorcraft_text::OtFeatures::known_tag(t)) {
-        return Err(bad(cmd, format!("unknown OpenType feature `{t}` (liga, calt, dlig, smcp, frac, onum, tnum, ordn, swsh; prefix - to turn off)")));
+        return Err(bad(
+            cmd,
+            format!(
+                "unknown OpenType feature `{t}` (liga, calt, dlig, smcp, frac, onum, tnum, ordn, swsh, ss01–ss20, salt, titl, pnum, lnum, sups, subs; prefix - to turn off)"
+            ),
+        ));
     }
     Ok(Some(vectorcraft_text::OtFeatures::default().with_tags(tags).to_tags()))
 }

crates/engine/src/cmd/textstyles.rs

@@ -58,7 +58,7 @@ macro_rules! style_cmds {
                 concat!($p, ".new"),
                 concat!("New ", $what, " Style"),
                 &["Window", "Type", $menu],
-                "{name?, attrs?: {…} (default: those of the selected text, or of text `id` at `start`), id?, start?: byte} → {name}",
+                "{name?, attrs?: {…} (default: selected text), id?, start?: byte, end?: byte} → {name}; a nonempty character range samples its first selected character; start alone keeps insertion affinity; paragraph styles sample start",
                 |s, p| new(s, p, $kind),
                 true,
             ),
@@ -74,7 +74,7 @@ macro_rules! style_cmds {
                 concat!($p, ".redefine"),
                 concat!("Redefine ", $what, " Style"),
                 &["Window", "Type", $menu],
-                "{name, id?, start?} from the selected text; users keep their overrides",
+                "{name, id?, start?: byte, end?: byte} from selected text; nonempty character ranges sample their first selected character, start alone keeps insertion affinity, paragraph styles sample start; users keep their overrides",
                 |s, p| redefine(s, p, $kind),
                 true,
             ),
@@ -133,6 +133,14 @@ fn to_attrs<T: Serialize>(v: &T) -> Map<String, Value> {
     m
 }
 
+/// Captured character styles set Auto leading explicitly. A missing style attribute instead
+/// leaves the text's existing leading alone, unlike a run's omitted Auto value.
+fn char_attrs(v: &CharStyle) -> Map<String, Value> {
+    let mut m = to_attrs(v);
+    m.insert("leading".into(), json!(v.leading));
+    m
+}
+
 /// Every attribute name `T` reads, including those its JSON leaves out at their defaults (Auto
 /// leading and kerning, no mojikumi…): the field names serde's derive hands `deserialize_struct`.
 /// Not `justify_auto`, which [`to_map`] turns into `"justify": "Auto"`.
@@ -183,6 +191,10 @@ fn with_attrs<T: Serialize + DeserializeOwned>(base: &T, attrs: &Map<String, Val
 /// round-trip through JSON.
 fn restyle<T: Serialize + DeserializeOwned + Clone>(cur: &T, old: &Map<String, Value>, new: &Map<String, Value>) -> T {
     let Some(mut m) = to_map(cur) else { return cur.clone() };
+    // Runs omit Auto leading from JSON; it still matches a style's explicit null.
+    if old.get("leading") == Some(&Value::Null) {
+        m.entry("leading").or_insert(Value::Null);
+    }
     for (k, v) in new {
         if old.get(k).is_none_or(|o| m.get(k) == Some(o)) {
             m.insert(k.clone(), v.clone());
@@ -254,8 +266,9 @@ fn update_users(d: &mut Document, kind: Kind, name: &str, old: &Map<String, Valu
     }
 }
 
-/// The selected text's attributes: the Type tool range's start (`id`, `start`) or the first
-/// selected text object's first run.
+/// The selected text's attributes: the first selected character for a nonempty range,
+/// the insertion style at a lone `start`, or the first selected text object's first run.
+/// Paragraph capture always samples the paragraph at `start`.
 fn selection_attrs(s: &Session, p: &Value, kind: Kind) -> Result<Option<Map<String, Value>>> {
     let d = &s.doc()?.doc;
     let id = match id_param(p, "id") {
@@ -265,7 +278,13 @@ fn selection_attrs(s: &Session, p: &Value, kind: Kind) -> Result<Option<Map<Stri
     let Some(NodeKind::Text(t)) = id.and_then(|i| d.node(i)).map(|n| &n.kind) else { return Ok(None) };
     let at = p.get("start").and_then(Value::as_u64).map_or(0, |v| usize::try_from(v).unwrap_or(usize::MAX));
     Ok(Some(match kind {
-        Kind::Char => to_attrs(&vectorcraft_text::edit::style_at(&t.runs, at)),
+        Kind::Char => {
+            let style = match p.get("end").and_then(Value::as_u64).map(|v| usize::try_from(v).unwrap_or(usize::MAX)) {
+                Some(end) => vectorcraft_text::edit::insertion_style(&t.runs, at.min(end), at.max(end)),
+                None => vectorcraft_text::edit::style_at(&t.runs, at),
+            };
+            char_attrs(&style)
+        }
         // The paragraph at `start`.
         Kind::Para => to_attrs(t.para_at(t.paragraphs_in(at, at).start)),
     }))
@@ -294,7 +313,7 @@ fn attrs_param(p: &Value, kind: Kind, verb: &str) -> Result<Option<Map<String, V
             // form (so comparing a style with its text's attributes is exact).
             let c = kind.cmd(verb);
             let full = match kind {
-                Kind::Char => to_attrs(&with_attrs(&CharStyle::default(), m, &c)?),
+                Kind::Char => char_attrs(&with_attrs(&CharStyle::default(), m, &c)?),
                 Kind::Para => to_attrs(&with_attrs(&ParaStyle::default(), m, &c)?),
             };
             Ok(Some(m.keys().filter_map(|k| full.get(k).map(|v| (k.clone(), v.clone()))).collect()))
@@ -643,6 +662,72 @@ mod tests {
         assert_eq!(runs(&s, other)[0].style.leading, Some(30.0));
     }
 
+    #[test]
+    fn auto_leading_redefine_keeps_overrides_and_history() {
+        for redefine in [true, false] {
+            let (mut s, source) = session_with_text("Source");
+            let [linked, local] =
+                ["Linked", "Local"].map(|text| s.execute("text.create", &json!({"x": 10, "y": 90, "text": text})).unwrap()["id"].as_u64().unwrap());
+            let ids = [source, linked, local];
+            s.execute("charStyle.new", &json!({"name": "Body", "attrs": {"leading": 30}})).unwrap();
+            s.execute("charStyle.apply", &json!({"name": "Body", "ids": ids})).unwrap();
+            s.execute("text.setStyle", &json!({"ids": [local], "leading": 42})).unwrap();
+            s.execute("text.setStyle", &json!({"ids": [source], "leading": "auto"})).unwrap();
+            let before = s.doc().unwrap().doc.clone();
+            let undo = s.doc().unwrap().history.undo.len();
+            if redefine {
+                s.execute("charStyle.redefine", &json!({"name": "Body", "id": source})).unwrap();
+            } else {
+                s.execute("charStyle.setAttrs", &json!({"name": "Body", "attrs": {"leading": null}})).unwrap();
+            }
+            assert_eq!(ids.map(|id| runs(&s, id)[0].style.leading), [None, None, Some(42.0)]);
+            assert!(ids.iter().all(|&id| runs(&s, id)[0].style.style_name.as_deref() == Some("Body")));
+            let after = s.doc().unwrap().doc.clone();
+            assert_eq!(after.char_styles[0].attrs.get("leading"), Some(&Value::Null), "Auto is explicit, not an unset attribute");
+            assert_eq!(s.doc().unwrap().history.undo.len(), undo + 1);
+            s.execute("edit.undo", &json!({})).unwrap();
+            assert_eq!(s.doc().unwrap().doc, before);
+            s.execute("edit.redo", &json!({})).unwrap();
+            assert_eq!(s.doc().unwrap().doc, after);
+            let back = vectorcraft_format::load(&vectorcraft_format::save(&after, false)).unwrap();
+            assert_eq!(back.char_styles, after.char_styles);
+            for id in ids {
+                let NodeKind::Text(t) = &back.node(NodeId(id)).unwrap().kind else { panic!("not text") };
+                assert_eq!(t.runs, runs(&s, id));
+            }
+            // Auto users follow the next numeric definition; real numeric and Auto overrides stay.
+            s.execute("charStyle.setAttrs", &json!({"name": "Body", "attrs": {"leading": 26}})).unwrap();
+            assert_eq!(ids.map(|id| runs(&s, id)[0].style.leading), [Some(26.0), Some(26.0), Some(42.0)]);
+            s.execute("text.setStyle", &json!({"ids": [linked], "leading": "auto"})).unwrap();
+            s.execute("charStyle.setAttrs", &json!({"name": "Body", "attrs": {"leading": 28}})).unwrap();
+            assert_eq!(ids.map(|id| runs(&s, id)[0].style.leading), [Some(28.0), None, Some(42.0)]);
+            // Omitting leading replaces the definition without resetting the text's leading.
+            s.execute("charStyle.setAttrs", &json!({"name": "Body", "attrs": {"tracking": 20}})).unwrap();
+            assert!(!s.doc().unwrap().doc.char_styles[0].attrs.contains_key("leading"));
+            assert_eq!(ids.map(|id| runs(&s, id)[0].style.leading), [Some(28.0), None, Some(42.0)]);
+        }
+    }
+
+    #[test]
+    fn auto_leading_new_distinguishes_unset_attributes() {
+        let (mut s, id) = session_with_text("Title");
+        s.execute("text.setStyle", &json!({"leading": 30})).unwrap();
+        s.execute("charStyle.new", &json!({"name": "Sparse", "attrs": {"tracking": 20}})).unwrap();
+        assert!(!s.doc().unwrap().doc.char_styles[0].attrs.contains_key("leading"));
+        s.execute("charStyle.apply", &json!({"name": "Sparse", "id": id})).unwrap();
+        assert_eq!(runs(&s, id)[0].style.leading, Some(30.0));
+        s.execute("charStyle.new", &json!({"name": "Automatic", "attrs": {"leading": null}})).unwrap();
+        s.execute("charStyle.apply", &json!({"name": "Automatic", "id": id})).unwrap();
+        assert_eq!(runs(&s, id)[0].style.leading, None);
+        assert_eq!(s.doc().unwrap().doc.char_styles[1].attrs.get("leading"), Some(&Value::Null));
+        // New from Auto text captures that value too, rather than leaving leading unspecified.
+        s.execute("charStyle.new", &json!({"name": "Captured", "id": id})).unwrap();
+        s.execute("text.setStyle", &json!({"ids": [id], "leading": 36})).unwrap();
+        s.execute("charStyle.apply", &json!({"name": "Captured", "id": id})).unwrap();
+        assert_eq!(runs(&s, id)[0].style.leading, None);
+        assert_eq!(s.doc().unwrap().doc.char_styles[2].attrs.get("leading"), Some(&Value::Null));
+    }
+
     #[test]
     fn paragraph_styles_and_survive_save() {
         let (mut s, id) = session_with_text("Body");
@@ -660,4 +745,104 @@ mod tests {
         let back = vectorcraft_format::load(&vectorcraft_format::save(&d, false)).unwrap();
         assert_eq!(back.para_styles, d.para_styles);
     }
+
+    fn capture_boundary_command(redefine: bool, text: &str, start: usize, end: Option<usize>, expected_size: f64) {
+        let (mut s, id) = session_with_text(text);
+        s.execute("text.setStyle", &json!({"id": id, "size": 18})).unwrap();
+        s.execute("text.setRangeStyle", &json!({"id": id, "start": 2, "end": text.len(), "size": 34})).unwrap();
+        if redefine {
+            s.execute("charStyle.new", &json!({"name": "Captured", "attrs": {"size": 24}})).unwrap();
+        }
+        s.doc_mut().unwrap().mark_saved();
+        let before = s.doc().unwrap().doc.clone();
+        let selection = s.doc().unwrap().selection.clone();
+        let undo = s.doc().unwrap().history.undo.len();
+        let mut params = json!({"name": "Captured", "id": id, "start": start});
+        if let Some(end) = end {
+            params["end"] = json!(end);
+        }
+        let command = if redefine { "charStyle.redefine" } else { "charStyle.new" };
+        s.execute(command, &params).unwrap();
+        let st = s.doc().unwrap();
+        let def = st.doc.char_styles.iter().find(|d| d.name == "Captured").unwrap();
+        assert_eq!(def.attrs.get("size").and_then(Value::as_f64), Some(expected_size), "{command} {text:?} {start}..{end:?}");
+        assert!(!def.attrs.contains_key("style_name"));
+        assert_eq!(st.doc.node(NodeId(id)), before.node(NodeId(id)), "capture does not apply the definition");
+        assert_eq!(st.selection, selection);
+        assert_eq!((st.history.undo.len(), st.history.redo.len()), (undo + 1, 0));
+        assert!(st.is_dirty());
+        let after = st.doc.clone();
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(s.doc().unwrap().doc, before);
+        assert_eq!(s.doc().unwrap().selection, selection);
+        assert!(!s.doc().unwrap().is_dirty());
+        s.execute("edit.redo", &json!({})).unwrap();
+        assert_eq!(s.doc().unwrap().doc, after);
+        assert_eq!(s.doc().unwrap().selection, selection);
+    }
+
+    fn capture_boundary_ranges(redefine: bool) {
+        for (text, start, end, size) in [
+            ("ABcdef", 2, 5, 34.0),
+            ("é漢字", 2, 5, 34.0),
+            ("ABcdef", 5, 2, 34.0), // command ranges are ordered before selected-character sampling
+            ("ABcdef", 1, 5, 18.0), // a mixed range samples its first selected character
+            ("ABcdef", 2, 2, 18.0), // collapsed range retains insertion affinity
+            ("ABcdef", 3, 3, 34.0),
+            ("ABcdef", 99, 100, 34.0), // beyond the text retains the final run
+        ] {
+            capture_boundary_command(redefine, text, start, Some(end), size);
+        }
+    }
+
+    #[test]
+    fn char_style_new_range_capture_boundary() {
+        capture_boundary_ranges(false);
+    }
+
+    #[test]
+    fn char_style_redefine_range_capture_boundary() {
+        capture_boundary_ranges(true);
+    }
+
+    #[test]
+    fn char_style_start_only_capture_affinity_controls() {
+        for redefine in [false, true] {
+            for text in ["ABcdef", "é漢字"] {
+                for (start, size) in [(0, 18.0), (2, 18.0), (3, 34.0), (99, 34.0)] {
+                    capture_boundary_command(redefine, text, start, None, size);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn para_style_range_capture_samples_start_paragraph() {
+        for redefine in [false, true] {
+            for (start, end, justify) in [(0, 7, "Left"), (4, 7, "Right"), (4, 0, "Right")] {
+                let (mut s, id) = session_with_text("One\nTwo");
+                s.execute("text.setStyle", &json!({"id": id, "justify": "left"})).unwrap();
+                s.execute("text.setStyle", &json!({"id": id, "start": 4, "end": 7, "justify": "right"})).unwrap();
+                if redefine {
+                    s.execute("paraStyle.new", &json!({"name": "Captured", "attrs": {"justify": "Center"}})).unwrap();
+                }
+                let before = s.doc().unwrap().doc.clone();
+                let selection = s.doc().unwrap().selection.clone();
+                let undo = s.doc().unwrap().history.undo.len();
+                let command = if redefine { "paraStyle.redefine" } else { "paraStyle.new" };
+                s.execute(command, &json!({"name": "Captured", "id": id, "start": start, "end": end})).unwrap();
+                let st = s.doc().unwrap();
+                let def = st.doc.para_styles.iter().find(|d| d.name == "Captured").unwrap();
+                assert_eq!(def.attrs["justify"], json!(justify), "paragraph capture still samples start, not the end or a normalized range");
+                assert_eq!(st.doc.node(NodeId(id)), before.node(NodeId(id)));
+                assert_eq!(st.selection, selection);
+                assert_eq!(st.history.undo.len(), undo + 1);
+                let after = st.doc.clone();
+                s.execute("edit.undo", &json!({})).unwrap();
+                assert_eq!(s.doc().unwrap().doc, before);
+                s.execute("edit.redo", &json!({})).unwrap();
+                assert_eq!(s.doc().unwrap().doc, after);
+            }
+        }
+    }
 }

