Release 0.14.0

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+updates:
+  # Maintain Rust / Cargo dependencies
+  - package-ecosystem: "cargo"
+    directories:
+      - "/"
+      - "/crates/affinity/fuzz"
+      - "/crates/plugins/example"
+    schedule:
+      interval: "daily"
+      time: "06:00"
+      timezone: "America/New_York"
+    # Consolidate updates into a single PR rather than one PR per crate
+    groups:
+      cargo-dependencies:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # Maintain GitHub Actions workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+      time: "06:00"
+      timezone: "America/New_York"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "ci(deps)"

.github/workflows/freebsd.yml

@@ -35,48 +35,5 @@ jobs:
     uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
     with:
       require-craft-fonts: true
-      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
-
-  package:
-    name: FreeBSD 14 (package)
-    # The release build takes a while: only for PRs that touch FreeBSD packaging (or dependencies)
-    # and on demand, not on every push to main.
-    if: github.event_name != 'push'
-    runs-on: ubuntu-latest
-    timeout-minutes: 150
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Japanese, Chinese, Arabic and Thai fonts, embedded by crates/text/build.rs (CRAFT_FONTS_DIR in the VM).
-      # Bump the commit deliberately; see craftrules standards/fonts.md.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
-          path: craft-fonts
-      - name: Package in a FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
-        with:
-          release: "14.3"
-          usesh: true
-          mem: 12288
-          prepare: |
-            pkg install -y bash curl git pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 alsa-lib
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
-          run: |
-            . "$HOME/.cargo/env"
-            git config --global --add safe.directory "$PWD"
-            # Build outside the checkout so only dist/ is copied back out of the VM.
-            # The craft-fonts checkout is synced into the VM with the workspace.
-            export CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1
-            export CARGO_TARGET_DIR=/var/tmp/vectorcraft-target CARGO_BUILD_JOBS=4
-            bash packaging/freebsd/package.sh
-            # Every part the package must have, the craft-fonts licences included.
-            tar -tzf dist/release/vectorcraft-*-freebsd-x86_64.tar.gz >/var/tmp/contents.txt
-            for want in '/bin/vectorcraft$' '/bin/vectorcraft-cli$' '/share/applications/.*\.desktop$' '/share/icons/hicolor/' '/share/doc/vectorcraft/NOTICE$' '/share/doc/vectorcraft/OFL-.*\.txt$'; do
-              grep -Eq "$want" /var/tmp/contents.txt || { echo "missing from the package: $want"; exit 1; }
-            done
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: freebsd-package
-          path: dist/release/*
-          if-no-files-found: error
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
+      run-package-check: true

.github/workflows/nix.yml

@@ -18,16 +18,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  eval:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
-      - name: nix flake check --no-build
-        run: |
-          if [ -f flake.nix ]; then
-            nix flake check --no-build --all-systems
-          else
-            echo "No flake.nix present in this repository; skipping check."
-          fi
+  nix:
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/nix.yml@main

.github/workflows/release.yml

@@ -26,7 +26,8 @@ jobs:
     with:
       app-name: vectorcraft
       app-title: VectorCraft
-      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
+      web-craft-fonts: true
       version: ${{ inputs.version }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}

AGENTS.md

@@ -41,6 +41,7 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
   - `vectorcraft_engine::guard` is the last line of defence. Every entry point (commands, tool events, MCP requests, the UI frame, control requests) catches a panic, rolls the document back and reports an internal error. It exists for bugs and doesn't replace `Result`: wasm aborts on panic, so the web app has no safety net.
   - Untrusted input is fuzzed (`engine/tests/import_fuzz.rs`, `engine/tests/command_sweep.rs`, `format/tests/prop_format.rs`, `mcp/tests/protocol_props.rs`). Extend these when you add an importer, a parser or a protocol method.
 - **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*` (id, label, menu path, shortcut, params doc, `enabled`, `run`) + tests. Tools emit commands (Begin/Preview/Commit). UI-only commands live in `crates/ui-egui/src/menus.rs` (`UI_COMMANDS`). The control channel and MCP reach all of them.
+- **Adding a cursor.** The app decides which cursors exist; whoever draws them works from the list. For a new tool state with a cursor of its own: add the `Cursor` variant (`crates/tools/src/lib.rs`, with a doc comment), return it from the tool's `cursor()` with a tool test, cover it in `cursor_icon` (`crates/ui-egui/src/canvas.rs`), draw it in `crates/ui-egui/src/cursors.rs` or give it a stand-in in `Cursor::stand_in()` until it's drawn, and add its `[[cursor]]` entry to `crates/tools/src/cursors.toml` (when it shows, in plain behaviour terms, and its hotspot; never another app's look). A missing entry only warns (`cargo xtask cursors`): the cursor still works.
 - **Layering** is enforced by `cargo xtask layers`. Nothing below L6 depends on egui/eframe/winit/rfd.
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)`. Colours come from `theme::Tokens`.
 - **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).

ASSETS.md

@@ -167,6 +167,7 @@ Generated-in-code art is original and has no file to list. This covers the defau
 | `assets/icons/dc-new-fill.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-new-item.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-new-stroke.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
+| `assets/icons/dc-objects-on-path.svg` | VectorCraft contributors | Original work, drawn for VectorCraft: three small squares along a curve | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-options.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-para-center.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |
 | `assets/icons/dc-para-justify-all.svg` | VectorCraft contributors | Original work, drawn for VectorCraft | MIT OR Apache-2.0 |  |

CLAUDE.md

@@ -41,6 +41,7 @@ Formerly **DrawCraft** (renamed 2026-10-01): old `.drawcraft` files and `"format
   - `vectorcraft_engine::guard` is the last line of defence. Every entry point (commands, tool events, MCP requests, the UI frame, control requests) catches a panic, rolls the document back and reports an internal error. It exists for bugs and doesn't replace `Result`: wasm aborts on panic, so the web app has no safety net.
   - Untrusted input is fuzzed (`engine/tests/import_fuzz.rs`, `engine/tests/command_sweep.rs`, `format/tests/prop_format.rs`, `mcp/tests/protocol_props.rs`). Extend these when you add an importer, a parser or a protocol method.
 - **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*` (id, label, menu path, shortcut, params doc, `enabled`, `run`) + tests. Tools emit commands (Begin/Preview/Commit). UI-only commands live in `crates/ui-egui/src/menus.rs` (`UI_COMMANDS`). The control channel and MCP reach all of them.
+- **Adding a cursor.** The app decides which cursors exist; whoever draws them works from the list. For a new tool state with a cursor of its own: add the `Cursor` variant (`crates/tools/src/lib.rs`, with a doc comment), return it from the tool's `cursor()` with a tool test, cover it in `cursor_icon` (`crates/ui-egui/src/canvas.rs`), draw it in `crates/ui-egui/src/cursors.rs` or give it a stand-in in `Cursor::stand_in()` until it's drawn, and add its `[[cursor]]` entry to `crates/tools/src/cursors.toml` (when it shows, in plain behaviour terms, and its hotspot; never another app's look). A missing entry only warns (`cargo xtask cursors`): the cursor still works.
 - **Layering** is enforced by `cargo xtask layers`. Nothing below L6 depends on egui/eframe/winit/rfd.
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)`. Colours come from `theme::Tokens`.
 - **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).

Cargo.lock

@@ -806,6 +806,11 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "craft-docpath"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
@@ -3671,6 +3676,17 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sctk-adwaita"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec"
+dependencies = [
+ "log",
+ "smithay-client-toolkit 0.19.2",
+ "tiny-skia",
+]
+
 [[package]]
 name = "self_cell"
 version = "1.3.0"
@@ -4507,7 +4523,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "arboard",
  "block2 0.6.2",
@@ -4531,6 +4547,7 @@ dependencies = [
  "vectorcraft-engine",
  "vectorcraft-text",
  "vectorcraft-ui-egui",
+ "wayland-backend",
  "wayland-client",
  "wayland-protocols",
  "webbrowser",
@@ -4538,11 +4555,12 @@ dependencies = [
  "winit",
  "winresource",
  "winsafe",
+ "zbus",
 ]
 
 [[package]]
 name = "vectorcraft-affinity"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "crc32fast",
  "flate2",
@@ -4553,7 +4571,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-brush"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "kurbo 0.13.1",
  "serde",
@@ -4565,7 +4583,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cad"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4581,7 +4599,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-cli"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "log",
  "objc2-core-foundation",
@@ -4603,7 +4621,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-color"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "kurbo 0.13.1",
  "moxcms",
@@ -4615,8 +4633,9 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-doc"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
+ "hayro-ccitt",
  "image",
  "jpeg-encoder",
  "kurbo 0.13.1",
@@ -4632,7 +4651,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-effects"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4648,14 +4667,16 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-engine"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
+ "craft-docpath",
  "crc32fast",
  "flate2",
  "image",
  "kurbo 0.13.1",
  "log",
  "proptest",
+ "roxmltree 0.21.1",
  "ruzstd",
  "serde",
  "serde_json",
@@ -4684,9 +4705,11 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-eps"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
+ "fax",
  "flate2",
+ "hayro-ccitt",
  "image",
  "kurbo 0.13.1",
  "ruzstd",
@@ -4705,7 +4728,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-format"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "flate2",
  "proptest",
@@ -4720,7 +4743,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-geom"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "kurbo 0.13.1",
  "proptest",
@@ -4732,7 +4755,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-mcp"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "image",
  "log",
@@ -4751,7 +4774,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-metafile"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4765,7 +4788,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pathops"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "kurbo 0.13.1",
  "linesweeper",
@@ -4777,7 +4800,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-pdf"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "aes",
  "craft-pdf",
@@ -4807,7 +4830,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-plugins"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -4821,7 +4844,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-render"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "flate2",
  "gif",
@@ -4848,15 +4871,16 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-scriptcheck"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "proptest",
 ]
 