crates/engine/src/cmd/threads.rs

@@ -62,6 +62,12 @@ fn text_of(d: &Document, id: NodeId) -> Option<&TextObject> {
     }
 }
 
+#[cfg(test)]
+thread_local! {
+    /// Tests: how many threads' stories [`reflow`] copied on this thread.
+    static COPIED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
 /// Re-flow every thread with a frame that changed between `before` and `doc` (structural sharing
 /// makes "changed" a pointer comparison). Deleted frames' text flows into the remaining ones.
 pub(crate) fn reflow(before: &Document, doc: &mut Document) {
@@ -73,6 +79,16 @@ pub(crate) fn reflow(before: &Document, doc: &mut Document) {
             (None, None) => false,
             _ => true,
         });
+        // When no frame changed, the thread keeps its area-type frames and their text is not copied.
+        if !changed {
+            let live: Vec<NodeId> = thread.into_iter().filter(|id| text_of(doc, *id).is_some()).collect();
+            if live.len() >= 2 {
+                kept.push(live);
+            }
+            continue;
+        }
+        #[cfg(test)]
+        COPIED.with(|c| c.set(c.get() + 1));
         // The story: live frames' runs, plus the text of frames deleted by this edit.
         let mut story: Vec<TextRun> = vec![];
         let mut sources: Vec<TextObject> = vec![];
@@ -96,10 +112,7 @@ pub(crate) fn reflow(before: &Document, doc: &mut Document) {
                 (None, None) => {}
             }
         }
-        if !changed || live.is_empty() {
-            if live.len() >= 2 {
-                kept.push(live);
-            }
+        if live.is_empty() {
             continue;
         }
         let source_refs: Vec<&TextObject> = sources.iter().collect();
@@ -293,6 +306,113 @@ mod tests {
         assert_eq!(s.doc().unwrap().doc.text_threads.len(), 1);
     }
 
+    #[test]
+    fn edits_copy_only_the_stories_of_threads_whose_frames_changed() {
+        let (mut s, a, b) = setup();
+        s.execute("text.thread.create", &json!({})).unwrap();
+        let c = s.execute("text.create", &json!({"x": 10, "y": 200, "text": TEXT.repeat(2), "area": {"width": 150, "height": 40}})).unwrap()["id"]
+            .as_u64()
+            .unwrap();
+        let d = s.execute("shape.rectangle", &json!({"x": 200, "y": 220, "width": 150, "height": 60})).unwrap()["id"].as_u64().unwrap();
+        s.execute("select.set", &json!({"ids": [c, d]})).unwrap();
+        s.execute("text.thread.create", &json!({})).unwrap();
+        let texts = |s: &Session| [a, b, c, d].map(|id| text(s, id));
+        let copied = || COPIED.with(std::cell::Cell::get);
+        let (shown, start) = (texts(&s), copied());
+        // A rectangle drawn, moved and dragged beside the threads changes none of their frames.
+        let r = s.execute("shape.rectangle", &json!({"x": 400, "y": 250, "width": 20, "height": 20})).unwrap()["id"].as_u64().unwrap();
+        s.execute("select.set", &json!({"ids": [r]})).unwrap();
+        s.execute("object.move", &json!({"dx": 5, "dy": 0})).unwrap();
+        s.begin_interaction("Move").unwrap();
+        for dx in 1..=3 {
+            s.preview("object.move", &json!({"dx": dx, "dy": 0})).unwrap();
+        }
+        s.commit_interaction().unwrap();
+        assert_eq!(copied(), start, "edits beside the threads copied their stories");
+        assert_eq!(texts(&s), shown);
+        // Typing in the first thread copies and re-flows that thread's story only.
+        s.execute("text.editRange", &json!({"id": a, "start": 0, "end": 0, "insert": "NEW "})).unwrap();
+        assert_eq!(copied(), start + 1);
+        assert_eq!(format!("{}{}", text(&s, a), text(&s, b)), format!("NEW {}", TEXT.repeat(4)));
+        assert_eq!(texts(&s)[2..], shown[2..]);
+        let ids = |t: [u64; 2]| t.map(NodeId).to_vec();
+        assert_eq!(s.doc().unwrap().doc.text_threads, [ids([a, b]), ids([c, d])]);
+    }
+
+    /// Time edits of a story of 50,000 characters threaded through 8 frames, each frame wrapping
+    /// around an ellipse, with one style, a style change every 10 words and a style change at every
+    /// word: 21 characters typed into the first frame, then 200 moves of a rectangle below the
+    /// frames and 200 frames of a drag of it.
+    /// Run with `cargo test --release -p vectorcraft-engine --lib threaded_story_edit_timing -- --ignored --nocapture`.
+    #[test]
+    #[ignore = "manual timing probe; wall-clock performance depends on machine load"]
+    fn threaded_story_edit_timing() {
+        fn median(s: &mut Session, n: u32, f: &dyn Fn(&mut Session, f64)) -> f64 {
+            let mut ms: Vec<f64> = (1..=n)
+                .map(|i| {
+                    let start = std::time::Instant::now();
+                    f(s, f64::from(i));
+                    start.elapsed().as_secs_f64() * 1000.0
+                })
+                .collect();
+            ms.sort_by(f64::total_cmp);
+            ms[ms.len() / 2]
+        }
+        let story = format!("{}\n", TEXT.repeat(6).trim_end()).repeat(81)[..50_000].to_string();
+        for words in [0, 10, 1] {
+            let mut s = Session::new();
+            s.execute("file.new", &json!({"width": 4400, "height": 1200})).unwrap();
+            let area = json!({"width": 500, "height": 900});
+            let first = s.execute("text.create", &json!({"x": 20, "y": 20, "text": story, "size": 9, "area": area})).unwrap()["id"].as_u64().unwrap();
+            if words > 0 {
+                s.edit("Restyle", |d, _| {
+                    let Some(NodeKind::Text(t)) = d.node_mut(NodeId(first)).map(|n| &mut n.kind) else { panic!("not text") };
+                    let style = t.runs[0].style.clone();
+                    let pieces: Vec<&str> = story.split_inclusive([' ', '\n']).collect();
+                    t.runs = pieces
+                        .chunks(words)
+                        .enumerate()
+                        .map(|(i, c)| {
+                            let mut run = TextRun::new(c.concat(), style.clone());
+                            run.style.underline = i % 2 == 1;
+                            run
+                        })
+                        .collect();
+                    refresh_bounds(t);
+                    Ok(())
+                })
+                .unwrap();
+            }
+            let mut ids = vec![first];
+            for k in 1..8 {
+                let frame = json!({"x": 20 + k * 540, "y": 20, "width": 500, "height": 900});
+                ids.push(s.execute("shape.rectangle", &frame).unwrap()["id"].as_u64().unwrap());
+            }
+            s.execute("select.set", &json!({"ids": ids})).unwrap();
+            s.execute("text.thread.create", &json!({})).unwrap();
+            for k in 0..8 {
+                let e = s.execute("shape.ellipse", &json!({"x": 195 + k * 540, "y": 395, "width": 150, "height": 150})).unwrap()["id"].clone();
+                s.execute("object.textWrap.make", &json!({"ids": [e]})).unwrap();
+            }
+            let r = s.execute("shape.rectangle", &json!({"x": 20, "y": 1100, "width": 30, "height": 30})).unwrap()["id"].clone();
+            s.execute("select.set", &json!({"ids": [r]})).unwrap();
+            let typing = median(&mut s, 21, &|s, _| {
+                s.execute("text.editRange", &json!({"id": first, "start": 0, "end": 0, "insert": "x"})).unwrap();
+            });
+            let edit = median(&mut s, 200, &|s, _| {
+                s.execute("object.move", &json!({"dx": 0.5, "dy": 0})).unwrap();
+            });
+            s.begin_interaction("Move").unwrap();
+            let frame = median(&mut s, 200, &|s, i| {
+                s.preview("object.move", &json!({"dx": i * 0.25, "dy": 0})).unwrap();
+            });
+            s.commit_interaction().unwrap();
+            let d = &s.doc().unwrap().doc;
+            let runs: usize = ids.iter().filter_map(|id| text_of(d, NodeId(*id))).map(|t| t.runs.len()).sum();
+            println!("{runs} runs in 8 frames: typing {typing:.1} ms, a move below them {edit:.3} ms, a drag frame {frame:.3} ms (medians)");
+        }
+    }
+
     #[test]
     fn release_and_remove() {
         let (mut s, a, b) = setup();

crates/engine/src/cmd/typecmd.rs

@@ -392,7 +392,7 @@ fn set_text(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(with_overflow(s, &ids, json!({ "ids": ids.iter().map(|i| i.0).collect::<Vec<_>>() })))
 }
 
-fn justify_param(v: &str) -> Option<Justify> {
+pub(crate) fn justify_param(v: &str) -> Option<Justify> {
     Some(match v.to_ascii_lowercase().as_str() {
         "auto" => Justify::Auto,
         "left" => Justify::Left,
@@ -716,6 +716,51 @@ fn reshape_area(s: &mut Session, p: &Value) -> Result<Value> {
 mod area_tests {
     use super::*;
 
+    /// #1748: `text.create` takes `justify`; point type then lines up on its point (centred on
+    /// it, or ending there), and `text.setStyle` moves it the same way afterwards.
+    #[test]
+    fn text_create_justify_anchors_point_type_on_its_point() {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 600, "height": 400})).unwrap();
+        let bounds = |s: &Session, id: &Value| {
+            let id = NodeId(id.as_u64().unwrap());
+            let st = s.doc().unwrap();
+            st.doc.bounds_of(&[id], false).unwrap()
+        };
+        let make = |s: &mut Session, extra: Value| {
+            let mut p = json!({"x": 300, "y": 100, "text": "Centred title", "size": 24});
+            for (k, v) in extra.as_object().unwrap() {
+                p[k] = v.clone();
+            }
+            s.execute("text.create", &p).unwrap()["id"].clone()
+        };
+        let id = make(&mut s, json!({}));
+        let left = bounds(&s, &id);
+        assert!(left.width() > 10.0, "{left:?}");
+        assert!((left.x0 - 300.0).abs() < 1.0, "left (the default) starts at x: {left:?}");
+        let id = make(&mut s, json!({"justify": "center"}));
+        let centre = bounds(&s, &id);
+        assert!((centre.center().x - 300.0).abs() < 0.5, "centred on x: {centre:?}");
+        assert!((centre.width() - left.width()).abs() < 0.5);
+        let right = make(&mut s, json!({"justify": "right"}));
+        let r = bounds(&s, &right);
+        assert!((r.x1 - 300.0).abs() < 1.0, "ends at x: {r:?}");
+        let got = |s: &Session, id: &Value| match &s.doc().unwrap().doc.node(NodeId(id.as_u64().unwrap())).unwrap().kind {
+            NodeKind::Text(t) => t.para.justify,
+            _ => panic!("not text"),
+        };
+        assert_eq!(got(&s, &right), Justify::Right);
+        // Changed afterwards, it moves to the same place as made centred.
+        s.execute("text.setStyle", &json!({"id": right, "justify": "center"})).unwrap();
+        let moved = bounds(&s, &right);
+        assert!((moved.center().x - 300.0).abs() < 0.5, "{moved:?}");
+        assert!(s.execute("text.create", &json!({"x": 0, "y": 0, "text": "a", "justify": "middle"})).is_err());
+        // Type in or on a path takes it too.
+        let path = s.execute("path.create", &json!({"d": "M50 300 L550 300"})).unwrap()["id"].clone();
+        let on = s.execute("text.createInPath", &json!({"path": path, "mode": "onPath", "text": "On a path", "justify": "center"})).unwrap();
+        assert_eq!(got(&s, &on["id"]), Justify::Center);
+    }
+
     #[test]
     fn kinsoku_set_is_set_per_paragraph_and_saved_only_when_not_hard() {
         use vectorcraft_doc::Kinsoku;

crates/engine/src/cmd/wand.rs

@@ -86,14 +86,16 @@ fn set(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!(s.menu.wand))
 }
 
-fn fill_of(n: &Node) -> Paint {
+/// The fill an object shows: type's comes from its characters (the first run speaks for all).
+pub(crate) fn fill_of(n: &Node) -> Paint {
     match &n.kind {
         NodeKind::Text(t) => t.runs.first().map(|r| r.style.fill.clone()).unwrap_or_default(),
         _ => n.appearance.fill_paint(),
     }
 }
 
-fn stroke_of(n: &Node) -> (Paint, f64) {
+/// The stroke paint and weight an object shows, type's from its first run as [`fill_of`].
+pub(crate) fn stroke_of(n: &Node) -> (Paint, f64) {
     match &n.kind {
         NodeKind::Text(t) => t.runs.first().map(|r| (r.style.stroke.clone(), r.style.stroke_width)).unwrap_or_default(),
         _ => (n.appearance.stroke_paint(), n.appearance.stroke_width()),

crates/engine/src/inspect.rs

@@ -2,7 +2,7 @@
 
 use serde_json::{Value, json};
 use vectorcraft_color::BlendMode;
-use vectorcraft_doc::{ArrowAlign, Document, LineCap, LineJoin, Node, NodeKind, StrokeAlign, StrokeLayer, WidthProfile};
+use vectorcraft_doc::{ArrowAlign, Document, LineCap, LineJoin, Node, NodeKind, StrokeAlign, StrokeLayer, SymbolBoxes, WidthProfile};
 
 use crate::Session;
 
@@ -26,20 +26,21 @@ pub struct SummaryOpts {
     pub compound_member: bool,
 }
 
-/// Compact tree summary of a node (for `document.inspect`): the whole subtree.
-pub fn node_summary(n: &Node) -> Value {
-    node_summary_opts(n, SummaryOpts::default())
+/// Compact tree summary of a node (for `document.inspect`): the whole subtree, symbol instances
+/// measured by their art from `symbols`.
+pub fn node_summary(n: &Node, symbols: &SymbolBoxes) -> Value {
+    node_summary_opts(n, SummaryOpts::default(), symbols)
 }
 
 /// The same summary with [`SummaryOpts`] applied.
-pub fn node_summary_opts(n: &Node, opts: SummaryOpts) -> Value {
+pub fn node_summary_opts(n: &Node, opts: SummaryOpts, symbols: &SymbolBoxes) -> Value {
     let mut v = json!({
         "id": n.id.0,
         "name": n.display_name(),
         "kind": n.kind_label(),
         "visible": n.visible,
         "locked": n.locked,
-        "bounds": rect_json(n.geometric_bounds()),
+        "bounds": rect_json(n.geometric_bounds_with(symbols)),
     });
     if n.opacity < 1.0 {
         v["opacity"] = json!(n.opacity);
@@ -114,7 +115,7 @@ pub fn node_summary_opts(n: &Node, opts: SummaryOpts) -> Value {
                 child_limit: opts.child_limit,
                 compound_member: matches!(n.kind, NodeKind::Compound { .. }),
             };
-            v["children"] = Value::Array(ch.iter().rev().take(take_n).map(|c| node_summary_opts(c, next)).collect());
+            v["children"] = Value::Array(ch.iter().rev().take(take_n).map(|c| node_summary_opts(c, next, symbols)).collect());
         }
         if take_n < total || v.get("children").is_none() {
             v["childCount"] = json!(total);
@@ -132,6 +133,7 @@ pub fn document(s: &Session) -> Value {
 pub fn document_opts(s: &Session, opts: SummaryOpts) -> Value {
     let Some(st) = s.active() else { return Value::Null };
     let d = &st.doc;
+    let symbols = d.symbol_boxes();
     json!({
         "title": st.title(),
         "path": st.path,
@@ -141,7 +143,7 @@ pub fn document_opts(s: &Session, opts: SummaryOpts) -> Value {
         "colorMode": format!("{:?}", d.color_mode),
         "artboards": d.artboards.iter().map(|a| json!({"name": a.name, "x": a.rect.x0, "y": a.rect.y0, "width": a.rect.width(), "height": a.rect.height()})).collect::<Vec<_>>(),
         // Top of the stack first, like the Layers panel.
-        "layers": d.layers.iter().rev().map(|l| node_summary_opts(l, opts)).collect::<Vec<_>>(),
+        "layers": d.layers.iter().rev().map(|l| node_summary_opts(l, opts, &symbols)).collect::<Vec<_>>(),
         "currentLayer": st.active_layer.map(|l| l.0),
         // The rows highlighted in the Layers panel (`layer.setCurrent`, `layer.highlight`).
         "layerRows": st.highlighted_rows().iter().map(|i| i.0).collect::<Vec<_>>(),

crates/engine/src/lib.rs

@@ -583,6 +583,10 @@ pub(crate) fn is_guide_path(d: &Document, id: NodeId) -> bool {
     d.node(id).is_some_and(|n| matches!(n.kind, NodeKind::Path { guide: true, .. }))
 }
 
+/// The error of an edit that would nest objects deeper than [`vectorcraft_doc::MAX_DEPTH`].
+pub const TOO_DEEP: &str = "objects can't be nested more than 32 deep";
+const _: () = assert!(vectorcraft_doc::MAX_DEPTH == 32, "TOO_DEEP (and its catalog rows) names the cap");
+
 /// Cheap sanity check after an edit: artboards and the objects just touched (the selection) must
 /// have finite, in-range geometry, so saved files always reload and renderers never see NaN/∞.
 fn doc_sane(d: &Document, sel: &Selection) -> bool {
@@ -830,6 +834,8 @@ pub struct Prefs {
     /// the Properties panel and the Control bar (their size fields pass `proportional` to
     /// `object.setBounds`).
     pub constrain_proportions: bool,
+    /// One Corner Radius field sets every corner of a live rectangle (off: a field per corner).
+    pub single_corner_radius: bool,
     /// The tools' persistent options by store (a tool id, or a store a family shares: `liquify`
     /// holds the Liquify tools' Global Brush Dimensions), see [`vectorcraft_tools::settings`]:
     /// kept across tool switches and saved with the preferences. Not a Preferences dialog field:
@@ -990,6 +996,7 @@ impl Default for Prefs {
             web_export_settings: None,
             print_presets: vec![],
             constrain_proportions: false,
+            single_corner_radius: true,
             tool_settings: Default::default(),
             perspective_presets: vec![],
             blend_options: None,
@@ -1223,7 +1230,7 @@ impl Session {
     }
     /// Text layout bounds are a cache (not saved): compute them for a document just read, or
     /// selection boxes and hit testing would use the rough estimate until each text is edited.
-    fn refresh_text_bounds(doc: &mut Document) {
+    pub(crate) fn refresh_text_bounds(doc: &mut Document) {
         // Inline graphics in text take their size from their symbols' art (not saved either).
         doc.resolve_inline_art();
         let mut texts = vec![];
@@ -1242,6 +1249,9 @@ impl Session {
     }
     /// Add a document and make it active.
     pub fn add_document(&mut self, mut doc: Document, path: Option<String>) -> usize {
+        // Every edit is checked against the document before it, so the first one is within the cap
+        // (importers and the native reader have seen to theirs already, with a warning).
+        doc.limit_depth();
         Self::refresh_text_bounds(&mut doc);
         // Guides from files saved before guides had layers go on a layer.
         doc.adopt_guides();
@@ -1259,6 +1269,7 @@ impl Session {
         if index >= self.docs.len() {
             return false;
         }
+        doc.limit_depth();
         Self::refresh_text_bounds(&mut doc);
         doc.adopt_guides();
         if self.active == Some(index) {
@@ -1300,16 +1311,35 @@ impl Session {
         true
     }
 
+    /// `spec`'s `enabled` with `ids` selected instead of the selection, which is then put back.
+    fn enabled_with_selection(&mut self, spec: &CommandSpec, ids: Vec<NodeId>) -> std::result::Result<(), String> {
+        let Some(d) = self.active_mut() else { return (spec.enabled)(self) };
+        let old = std::mem::replace(&mut d.selection, Selection { objects: ids, ..Selection::default() });
+        let r = (spec.enabled)(self);
+        if let Some(d) = self.active_mut() {
+            d.selection = old;
+        }
+        r
+    }
+
     /// Execute a command by id. This is THE entry point for every frontend.
     pub fn execute(&mut self, id: &str, params: &Value) -> Result<Value> {
         let spec = find_command(id).ok_or_else(|| EngineError::UnknownCommand(id.to_string()))?;
         // The crate's own tests are the audit of the params descriptions (#1442): a key a test
         // passes that its command's description doesn't name fails the test.
         #[cfg(test)]
-        cmd::params::check_params(id, params)?;
+        self.check_params(id, params)?;
         // Clear's menu needs a selection; an agent supplying explicit targets only needs a
         // document. The command validates those targets before making any edit.
-        let enabled = if id == "edit.clear" && params.get("ids").is_some() { cmd::has_doc(self) } else { (spec.enabled)(self) };
+        let enabled = if id == "edit.clear" && params.get("ids").is_some() {
+            cmd::has_doc(self)
+        } else if let Some(ids) = given_ids(spec.params, params) {
+            // Objects given as `ids` stand in for the selection: the command is enabled as it is
+            // with them selected (#1575).
+            self.enabled_with_selection(spec, ids)
+        } else {
+            (spec.enabled)(self)
+        };
         if let Err(why) = enabled {
             return Err(EngineError::Disabled(id.to_string(), why));
         }
@@ -1454,7 +1484,10 @@ impl Session {
                     if !st.doc.variables.bindings.is_empty() {
                         Arc::make_mut(&mut st.doc).prune_variable_bindings();
                     }
-                    if doc_sane(&st.doc, &st.selection) {
+                    if st.doc.too_deep(Some(&before)) {
+                        // Deeper trees overflow the stack of what walks them.
+                        Err(EngineError::Other(TOO_DEEP.into()))
+                    } else if doc_sane(&st.doc, &st.selection) {
                         Ok(v)
                     } else {
                         Err(EngineError::Other("result would exceed the canvas (coordinates out of range)".into()))
@@ -1554,13 +1587,17 @@ impl Session {
                 st.selection.clone_from(&it.selection);
             }
         }
+        // The previous preview's paint is undone with it.
+        self.pending_paint = None;
         let rw = cmd::distortcmds::perspective_rewrite(self, cmd, params);
         let (cmd, params) = rw.as_ref().map_or((cmd, params), |(c, p)| (c.as_str(), p));
         let r = self.execute(cmd, params);
         let params = self.noted(params);
         let st = self.doc_mut()?;
         if let Some(it) = &mut st.interaction {
-            it.preview = Some((cmd.to_string(), params));
+            // A failed preview leaves the document at the snapshot, so nothing is left to commit
+            // (not even an earlier successful preview, which the reset above already undid).
+            it.preview = r.is_ok().then(|| (cmd.to_string(), params));
         }
         r
     }
@@ -1770,6 +1807,8 @@ mod tests_halftone;
 #[cfg(test)]
 mod tests_history_mem;
 #[cfg(test)]
+mod tests_ids_without_selection;
+#[cfg(test)]
 mod tests_inline;
 #[cfg(test)]
 mod tests_journal;
@@ -1896,6 +1935,8 @@ mod tests_saveoptions;
 #[cfg(test)]
 mod tests_scalestrokes;
 #[cfg(test)]
+mod tests_scripts;
+#[cfg(test)]
 mod tests_shaper;
 #[cfg(test)]
 mod tests_slices;
@@ -1922,6 +1963,8 @@ mod tests_swatches;
 #[cfg(test)]
 mod tests_swatchlib;
 #[cfg(test)]
+mod tests_symbolbounds;
+#[cfg(test)]
 mod tests_targeting;
 #[cfg(test)]
 mod tests_textcombos;
@@ -1955,3 +1998,10 @@ mod tests_widthprofiles;
 mod tests_widthtool;
 #[cfg(test)]
 mod tests_xform;
+
+/// The non-empty `ids` given to a command whose params description names `ids` as a key (the
+/// key callers outside the app may pass it, [`cmd::params::takes_key`]).
+fn given_ids(description: &'static str, params: &Value) -> Option<Vec<NodeId>> {
+    let ids = cmd::ids_param(params, "ids").filter(|ids| !ids.is_empty())?;
+    cmd::params::takes_key(description, "ids").then_some(ids)
+}

crates/engine/src/link_watch.rs

@@ -97,6 +97,11 @@ impl Session {
         if self.active().map(|d| d.uid) != Some(uid) {
             return Ok(none());
         }
+        // A drag is in progress: its next preview or cancel would throw an update away while the new
+        // stamp stayed recorded. Leave the stamps alone; the first look after the drag sees the change.
+        if self.in_interaction() {
+            return Ok(none());
+        }
         // This document's last stamps; those of closed documents are dropped.
         let open: HashSet<u64> = self.documents().iter().map(|d| d.uid).collect();
         let mut before: HashMap<String, Stamp> = HashMap::new();

crates/engine/src/tests.rs

@@ -2304,6 +2304,39 @@ fn align_moves_selected_anchor_points() {
     assert_eq!(anchors(&s)[2].1 - anchors(&s)[0].1, 120.0, "its shape kept");
 }
 