 [[package]]
 name = "vectorcraft-svg"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
+ "craft-docpath",
  "flate2",
  "image",
  "kurbo 0.13.1",
@@ -4879,8 +4903,9 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-testkit"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
+ "fax",
  "image",
  "kurbo 0.13.1",
  "proptest",
@@ -4896,7 +4921,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-text"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "harfrust 0.13.3",
  "icu_segmenter",
@@ -4916,7 +4941,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-three-d"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "vectorcraft-geom",
  "vectorcraft-pathops",
@@ -4924,7 +4949,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-tools"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4940,7 +4965,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-trace"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
@@ -4952,7 +4977,7 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-ui-egui"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "craft-ui",
  "egui",
@@ -4986,13 +5011,14 @@ dependencies = [
 
 [[package]]
 name = "vectorcraft-web"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "eframe",
  "egui",
  "js-sys",
  "log",
  "rfd",
+ "serde_json",
  "vectorcraft-engine",
  "vectorcraft-format",
  "vectorcraft-text",
@@ -5933,6 +5959,7 @@ dependencies = [
  "raw-window-handle",
  "redox_syscall 0.4.1",
  "rustix 0.38.44",
+ "sctk-adwaita",
  "smithay-client-toolkit 0.19.2",
  "smol_str",
  "tracing",
@@ -6096,7 +6123,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.11.0"
+version = "0.14.0"
 dependencies = [
  "serde_json",
 ]

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/vectorcraft", "apps/vectorcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.11.0"
+version = "0.14.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -13,6 +13,7 @@ repository = "https://github.com/storytold/vectorcraft"
 [workspace.dependencies]
 craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d", default-features = false, features = ["interpret", "write"] }
 craft-print = { git = "https://github.com/storytold/craft-libs", rev = "d991bf6792f8ade99c51358bf3c1d902c8cd96b5" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
 craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
 # internal
 vectorcraft-geom = { path = "crates/geom" }
@@ -64,7 +65,7 @@ wat = "1.228"
 # Without `text` (glyph runs, through glifo and a second skrifa): the renderer draws the outlines
 # vectorcraft-text gives it. The other default features stay.
 vello_cpu = { version = "0.2", default-features = false, features = ["std", "png", "u8_pipeline", "f32_pipeline"] }
-image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
+image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp", "tga"] }
 # Without `text` and the system fonts (fontdb, harfrust and skrifa, at other versions than ours):
 # SVG import reads `<text>` from the XML itself and never gives usvg a font. A test of the SVG
 # crate turns `text` on.
@@ -79,6 +80,9 @@ flate2 = { version = "1", default-features = false, features = ["rust_backend"]
 rustix = { version = "1.1", default-features = false }
 # Zstandard decoder (pure Rust, builds for wasm32 too): the editing copy an EPS carries of its art.
 ruzstd = { version = "0.9.1", default-features = false, features = ["std"] }
+# CCITT Group 3 and Group 4 decoder (ITU-T T.4 and T.6): EPS images read through
+# `CCITTFaxDecode`. The PDF reader's hayro-syntax uses the same version.
+hayro-ccitt = "0.3"
 jpeg-encoder = { version = "0.6", default-features = false, features = ["std"] }
 gif = { version = "0.14", default-features = false, features = ["std", "raii_no_panic"] }
 # CMYK image samples (vectorcraft-doc's cmyk module): the image crate's own TIFF and JPEG

NOTICE

@@ -92,3 +92,34 @@ Assets already bundled through Hayro's default features retain their licences:
   non-visual character-mapping data; see licenses/pdf-backend/hayro-cmap/LICENSE.txt.
   Adobe and contributor names do not endorse or promote this product.
 Per-file hashes and sources are recorded in ASSETS.md.
+
+Linux Wayland window decorations
+-------------------------------
+sctk-adwaita 0.10.1 (https://github.com/PolyMeilex/sctk-adwaita,
+commit d5f343c45c04d4a026db57f76760819b7325db00) is used by winit on Linux
+for vector window controls. Its title-font features are disabled: no Cantarell
+font is embedded by this dependency and no font file is added to this repo.
+
+sctk-adwaita's MIT licence:
+
+MIT License
+
+Copyright (c) 2022 Bartłomiej Maryńczak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -11,11 +11,11 @@
 <h1 align="center">VectorCraft</h1>
 
 <p align="center">
-  <b>Vector illustration; an open-source, clean-room reimplementation of Adobe Illustrator, rebuilt in pure Rust.</b>
+  <b>Vector illustration; an open-source, modern vector art application, built in pure Rust.</b>
 </p>
 
 <p align="center">
-  A fast, open-source, clean-room take on the Adobe Illustrator workflow. It runs natively on
+  A fast, open-source vector illustration workflow. It runs natively on
   macOS, Windows, Linux and FreeBSD, and in the browser via WebAssembly. Built by the ArtCraft team.
 </p>
 
@@ -147,7 +147,7 @@ exposes to agents, and exported by VectorCraft's own renderer. The source files
 
 ## Why VectorCraft
 
-- **Familiar.** Illustrator's layout, tools, menus, panels and shortcuts: the Pen, Direct Selection,
+- **Familiar.** A familiar layout, tools, menus, panels and shortcuts: the Pen, Direct Selection,
   Pathfinder, Smart Guides, Appearance, Swatches, Layers and more. You already know how to use it.
 - **Fast.** Multithreaded SIMD rendering off the UI thread. 20,000 shapes render in about 27 ms at
   full retina resolution while the interface stays at 120 fps.
@@ -163,6 +163,8 @@ exposes to agents, and exported by VectorCraft's own renderer. The source files
 
 ## Quick start
 
+For posters and sewing patterns, see [Print a large poster across multiple pages](docs/print-tiling.md).
+
 ```sh
 git clone https://github.com/storytold/vectorcraft
 cd vectorcraft
@@ -178,6 +180,8 @@ cd apps/vectorcraft-web && trunk build --release            # web build → dist
 cargo xtask ci                                            # fmt, clippy, tests, layering, wasm, vendor names
 ```
 
+For text and custom letter shapes, see [Typography and Custom Lettering](docs/typography-lettering.md).
+
 Japanese fonts come from [storytold/craft-fonts](https://github.com/storytold/craft-fonts), an optional
 build input (releases always use it): `CRAFT_FONTS_DIR="$PWD/../craft-fonts" cargo run --release -p vectorcraft` (an absolute path).
 Without it, Japanese text uses the installed system fonts. See [`docs/development.md`](docs/development.md#fonts-craft-fonts-optional-build-input).
@@ -194,8 +198,10 @@ drag-and-drop, set **Preferences › Performance › Linux Display Server** to *
 the app with `WAYLAND_DISPLAY= vectorcraft`: the window then opens through XWayland, where drops work
 (see [`docs/development.md`](docs/development.md#linux-wayland-and-x11)).
 
-On Linux under KDE Plasma 6.3 or later with Wayland, a drawing tablet's pen moves the cursor but VectorCraft doesn't
-respond to it yet (#491). Open the window through XWayland instead, with the same preference or `WAYLAND_DISPLAY= vectorcraft` (see
+On Linux with Wayland, under KDE Plasma 6.3 or later and under GNOME, VectorCraft doesn't respond to a drawing tablet's
+pen yet (#491, #2028). Open the window through XWayland instead, where the pen works as a mouse: set the same
+preference to **X11 (XWayland)**, or to **X11 (XWayland) When a Pen Is Attached** to use XWayland only when a pen is
+attached as VectorCraft starts, and restart; or start the app with `WAYLAND_DISPLAY= vectorcraft` (see
 [`docs/development.md`](docs/development.md#linux-wayland-and-x11)).
 
 ### Use it from Claude Code and other agents
@@ -222,9 +228,8 @@ VectorCraft is under active development. [**ROADMAP.md**](ROADMAP.md) has the st
 and what's next; [`docs/target-app-parity.md`](docs/target-app-parity.md) the full parity assessment and
 [`docs/gaps.md`](docs/gaps.md) the ranked list of what's missing.
 
-**Where we are (2026-10-10): alpha.** About 88% of Illustrator 2026's menu items, tools, effects and formats exist
-(92.5% of menu items do something), feature depth is ~75%, and we estimate ~65% "ready for real work" for a mainstream illustrator (~62% against
-all of Illustrator): everyday
+**Where we are (2026-10-10): alpha.** About 88% of core menu items, tools, effects and formats exist
+(92.5% of menu items do something), feature depth is ~75%, and we estimate ~65% ready for real work for a mainstream illustrator (~62% across all tracked features): everyday
 vector illustration is close to usable: drawing and path tools,
 Pathfinder and Shape Builder, paint, gradients, appearance and transparency, type with styles, threading and Hebrew/Arabic bidirectional layout, and
 files (SVG, PDF and PDF-compatible `.ai` with PDF/X, legacy version 7 `.ai` keeping layers, groups and type, EPS, DXF, EMF/WMF, raster formats, PSD out and PSD/PSB in as their merged image, Print, Package).
@@ -236,22 +241,22 @@ doesn't write Affinity files. Current `.af` validation includes 33 pinned files,
 and every-board SVG/PDF/PSD export, with fixes for Affinity 3 artboards, source-backed JPEGs and text runs.
 [Scope and limits](crates/affinity/README.md); [source audit and remaining gaps](docs/affinity-validation.md).
 The interface
-speaks English, German, Japanese, Korean, Vietnamese, Traditional and Simplified Chinese, Spanish, French, Hungarian, Italian, Polish, Brazilian Portuguese, Russian, Swedish, Ukrainian, Finnish, Bulgarian, Greek and Czech;
+speaks English, German, Japanese, Korean, Vietnamese, Traditional and Simplified Chinese, Spanish, French, Hungarian, Italian, Polish, Brazilian Portuguese, Russian, Swedish, Ukrainian, Finnish, Bulgarian, Greek, Czech and Georgian;
 [localization-parity.md](docs/localization-parity.md) has the details.
-The scores are self-assessed from our code against Illustrator's public documentation;
+The scores are self-assessed from our code against public documentation;
 [target-app-parity.md](docs/target-app-parity.md#how-this-was-measured-2026-10-10) explains how far to trust them.
 