+/// #1636: with anchor points selected, the Distribute commands space those points, on one path
+/// or across paths, and leave the other points and the paths' objects where they are.
+#[test]
+fn distribute_spaces_selected_anchor_points() {
+    let mut s = session();
+    let new = |s: &mut Session, d: &str| NodeId(s.execute("path.create", &json!({"d": d})).unwrap()["id"].as_u64().unwrap());
+    let a = new(&mut s, "M10 10 L20 50 L100 30 L60 90");
+    let pts = |s: &Session, id: NodeId| -> Vec<(f64, f64)> {
+        s.doc().unwrap().doc.node(id).unwrap().path_data().unwrap().anchors().map(|(_, _, a)| (a.p.x, a.p.y)).collect()
+    };
+    // One path selected whole is one object: nothing to distribute.
+    assert!(s.execute("object.distribute", &json!({"horizontal": "center"})).is_err());
+    s.execute("select.anchors", &json!({"id": a.0, "anchors": [[0, 0], [0, 1], [0, 2]], "mode": "set"})).unwrap();
+    for h in ["left", "center", "right"] {
+        s.execute("object.distribute", &json!({"horizontal": h})).unwrap();
+        assert_eq!(pts(&s, a), [(10.0, 10.0), (55.0, 50.0), (100.0, 30.0), (60.0, 90.0)], "{h}: a point has no width");
+    }
+    let steps = history(&s);
+    s.execute("object.distribute", &json!({"horizontal": "left"})).unwrap();
+    assert_eq!(history(&s), steps, "already distributed: no undo step");
+    s.execute("object.distribute", &json!({"vertical": "top"})).unwrap();
+    assert_eq!(pts(&s, a), [(10.0, 10.0), (55.0, 50.0), (100.0, 30.0), (60.0, 90.0)], "10, 30, 50 are even already");
+    s.execute("object.distributeSpacing", &json!({"axis": "vertical", "spacing": 5})).unwrap();
+    assert_eq!(pts(&s, a), [(10.0, 10.0), (55.0, 20.0), (100.0, 15.0), (60.0, 90.0)], "5 apart from the first, in order");
+    assert!(s.execute("object.distribute", &json!({})).is_err());
+    // Across paths: the points of both, with the second path's unselected point left alone.
+    let b = new(&mut s, "M40 200 L400 300");
+    s.execute("select.anchors", &json!({"id": a.0, "anchors": [[0, 0], [0, 2]], "mode": "set"})).unwrap();
+    s.execute("select.anchors", &json!({"id": b.0, "anchors": [[0, 0]], "mode": "add"})).unwrap();
+    s.execute("object.distributeSpacing", &json!({"axis": "horizontal"})).unwrap();
+    assert_eq!((pts(&s, a)[0].0, pts(&s, b), pts(&s, a)[2].0), (10.0, vec![(55.0, 200.0), (400.0, 300.0)], 100.0));
+}
+
 /// Repeating anchor Align must leave one Undo for the move that actually changed the path.
 #[test]
 fn repeating_anchor_alignment_does_not_consume_undo() {

crates/engine/src/tests_build.rs

@@ -737,6 +737,18 @@ fn image_trace_auto_grouping_groups_what_is_inside() {
         (0..120).flat_map(|x| (0..80).map(move |y| (x, y))).map(|(x, y)| img.pixel(x, y)).collect::<Vec<_>>()
     };
     assert_eq!(shot(&s), shot(&flat));
+    // In black and white too, where the white inside the ring is a path traced before the ring:
+    // it stays under the ring in their group (over it, the ring's inner edge would show a seam).
+    let bw = |grouping: bool| {
+        let mut s = session();
+        add_image(&mut s, &art, Affine::IDENTITY);
+        let r = s.execute("imageTrace.make", &json!({"params": {"autoGrouping": grouping}})).unwrap();
+        let groups = traced_paths(&node(&s, NodeId(r["id"].as_u64().unwrap()))).iter().filter(|n| matches!(n.kind, NodeKind::Group { .. })).count();
+        (s, groups)
+    };
+    let (grouped, flat) = (bw(true), bw(false));
+    assert!(grouped.1 > 0 && flat.1 == 0);
+    assert_eq!(shot(&grouped.0), shot(&flat.0));
     // Traced again without the option, it is flat again; expanded, the groups stay.
     let r = s.execute("imageTrace.make", &json!({"preset": "6 Colors", "params": {"ignoreWhite": true}})).unwrap();
     assert_eq!(traced_paths(&node(&s, NodeId(r["id"].as_u64().unwrap()))).len(), 3);
@@ -746,6 +758,56 @@ fn image_trace_auto_grouping_groups_what_is_inside() {
     assert_eq!(expanded.children().unwrap().len(), 2);
 }
 
+/// Gradients: an image that is one linear gradient is one path filled with it, the gradient's line
+/// where the image lies; without the option it is bands of flat colour, as saved documents have it.
+#[test]
+fn image_trace_gradients_fills_with_a_gradient() {
+    let art = vectorcraft_trace::Raster::from_fn(100, 60, |x, _| {
+        let t = (f64::from(x) + 0.5) / 100.0;
+        [(20.0 + 200.0 * t) as u8, 40, (220.0 - 180.0 * t) as u8, 255]
+    });
+    let make = |gradients: bool| {
+        let mut s = session();
+        add_image(&mut s, &art, Affine::translate((50.0, 50.0)) * Affine::scale(2.0));
+        let r = s.execute("imageTrace.make", &json!({"preset": "6 Colors", "params": {"gradients": gradients}})).unwrap();
+        traced_paths(&node(&s, NodeId(r["id"].as_u64().unwrap())))
+    };
+    let paths = make(true);
+    assert_eq!(paths.len(), 1);
+    let Paint::Gradient(g) = paths[0].appearance.fill_paint() else { panic!("{:?}", paths[0].appearance.fill_paint()) };
+    assert_eq!(g.gradient.kind, vectorcraft_color::GradientKind::Linear);
+    assert_eq!(g.gradient.stops.len(), 2);
+    // Level, from the image's left edge (x = 50) to its right one (x = 250), at any height.
+    let geom = g.geom.as_ref().unwrap();
+    let (a, b) = if geom.start.x < geom.end.x { (geom.start, geom.end) } else { (geom.end, geom.start) };
+    assert!((a.x - 50.0).abs() < 3.0 && (b.x - 250.0).abs() < 3.0 && (a.y - b.y).abs() < 2.0, "{geom:?}");
+    let flat = make(false);
+    assert!(flat.len() > 1 && flat.iter().all(|n| matches!(n.appearance.fill_paint(), Paint::Solid { .. })));
+}
+
+/// A preset's enhanced version: the preset with Auto Grouping and Shapes, under the preset's name.
+#[test]
+fn image_trace_enhanced_presets() {
+    let mut s = session();
+    image_doc(&mut s);
+    let r = s.execute("imageTrace.make", &json!({"preset": "6 Colors", "enhanced": true})).unwrap();
+    let n = node(&s, NodeId(r["id"].as_u64().unwrap()));
+    let stored = n.extras().trace.clone().unwrap();
+    assert_eq!(stored["preset"], "6 Colors");
+    assert_eq!((stored["params"]["shapes"].as_bool(), stored["params"]["autoGrouping"].as_bool()), (Some(true), Some(true)));
+    // The disc of the test image is a live ellipse, in a group with nothing (it has nothing inside).
+    let shapes: Vec<_> = traced_paths(&n).into_iter().filter(|c| matches!(&c.kind, NodeKind::Path { live: Some(_), .. })).collect();
+    assert_eq!(shapes.len(), 1);
+    // Listed with each preset; the legacy preset is as it was.
+    let list = s.execute("imageTrace.presets", &json!({})).unwrap();
+    let six = list["presets"].as_array().unwrap().iter().find(|p| p["name"] == "6 Colors").unwrap().clone();
+    assert_eq!((six["params"]["shapes"].as_bool(), six["enhanced"]["shapes"].as_bool()), (Some(false), Some(true)));
+    assert_eq!(list["presets"].as_array().unwrap().iter().find(|p| p["name"] == "High Fidelity Photo").unwrap()["enhanced"]["shapes"], false);
+    assert!(s.execute("imageTrace.make", &json!({"preset": "No Such", "enhanced": true})).is_err());
+    // Flat Logo, a preset of our own, has no enhanced version.
+    assert!(list["presets"].as_array().unwrap().iter().find(|p| p["name"] == "Flat Logo").unwrap()["enhanced"].is_null());
+}
+
 #[test]
 fn image_trace_release_and_expand() {
     let mut s = session();
@@ -847,7 +909,8 @@ fn image_trace_create_strokes_makes_stroked_centre_lines() {
     assert!(line.appearance.fill_paint().color().is_none(), "not filled");
     let st = line.appearance.items.iter().find_map(|i| if let AppearanceItem::Stroke(st) = i { Some(st) } else { None }).expect("stroked");
     assert!((st.width - 6.0).abs() < 1.0, "3 px at 2× is about 6 pt: {}", st.width);
-    assert_eq!((st.cap, st.join), (LineCap::Round, LineJoin::Round));
+    // (The line is cut square at its ends, and so is its stroke.)
+    assert_eq!((st.cap, st.join), (LineCap::Square, LineJoin::Round));
     assert_eq!(st.paint, Paint::solid(Color::rgb8(0, 0, 0)));
     let sp = &line.path_data().unwrap().subpaths[0];
     assert!(!sp.closed);

crates/engine/src/tests_draw2.rs

@@ -1235,3 +1235,21 @@ fn pen_with_alt_converts_the_anchors_of_a_path_in_a_selected_group() {
         assert_eq!(paths(&s).len(), 1, "{wrap}: no new path");
     }
 }
+
+/// #1679: a filled pencil path keeps a stroke of None; an unfilled one with no stroke gets black,
+/// or it would show nothing.
+#[test]
+fn a_filled_pencil_path_keeps_no_stroke() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+    s.execute("select.none", &json!({})).unwrap();
+    s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+    s.execute("paint.setStroke", &json!({"none": true})).unwrap();
+    let pts = json!([[10, 10], [60, 20], [90, 80], [20, 90]]);
+    let id = NodeId(s.execute("path.freehand", &json!({"points": pts, "fill": true})).unwrap()["id"].as_u64().unwrap());
+    let n = s.doc().unwrap().doc.node(id).unwrap().clone();
+    assert!(n.appearance.stroke_paint().is_none(), "{:?}", n.appearance);
+    assert!(!n.appearance.fill_paint().is_none());
+    let id = NodeId(s.execute("path.freehand", &json!({"points": pts})).unwrap()["id"].as_u64().unwrap());
+    assert!(!s.doc().unwrap().doc.node(id).unwrap().appearance.stroke_paint().is_none());
+}

crates/engine/src/tests_ids_without_selection.rs

@@ -0,0 +1,83 @@
+//! #1575: commands that take `ids` work on the objects given, with nothing selected; the
+//! selection is left as it was.
+
+use serde_json::json;
+
+use super::*;
+
+fn doc_with_rect() -> (Session, u64) {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+    let id = s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 50, "height": 40})).unwrap()["id"].as_u64().unwrap();
+    s.execute("select.none", &json!({})).unwrap();
+    (s, id)
+}
+
+#[test]
+fn ids_stand_in_for_the_selection() {
+    for (cmd, params) in [
+        ("object.repeat.radial", json!({})),
+        ("edit.colors.invert", json!({})),
+        ("object.pattern.make", json!({"name": "P"})),
+        ("symbol.new", json!({"name": "S"})),
+        ("object.mesh.create", json!({})),
+        ("object.makePixelPerfect", json!({})),
+    ] {
+        let (mut s, id) = doc_with_rect();
+        let mut p = params;
+        p["ids"] = json!([id]);
+        let r = s.execute(cmd, &p);
+        assert!(r.is_ok(), "{cmd}: {r:?}");
+    }
+}
+
+#[test]
+fn the_selection_is_put_back_and_the_check_still_applies() {
+    let (mut s, id) = doc_with_rect();
+    // Disabled even with the object given: Make with Top Object needs two.
+    let r = s.execute("object.envelope.makeWithTopObject", &json!({"ids": [id]}));
+    assert!(matches!(r, Err(EngineError::Disabled(..))), "{r:?}");
+    assert!(s.doc().unwrap().selection.objects.is_empty(), "the stand-in selection is put back");
+    // Without ids, nothing selected is still nothing selected.
+    let r = s.execute("object.repeat.radial", &json!({}));
+    assert!(matches!(r, Err(EngineError::Disabled(..))), "{r:?}");
+}
+
+#[test]
+fn only_an_ids_key_counts() {
+    let p = json!({"ids": [3]});
+    assert_eq!(given_ids("{ids?: [id]}", &p), Some(vec![NodeId(3)]));
+    assert_eq!(given_ids("{id?|ids?, name}", &p), Some(vec![NodeId(3)]));
+    assert_eq!(given_ids("{grids: n, guides: bool}", &p), None);
+    // A word in what the description says about another key isn't the key.
+    assert_eq!(given_ids("{name: of the swatch the ids of the selection take}", &p), None);
+    assert_eq!(given_ids("{ids?: [id]}", &json!({"ids": []})), None);
+}
+
+/// Every command that names `ids` and is refused with nothing selected: given the object as `ids`
+/// it does what it does with the object selected (the same result or the same error, and the same
+/// document), so no command is let through to run on an empty selection.
+#[test]
+fn ids_do_what_the_selection_does_in_every_command_that_takes_them() {
+    let mut checked = vec![];
+    for spec in command_specs() {
+        let (mut given, id) = doc_with_rect();
+        if !cmd::params::takes_key(spec.params, "ids") || (spec.enabled)(&given).is_ok() {
+            continue;
+        }
+        let (mut selected, _) = doc_with_rect();
+        selected.execute("select.set", &json!({"ids": [id]})).unwrap();
+        let (a, b) = (given.execute(spec.id, &json!({"ids": [id]})), selected.execute(spec.id, &json!({})));
+        match (&a, &b) {
+            (Ok(_), Ok(_)) => {}
+            (Err(x), Err(y)) => assert_eq!(x.to_string(), y.to_string(), "{}", spec.id),
+            _ => panic!("{}: with ids {a:?}, with the selection {b:?}", spec.id),
+        }
+        match (given.doc(), selected.doc()) {
+            (Ok(g), Ok(s)) => assert!(g.doc == s.doc, "{}: the documents differ", spec.id),
+            (g, s) => assert_eq!(g.is_ok(), s.is_ok(), "{}", spec.id),
+        }
+        checked.push((spec.id, a.is_ok()));
+    }
+    assert!(checked.iter().filter(|c| c.1).count() >= 20, "{checked:?}");
+}

crates/engine/src/tests_journal.rs

@@ -371,3 +371,25 @@ fn a_move_drag_is_named_for_whether_it_copied() {
         assert_eq!(last(&s).as_deref(), Some(label), "begun as {begin}, copy: {copy}");
     }
 }
+
+#[test]
+fn a_failed_preview_is_not_journaled_at_commit() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 100, "height": 50})).unwrap();
+    let journal = s.journal.len();
+
+    // Only a failing preview: committing records nothing.
+    s.begin_interaction("Bad").unwrap();
+    assert!(s.preview("no.such.command", &json!({})).is_err());
+    s.commit_interaction().unwrap();
+    assert_eq!(s.journal.len(), journal);
+
+    // A good preview followed by a failing one: the document is back at the snapshot, so the
+    // earlier preview is not journaled either.
+    s.begin_interaction("Opacity").unwrap();
+    s.preview("transparency.set", &json!({"opacity": 50})).unwrap();
+    assert!(s.preview("no.such.command", &json!({})).is_err());
+    s.commit_interaction().unwrap();
+    assert_eq!(s.journal.len(), journal);
+}

crates/engine/src/tests_large_edits.rs

@@ -22,13 +22,13 @@ fn square_at(k: usize) -> Rect {
 }
 
 /// Square `k` ([`square_at`]) as a path with a new id.
-fn square(d: &mut Document, k: usize) -> Node {
+pub(crate) fn square(d: &mut Document, k: usize) -> Node {
     Node::path(d.alloc_id(), shapes::rectangle(square_at(k)), Appearance::default_art())
 }
 