 **What's missing:**
-- reliable exchange of Illustrator's own `.ai` files (layer structure in real files; Illustrator's editing data isn't written);
+- reliable exchange of .ai files (layer structure in real files; proprietary editing data isn't written);
 - an interaction-fidelity pass covering every tool's modifiers and small behaviours;
 - 3D and Materials beyond the initial live Revolve (Extrude & Bevel, Inflate, Rotate, materials);
-- about half of the Photoshop-style raster effects (28 of 57 still missing; Film Grain is available under Artistic) and the Effect Gallery;
+- most of the raster effects (11 of 57 still missing; Cutout, Film Grain, Neon Glow, Plastic Wrap, Poster Edges, Smudge Stick, Sponge and Watercolor are available under Artistic, Bas Relief, Chalk & Charcoal, Charcoal, Chrome, Graphic Pen, Halftone Pattern, Note Paper, Photocopy, Plaster, Reticulation and Stamp under Sketch) and the Effect Gallery;
 - CJK composition for vertical type (vertical type itself has initial support, with a Japanese interface);
 - scripting, and the rest of Variables (image and graph kinds, dataset import);
 - generative AI features.
 
 **Where we're going:** next is the interaction-fidelity pass, `.ai` files from real users and start-up stability,
-alongside the raster-effects package; then type, the Illustrator 2026 additions and 3D. The ranked list is in
+alongside the raster-effects package; then type, recent additions and 3D. The ranked list is in
 [`docs/gaps.md`](docs/gaps.md).
 
 **Workspace:** `crates/{geom, color, doc, pathops, text, effects, three-d, trace, brush, render, svg, pdf, eps, cad, metafile, format, tools, engine, ui-egui, mcp, testkit}`
@@ -370,8 +375,6 @@ ArtCraft Team and are not covered by this license. They may be used only unmodif
 part of this repository and VectorCraft, under [`docs/brand/LICENSE-brand.txt`](docs/brand/LICENSE-brand.txt).
 Forks and modified versions must remove them.
 
-<sub>Adobe, Photoshop, Illustrator, Premiere Pro, Lightroom, Acrobat, After Effects and InDesign are trademarks or registered trademarks of Adobe Inc. in the United States and/or other countries. VectorCraft is an independent, open-source project and is not affiliated with, sponsored by or endorsed by Adobe Inc.; these names are used only to describe the workflows it is compatible with.</sub>
-
 <p align="center">
   <a href="https://getartcraft.com/"><img alt="ArtCraft" src="docs/brand/artcraft-mark.svg" width="28"></a><br>
   <sub>Made by the <a href="https://getartcraft.com/">ArtCraft</a> team and community.</sub>

ROADMAP.md

@@ -9,7 +9,7 @@
 
 **Stage: alpha** · next: beta, ~13 points (ready for real work ~62% → ~75%, and reliable `.ai` exchange) and ~170–270 h away
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-16 · **Change:** minor (about 160 community PRs of 2026-10-15/16: PDF import crash fixes, Dimension tool, legacy `.ai` save, Intertwine, web pen input, Image Trace fixes, `.ai`/EPS/PDF import fidelity, Bulgarian, Greek, Swedish and Finnish catalogs; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-19 · **Change:** minor (about 90 community PRs of 2026-10-19: Objects on Path, the Simplify slider, Pencil Edit Selected Paths in the middle of a path, Georgian, and more; Background Export progress dialog with Cancel, #2564; about 85 community PRs of 2026-10-18: Justification…, Word .docx placed as area type, CCITT Group 3 TIFF, Roman Hanging Punctuation, blend spines edited with the Anchor Point tool, shadows and glows in stack order, coloured 3D lights, a Dutch catalog completed; 3D lighting: one to ten colored lights, smooth colored Inflate, legacy white-light appearance preserved; surface batching and restored seam minimum; scores and estimates unchanged; about 145 community PRs of 2026-10-17: image-decode overflow guards, opaque floating panels, MCP export cancel and progress, editable Illustrator EPS import, scoped `doc_inspect`, Dutch, Danish and Indonesian, Simplified Chinese messages, screen-reader names; headline numbers unchanged; about 160 community PRs of 2026-10-15/16: PDF import crash fixes, Dimension tool, legacy `.ai` save, Intertwine, web pen input, Image Trace fixes, `.ai`/EPS/PDF import fidelity, Bulgarian, Greek, Swedish and Finnish catalogs; headline numbers unchanged) · **Target:** Adobe Illustrator 2026 (30.x)
 
 VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adobe Illustrator workflow. It runs
 on macOS, Windows, Linux, FreeBSD and the web (WASM), and agents can drive all of it over MCP, the CLI and a JSON
@@ -29,7 +29,7 @@ blocking it ([Alpha gate](docs/roadmap.md#alpha-gate)).
 
 | | Value | Kind |
 |---|---|---|
-| **Feature breadth** (Illustrator's menu items, tools, effects, formats exist) | **~88%** | measured in part: menu items 348/375 wired (92.8%), tools 89/92, Illustrator effects 44/50, Photoshop effects 29/57, 3D 4/4 (initial types, no materials) |
+| **Feature breadth** (Illustrator's menu items, tools, effects, formats exist) | **~88%** | measured in part: menu items 348/375 wired (92.8%), tools 89/92, Illustrator effects 46/50, Photoshop effects 46/57, 3D 4/4 (initial types, no materials) |
 | **Feature depth** (weighted by use, scored by behaviour) | **~75%** | estimated |
 | **To beta** | **~170–270 h** one agent · ~50–80 h with 4–6 agents | estimated |
 | **To full parity** | **~360–590 h** one agent · ~95–165 h with 4–6 agents | estimated |
@@ -76,11 +76,11 @@ The dimension hours overlap (feature rows hold some UI, format and AI work), so
 | Strokes, brushes, width profiles | 88% | 8–15 |
 | Appearance, transparency, graphic styles, masks | 97% | 1–2 |
 | Live vector effects | 85% | 6–10 |
-| Raster effects (Effect Gallery) — [effects-parity.md](docs/effects-parity.md) | 49% | 23–39 |
+| Raster effects (Effect Gallery) — [effects-parity.md](docs/effects-parity.md) | 81% | 8–14 |
 | 3D and Materials | ~25% | 30–55 |
 | Type core — [type-parity.md](docs/type-parity.md) | 80% | 14–19 |
 | Type advanced (CJK, spelling, Touch Type) | 50% | 20–28 |
-| Symbols, blends, envelopes, Repeat, perspective | 85% | 6–10 |
+| Symbols, blends, envelopes, Repeat, perspective | 87% | 5–9 |
 | Image Trace, graphs, image tools | 75% | 5–8 |
 | Layers, artboards, document setup | 78% | 5–8 |
 | View & navigation | 70% | 9–14 |
@@ -112,8 +112,8 @@ Weights, evidence and the missing items per area: [target-app-parity.md](docs/ta
 | Korean | `ko` | full | 100% |
 | Vietnamese | `vi` | full | 100% |
 
-Also shipped: Traditional Chinese (partial, 80%), Bulgarian, Finnish, Greek, Hungarian, Italian, Polish, Russian, Swedish and Ukrainian (full), Czech (catalog complete; render-site gaps reduced; native review pending).
-No catalog has had a native speaker's review. Details: [localization-parity.md](docs/localization-parity.md).
+Also shipped: Traditional Chinese (partial, 80%), Bulgarian, Finnish, Greek, Hungarian, Italian, Polish, Russian, Swedish, Ukrainian and Georgian (full), Czech (catalog complete; render-site gaps reduced; native review pending).
+The Georgian catalog has had a native speaker's review; no other catalog has. Details: [localization-parity.md](docs/localization-parity.md).
 
 ## Upcoming
 
@@ -123,7 +123,7 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap
 2. **`.ai` files from real users** (G9): layer structure, guides, speed: 10–20 h.
 3. **Launch and stability on real machines** (G10): 20–35 h.
 4. **Core-tool correctness** (G11: Shape Builder regions, Asset Export borders): 8–15 h.
-5. **Raster effects** (G2) alongside: 28 filters and the Effect Gallery, 23–39 h.
+5. **Raster effects** (G2) alongside: the 11 remaining filters (7 Artistic, 3 Sketch, 1 more) and the Effect Gallery, 8–14 h.
 6. **Then:** type core and advanced type (G4), the Illustrator 2026 additions (G13), 3D (G3).
 
 ## Progress log
@@ -134,6 +134,14 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap
 
 | Date | What landed |
 |---|---|
+| 2026-10-18 | Inch rulers divide the inch in half, not in ten. Zooming in stepped an inch ruler through 0.2, 0.1 and 0.05 of an inch, marks an inch ruler does not carry; below an inch the steps are binary fractions now, 1/2 down to 1/16, with the unlabelled ticks between them binary too (down to 1/128, so the 32nds, 64ths and 128ths appear as the report expects), while the metric units, points, pixels and picas keep their tenths. A label carries the decimals its step needs, so a sixteenth reads 0.0625 rather than the rounded 0.06, with trailing zeros dropped (#2827). Headline numbers unchanged. |
+| 2026-10-18 | Exported and saved files can repeat their bytes: PNG, PDF, EPS, legacy `.ai`, packaged zips and `.vectorcraft` saves recorded the wall-clock time they were made in, so the same commands run twice gave different bytes though the pixels matched. `SOURCE_DATE_EPOCH` now stands in for the clock in everything a file records, as the reproducible-builds specification defines it; a date a command is given still wins, and a malformed value is ignored rather than refusing the export. The recovery heartbeat and the seed PDF encryption draws on keep the real clock, so a password-protected PDF still differs between runs (#2880). Headline numbers unchanged. |
+| 2026-10-18 | About 85 community PRs landed in two batches through the full gate, with our fixes on top. New: Word `.docx` files place as area type with their formatting (#2766), CCITT Group 3 TIFF files open (#2770), Paragraph panel menu › Roman Hanging Punctuation (#2775), the Anchor Point tool edits blend spine points and handles (#2643, fixes #2544), shadows and glows each draw from the art with the effects before them, without the old exponential cost (#2395), one to ten coloured lights in 3D effects (#2706), Artboard Options X and Y with a reference point (#2739), more Contextual Task Bar actions (#2471), Optical Margin Alignment for a whole thread (#2773), History panel Step Backward/Forward and Set History Limit (#2764), Edit › Undo and Redo name the step as the History panel does (#2774), bounding-box handles snap to the grid, pixels and guides (#2715), Ctrl/Cmd+A in the Artboards panel (#2761), Tabs panel menu items (#2742), Import Data Sets defines variables from header cells (#2736), a Linux option to use X11 when a pen is attached (#2717). Fidelity and robustness: variable fonts named by their default weight and fallback glyphs keep bold and italic (#2733, #2732), legacy `.ai` layer names in Windows Latin-1 (#2722), WMF window mapping (#2721), Magic Wand inside isolation (#2720), type values out of range in files are clamped (#2728, #2757), raster effects stay responsive in drags (#2745), exports and Save for Web report undecodable images (#2762, #2737, #2684), Windows-safe exported file names (#2738), a marquee skips a Shaper Group's originals (#2772). Second batch: an export progress dialog with Cancel on the shared cancel token (#2564), CMYK gradient meshes drawn several times faster within a 16 MB cap (#2802), Paragraph panel menu › Justification… with file values clamped (#2771), Edit › Clear History (#2843), SVG image links keep their spelling (#2837, fixes main's Windows test failures), the Linux save dialog through the XDG portal (#2783), RGB input stored as CMYK in CMYK documents (#2812), legacy `.ai` export of images and radial highlights (#2801, #2807), `.ai` import notes for damaged editing data, page sizes and variable libraries (#2799, #2800, #2842), PDF and `.ai` keep their creation date (#2838), undecodable images left out of PDF exports with a note (#2790), MCP input waits for queue room (#2776), slice, snapping, selection, type and accessibility fixes (#2794–#2797, #2805, #2806, #2809, #2815, #2844–#2846), dropdowns close after a keyboard pick (#2824), plug-in dialogs scroll (#2840). Languages: the Dutch catalog completed (#2730). Headline numbers unchanged (estimated). |
+| 2026-10-19 | About 90 community PRs landed in batches through the full gate, with our fixes on top (formatting, catalog rows, small correctness fixes). New: Objects on Path (#3066), Object › Path › Simplify's slider with Auto-Simplify and More Options (#2555), Pencil Edit Selected Paths redraws the middle of a selected path (#2905), Pencil Tool Options' Alt key toggles to Smooth Tool (#2685), 3D solids built from each stroke's outline (#3049), Live Paint Selection Tool Options (#3052), Locate Selected Objects in the Layers panel (#3033), Snap to Unit for tab stops (#3039), DXF circles and arcs as native entities (#2962), Targa files (#2765), a Georgian interface (#2045), Traditional Chinese status and error messages (#2784), the web page's `window.vectorcraft` control channel (#2943), `select.color` (#2939), reproducible export bytes with `SOURCE_DATE_EPOCH` (#2947), Spacing Guides on resizes (#2966) and measurement labels on more tools. Fixed: number fields step to the next whole unit (#2916), a click away from edited type makes no new text (#2922), inch rulers in halves (#2951), Recent cards in New Document (#2904), Japanese W-weights in SVG (#2896), the point-type baseline marker (#2897) and the Reshape tool's falloff (#2900). Headline numbers unchanged. |
+| 2026-10-17 | Background Export shows a progress dialog: the file being exported, the artboard count and a bar, Cancel (Esc) and Continue in Background. It runs on the shared cancel token of #2546, so a cancelled export writes no file and keeps no half-drawn pattern tile or effect raster; translated in every language with complete menus (#2564). Headline numbers unchanged. |
+| 2026-10-17 | About 145 community PRs landed in six batches, each through the full gate, plus our fixes on top. Crashes and hostile input: an image's RGBA size is checked from its header before decoding, without overflowing, in the renderer, sampling, recoloring and Crop Image (#2442, #2468, #2407), PDF Add Around and huge art are clamped (#2440), graph axis labels past i64, `+` in hex colours and XML ids are handled (#2610, #2470, #2447), Document Raster Effects resolutions open in range (#2579), Batch names stay in their folder (#2504). Regressions: floating panel groups are opaque again while the docked card keeps its rounded corners (#2499), the Wayland pointer returns over panels (#2502). New: MCP cancels long exports, answers while one runs and reports progress (#2546), `doc_inspect` takes ids, kind and paging (#2543), raster export of a page rectangle (#2511), `text.create` returns bounds (#2478), PDF presets and ICC profiles persist (#2547), screen-reader names for widgets (#2611), Expand on Intertwine (#2622, fixes #2540), Duplicate/Copy/Cut of several artboards (#2567), print presets by name (#2607), TSV data sets (#2608), planar TIFF (#2598), Alt-click a swatch onto a gradient stop (#2623), Shift-click ranges in Links, Graphic Styles and Libraries (#2612, #2613, #2618), Space+Shift rotates the view (#2601), Presentation Mode keys (#2583), Small Caps and super/subscript buttons (#2508). Fidelity: editable vector art from Illustrator EPS (#2571), `.ai` Drop Shadow Darkness (#2513), overprint preview with Darken (#2514), Generic CMYK black round-trips (#2503), PNG sRGB chunk (#2519), kerning at a caret (#2518), tab widths in justified area type (#2487), Transform copies keep their own gradients (#2486), smooth Zig Zag (#2475), Live Corners round up to their neighbours (#2484), kerning across style runs (#2554), SVG letter spacing on justified lines (#2574), Dimension tool snapping (#2482), gradient chips (#2495), Transform panel flips and percentages (#2400, #2404). Later the same day: PostScript `.ps` and `.epsf` files open (#2461), EPS images with CCITTFax compression draw (#2445), Illustrator 3 EPS without layers (#2436), `.ai` type opacity and blend modes (#2420), envelope meshes and compound holes in `.ai` (#2410, #2444), CMYK image soft masks in PDF export (#2448), Show Transparency Grid saved with the document (#2488), Save Selection in the Layers panel menu (#2483), Character and Paragraph Reset Panel (#2479, #2438), Cmd/Ctrl+Shift double-click releases a guide (#2467), Shift+Enter keeps a field active (#2431), Shift keeps reshaped handles perpendicular (#2425), emptied type keeps its style (#2464), Smart Blur radius (#2443), freeform gradients recolour (#2397), mesh slivers (#2456), Recolor wheel handles in CMYK (#2454), and six Image Trace fixes (#2387, #2584, #2586–#2589). Fifth batch: Optical Margin Alignment (#2563), Window › Blend panel (#2573), graph column designs (#2406), Live Paint Gap Options (#2424), the SVG Interactivity panel (#2437), RTF placed as area type (#2524), the Touch Type tool (#2469), pattern fills expand into clipped tiles (#2616), Save and Export ask before replacing a file an added extension names (#2619), the Artboard tool's Control bar and Contextual Task Bar (#2559, #2556), Alt-click New Artboard for its options (#2496), Shift-click in Brushes (#2562), the Move dialog remembers the last move (#2542), PDF export uses the document's assigned profiles (#2536), Printer Setup opens the selected printer's preferences on Windows (#2577). Sixth batch: Effect › Artistic › Cutout, Neon Glow and Poster Edges (#2453), View › Rulers › Change to Global / Artboard Rulers (#2416), Symbol Options 9-slice guides (#2512), Create Gradient Mesh on an embedded image (#2538), Rotate View cursors and the Mac trackpad rotation gesture (#2594, #2644), choice parameters as dropdowns in the inline effect editor (#2582), Group Selection picks and moves one path of a compound path (part of #2441), Shift-click ranges in the Artboards panel (#2626), Lock Variables (#2631), a layer dropped under the last row goes to the bottom (#2632), and robustness work: huge selections draw bounded overlays (#2635, #2645, part of #2460), values out of range in presets and files are clamped (#2656), whole-number checks for counts (#2638, #2659), exports warn about overset type (#2628), symbol instances measured by their art (#2614), colour-managed Eyedropper in CMYK documents (#2664). Later: Effect › Rasterize (#2409), variable-font axis sliders in the Character panel (#2710), Image Trace Create Strokes on an exact distance transform with Guo–Hall thinning and a skeleton graph (#2703–#2705), Auto Color keeps rare colours (#2702), large images trace with a warning (#2700), a 1e9 pt input bound on Reshape Segment, Convert Anchor Point and the Pencil (#2709), task-bar Connect, Corner and Smooth for selected anchors (#2697), PDF 0 w strokes import as hairlines (#2696), threading text from theLine truncated
+| 2026-10-16 | Symbol Options › Export Type (Graphic or Movie Clip, default Movie Clip) with Registration; `symbol.options` / `symbol.list` (G5).
+| 2026-10-15 | Cursors: 36 more tool states get cursors of their own. Node editing follows the public manual (Direct Selection's anchor squares, Reshape Segment, Group Selection's plus, the arrow hollow on a snap, the Alt-copy arrowheads), the Anchor Point caret, the Curvature pen and Free Transform's side-shear arrows are drawn; Lasso, the freehand, symbolism and other tools borrow a drawn cursor until theirs is drawn. `crates/tools/src/cursors.toml` lists every cursor for whoever draws them, and `cargo xtask cursors` warns about one missing from it. Scores unchanged. |
 | 2026-10-16 | About 160 community PRs landed, each through the full gate. Crashes and hostile files: damaged PDF dictionaries and arrays no longer crash import (#2133, #2240, #2244, #2271), area type with huge row or column counts opens (#2109), hostile mesh edges are bounded (#2051). New: Dimension tool (#1788), legacy version 7 `.ai` save (#1794), Object › Intertwine (#2095), Apple Pencil and touch input on the web (#1740), Sample Color from Screen (#2257), Drop Shadow Darkness (#2252), Smart Blur edge modes (#2154), Scribble variations (#2180), Free Distort corners in its dialog (#2134), Rotate View presets (#2106), tritanopia proofing (#2234), Layers panel filters (#2087), Hide Template (#2117), File › Automate Batch through the Actions panel (#1938), dataset and graph CSV (#1929, #1941), Reset Tracking and Kerning (#2274), Alt+Enter copies in Transform fields (#2236), Shift+Tab panels (#2254), Control bar isolation, Recolor and image Replace (#2258, #2079, #2081). Revolve renders smooth with Cap on by default (#1193); Image Trace keeps tiny parts, thin outlines and shared corners, and Grayscale gradients are grey (#2012, #2025, #2263, #2264, #2265, #1879). Import: many `.ai`, EPS and PDF fidelity fixes (#2014–#2016, #2029, #2030, #2044, #2046, #2050–#2052, #2058, #2129, #2199, #2202, #2218), images up to 1 GB decoded (#2060), `.ai`/`.ait`/`.svgz` files paste from a file manager (#2148, #2201). Fixes across fields (arithmetic #2069, #2209, #2022; caret #1403), New Document (#2158, #2176), menus (#2232), shortcuts (#2235, #2146), Transform Each axes (#2227), Paste in Place (#1926), Color Picker tab order (#1937, #1939) and more. Languages: Bulgarian, Greek, Swedish and Finnish complete under the tests, pt-br completed. Details per PR in the PRs; headline numbers unchanged (estimated). |
 | 2026-10-14 | Brazilian Portuguese (`pt-br`) covers the whole interface and status/error messages under the completeness tests (#1914); Localization 71% → 74% (measured), hours 55–90 → 50–85. |