 /// A session whose document holds `make(d, k)` for each `k` below `n` on its one layer, all of it
 /// selected.
-fn session(n: usize, mut make: impl FnMut(&mut Document, usize) -> Node) -> Session {
+pub(crate) fn session(n: usize, mut make: impl FnMut(&mut Document, usize) -> Node) -> Session {
     let mut d = Document::new(ROW as f64 * 20.0, (n / ROW + 1) as f64 * 20.0);
     let art: Vec<Arc<Node>> = (0..n).map(|k| Arc::new(make(&mut d, k))).collect();
     if let Some(ch) = Arc::make_mut(&mut d.layers[0]).children_mut() {
@@ -46,7 +46,7 @@ fn ids_of(n: &Node) -> Vec<NodeId> {
 }
 
 /// The ids of the objects on layer `i`.
-fn layer(s: &Session, i: usize) -> Vec<NodeId> {
+pub(crate) fn layer(s: &Session, i: usize) -> Vec<NodeId> {
     ids_of(&s.doc().unwrap().doc.layers[i])
 }
 
@@ -76,7 +76,7 @@ fn soon<T: Send + 'static>(mut s: Session, what: &'static str, f: impl FnOnce(&m
 }
 
 /// Runs command `cmd` with `params` through [`soon`] and returns its result.
-fn run_soon(s: Session, cmd: &'static str, params: Value) -> (Session, Value) {
+pub(crate) fn run_soon(s: Session, cmd: &'static str, params: Value) -> (Session, Value) {
     let (s, r) = soon(s, cmd, move |s| s.execute(cmd, &params));
     (s, r.unwrap())
 }
@@ -87,7 +87,7 @@ fn ids_in(r: &Value) -> Vec<NodeId> {
 }
 
 /// Runs Undo and checks that it gives back `before`.
-fn undo_gives_back(s: &mut Session, before: &Document) {
+pub(crate) fn undo_gives_back(s: &mut Session, before: &Document) {
     s.execute("edit.undo", &json!({})).unwrap();
     assert!(*s.doc().unwrap().doc == *before, "Undo gives back the document");
 }

crates/engine/src/tests_layers.rs

@@ -238,6 +238,25 @@ fn visibility_and_lock_per_row_are_undoable() {
     assert_eq!(node(&s, sub).display_name(), "Sub", "a layer keeps its name");
 }
 
+/// Preferences › Units › Identify Objects By › XML ID (#394): `layer.setProps` takes a valid XML
+/// id and stores the object name; Object Name (the default) keeps free text. The Layers label is
+/// the XML id when that preference is on.
+#[test]
+fn identify_objects_by_xml_id_names_layers() {
+    let mut s = session();
+    let a = rect(&mut s, 0.0);
+    run(&mut s, "layer.setProps", json!({"id": a.0, "name": "My Rect #2"}));
+    assert_eq!(node(&s, a).display_name(), "My Rect #2");
+    assert_eq!(node(&s, a).identify_label(true), "My_Rect__x23_2");
+    run(&mut s, "prefs.set", json!({"key": "identifyObjectsBy", "value": "xmlId"}));
+    assert!(s.execute("layer.setProps", &json!({"id": a.0, "name": "My Rect"})).is_err(), "spaces are refused");
+    run(&mut s, "layer.setProps", json!({"id": a.0, "name": "My_Rect__x23_2"}));
+    assert_eq!(node(&s, a).display_name(), "My Rect #2", "the XML id is stored as the object name");
+    run(&mut s, "prefs.set", json!({"key": "identifyObjectsBy", "value": "objectName"}));
+    run(&mut s, "layer.setProps", json!({"id": a.0, "name": "My Rect"}));
+    assert_eq!(node(&s, a).display_name(), "My Rect");
+}
+
 #[test]
 fn object_set_props_deselects_the_objects_it_hides_or_locks() {
     let mut s = session();

crates/engine/src/tests_links.rs

@@ -257,6 +257,56 @@ fn a_modified_link_follows_the_update_links_preference() {
     assert!(s.doc().unwrap().history.undo.is_empty(), "opening is not an undo step");
 }
 
+/// The half of opening that the desktop app runs on a thread of its own (`read_for_open`) reads
+/// the linked files and lays out the type. The half left for the UI thread (`open_read`) reads no
+/// file: with a linked file moved away in between, it opens the document that `document.open` opens.
+#[test]
+fn a_file_read_for_opening_has_its_links_read_and_its_type_laid_out() {
+    let dir = Folder::new("read-for-open");
+    let tif = dir.file("art/photo.tif");
+    let mut tiff = vec![];
+    image::RgbImage::from_pixel(600, 300, image::Rgb(RED)).write_to(&mut std::io::Cursor::new(&mut tiff), image::ImageFormat::Tiff).unwrap();
+    write(&tif, &tiff);
+    let (gone, changed) = (dir.file("gone.png"), dir.file("changed.png"));
+    write(&gone, &png(300, 100, BLUE));
+    write(&changed, &png(300, 100, BLUE));
+    let mut s = session();
+    let photo = place(&mut s, &tif);
+    place(&mut s, &gone);
+    place(&mut s, &changed);
+    let area = json!({"width": 150, "height": 20, "fit": "autoHeight"});
+    let r = s.execute("text.create", &json!({"x": 20, "y": 40, "text": "Linked files and type. ".repeat(12), "area": area})).unwrap();
+    let text = NodeId(r["id"].as_u64().unwrap());
+    s.execute("text.areaOptions", &json!({"ids": [text.0], "columns": 2})).unwrap();
+    let doc_path = dir.file("poster.vectorcraft");
+    save(&mut s, &doc_path);
+    std::fs::remove_file(&gone).unwrap();
+    write(&changed, &png(200, 200, RED));
+    let bytes = std::fs::read(&doc_path).unwrap();
+    let away = dir.file("away.tif");
+    for update in ["askWhenModified", "automatically"] {
+        let mut at_once = session();
+        at_once.execute("prefs.set", &json!({"key": "updateLinks", "value": update})).unwrap();
+        let expected = open(&mut at_once, &doc_path);
+        let rows = if update == "automatically" { &expected["updatedLinks"] } else { &expected["modifiedLinks"] };
+        assert!(expected["missingLinks"][0]["name"] == "gone.png" && rows[0]["name"] == "changed.png", "{update}: {expected}");
+        let file = cmd::fileio::read_for_open(&doc_path, &bytes, Some(doc_path.clone()), &Value::Null, update == "automatically").unwrap();
+        let doc = file.document();
+        let NodeKind::Image(im) = &doc.node(photo).unwrap().kind else { panic!("not an image") };
+        assert!(!doc.images[&im.key].is_proxy(), "{update}: the TIFF is read, not the preview saved for it");
+        let NodeKind::Text(t) = &doc.node(text).unwrap().kind else { panic!("not type") };
+        assert!(t.cached_bounds.is_some(), "{update}: the type is laid out");
+        std::fs::rename(&tif, &away).unwrap();
+        let mut opened = session();
+        let r = cmd::fileio::open_read(&mut opened, file).unwrap();
+        std::fs::rename(&away, &tif).unwrap();
+        assert_eq!(r, expected, "{update}");
+        let (a, b) = (at_once.doc().unwrap(), opened.doc().unwrap());
+        assert!(*b.doc == *a.doc, "{update}: the same document");
+        assert!(b.history.undo.is_empty() && !b.is_dirty(), "{update}");
+    }
+}
+
 #[test]
 fn links_from_older_files_load_and_keep_their_pixels() {
     let dir = Folder::new("legacy");

crates/engine/src/tests_linkwatch.rs

@@ -86,3 +86,21 @@ fn a_file_still_being_written_is_tried_again() {
     assert_eq!(look(&mut s)["updated"], json!([id.0]));
     assert_eq!(colour(&s), BLUE);
 }
+
+#[test]
+fn a_change_during_a_drag_waits_for_the_drag_to_end() {
+    let dir = Folder::new("watch-drag");
+    let path = dir.file("art.png");
+    std::fs::write(&path, png(40, 40, RED)).unwrap();
+    let mut s = session();
+    s.prefs.update_links = "automatically".into();
+    let id = place(&mut s, &path);
+    look(&mut s);
+    s.begin_interaction("Move").unwrap();
+    save(&path, &png(40, 40, BLUE));
+    // The preview would throw the update away, so it is not applied (nor its stamp kept).
+    assert_eq!(look(&mut s), json!({"updated": [], "ask": [], "modified": []}));
+    s.cancel_interaction().unwrap();
+    assert_eq!(look(&mut s)["updated"], json!([id.0]));
+    assert_eq!(colour(&s), BLUE);
+}

crates/engine/src/tests_menucmds.rs

@@ -2,9 +2,10 @@
 
 use serde_json::{Value, json};
 use vectorcraft_color::{Color, Paint};
-use vectorcraft_doc::{ColorMode, LiveShape, Node, NodeKind, TextKind};
-use vectorcraft_geom::Rect;
+use vectorcraft_doc::{Appearance, ColorMode, LiveShape, Node, NodeKind, TextKind};
+use vectorcraft_geom::{Rect, shapes};
 
+use super::tests_large_edits::{layer, run_soon, square, undo_gives_back};
 use super::*;
 
 fn session() -> Session {
@@ -137,6 +138,100 @@ fn hide_all_artwork_above_deselects_the_objects_it_hides() {
     assert_eq!((selected(&s), key(&s)), (vec![hidden, a, b], Some(a)));
 }
 
+/// Lock › All Artwork Above and Hide › All Artwork Above take each object that overlaps a selected
+/// object below it in the same layer, once, whether it is locked or hidden already or not. An object
+/// that overlaps only a selected object above it, the group around a selected object, the selected
+/// objects and an object that lies over a selected object of another layer stay as they are.
+#[test]
+fn lock_and_hide_all_artwork_above_take_what_overlaps_a_selected_object_below_in_its_layer() {
+    let mut s = session();
+    let a = rect(&mut s, 0.0, 0.0, 100.0, 100.0);
+    // `b` overlaps only `c`, which lies above it.
+    let b = rect(&mut s, 250.0, 0.0, 100.0, 100.0);
+    let c = rect(&mut s, 90.0, 0.0, 200.0, 100.0);
+    // `d` overlaps `a`, `e` overlaps `c`, `f` overlaps both, `g` overlaps neither, and `k` overlaps `a` and is locked.
+    let d = rect(&mut s, 20.0, 50.0, 30.0, 30.0);
+    let e = rect(&mut s, 200.0, 50.0, 30.0, 30.0);
+    let f = rect(&mut s, 60.0, 10.0, 50.0, 20.0);
+    let g = rect(&mut s, 500.0, 500.0, 20.0, 20.0);
+    let k = rect(&mut s, 10.0, 10.0, 10.0, 10.0);
+    s.execute("layer.setProps", &json!({"id": k.0, "locked": true})).unwrap();
+    // `m` is in a group, and `n` overlaps it.
+    let m = rect(&mut s, 800.0, 0.0, 50.0, 50.0);
+    sel(&mut s, &[m]);
+    let group = id_of(&s.execute("object.group", &json!({})).unwrap());
+    let n = rect(&mut s, 820.0, 20.0, 50.0, 50.0);
+    // In another layer, `h` lies where `a` lies, and `j` overlaps `i`.
+    s.execute("layer.new", &json!({})).unwrap();
+    let h = rect(&mut s, 0.0, 0.0, 100.0, 100.0);
+    let i = rect(&mut s, 600.0, 0.0, 100.0, 100.0);
+    let j = rect(&mut s, 650.0, 50.0, 100.0, 100.0);
+    let (taken, kept) = ([d, e, f, k, n, j], [a, b, c, g, group, m, h, i]);
+    for (cmd, lock) in [("object.lock.above", true), ("object.hide.above", false)] {
+        let done = |s: &Session, id: NodeId| if lock { node(s, id).locked } else { !node(s, id).visible };
+        sel(&mut s, &[a, c, m, i]);
+        let steps = undo_len(&s);
+        assert_eq!(s.execute(cmd, &json!({})).unwrap(), json!({"count": 6}), "{cmd}");
+        assert!(taken.iter().all(|id| done(&s, *id)), "{cmd}");
+        assert!(!kept.iter().any(|id| done(&s, *id)), "{cmd}");
+        assert_eq!((undo_len(&s), selected(&s)), (steps + 1, vec![a, c, m, i]), "{cmd}");
+        s.execute("edit.undo", &json!({})).unwrap();
+    }
+}
+
+/// A session with 1,000 tiles of 100 x 200 pt in rows of 40 under the 50,000 squares of [`square`],
+/// 50 on each tile, all of it selected; and the ids of the tiles and of the squares.
+fn tiles_under_squares() -> (Session, Vec<NodeId>, Vec<NodeId>) {
+    let tile = |t: usize| {
+        let (x, y) = ((t % 40) as f64 * 100.0, (t / 40) as f64 * 200.0);
+        Rect::new(x, y, x + 100.0, y + 200.0)
+    };
+    let s = super::tests_large_edits::session(51_000, |d, k| {
+        if k < 1000 { Node::path(d.alloc_id(), shapes::rectangle(tile(k)), Appearance::default_art()) } else { square(d, k - 1000) }
+    });
+    let mut tiles = layer(&s, 0);
+    let squares = tiles.split_off(1000);
+    (s, tiles, squares)
+}
+
+/// With 1,000 tiles selected under 50,000 squares, Lock › All Artwork Above locks every square in one
+/// undo step and Hide › All Artwork Above hides every square, each within 20 s, and the tiles stay
+/// selected.
+#[test]
+fn lock_and_hide_all_artwork_above_1000_tiles_under_50000_objects_finish_within_20_s() {
+    let (mut s, tiles, squares) = tiles_under_squares();
+    sel(&mut s, &tiles);
+    let before = s.doc().unwrap().doc.clone();
+    let (mut s, r) = run_soon(s, "object.lock.above", json!({}));
+    assert_eq!(r, json!({"count": 50_000}));
+    let d = &s.doc().unwrap().doc;
+    assert!(squares.iter().all(|id| d.node(*id).is_some_and(|n| n.locked)), "every square is locked");
+    assert!(tiles.iter().all(|id| d.node(*id).is_some_and(|n| !n.locked)), "no tile is locked");
+    assert!(selected(&s) == tiles, "the tiles stay selected");
+    undo_gives_back(&mut s, &before);
+    let (s, r) = run_soon(s, "object.hide.above", json!({}));
+    assert_eq!(r, json!({"count": 50_000}));
+    let d = &s.doc().unwrap().doc;
+    assert!(squares.iter().all(|id| d.node(*id).is_some_and(|n| !n.visible)), "every square is hidden");
+    assert!(tiles.iter().all(|id| d.node(*id).is_some_and(|n| n.visible)), "no tile is hidden");
+    assert!(selected(&s) == tiles, "the tiles stay selected");
+}
+
+/// With all 51,000 objects of [`tiles_under_squares`] selected, Lock › All Artwork Above and Hide ›
+/// All Artwork Above each find nothing to lock or hide within 20 s and record no undo step.
+#[test]
+fn lock_and_hide_all_artwork_above_with_51000_objects_selected_finish_within_20_s() {
+    let (s, tiles, squares) = tiles_under_squares();
+    let (steps, all) = (undo_len(&s), [tiles, squares].concat());
+    assert!(selected(&s) == all, "everything is selected");
+    let (s, r) = run_soon(s, "object.lock.above", json!({}));
+    assert_eq!(r, json!({"count": 0}));
+    let (s, r) = run_soon(s, "object.hide.above", json!({}));
+    assert_eq!(r, json!({"count": 0}));
+    assert_eq!(undo_len(&s), steps);
+    assert!(selected(&s) == all, "everything stays selected");
+}
+
 #[test]
 fn lock_and_hide_other_layers() {
     let mut s = session();
@@ -671,6 +766,43 @@ fn select_same_font_size_and_fill() {
     assert!(s.execute("select.same.fontSize", &json!({})).is_err());
 }
 