 | 2026-10-14 | Direct Selection: deleting an interior anchor of an open path leaves separate surviving runs. Delete/Backspace and history regressions cover the gap; explicit Remove Anchors remains connected. Headline numbers unchanged. |
@@ -159,6 +167,7 @@ Ranked; detail in [docs/roadmap.md](docs/roadmap.md) and [docs/gaps.md](docs/gap
 | 2026-10-12 | A `.ai` file with placed (linked) pictures opens from its editing data, with its guides, sublayers and hidden objects: each picture is a linked image in its place, showing the low-resolution preview the file keeps until its file is found or relinked (#1264). Scores unchanged. |
 | 2026-10-12 | Desktop printing adopts the shared `craft-print` spooler with exact physical sheet sizes. Windows 7 retains its WMI/viewer transport and excludes the shared backend; compatibility CI checks the dependency tree and PE imports. Scores unchanged. |
 | 2026-10-12 | Graphs: Object › Graph › Design… and Marker… (designs with a preview, New Design, Rename, Delete Design, Paste Design, Select Unused, and markers drawn with a design or None) (#1092); Graph Data opens as a worksheet with Import Data…, column width and decimals (#1138), and takes Transpose, Switch x/y, `|` line breaks in labels and the pie Legend, Position and Sort options (#1115); Graph Type adds Add Drop Shadow and Add Legend Across Top (#1119), widths past 100%, First Row and First Column in Front, and Draw Filled Lines (#1136); graphs keep their label formatting when drawn again (#1137). Align: a Horizontal & Vertical Align Center button (#1073); Align to Key Object makes the topmost selected object the key (#1221), and the palette's key entry reads Cancel Key Object (#1224). Pen: the nearest end wins over snapping, Alt on the last anchor edits it, and Enter, Escape or a tool switch finish a handle preview as one undo step (#821). Direct Selection: a click on an anchor of an already selected path selects that anchor alone (#1237). Make Compound Path keeps the backmost object's paint, and a selected member reads and changes the compound's fill rule (#1225). Shape Builder and Live Paint no longer turn a line's loose end past a crossing into a piece that runs out and back (#1230). Art moved or duplicated with an artboard follows Transform Pattern Tiles (#1219). A click with the Rectangular Grid tool opens its options dialog (#1169). Commands that change nothing (Lock, Hide, Transform Each, Rearrange Artboards and others) add no undo step (#1233). Saving with missing placed files keeps their relink data, and .ai export honours the chosen artboards (#718). SVG export keeps Unicode data-attribute names, and SVG Options refuses an invalid artboard range (#989). CMYK colours given in percent with a component under 1 keep their scale (#1249). Colour Image Trace keeps close dark tones apart (#1247). macOS: the Save sheet has a Format menu (#1235). The Hand and Zoom tools show drawn cursors on every platform (#1238). Czech: the remaining strings are translated, and Pathfinder's Add reads "Sjednotit" (#1226). MCP: a lost reply reports that the edit may have happened instead of replaying it (#1246); `select.key` checks its id and agents can read the key object (#1222). Tests: the command sweeps and import fuzz tests fail on a panic caught by the engine's guard (#1218), and the envelope export test ignores PDF dates and file IDs (#1220). Effect › Artistic › Film Grain (Grain, Highlight Area, Intensity; Photoshop-style filters 29/57) (#1282), and Craquelure, Mosaic Tiles and Stained Glass redraw 25–30% faster with identical pixels (#1265). Direct Selection: clicking a segment selects only that segment, and Delete removes just it (#1300); Shift-click deselects one anchor of a path selected whole (#1263). Pen + Alt converts anchors of paths inside a selected group or compound path (#1306). The Curvature tool shows circular point markers without direction handles (#1284). Snap to Point: pressing near an anchor drags by that anchor, with Smart Guides on or off (#1313). Transform Again repeats the options of the transform it repeats (#1303). Aligning anchors that are already aligned adds no undo step (#1276), and type commands that change nothing record none either (#1316). Simplify keeps the path selected with its new anchors, and its dialog previews and shows the anchor count (#1305). Adding a stroke colour to an unpainted zero-width stroke gives it a visible 1 pt width (#1256). The Eyedropper samples locked objects, template layers and art outside isolation mode (#1260), and shows a pipette cursor (#1288). Fonts named by their full name resolve to the right face (#1267), and Proportional Metrics brings the matching kerning (`apkn`, `vkrn`, `vapk`) (#1291). Artboards: Escape leaves Artboard editing (#1296), Document Setup's Edit Artboards switches to the Artboard tool (#1294), and the Artboard tool starts on the active artboard (#1309). New and imported documents use the Gridline every and Subdivisions preferences (#1314). Send to Current Layer refuses a hidden or locked current layer (#1301), and layer row commands check explicit ids (#1255). Links: Find in Folder… finds missing linked files in a folder and its subfolders and can copy them into the document's folder (#1287). Image Trace traces images over 64 megapixels scaled down instead of refusing them (#1315). DXF export marks closed curves as closed SPLINE entities (#1320). EPS import: closepath respects the path size limit (#1311). The interface is available in Hungarian (#1302), and more Czech labels are translated (#1259). Linux RPMs declare shared-library capabilities (#1290). CI pins every third-party action to a verified commit (#1321). Select menu commands skip hidden and locked art and stay inside the isolated group in isolation mode (#1325). Fill, stroke, gradient and Appearance panel commands that change nothing add no undLine truncated
+| 2026-10-12 | Georgian interface (`ka`, ქართული): the whole catalog, plurals and messages, tested complete; Georgian letters come from an installed font (SF Georgian, Sylfaen, Noto Sans Georgian, DejaVu Sans) from the first frame; Type › Change Case › Title Case and Sentence case leave Georgian lower case instead of turning it into Mtavruli. |
 | 2026-10-11 | Effect › Brush Strokes: Accented Edges, Angled Strokes, Crosshatch, Dark Strokes, Ink Outlines, Spatter, Sprayed Strokes, Sumi-e (G2). Command parameters from agents and files checked before anything changes (paint, place, cuts, dashes, crop, asset ids, anchors, paths, distort; #984–#999); command dialogs keep whole numbers whole, so Create Object Mosaic takes the tiles typed (#1000); stepper arrows take Shift (×10) and Ctrl/Cmd (÷10) like the arrow keys (#991). Exports and Rasterize supersample Art Optimized edges, so shapes meeting edge to edge leave no seam (#983). Character and paragraph styles take leading, kerning, mojikumi and the other attributes left out at their defaults (#1001). Drawing, typing and pasting with no layer shown and unlocked is refused instead of adding art to a hidden or locked layer (#1002). MCP `add_text` gives type on or in a path the colour asked for (#1003). MCP `screenshot` of a connected app renders the artboard asked for (#1004). `vectorcraft-cli run` ends quietly when its reader closes early (#1005). Select › All on Active Artboard selects on the artboard made active, not always the first (#1006). Reverse Gradient keeps off-centre midpoints, mirrored (#1007). A polar grid with no radial dividers draws none (#1008). Use Precise Cursors also covers the Pen's join pointer (#1009). SVGs with one absolute and one unitless root side import at their size, unstretched (#1010). DXF US survey inches, yards and miles open at their size and name (#1011). A file placed into a document with no other links follows its first change even while the app sits idle (#1031). PDF import keeps the style a font name says when the file doesn't embed the font (#1023). Shift selects ruler guides and art together, and Delete removes both (#1022). Open filled paths are hit by their fill on every side, the rotate cursor bows around the corner it is at, the flip icons match their flips, the Color Picker previews on the selection, and Properties › Transform reaches Scale Corners and Scale Strokes & Effects (#1036). Offset Path and the other booleans finish on outlines where the sweep used to loop until memory ran out (linesweeper 0.5, #1028). Floating panel groups stack into sets that move together, collapse to their tabs and dock as extra dock columns that scroll (#1020). Ruler guides live on layers: listed in the Layers panel, shown, hidden, locked, duplicated, merged and deleted with their layer, and moved between layers (#1021). A `.ai` whose editing data uses global process colours (`Xk`/`XK`) or pattern fills keeps its sublayers: the colours come in as global swatches at their tint, the patterns as pattern swatches (#1025). A `.ai` in PostScript form opens through its layers, read from the program itself, also when it names the prolog defining its operators without including it, as Rhino and other CAD apps write it (#1027). A fill or stroke chosen while the Type tool has characters selected colours just those characters (#1063). Scaled type shows its scaled font size, leading, baseline shift and horizontal scale in the Character panel, and a size typed there is the size you get (#1034). Character panel menu › Proportional Metrics sets Japanese and Chinese full-width glyphs on the font's proportional widths in horizontal type (#966). Align, Distribute, Move, Arrange, Lock, Hide, Ungroup and other Object commands that would change nothing no longer record an undo step or mark the document changed (#1060). Spot colours defined in Lab open with their Lab values from `.ai` and PDF files, instead of as wrong RGB colours or their CMYK equivalents (#1032). Build scripts leave a generated source they wouldn't change untouched, so the next build doesn't compile most of the workspace again where file times lose their sub-second part (#1051). A fill colour recolours the gradient mesh point last clicked with the Mesh tool or Direct Selection, and a Mesh tool click on a mesh's point selects that mesh (#1052). The All Tools drawer stays two tools wide instead of filling a wide window (#1054). Text Wrap's Make, Release and Options refuse a list of object ids with a malformed or unknown id instead of skipping it (#1055). A freeform gradient line with a malformed point index is refused instead of being shortened to the indices that are valid (#1056). The Corners dialog (`ui.corners`) refuses a malformed object id or a listed anchor that isn't a corner instead of editing the selection or the other corners (#1057). New View refuses a centre that isn't exactly [x, y] and a rotation that isn't a number, instead of trimming the one and saving the other as 0° (#1058). The command sweeps try junk scale, spacing and artboard values too, which they had skipped since before those bugs were fixed (#1059). EPS and PostScript `arc` and `arcn` with huge angles no longer hang the import, and an arc whose angles are whole turns apart is empty, as the PostScript reference defines it (#1062). Align and DisLine truncated
 | 2026-10-10 | Initial live Revolve (Effect › 3D and Materials, #846, #605), in its own `three-d` crate. Progress docs re-measured and restructured to the craftrules standard (this page, `docs/target-app-parity.md`, `gaps.md`, `ui-parity.md`, the format, hardware, localization, effects and type checklists). Same day: v0.8.0; Effect › Distort, Pixelate and Texture filters (13); German interface; Variables (data merge); Graph Type value axes and tick marks; restart when the first frame never reaches the screen (#964) |
 | 2026-10-09 | Radial Blur, Smart Blur, Unsharp Mask (gap 2 begins); 340 commits, the busiest day |
@@ -176,6 +185,10 @@ The full pre-standard record of what landed is kept in [docs/roadmap.md](docs/ro
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-17 | minor | Colored Inflate: shared membrane normals and smooth RGB vector ramps replace flat polygon bands; channel groups are batched per solid-fill surface. White-light Inflate retains its original polygons, paint composition and seam joins; the 0.05 seam minimum is restored. Scores and hour estimates unchanged. |
+| 2026-10-16 | minor | 3D lighting: one to ten directional lights, a selectable light list, Add Light and Delete Light, independent settings and artboard gestures; ambient applied once and smooth RGB vector export; scores and hour estimates unchanged |
+| 2026-10-16 | minor | 3D lighting: opaque RGB Color for the shared directional light, with neutral ambient, preview/reset controls and smooth vector Revolve shading; scores and hour estimates unchanged |
+| 2026-10-17 | minor | Progress log row for the Background Export progress dialog (#2564); headline numbers unchanged. |
 | 2026-10-14 | minor | G11: open-path anchor Delete removes adjoining segments without bridging the gap; explicit Remove Anchors keeps its reconnect/refit behavior. Scores and hours unchanged. |
 | 2026-10-14 | minor | Document fonts register every explicitly supplied craft-fonts family after the existing Japanese, Arabic and Thai prefix; optional empty input remains supported. Headline scores and estimates are unchanged. |
 | 2026-10-14 | minor | Progress log rows for the later merges of 2026-10-14 (#1630–#1875 as listed there); headline numbers unchanged. |

apps/vectorcraft-cli/src/main.rs

@@ -78,16 +78,20 @@ USAGE:
 
   vectorcraft-cli run [--in FILE] [--cmd ID [--params JSON]]... [--export FILE]... [--scale N]
       Headless batch: open FILE (any readable format) or start a new document, run commands in
-      order, export each FILE in the format its extension picks (see Writable formats). Prints one
-      JSON result per step.
+      order, export each FILE in the format its extension picks (see Writable formats; a .ait FILE
+      is a template, written as file.saveAsTemplate writes it). --scale sizes raster exports
+      (pixels per point, default 1); other formats leave it out. Prints one JSON result per step.
 
   vectorcraft-cli commands
       Print the command catalogue as JSON.
 
   vectorcraft-cli convert IN OUT [--scale N] [--artboard I | --range R] [--outline-text] [--decimals N] [--replace-lossy] [--editing-data] [--ai-version 7|pdf] [--hidden-objects layer|omit|visible] [--transparent-images flatten|omit]
       Open IN (any readable format) and export OUT in the format its extension picks (see Writable
-      formats). --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
+      formats). --scale sizes a raster OUT (pixels per point, default 1); other formats leave it
+      out. --artboard is 0-based, --range 1-based (\"1-3,5\"); a PDF gets every artboard
       unless one of them is given, EPS the bounds of the art, the other formats the first artboard.
+      A .ait OUT is a template of every artboard, written as file.saveAsTemplate writes it (not with
+      --artboard or --range).
       Live effects are kept, and hidden layers and objects (written hidden in SVG and PSD), with
       SVG's data-* attributes; --outline-text writes SVG text as paths, --decimals sets SVG's coordinate
       precision (1–7, default 3). OUT may not be IN when reading
@@ -159,6 +163,16 @@ fn main() -> ExitCode {
     }
 }
 
+/// A headless session that remembers what the user keeps between runs: the PDF presets saved, the
+/// ICC profiles loaded and the plug-ins installed (#2168, #2174, #2541), in the folders next to the preferences that the desktop
+/// app uses too. `VECTORCRAFT_NO_PREFS` and `VECTORCRAFT_CONFIG_DIR` apply as they do there.
+fn with_stores(mut h: Headless) -> Headless {
+    prefs_dir::attach_profile_store(&mut h.session);
+    prefs_dir::attach_plugin_store(&mut h.session);
+    prefs_dir::attach_pdf_preset_store(&mut h.session);
+    h
+}
+
 fn mcp(args: &[String]) -> Result<(), String> {
     let mut connect: Option<String> = None;
     let mut headless = false;
@@ -198,14 +212,14 @@ fn mcp(args: &[String]) -> Result<(), String> {
         eprintln!("vectorcraft-cli: files confined: read root {}, write root {}", show(roots.read_root()), show(roots.write_root()));
         Box::new(Headless::with_document().with_automation_roots(Some(roots)))
     } else if headless {
-        Box::new(Headless::with_document())
+        Box::new(with_stores(Headless::with_document()))
     } else if let Some(addr) = connect {
         // Explicit address: fail loudly if the app isn't there.
         Box::new(Remote::connect(&addr).map_err(|e| format!("cannot connect to {addr}: {e}"))?)
     } else {
         match Remote::connect(DEFAULT_ADDR) {
             Ok(r) => Box::new(r),
-            Err(_) => Box::new(Headless::with_document()),
+            Err(_) => Box::new(with_stores(Headless::with_document())),
         }
     };
     eprintln!("vectorcraft-cli: MCP server on stdio ({})", backend.describe());
@@ -213,8 +227,8 @@ fn mcp(args: &[String]) -> Result<(), String> {
     // uses `vectorcraft_mcp` free to bring its own. Silent until a client sends logging/setLevel.
     vectorcraft_mcp::logging::install();
     let stdin = std::io::stdin();
-    let stdout = std::io::stdout();
-    Server::new(backend).serve(stdin.lock(), stdout.lock()).map_err(|e| e.to_string())
+    // The server reads and writes from threads of its own, so it takes the handles, not locks held here.
+    Server::new(backend).serve(std::io::BufReader::new(stdin), std::io::stdout()).map_err(|e| e.to_string())
 }
 
 fn commands() -> Result<(), String> {
@@ -249,6 +263,10 @@ fn convert(args: &[String]) -> Result<(), String> {
         }
     }
     let [input, output] = <[String; 2]>::try_from(files).map_err(|_| "convert needs IN and OUT")?;
+    let template = is_template(&output);
+    if template && (artboard.is_some() || range.is_some()) {
+        return Err("a .ait template holds every artboard: --artboard and --range don't apply".into());
+    }
     let mut h = Headless::new();
     let opened = if editing_data {
         let params = json!({"path": input, "editingData": "always"});
@@ -256,16 +274,23 @@ fn convert(args: &[String]) -> Result<(), String> {
     } else {
         h.call("app.open", json!({"path": input})).map_err(|e| format!("open {input}: {e}"))?
     };
-    // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
-    // PSD).
-    let mut params = json!({"path": output, "scale": scale, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
-    if let Some(decimals) = decimals {
-        params["decimals"] = json!(decimals);
-    }
+    let (command, mut params) = if template {
+        // Save as Template writes every artboard, with the .ai options.
+        ("file.saveAsTemplate", json!({"path": output, "format": "ait", "outlineText": outline_text, "acknowledgeLoss": replace_lossy}))
+    } else {
+        // A conversion keeps hidden layers and objects, written hidden, where the format can (SVG,
+        // PSD).
+        let params = json!({"path": output, "artboard": artboard, "range": range, "outlineText": outline_text, "hiddenLayers": true, "acknowledgeLoss": replace_lossy});
+        let mut params = with_pixel_scale(params, &output, scale);
+        if let Some(decimals) = decimals {
+            params["decimals"] = json!(decimals);
+        }
+        ("document.export", params)
+    };
     for (key, value) in legacy {
         params[key] = json!(value);
     }
-    let mut r = h.call("engine.execute", json!({"command": "document.export", "params": params})).map_err(|e| format!("export {output}: {e}"))?;
+    let mut r = h.call("engine.execute", json!({"command": command, "params": params})).map_err(|e| format!("export {output}: {e}"))?;
     // What reading the input left out (a missing linked file, an unsupported filter…) matters as
     // much as what writing the output did.
     if let (Some(w), Some(out)) = (opened.get("warnings").filter(|w| w.as_array().is_some_and(|a| !a.is_empty())), r.as_object_mut()) {
@@ -275,6 +300,21 @@ fn convert(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
+/// Is `path` a `.ait` template? `file.saveAsTemplate` writes it; exports don't.
+fn is_template(path: &str) -> bool {
+    vectorcraft_engine::cmd::fileio::format_for_name(path).is_some_and(|f| f.id == "ait")
+}
+
+/// The export `params` for `path`, with `--scale` (pixels per point) when its format is raster.
+/// DXF has a `scale` of its own (drawing units per unit), which would resize the drawing and leave
+/// its units unset.
+fn with_pixel_scale(mut params: Value, path: &str, scale: f64) -> Value {
+    if vectorcraft_engine::cmd::fileio::writable_format(None, Some(path)).is_ok_and(|f| f.raster) {
+        params["scale"] = json!(scale);
+    }
+    params
+}
+
 fn info(args: &[String]) -> Result<(), String> {
     let file = args.first().ok_or("info needs a FILE")?;
     let mut h = Headless::new();
@@ -327,7 +367,7 @@ fn run(args: &[String]) -> Result<(), String> {
         }
     }
 