+/// #1737: Select > Same reads type's fill and stroke from its characters (the first run), so type
+/// matches type and paths both ways.
+#[test]
+fn select_same_paint_reads_type_characters() {
+    let mut s = session();
+    let t1 = text(&mut s, "a");
+    let t2 = text(&mut s, "b");
+    let t3 = text(&mut s, "c");
+    let r = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    let q = rect(&mut s, 20.0, 0.0, 10.0, 10.0);
+    sel(&mut s, &[t1, t2, r]);
+    s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+    sel(&mut s, &[t3, q]);
+    s.execute("paint.setFill", &json!({"color": "#0000ff"})).unwrap();
+    sel(&mut s, &[t1, r]);
+    s.execute("paint.setStroke", &json!({"color": "#00ff00"})).unwrap();
+    s.execute("stroke.set", &json!({"weight": 3})).unwrap();
+    sel(&mut s, &[t3]);
+    s.execute("paint.setStroke", &json!({"color": "#000000"})).unwrap();
+    let q_stroke = node(&s, q).appearance;
+    assert_eq!((q_stroke.stroke_paint(), q_stroke.stroke_width()), (Paint::solid(Color::BLACK), 1.0));
+
+    let same = |s: &mut Session, from: NodeId, cmd: &str| {
+        sel(s, &[from]);
+        s.execute(cmd, &json!({})).unwrap();
+        let mut v = selected(s);
+        v.sort();
+        v
+    };
+    assert_eq!(same(&mut s, t1, "select.same.fillColor"), vec![t1, t2, r]);
+    assert_eq!(same(&mut s, q, "select.same.fillColor"), vec![t3, q]);
+    assert_eq!(same(&mut s, r, "select.same.strokeColor"), vec![t1, r]);
+    assert_eq!(same(&mut s, t3, "select.same.strokeColor"), vec![t3, q]);
+    assert_eq!(same(&mut s, q, "select.same.strokeWeight"), vec![t3, q]);
+    assert_eq!(same(&mut s, t1, "select.same.fillAndStroke"), vec![t1, r]);
+}
+
 #[test]
 fn select_direction_handles_selects_all_anchors() {
     let mut s = session();

crates/engine/src/tests_package.rs

@@ -143,6 +143,28 @@ fn options_leave_out_links_fonts_and_the_report() {
     assert!(s.execute("file.package", &json!({"name": "../up"})).is_err());
 }
 
+#[test]
+fn a_package_never_replaces_its_source_or_its_links() {
+    let dir = Folder::new("package-overwrite");
+    let mut s = poster(&dir);
+    let doc = dir.file("poster.vectorcraft");
+    let (saved, red) = (std::fs::read(&doc).unwrap(), std::fs::read(dir.file("art/red.png")).unwrap());
+    let parent = dir.0.parent().unwrap();
+    let name = dir.0.file_name().unwrap().to_string_lossy().into_owned();
+    // The document's own folder, named directly and through `..`.
+    for folder in [parent.to_path_buf(), dir.0.join("art").join("..").join("..")] {
+        let e = s.execute("file.package", &json!({"folder": folder, "name": name})).unwrap_err().to_string();
+        assert!(e.contains("would be overwritten"), "{e}");
+    }
+    // The folder of its linked files, with the links beside the packaged document.
+    let e = s.execute("file.package", &json!({"folder": dir.0, "name": "art", "linksFolder": false})).unwrap_err().to_string();
+    assert!(e.contains("red.png"), "{e}");
+    // Nothing was written.
+    assert_eq!(std::fs::read(&doc).unwrap(), saved);
+    assert_eq!(std::fs::read(dir.file("art/red.png")).unwrap(), red);
+    assert!(!dir.0.join("art/poster.vectorcraft").exists() && !dir.0.join("poster Report.txt").exists());
+}
+
 #[test]
 fn a_missing_link_is_reported_not_copied() {
     let dir = Folder::new("package-missing");

crates/engine/src/tests_paintproxy.rs

@@ -210,6 +210,11 @@ fn live_previews_remember_only_the_committed_colour() {
     s.preview("paint.setFill", &json!({"color": "#400000"})).unwrap();
     s.cancel_interaction().unwrap();
     assert_eq!(hexes(&s), ["#300000"], "a cancelled preview is forgotten");
+    s.begin_interaction("Color").unwrap();
+    s.preview("paint.setFill", &json!({"color": "#500000"})).unwrap();
+    assert!(s.preview("no.such.command", &json!({})).is_err());
+    s.commit_interaction().unwrap();
+    assert_eq!(hexes(&s), ["#300000"], "a preview undone by a failed one is forgotten");
 }
 
 #[test]

crates/engine/src/tests_params.rs

@@ -2,7 +2,7 @@
 
 use serde_json::json;
 
-use crate::cmd::params::{UNCHECKED, check_keys, check_params, doc_keys};
+use crate::cmd::params::{UNCHECKED, check_effect_params, check_keys, check_params, doc_keys};
 use crate::{EngineError, Session, command_specs, find_command};
 
 fn keys(doc: &str) -> Vec<&str> {
@@ -95,6 +95,50 @@ fn a_batch_checks_its_steps() {
     assert_eq!(refusal("command.batch", json!({"steps": []})), "unknown parameter `steps`; the command takes: label, commands, artboard");
 }
 
+/// #1592: the `params` of an effect are held to the effect's own keys and types, where the effect
+/// is named (`effect.apply`) and where the document says which it is (`effect.setParams`).
+#[test]
+fn effect_params_are_the_effects_own() {
+    use vectorcraft_render::effects::effect_catalog;
+    for e in effect_catalog() {
+        doc_keys(e.params).unwrap_or_else(|why| panic!("{}: {why}", e.id));
+        check_effect_params("effect.apply", e.id, &e.defaults).unwrap_or_else(|why| panic!("{}'s defaults: {why}", e.id));
+    }
+    let apply = |effect: &str, params| json!({"effect": effect, "params": params});
+    assert_eq!(refusal("effect.apply", apply("blur.gaussian", json!({"blurr": 3}))), "unknown parameter `blurr`; the command takes: radius");
+    assert_eq!(
+        refusal("appearance.addEffect", apply("stylize.dropShadow", json!({"opacty": 50}))),
+        "unknown parameter `opacty`; did you mean `opacity`?"
+    );
+    assert_eq!(refusal("effect.apply", apply("blur.gaussian", json!({"radius": "big"}))), "`radius` must be a number");
+    assert_eq!(refusal("effect.apply", apply("threeD.revolve", json!({"shade": 1}))), "`shade` must be true or false");
+    assert_eq!(refusal("effect.apply", apply("threeD.revolve", json!({"edge": 1}))), "`edge` must be a string");
+    // Out of range is the effect's to clamp; a key only its description names is one it takes;
+    // a plug-in's are its manifest's; an unknown effect is the command's to report.
+    for (effect, params) in [
+        ("stylize.dropShadow", json!({"opacity": 500, "x": -3, "color": "#ff0000"})),
+        ("stylize.dropShadow", json!({"color": [1, 0, 0]})),
+        ("threeD.revolve", json!({"segments": 100000})),
+        ("path.outlineStroke", json!({"width": 2})),
+        ("plugin.anything", json!({"whatever": 1})),
+        ("no.such", json!({"whatever": 1})),
+    ] {
+        assert!(check_params("effect.apply", &apply(effect, params.clone())).is_ok(), "{effect} {params}");
+    }
+    // `effect.setParams` names an index: the session knows the effect there.
+    let mut s = Session::new();
+    s.execute("file.new", &json!({})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 50, "height": 40})).unwrap();
+    s.execute("effect.apply", &apply("blur.gaussian", json!({"radius": 2}))).unwrap();
+    for (params, why) in [(json!({"blurr": 3}), "unknown parameter `blurr`"), (json!({"radius": true}), "`radius` must be a number")] {
+        let e = s.execute("effect.setParams", &json!({"index": 0, "params": params})).unwrap_err().to_string();
+        assert!(e.contains(why), "{e}");
+    }
+    s.execute("effect.setParams", &json!({"index": 0, "params": {"radius": 1e9}, "visible": false})).unwrap();
+    // No effect at the index: the command says so, not the check.
+    assert!(s.check_params("effect.setParams", &json!({"index": 7, "params": {"blurr": 3}})).is_ok());
+}
+
 /// What a command notes for its journal entry is a key its description names, so the entry
 /// passes the check a caller's params get.
 #[test]

crates/engine/src/tests_pathops.rs

@@ -893,3 +893,40 @@ fn divide_keeps_implicitly_closed_filled_paths_including_zero_signed_area() {
         assert!(pieces.iter().all(|n| n.appearance == source.appearance));
     }
 }
+
+/// #1570: Trim, Merge and Crop remove the objects' strokes; Merge then merges same-coloured
+/// fills whatever their strokes were.
+#[test]
+fn trim_merge_and_crop_remove_strokes() {
+    for op in ["trim", "merge", "crop"] {
+        let mut s = session();
+        let (a, b) = two_rects(&mut s);
+        for (id, c) in [(a, Color::rgb(0.0, 0.0, 0.0)), (b, Color::rgb(1.0, 0.0, 0.0))] {
+            s.edit("t", |d, _| {
+                d.node_mut(id).unwrap().appearance = Appearance::basic(Paint::solid(Color::rgb(0.0, 0.0, 1.0)), Paint::solid(c), 3.0).into();
+                Ok(())
+            })
+            .unwrap();
+        }
+        s.execute("select.set", &json!({"ids": [a.0, b.0]})).unwrap();
+        let r = ids(&s.execute(&format!("object.pathfinder.{op}"), &json!({})).unwrap());
+        let g = node(&s, r[0]);
+        let pieces = g.children().unwrap();
+        assert!(!pieces.is_empty(), "{op}");
+        assert!(pieces.iter().all(|c| c.appearance.stroke_width() == 0.0 && c.appearance.fill().is_some()), "{op} keeps a stroke");
+        if op == "merge" {
+            assert_eq!(pieces.len(), 1, "same fill, different strokes: merged");
+        }
+    }
+}
+
+/// #1590: an inset larger than the shape leaves nothing, and the error says so rather than asking
+/// for paths that are selected.
+#[test]
+fn offset_path_that_leaves_nothing_says_so() {
+    let mut s = session();
+    let a = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    s.execute("select.set", &json!({"ids": [a.0]})).unwrap();
+    let e = s.execute("object.path.offsetPath", &json!({"offset": -20})).unwrap_err().to_string();
+    assert!(e.contains("leaves nothing") && !e.contains("select paths"), "{e}");
+}

crates/engine/src/tests_pattern.rs

@@ -390,6 +390,52 @@ fn expand_yields_n_copies() {
     assert_eq!(u.len(), ids.len());
 }
 
+/// #1756: Object → Expand turns radial, grid and mirror repeats into groups of their instances, in
+/// one undo step, as Expand Repeat does.
+#[test]
+fn object_expand_expands_repeats() {
+    for (cmd, opts) in [("object.repeat.radial", json!({"instances": 5})), ("object.repeat.grid", json!({})), ("object.repeat.mirror", json!({}))] {
+        let mut s = session();
+        let r = rect(&mut s, 195.0, 95.0, 10.0, 10.0);
+        sel(&mut s, &[r]);
+        let id = id_of(&s.execute(cmd, &opts).unwrap());
+        let NodeKind::Repeat(spec) = node(&s, id).kind else { panic!("{cmd}") };
+        let n = spec.expand().len();
+        assert_eq!(s.execute("object.expand.info", &json!({})).unwrap()["object"], json!(true), "{cmd}");
+        let undo = s.doc().unwrap().history.undo.len();
+        s.execute("object.expand", &json!({"fill": false, "stroke": false})).unwrap();
+        let g = node(&s, id);
+        assert!(matches!(g.kind, NodeKind::Group { .. }), "{cmd}");
+        assert_eq!(g.children().unwrap().len(), n, "{cmd}");
+        assert_eq!(s.doc().unwrap().history.undo.len(), undo + 1, "{cmd}");
+        assert_eq!(s.doc().unwrap().selection.objects, vec![id], "{cmd}");
+        // Nothing left to expand: the instances are plain rectangles.
+        assert_eq!(s.execute("object.expand.info", &json!({})).unwrap()["object"], json!(false), "{cmd}");
+    }
+}
+
+/// Expand reaches repeats inside a selected group, and with every option on also outlines the
+/// instances' strokes.
+#[test]
+fn object_expand_expands_repeats_in_groups() {
+    let mut s = session();
+    let r = rect(&mut s, 195.0, 95.0, 10.0, 10.0);
+    sel(&mut s, &[r]);
+    let rep = id_of(&s.execute("object.repeat.radial", &json!({"instances": 4})).unwrap());
+    let other = rect(&mut s, 0.0, 0.0, 10.0, 10.0);
+    sel(&mut s, &[rep, other]);
+    s.execute("object.group", &json!({})).unwrap();
+    s.execute("object.expand", &json!({})).unwrap();
+    let mut repeats = 0;
+    for l in &doc(&s).layers {
+        l.walk(&mut |c| repeats += usize::from(matches!(c.kind, NodeKind::Repeat(_))));
+    }
+    assert_eq!(repeats, 0);
+    let g = node(&s, rep);
+    assert_eq!(g.children().unwrap().len(), 4);
+    assert!(g.children().unwrap().iter().all(|c| c.appearance.stroke_paint().is_none()));
+}
+
 #[test]
 fn grid_repeat_and_options() {
     let mut s = session();

crates/engine/src/tests_prefs.rs

@@ -373,6 +373,134 @@ fn use_precise_cursors_makes_drawing_cursors_crosshairs() {
     assert_eq!(cursor(&mut s, "eyedropper"), Cursor::Eyedropper);
 }
 