-    let mut h = Headless::new();
+    let mut h = with_stores(Headless::new());
     let mut out = std::io::stdout().lock();
     // A reader that stopped early (a closed pipe) isn't an error, and the batch goes on: its later
     // steps (an export…) still run, unprinted.
@@ -361,7 +401,12 @@ fn run(args: &[String]) -> Result<(), String> {
                 r
             }
             Step::Export(path) => {
-                let r = h.call("app.export", json!({"path": path, "scale": scale})).map_err(|e| format!("export {path}: {e}"))?;
+                let r = if is_template(&path) {
+                    h.call("engine.execute", json!({"command": "file.saveAsTemplate", "params": {"path": path, "format": "ait"}}))
+                } else {
+                    h.call("app.export", with_pixel_scale(json!({"path": path}), &path, scale))
+                };
+                let r = r.map_err(|e| format!("export {path}: {e}"))?;
                 emit(json!({"step": "export", "result": r}))?;
                 r
             }

apps/vectorcraft-cli/tests/cli.rs

@@ -7,10 +7,18 @@ use serde_json::{Value, json};
 
 const BIN: &str = env!("CARGO_BIN_EXE_vectorcraft-cli");
 
+/// Returns the path of `name` in `vectorcraft-cli-test-<pid>` in the temp folder. The first call removes
+/// that folder and creates it again empty.
 fn tmp(name: &str) -> std::path::PathBuf {
-    let dir = std::env::temp_dir().join(format!("vectorcraft-cli-test-{}", std::process::id()));
+    static DIR: std::sync::OnceLock<std::path::PathBuf> = std::sync::OnceLock::new();
+    DIR.get_or_init(|| empty_dir(std::env::temp_dir().join(format!("vectorcraft-cli-test-{}", std::process::id())))).join(name)
+}
+
+/// Removes `dir` and everything in it, creates it again empty and returns it.
+fn empty_dir(dir: std::path::PathBuf) -> std::path::PathBuf {
+    let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir.join(name)
+    dir
 }
 
 #[test]
@@ -50,6 +58,28 @@ fn run_batch_exports() {
     assert_eq!(last["result"]["artboards"][0]["width"], 200.0);
 }
 
+#[test]
+fn scale_sizes_raster_exports_only() {
+    // --scale is pixels per point. DXF has a `scale` of its own (drawing units per mm) that would
+    // resize the drawing and leave its units unset.
+    let svg = tmp("scale.svg");
+    std::fs::write(&svg, r#"<svg xmlns="http://www.w3.org/2000/svg" width="100" height="50"><rect x="10" y="10" width="30" height="20"/></svg>"#)
+        .unwrap();
+    let svg = svg.to_str().unwrap();
+    let (plain, scaled, png) = (tmp("plain.dxf"), tmp("scaled.dxf"), tmp("scaled.png"));
+    let ok = |args: &[&str]| {
+        let out = Command::new(BIN).args(args).output().unwrap();
+        assert!(out.status.success(), "{args:?}: {}", String::from_utf8_lossy(&out.stderr));
+    };
+    ok(&["convert", svg, plain.to_str().unwrap()]);
+    ok(&["convert", svg, scaled.to_str().unwrap(), "--scale", "2"]);
+    assert!(std::fs::read(&scaled).unwrap() == std::fs::read(&plain).unwrap(), "convert --scale 2 changed the DXF");
+    ok(&["run", "--in", svg, "--export", scaled.to_str().unwrap(), "--export", png.to_str().unwrap(), "--scale", "2"]);
+    assert!(std::fs::read(&scaled).unwrap() == std::fs::read(&plain).unwrap(), "run --scale 2 changed the DXF");
+    // 100 pt at scale 2 → 200 px (IHDR width).
+    assert_eq!(std::fs::read(&png).unwrap()[16..20], 200u32.to_be_bytes());
+}
+
 #[test]
 fn run_reports_errors() {
     let out = Command::new(BIN).args(["run", "--cmd", "nope.nothing"]).output().unwrap();
@@ -87,7 +117,20 @@ fn mcp_headless_over_stdio() {
 /// server starts, and the process then reads and writes only inside its roots.
 #[test]
 fn mcp_automation_roots() {
-    let base = tmp("roots");
+    automation_roots(&tmp("roots"));
+}
+
+/// A run that has the process id of an earlier run finds that run's files and links in its folder.
+/// `empty_dir`, which `tmp` uses, removes them, so the run can make them again instead of failing
+/// with "File exists".
+#[test]
+fn mcp_automation_roots_in_a_folder_an_earlier_run_left() {
+    let dir = tmp("earlier-run");
+    automation_roots(&dir.join("roots"));
+    automation_roots(&empty_dir(dir).join("roots"));
+}
+
+fn automation_roots(base: &std::path::Path) {
     for d in ["in", "out", "outside"] {
         std::fs::create_dir_all(base.join(d)).unwrap();
     }
@@ -346,3 +389,97 @@ fn run_with_a_closed_stdout_ends_quietly_and_finishes_the_batch() {
     let out = Command::new(BIN).args(["run", "--cmd", "not-a-command"]).stdout(Stdio::null()).output().unwrap();
     assert!(!out.status.success());
 }
+
+/// A fresh settings folder for one test (`VECTORCRAFT_CONFIG_DIR`), so no run reads or writes the
+/// developer's real profile.
+fn config_dir(name: &str) -> std::path::PathBuf {
+    let dir = tmp(&format!("config-{name}"));
+    let _ = std::fs::remove_dir_all(&dir);
+    dir
+}
+
+/// One `vectorcraft-cli run` with `steps` ((command, params)) against the settings folder `config`;
+/// the result of each step.
+fn run_in(config: &std::path::Path, steps: &[(&str, Value)]) -> Vec<Value> {
+    let mut cmd = Command::new(BIN);
+    cmd.arg("run").env("VECTORCRAFT_CONFIG_DIR", config).env_remove("VECTORCRAFT_NO_PREFS");
+    for (id, params) in steps {
+        cmd.args(["--cmd", id, "--params", &params.to_string()]);
+    }
+    let out = cmd.output().unwrap();
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    String::from_utf8(out.stdout).unwrap().lines().map(|l| serde_json::from_str::<Value>(l).unwrap()["result"].clone()).collect()
+}
+
+/// An ICC file of an RGB profile named `name` (a built-in one with its description replaced by a
+/// name of the same length).
+fn icc_file_named(path: &std::path::Path, name: &str) {
+    let builtin = "Display P3";
+    assert_eq!(builtin.len(), name.len());
+    let utf16 = |s: &str| s.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>();
+    let mut bytes = vectorcraft_color::cms::icc_bytes(builtin).unwrap().to_vec();
+    let (from, to) = (utf16(builtin), utf16(name));
+    let at = bytes.windows(from.len()).position(|w| w == from).expect("the description in the profile");
+    bytes[at..at + to.len()].copy_from_slice(&to);
+    std::fs::write(path, bytes).unwrap();
+}
+
+fn profile_names(settings: &Value) -> Vec<&str> {
+    settings["profiles"].as_array().unwrap().iter().map(|p| p["name"].as_str().unwrap()).collect()
+}
+
+/// #2168, #2174: the PDF presets saved and the ICC profiles loaded in one headless run are there in
+/// the next run, and gone again once deleted.
+#[test]
+fn saved_pdf_presets_and_loaded_profiles_survive_a_restart() {
+    let config = config_dir("restart");
+    let icc = tmp("studio-p3.icc");
+    icc_file_named(&icc, "StudioRGB3");
+    let r = run_in(
+        &config,
+        &[
+            ("pdf.preset.save", json!({"name": "Press", "description": "for the printer"})),
+            ("color.loadProfile", json!({"path": icc.to_str().unwrap()})),
+        ],
+    );
+    assert_eq!(r[1]["name"], "StudioRGB3");
+
+    let r = run_in(&config, &[("pdf.preset.list", json!({})), ("edit.colorSettings", json!({}))]);
+    let presets: Vec<&str> =
+        r[0]["presets"].as_array().unwrap().iter().filter(|p| p["builtIn"] == false).map(|p| p["name"].as_str().unwrap()).collect();
+    assert_eq!(presets, ["Press"]);
+    assert_eq!(r[0]["presets"].as_array().unwrap().iter().find(|p| p["name"] == "Press").unwrap()["description"], "for the printer");
+    assert!(profile_names(&r[1]).contains(&"StudioRGB3"), "{:?}", profile_names(&r[1]));
+    // The profile works as a working space, and the file it came from can go.
+    std::fs::remove_file(&icc).unwrap();
+    let steps = [
+        ("edit.colorSettings", json!({"rgb": "StudioRGB3"})),
+        ("pdf.preset.delete", json!({"name": "Press"})),
+        ("edit.colorSettings", json!({"rgb": vectorcraft_color::cms::SRGB})),
+        ("color.removeProfile", json!({"name": "StudioRGB3"})),
+    ];
+    let r = run_in(&config, &steps);
+    assert_eq!(r[0]["rgb"], "StudioRGB3");
+    assert_eq!(r[3]["removed"], "StudioRGB3");
+
+    let r = run_in(&config, &[("pdf.preset.list", json!({})), ("edit.colorSettings", json!({}))]);
+    assert!(r[0]["presets"].as_array().unwrap().iter().all(|p| p["builtIn"] == true));
+    assert!(!profile_names(&r[1]).contains(&"StudioRGB3"));
+}
+
+/// Runs without preferences (`VECTORCRAFT_NO_PREFS`) keep what they save for the run only, and
+/// leave nothing in the settings folder.
+#[test]
+fn runs_without_preferences_remember_nothing() {
+    let config = config_dir("noprefs");
+    let out = Command::new(BIN)
+        .args(["run", "--cmd", "pdf.preset.save", "--params", r#"{"name":"Press"}"#])
+        .env("VECTORCRAFT_CONFIG_DIR", &config)
+        .env("VECTORCRAFT_NO_PREFS", "1")
+        .output()
+        .unwrap();
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    assert!(!config.exists(), "nothing written");
+    let r = run_in(&config, &[("pdf.preset.list", json!({}))]);
+    assert!(r[0]["presets"].as_array().unwrap().iter().all(|p| p["builtIn"] == true));
+}

apps/vectorcraft-cli/tests/fileio.rs

@@ -8,9 +8,16 @@ use serde_json::Value;
 
 const BIN: &str = env!("CARGO_BIN_EXE_vectorcraft-cli");
 