+/// Use Precise Cursors changes the pointer of the tools that have one of their own: off, each shows its own
+/// pointer; on, a crosshair. Every other drawing tool shows a crosshair either way, and the Type tool and the
+/// Scissors over no path keep theirs.
+#[test]
+fn use_precise_cursors_swaps_the_tools_own_pointers_for_a_crosshair() {
+    use vectorcraft_tools::{Cursor, Mods};
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+    let at = vectorcraft_geom::Point::new(300.0, 300.0);
+    let cursor = |s: &mut Session, tool: &str| {
+        s.select_tool(tool, ViewInfo::default()).unwrap();
+        s.cursor(at, Mods::default(), ViewInfo::default())
+    };
+    // Off: the pointer of each tool whose own pointer the preference replaces.
+    let own = [
+        ("pen", Cursor::Pen),
+        ("addAnchor", Cursor::PenAdd),
+        ("deleteAnchor", Cursor::PenDelete),
+        ("anchorPoint", Cursor::Pen),
+        ("curvature", Cursor::Pen),
+        ("mesh", Cursor::PenAdd),
+        ("eyedropper", Cursor::Eyedropper),
+        ("slice", Cursor::Slice),
+        ("blend", Cursor::Blend),
+        ("shapeBuilder", Cursor::ShapeBuilder),
+    ];
+    for (tool, c) in own {
+        assert_eq!(cursor(&mut s, tool), c, "{tool} off");
+    }
+    // The tools that show a crosshair whatever the preference says.
+    let always = [
+        "lineSegment",
+        "arc",
+        "spiral",
+        "rectangularGrid",
+        "polarGrid",
+        "rectangle",
+        "roundedRectangle",
+        "ellipse",
+        "polygon",
+        "star",
+        "flare",
+        "paintbrush",
+        "blobBrush",
+        "shaper",
+        "pencil",
+        "smooth",
+        "pathEraser",
+        "join",
+        "eraser",
+        "knife",
+        "mirrorCut",
+        "lineCut",
+        "rectCut",
+        "gradient",
+    ];
+    for tool in always {
+        assert_eq!(cursor(&mut s, tool), Cursor::Crosshair, "{tool} off");
+    }
+    s.execute("prefs.set", &json!({"key": "usePreciseCursors", "value": true})).unwrap();
+    for (tool, _) in own {
+        assert_eq!(cursor(&mut s, tool), Cursor::Crosshair, "{tool} on");
+    }
+    for tool in always {
+        assert_eq!(cursor(&mut s, tool), Cursor::Crosshair, "{tool} on");
+    }
+    assert_eq!(cursor(&mut s, "type"), Cursor::Text);
+    assert_eq!(cursor(&mut s, "scissors"), Cursor::NotAllowed);
+    s.execute("prefs.set", &json!({"key": "usePreciseCursors", "value": false})).unwrap();
+    for (tool, c) in own {
+        assert_eq!(cursor(&mut s, tool), c, "{tool} off again");
+    }
+}
+
+/// Every state of the Pen's pointer, and the other drawing pointers, turn into a crosshair; the rest stay.
+#[test]
+fn precise_cursors_replace_every_pen_state() {
+    use vectorcraft_tools::Cursor;
+    for c in [
+        Cursor::Pen,
+        Cursor::PenAdd,
+        Cursor::PenDelete,
+        Cursor::PenClose,
+        Cursor::PenContinue,
+        Cursor::PenJoin,
+        Cursor::PenConvert,
+        Cursor::Eyedropper,
+        Cursor::Slice,
+        Cursor::Blend,
+        Cursor::BlendObject,
+        Cursor::BlendAnchor,
+        Cursor::ShapeBuilder,
+        Cursor::ShapeBuilderErase,
+    ] {
+        assert_eq!(c.precise(), Cursor::Crosshair, "{c:?}");
+    }
+    for c in [Cursor::Arrow, Cursor::Move, Cursor::Text, Cursor::Hand, Cursor::NotAllowed, Cursor::SliceSelect] {
+        assert_eq!(c.precise(), c, "{c:?}");
+    }
+}
+
+/// Switching the preference is not an edit: no undo step, no unsaved changes.
+#[test]
+fn use_precise_cursors_is_not_an_edit() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+    let before = (s.active().unwrap().history.undo.len(), s.active().unwrap().history.redo.len());
+    assert!(!s.active().unwrap().is_dirty());
+    s.execute("prefs.set", &json!({"key": "usePreciseCursors", "value": true})).unwrap();
+    assert!(s.prefs.use_precise_cursors);
+    let st = s.active().unwrap();
+    assert_eq!((st.history.undo.len(), st.history.redo.len()), before, "no undo step");
+    assert!(!st.is_dirty(), "the document stays saved");
+}
+
+/// The preference is saved with the others and reads back as it was.
+#[test]
+fn use_precise_cursors_is_saved_and_restored() {
+    let mut s = Session::new();
+    assert!(!s.prefs.use_precise_cursors, "off by default");
+    s.execute("prefs.set", &json!({"key": "usePreciseCursors", "value": true})).unwrap();
+    let saved = s.prefs.to_json();
+    assert_eq!(saved["usePreciseCursors"], json!(true));
+    let mut t = Session::new();
+    t.apply_prefs(serde_json::from_value(saved).unwrap());
+    assert!(t.prefs.use_precise_cursors);
+}
+
 // ---------- #394, second batch ----------
 
 fn new_doc() -> Session {

crates/engine/src/tests_previewbounds.rs

@@ -98,6 +98,248 @@ fn the_w_field_sets_the_visual_width() {
     assert!((geometric(&s, id).x0 - 5.0).abs() < 1e-9);
 }
 
+#[test]
+fn a_size_below_what_a_kept_stroke_adds_gives_the_path_no_width_or_height() {
+    // The 10 pt stroke adds 10 pt to the width and the height. With strokes kept, a width or height
+    // of 0 or more below 10 pt gives the path no width or height, and the visual box is the
+    // stroke's 10 pt: the path does not turn over. A size of 10 pt or more scales the path to it,
+    // and a negative size turns the path over.
+    let mut wrong = vec![];
+    for (key, size, path, visual) in [
+        ("width", 5.0, 0.0, 10.0),
+        ("width", 0.0, 0.0, 10.0),
+        ("width", 10.0, 0.0, 10.0),
+        ("width", 30.0, 20.0, 30.0),
+        ("width", -10.0, 20.0, 30.0),
+        ("height", 5.0, 0.0, 10.0),
+        ("height", 0.0, 0.0, 10.0),
+        ("height", 10.0, 0.0, 10.0),
+        ("height", 30.0, 20.0, 30.0),
+        ("height", -10.0, 20.0, 30.0),
+    ] {
+        let mut s = session();
+        let id = rect(&mut s, 100.0, 100.0, 10.0);
+        preview(&mut s, true);
+        run(&mut s, "object.setBounds", json!({key: size, "reference": 0, "strokes": false}));
+        let (g, v) = (geometric(&s, id), s.transform_bounds(&[id]).unwrap());
+        let (g, v) = if key == "width" { (g.width(), v.width()) } else { (g.height(), v.height()) };
+        if (g - path).abs() > 1e-9 || (v - visual).abs() > 1e-9 {
+            wrong.push(format!("{key} {size}: path {g}, visual box {v}"));
+        }
+    }
+    assert!(wrong.is_empty(), "{wrong:?}");
+}
+
+#[test]
+fn set_bounds_gives_one_path_sizes_out_of_proportion_when_strokes_scale() {
+    // The 100 × 50 rectangle with a 10 pt stroke: its visual box runs from (95, 95) to (205, 155).
+    // The stroke scales by the square root of the product of the two scales, so the width it adds
+    // depends on the height too. Set from the top-left corner, the visual box is 220 × 60, and
+    // 5 × 1000 with the path the same way round.
+    let mut wrong = vec![];
+    for (width, height) in [(220.0, 60.0), (5.0, 1000.0)] {
+        let mut s = session();
+        let id = rect(&mut s, 100.0, 100.0, 10.0);
+        preview(&mut s, true);
+        run(&mut s, "object.setBounds", json!({"width": width, "height": height, "reference": 0, "strokes": true}));
+        let v = s.transform_bounds(&[id]).unwrap();
+        let Some(vectorcraft_doc::LiveShape::Rectangle { xf, .. }) = s.doc().unwrap().doc.node(id).unwrap().live_shape() else {
+            panic!("the rectangle")
+        };
+        if !close(v, Rect::new(95.0, 95.0, 95.0 + width, 95.0 + height)) || xf.as_coeffs()[0] <= 0.0 {
+            wrong.push(format!("{width} × {height}: {v:?}, {xf:?}"));
+        }
+    }
+    assert!(wrong.is_empty(), "{wrong:?}");
+}
+
+fn close(a: Rect, b: Rect) -> bool {
+    [(a.x0, b.x0), (a.y0, b.y0), (a.x1, b.x1), (a.y1, b.y1)].iter().all(|(x, y)| (x - y).abs() < 1e-9)
+}
+
+/// Two rectangles 50 pt high at y 100, both selected with Use Preview Bounds on: one from x 0 to
+/// 10 with a 2 pt stroke, which sets the left edge of the paths, and one from x 3 to 10 with a
+/// 10 pt stroke, which sets every edge of the visual box, (-2, 95) to (15, 155).
+fn thin_and_thick() -> (Session, [NodeId; 2]) {
+    let mut s = session();
+    let ids = [rect(&mut s, 0.0, 10.0, 2.0), rect(&mut s, 3.0, 7.0, 10.0)];
+    preview(&mut s, true);
+    run(&mut s, "select.set", json!({"ids": [ids[0].0, ids[1].0]}));
+    assert!(close(s.transform_bounds(&ids).unwrap(), Rect::new(-2.0, 95.0, 15.0, 155.0)));
+    (s, ids)
+}
+
+#[test]
+fn set_bounds_measures_the_margins_on_each_side_object_by_object() {
+    // Set to 37 wide from the left edge with strokes kept, the paths scale by 3.1, and the left edge
+    // of the visual box stays at -2.
+    let (mut s, ids) = thin_and_thick();
+    run(&mut s, "object.setBounds", json!({"width": 37, "reference": 0, "strokes": false}));
+    let v = s.transform_bounds(&ids).unwrap();
+    assert!(close(v, Rect::new(-2.0, 95.0, 35.0, 155.0)), "{v:?}");
+    assert!(close(geometric(&s, ids[0]), Rect::new(-1.0, 100.0, 30.0, 150.0)), "{:?}", geometric(&s, ids[0]));
+    assert!(close(geometric(&s, ids[1]), Rect::new(8.3, 100.0, 30.0, 150.0)), "{:?}", geometric(&s, ids[1]));
+}
+
+#[test]
+fn set_bounds_scales_both_ways_at_once_when_strokes_scale_and_the_sizes_are_out_of_proportion() {
+    // Each stroke scales by the square root of the product of the two scales, so the width it
+    // adds depends on the height too. The visual box is 40 × 100.
+    let (mut s, ids) = thin_and_thick();
+    run(&mut s, "object.setBounds", json!({"width": 40, "height": 100, "reference": 0, "strokes": true}));
+    let v = s.transform_bounds(&ids).unwrap();
+    assert!(close(v, Rect::new(-2.0, 95.0, 38.0, 195.0)), "{v:?}");
+}
+
+#[test]
+fn set_bounds_measures_paths_turned_together_square_to_their_box() {
+    // Turned 30° together, the paths are measured square to their turned box: it is 37 wide, and
+    // its top-left corner stays where it was.
+    let (mut s, ids) = thin_and_thick();
+    run(&mut s, "object.rotate", json!({"angle": 30}));
+    let before = s.transform_box(&ids).unwrap();
+    run(&mut s, "object.setBounds", json!({"width": 37, "reference": 0, "strokes": false}));
+    let after = s.transform_box(&ids).unwrap();
+    assert!((after.angle - 30.0).abs() < 1e-9 && (after.rect.width() - 37.0).abs() < 1e-9, "{after:?}");
+    assert!((after.rect.height() - 60.0).abs() < 1e-9, "{after:?}");
+    assert!(after.reference_point(0).distance(before.reference_point(0)) < 1e-9, "{before:?} {after:?}");
+}
+
+#[test]
+fn a_size_below_what_the_kept_strokes_of_several_paths_add_gives_them_no_width() {
+    // With no width, the paths have a visual box 10 pt wide, the width of the thick stroke. A width
+    // of 0 or more below 10 gives both paths no width, and the left edge of the visual box stays at
+    // -2. A negative width turns the paths over, as it does one path.
+    let mut wrong = vec![];
+    for (width, paths, visual) in [
+        (8.0, [Rect::new(3.0, 100.0, 3.0, 150.0); 2], Rect::new(-2.0, 95.0, 8.0, 155.0)),
+        (0.0, [Rect::new(3.0, 100.0, 3.0, 150.0); 2], Rect::new(-2.0, 95.0, 8.0, 155.0)),
+        (-37.0, [Rect::new(-44.0, 100.0, 0.0, 150.0), Rect::new(-44.0, 100.0, -13.2, 150.0)], Rect::new(-49.0, 95.0, 1.0, 155.0)),
+    ] {
+        let (mut s, ids) = thin_and_thick();
+        run(&mut s, "object.setBounds", json!({"width": width, "reference": 0, "strokes": false}));
+        let (g, v) = (ids.map(|id| geometric(&s, id)), s.transform_bounds(&ids).unwrap());
+        if !close(g[0], paths[0]) || !close(g[1], paths[1]) || !close(v, visual) {
+            wrong.push(format!("width {width}: paths {g:?}, visual box {v:?}"));
+        }
+    }
+    assert!(wrong.is_empty(), "{wrong:?}");
+}
+
+#[test]
+fn set_bounds_leaves_the_height_of_lines_with_no_height() {
+    // Horizontal lines at y 100 with square caps, from x 0 to 10 with a 2 pt stroke and from x 3 to
+    // 10 with a 10 pt stroke: the visual box is (-2, 95) to (15, 105). They have no height to
+    // scale, so the height stays 10; the width becomes 37 from the left edge.
+    let mut s = session();
+    let mut ids = vec![];
+    for (x, weight) in [(0.0, 2.0), (3.0, 10.0)] {
+        ids.push(NodeId(run(&mut s, "shape.line", json!({"x1": x, "y1": 100, "x2": 10, "y2": 100}))["id"].as_u64().unwrap()));
+        run(&mut s, "stroke.set", json!({"weight": weight, "cap": "square"}));
+    }
+    preview(&mut s, true);
+    run(&mut s, "select.set", json!({"ids": [ids[0].0, ids[1].0]}));
+    assert!(close(s.transform_bounds(&ids).unwrap(), Rect::new(-2.0, 95.0, 15.0, 105.0)), "{:?}", s.transform_bounds(&ids));
+    run(&mut s, "object.setBounds", json!({"width": 37, "height": 30, "reference": 0, "strokes": false}));
+    let v = s.transform_bounds(&ids).unwrap();
+    assert!(close(v, Rect::new(-2.0, 95.0, 35.0, 105.0)), "{v:?}");
+    assert!(close(geometric(&s, ids[1]), Rect::new(8.3, 100.0, 30.0, 100.0)), "{:?}", geometric(&s, ids[1]));
+}
+
+/// The rectangles of [`thin_and_thick`] in a group, the thick one in a group of its own inside it
+/// when `nested`, selected with an unstroked rectangle from x 100 to 110 when `plain`. Returns the
+/// selected objects.
+fn grouped(nested: bool, plain: bool) -> (Session, Vec<NodeId>) {
+    let (mut s, [thin, thick]) = thin_and_thick();
+    let mut members = vec![thin.0, thick.0];
+    if nested {
+        run(&mut s, "select.set", json!({"ids": [thick.0]}));
+        members[1] = run(&mut s, "object.group", json!({}))["id"].as_u64().unwrap();
+    }
+    run(&mut s, "select.set", json!({"ids": members}));
+    let mut ids = vec![NodeId(run(&mut s, "object.group", json!({}))["id"].as_u64().unwrap())];
+    if plain {
+        ids.push(rect(&mut s, 100.0, 10.0, 0.0));
+    }
+    run(&mut s, "select.set", json!({"ids": ids.iter().map(|id| id.0).collect::<Vec<_>>()}));
+    (s, ids)
+}
+
+#[test]
+fn set_bounds_measures_the_members_of_groups_one_by_one() {
+    // With the unstroked rectangle, the visual box runs from (-2, 95) to (110, 155). Set to 224 wide
+    // from its left edge, it is 224 wide and its left edge stays at -2, with strokes kept or
+    // scaling, and with the thick rectangle in a group of its own. The group alone, (-2, 95) to
+    // (15, 155), set to 37 wide is 37 wide.
+    let mut wrong = vec![];
+    for (nested, plain, width, strokes) in
+        [(false, true, 224.0, false), (false, true, 224.0, true), (true, true, 224.0, false), (false, false, 37.0, false)]
+    {
+        let (mut s, ids) = grouped(nested, plain);
+        run(&mut s, "object.setBounds", json!({"width": width, "reference": 0, "strokes": strokes}));
+        let v = s.transform_bounds(&ids).unwrap();
+        if !close(v, Rect::new(-2.0, 95.0, width - 2.0, 155.0)) {
+            wrong.push(format!("nested {nested}, plain {plain}, strokes {strokes}: {v:?}"));
+        }
+    }
+    // The group with a 1 pt stroke of its own, which reaches 5 pt at its miter limit of 10, around
+    // each member: the visual box runs from (-7, 90) to (110, 160). Set to 224 wide from its left
+    // edge, it is 224 wide and its left edge stays at -7, with strokes kept or scaling.
+    for strokes in [false, true] {
+        let (mut s, _) = thin_and_thick();
+        let group = NodeId(run(&mut s, "object.group", json!({}))["id"].as_u64().unwrap());
+        run(&mut s, "appearance.addStroke", json!({"ids": [group.0]}));
+        let ids = [group, rect(&mut s, 100.0, 10.0, 0.0)];
+        run(&mut s, "select.set", json!({"ids": [ids[0].0, ids[1].0]}));
+        assert!(close(s.transform_bounds(&ids).unwrap(), Rect::new(-7.0, 90.0, 110.0, 160.0)), "{:?}", s.transform_bounds(&ids));
+        run(&mut s, "object.setBounds", json!({"width": 224, "reference": 0, "strokes": strokes}));
+        let v = s.transform_bounds(&ids).unwrap();
+        if !close(v, Rect::new(-7.0, 90.0, 217.0, 160.0)) {
+            wrong.push(format!("the group with a stroke, strokes {strokes}: {v:?}"));
+        }
+    }
+    // A group of a rectangle from x 0 to 100 with a 2 pt stroke and one from x 40 to 60 with a 10 pt
+    // stroke: its visual box, (-1, 95) to (101, 155), set to 11 wide is 11 wide.
+    let mut s = session();
+    let ids = [rect(&mut s, 0.0, 100.0, 2.0), rect(&mut s, 40.0, 20.0, 10.0)];
+    preview(&mut s, true);
+    run(&mut s, "select.set", json!({"ids": [ids[0].0, ids[1].0]}));
+    let group = NodeId(run(&mut s, "object.group", json!({}))["id"].as_u64().unwrap());
+    run(&mut s, "object.setBounds", json!({"width": 11, "reference": 0, "strokes": false}));
+    let v = s.transform_bounds(&[group]).unwrap();
+    if !close(v, Rect::new(-1.0, 95.0, 10.0, 155.0)) {
+        wrong.push(format!("the 0 to 100 and 40 to 60 group: {v:?}"));
+    }
+    assert!(wrong.is_empty(), "{wrong:?}");
+}
+
+#[test]
+fn set_bounds_measures_clip_groups_and_groups_with_effects_as_one_object() {
+    // A clip group is measured by its clipping path, a rectangle from x 0 to 10, though its content
+    // with a 10 pt stroke reaches past it: with the unstroked rectangle from x 100 to 110, set to
+    // 224 wide from the left edge, the visual box runs from x 0 to 224.
+    let mut s = session();
+    let content = rect(&mut s, 3.0, 17.0, 10.0);
+    let path = rect(&mut s, 0.0, 10.0, 0.0);
+    run(&mut s, "select.set", json!({"ids": [content.0, path.0]}));
+    let clip = NodeId(run(&mut s, "object.clippingMask.make", json!({}))["id"].as_u64().unwrap());
+    let plain = rect(&mut s, 100.0, 10.0, 0.0);
+    preview(&mut s, true);
+    run(&mut s, "select.set", json!({"ids": [clip.0, plain.0]}));
+    run(&mut s, "object.setBounds", json!({"width": 224, "reference": 0, "strokes": false}));
+    let v = s.transform_bounds(&[clip, plain]).unwrap();
+    assert!(close(v, Rect::new(0.0, 100.0, 224.0, 150.0)), "the clip group: {v:?}");
+    // A group with a drop shadow of its own is measured as one object, as before. Its 2 pt margin on
+    // the left is measured from the group's left edge, though the stroke of the thick rectangle at
+    // x 3 paints it, so the visual box is 223 wide and its left edge moves to -1.
+    let (mut s, ids) = grouped(false, true);
+    run(&mut s, "effect.apply", json!({"effect": "stylize.dropShadow", "ids": [ids[0].0]}));
+    run(&mut s, "select.set", json!({"ids": [ids[0].0, ids[1].0]}));
+    run(&mut s, "object.setBounds", json!({"width": 224, "reference": 0, "strokes": false}));
+    let v = s.transform_bounds(&ids).unwrap();
+    assert!(close(v, Rect::new(-1.0, 95.0, 222.0, 155.0)), "the group with a shadow: {v:?}");
+}
+
 #[test]
 fn the_bounding_box_handles_sit_on_the_preview_bounds() {
     // Drag from the visual right edge (10 pt outside the path) 100 pt to the right.

crates/engine/src/tests_printadvanced.rs

@@ -84,11 +84,11 @@ fn a_flattener_preset_flattens_transparency_before_printing() {
         any
     };
     assert!(transparent(doc(&s)));
-    let none = super::cmd::printadvanced::prepare("file.print", doc(&s), &settings(json!({})), &saved).unwrap();
+    let none = super::cmd::printadvanced::prepare("file.print", doc(&s), &settings(json!({})), &saved, false).unwrap();
     assert!(none.is_none(), "transparency prints live without a preset");
     for name in ["High Resolution", "low"] {
         let set = settings(json!({"advanced": {"flattenerPreset": name}}));
-        let flat = super::cmd::printadvanced::prepare("file.print", doc(&s), &set, &saved).unwrap().unwrap();
+        let flat = super::cmd::printadvanced::prepare("file.print", doc(&s), &set, &saved, false).unwrap().unwrap();
         assert!(!transparent(&flat), "{name}: flattened");
     }
     // A saved preset by name; an unknown one is refused by preview and print alike.
@@ -105,7 +105,7 @@ fn print_as_bitmap_prints_an_image_of_each_artboard() {
     s.execute("artboard.new", &json!({"x": 300, "y": 0, "width": 200, "height": 100})).unwrap();
     let saved = s.prefs.flattener_presets.clone();
     let set = settings(json!({"advanced": {"printAsBitmap": true}}));
-    let bitmap = super::cmd::printadvanced::prepare("file.print", doc(&s), &set, &saved).unwrap().unwrap();
+    let bitmap = super::cmd::printadvanced::prepare("file.print", doc(&s), &set, &saved, false).unwrap().unwrap();
     let mut kinds = vec![];
     bitmap.walk(|n| kinds.push(matches!(n.kind, NodeKind::Image(_))));
     assert_eq!(kinds.iter().filter(|k| **k).count(), 1, "one image: the empty artboard gets none");
@@ -127,5 +127,33 @@ fn print_as_bitmap_prints_an_image_of_each_artboard() {
     let pv = s.execute("print.preview", &seps).unwrap();
     assert!(pv["warnings"].as_array().unwrap().iter().any(|w| w.as_str().unwrap().contains("Print as Bitmap")));
     let set = settings(seps["settings"].clone());
-    assert!(super::cmd::printadvanced::prepare("file.print", doc(&s), &set, &saved).unwrap().is_none());
+    assert!(super::cmd::printadvanced::prepare("file.print", doc(&s), &set, &saved, false).unwrap().is_none());
+}
+
+/// Appearance of Black › Printing / Exporting (#394): Print as Bitmap draws pure CMYK black as RGB
+/// black when `rich_black` is on.
+#[test]
+fn print_as_bitmap_honours_rich_black() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 20, "height": 20, "colorMode": "cmyk"})).unwrap();
+    s.execute("paint.setStroke", &json!({"none": true})).unwrap();
+    s.execute("paint.setFill", &json!({"color": {"c": 0, "m": 0, "y": 0, "k": 1}})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 20, "height": 20})).unwrap();
+    let set = settings(json!({"advanced": {"printAsBitmap": true}}));
+    let saved = s.prefs.flattener_presets.clone();
+    let centre = |prepared: &Document| {
+        let mut key = None;
+        prepared.walk(|n| {
+            if let NodeKind::Image(im) = &n.kind {
+                key = Some(im.key.clone());
+            }
+        });
+        let bytes = &prepared.images[key.as_ref().expect("bitmap image")].bytes;
+        let img = image::load_from_memory(bytes).unwrap().to_rgba8();
+        img.get_pixel(img.width() / 2, img.height() / 2).0
+    };
+    let accurate = centre(&super::cmd::printadvanced::prepare("file.print", doc(&s), &set, &saved, false).unwrap().unwrap());
+    assert!(accurate[0] > 10, "accurate: dark grey, {accurate:?}");
+    let rich = centre(&super::cmd::printadvanced::prepare("file.print", doc(&s), &set, &saved, true).unwrap().unwrap());
+    assert_eq!(rich, [0, 0, 0, 255], "rich: RGB black");
 }

crates/engine/src/tests_rasterfilters.rs

@@ -106,10 +106,19 @@ fn listed_applied_edited_and_undone() {
             assert_eq!((&e["raster"], &e["menu"]), (&json!(true), &json!(["Effect", menu])), "{id}");
         }
     }
-    // Junk parameters are stored as given and read clamped; the canvas still draws.
+    // Numbers far out of range are stored as given and read clamped; the canvas still draws.
     for (id, _) in EFFECTS {
-        s.execute("effect.apply", &json!({"effect": id, "ids": [g], "params": {"amount": 1e308, "radius": -1e308, "threshold": "x", "quality": 7}}))
-            .unwrap();
+        let defaults = vectorcraft_render::effects::default_params(id).unwrap();
+        let junk: serde_json::Map<String, Value> = defaults
+            .as_object()
+            .unwrap()
+            .iter()
+            .filter(|(_, v)| v.is_number())
+            .enumerate()
+            .map(|(i, (k, _))| (k.clone(), json!(if i % 2 == 0 { 1e308 } else { -1e308 })))
+            .collect();
+        assert!(!junk.is_empty(), "{id}");
+        s.execute("effect.apply", &json!({"effect": id, "ids": [g], "params": junk})).unwrap();
     }
     let _ = render(&s);
     let n = s.doc().unwrap().doc.node(NodeId(g)).unwrap().clone();