+/// Returns the path of `name` in `vectorcraft-cli-fileio-<pid>` in the temp folder. The first call
+/// removes that folder and creates it again empty.
 fn tmp(name: &str) -> String {
-    let dir = std::env::temp_dir().join(format!("vectorcraft-cli-fileio-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
+    static DIR: std::sync::OnceLock<std::path::PathBuf> = std::sync::OnceLock::new();
+    let dir = DIR.get_or_init(|| {
+        let dir = std::env::temp_dir().join(format!("vectorcraft-cli-fileio-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    });
     dir.join(name).to_string_lossy().to_string()
 }
 
@@ -172,3 +179,28 @@ fn convert_writes_legacy_ai_with_its_options() {
     assert!(!bad.status.success());
     assert!(String::from_utf8_lossy(&bad.stderr).contains("hiddenObjects"), "{}", String::from_utf8_lossy(&bad.stderr));
 }
+
+/// convert and `run --export` write a `.ait` as Save as Template does: a PDF-compatible template of
+/// every artboard that opens as a new untitled document.
+#[test]
+fn convert_and_run_write_ait_templates() {
+    let pdf = tmp("template-in.pdf");
+    make(&pdf, 120, 80);
+    let (converted, exported) = (tmp("converted.ait"), tmp("exported.ait"));
+    let r: Value = serde_json::from_str(&ok(&["convert", &pdf, &converted])).unwrap();
+    assert_eq!((&r["format"], &r["path"]), (&Value::from("ait"), &Value::from(converted.as_str())), "{r}");
+    let r: Value = serde_json::from_str(ok(&["run", "--in", &pdf, "--export", &exported]).lines().nth(1).unwrap()).unwrap();
+    assert_eq!(r["result"]["format"], "ait", "{r}");
+    for ait in [&converted, &exported] {
+        assert!(std::fs::read(ait).unwrap().starts_with(b"%PDF"), "{ait}");
+        let opened: Value = serde_json::from_str(ok(&["run", "--in", ait]).lines().next().unwrap()).unwrap();
+        let opened = &opened["result"];
+        assert_eq!((&opened["format"], &opened["restored"]), (&Value::from("ait"), &Value::from(true)), "{opened}");
+        assert!(opened["title"].as_str().is_some_and(|t| t.starts_with("Untitled-")), "{opened}");
+        assert_eq!(info(ait)["artboards"].as_array().unwrap().len(), 2, "{ait}");
+    }
+    // A template holds every artboard: one can't be picked.
+    let one = Command::new(BIN).args(["convert", &pdf, &tmp("one.ait"), "--artboard", "0"]).output().unwrap();
+    assert!(!one.status.success());
+    assert!(String::from_utf8_lossy(&one.stderr).contains("every artboard"), "{}", String::from_utf8_lossy(&one.stderr));
+}

apps/vectorcraft-web/Cargo.toml

@@ -26,6 +26,7 @@ log = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
 rfd = { workspace = true }
 wasm-bindgen = "0.2"
+serde_json = { workspace = true }
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
 web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "PointerEvent", "TouchEvent", "AddEventListenerOptions", "DomRect", "DragEvent", "Storage", "Navigator", "RequestInit", "Response", "AbortController", "AbortSignal"] }

apps/vectorcraft-web/src/api.rs

@@ -0,0 +1,184 @@
+//! `window.vectorcraft`: the control channel for the page, as promises.
+//!
+//! The same JSON methods as the desktop control server (`docs/control-protocol.md`), so an agent
+//! driving VectorCraft in a browser tab (or an `<iframe>` in another app) uses the same commands as
+//! the CLI and the MCP server:
+//!
+//! ```js
+//! await vectorcraft.execute("object.rectangle", {x: 0, y: 0, width: 100, height: 50})  // engine command → its result
+//! await vectorcraft.request("ui.inspect")                      // control method → its result
+//! await vectorcraft.commands()                                 // command list
+//! const {base64} = await vectorcraft.screenshot()              // the canvas as PNG (base64)
+//! await vectorcraft.openFile("logo.svg", bytes)               // opened as a dropped file is
+//! vectorcraft.captureDownloads(true)                           // saves stay in the page…
+//! vectorcraft.files(); await vectorcraft.readFile("logo.png")  // …to be read back
+//! ```
+//!
+//! Results resolve with the method's `result`; errors reject with an `Error`.
+
+use std::cell::{Cell, RefCell};
+use std::sync::mpsc::{Receiver, Sender, TryRecvError};
+
+use serde_json::{Value, json};
+use vectorcraft_ui_egui::ControlRequest;
+use wasm_bindgen::prelude::*;
+
+use crate::saved_files::SavedFiles;
+
+use crate::web::Inbox;
+
+type Waiting = (Receiver<Value>, js_sys::Function, js_sys::Function);
+
+thread_local! {
+    static TX: RefCell<Option<Sender<ControlRequest>>> = const { RefCell::new(None) };
+    static WAITING: RefCell<Vec<Waiting>> = const { RefCell::new(Vec::new()) };
+    static CTX: RefCell<Option<egui::Context>> = const { RefCell::new(None) };
+    static INBOX: RefCell<Option<Inbox>> = const { RefCell::new(None) };
+    static CAPTURE: Cell<bool> = const { Cell::new(false) };
+    static SAVED: RefCell<SavedFiles> = RefCell::new(SavedFiles::default());
+}
+
+/// Wire the page's requests to the app: control requests go to `tx`, opened files to `inbox`.
+/// After a graphics restart the app keeps its channel: `tx` is `None` and only the context changes.
+pub fn connect(tx: Option<Sender<ControlRequest>>, inbox: Inbox, ctx: egui::Context) {
+    if let Some(tx) = tx {
+        TX.with(|t| *t.borrow_mut() = Some(tx));
+    }
+    INBOX.with(|i| *i.borrow_mut() = Some(inbox));
+    CTX.with(|c| *c.borrow_mut() = Some(ctx));
+}
+
+fn repaint() {
+    CTX.with(|c| {
+        if let Some(ctx) = c.borrow().as_ref() {
+            ctx.request_repaint();
+        }
+    });
+}
+
+/// Keep a save instead of downloading it, when the page asked for that. True when kept.
+pub fn capture(path: &str, bytes: &[u8]) -> bool {
+    if !CAPTURE.with(Cell::get) {
+        return false;
+    }
+    SAVED.with(|s| s.borrow_mut().keep(path, bytes));
+    true
+}
+
+fn to_js(v: &Value) -> JsValue {
+    js_sys::JSON::parse(&v.to_string()).unwrap_or(JsValue::NULL)
+}
+
+fn from_js(v: &JsValue) -> Value {
+    if v.is_undefined() || v.is_null() {
+        return json!({});
+    }
+    js_sys::JSON::stringify(v).ok().and_then(|s| s.as_string()).and_then(|s| serde_json::from_str(&s).ok()).unwrap_or(json!({}))
+}
+
+/// Settle the promises of answered requests (called every frame).
+pub fn poll_replies() {
+    WAITING.with(|w| {
+        w.borrow_mut().retain(|(rx, resolve, reject)| match rx.try_recv() {
+            Ok(v) => {
+                if v.get("ok").and_then(Value::as_bool) == Some(true) {
+                    let _ = resolve.call1(&JsValue::NULL, &to_js(v.get("result").unwrap_or(&Value::Null)));
+                } else {
+                    let msg = v.get("error").and_then(Value::as_str).unwrap_or("error").to_string();
+                    let _ = reject.call1(&JsValue::NULL, &js_sys::Error::new(&msg));
+                }
+                false
+            }
+            Err(TryRecvError::Empty) => true,
+            Err(TryRecvError::Disconnected) => {
+                let _ = reject.call1(&JsValue::NULL, &js_sys::Error::new("request dropped"));
+                false
+            }
+        });
+    });
+}
+
+fn request(method: &str, params: Value) -> js_sys::Promise {
+    let method = method.to_string();
+    let p = js_sys::Promise::new(&mut |resolve, reject| {
+        let (req, rx) = ControlRequest::new(method.clone(), params.clone());
+        let sent = TX.with(|t| t.borrow().as_ref().is_some_and(|tx| tx.send(req).is_ok()));
+        if sent {
+            WAITING.with(|w| w.borrow_mut().push((rx, resolve, reject)));
+        } else {
+            let _ = reject.call1(&JsValue::NULL, &js_sys::Error::new("VectorCraft is not running yet"));
+        }
+    });
+    repaint();
+    p
+}
+
+fn set_fn(obj: &js_sys::Object, name: &str, f: JsValue) -> Result<(), JsValue> {
+    js_sys::Reflect::set(obj, &name.into(), &f).map(|_| ())
+}
+
+/// Install `window.vectorcraft`.
+pub fn install() -> Result<(), JsValue> {
+    let obj = js_sys::Object::new();
+    set_fn(
+        &obj,
+        "request",
+        Closure::<dyn Fn(String, JsValue) -> js_sys::Promise>::new(|method: String, params: JsValue| request(&method, from_js(&params)))
+            .into_js_value(),
+    )?;
+    set_fn(
+        &obj,
+        "execute",
+        Closure::<dyn Fn(String, JsValue) -> js_sys::Promise>::new(|command: String, params: JsValue| {
+            request("engine.execute", json!({"command": command, "params": from_js(&params)}))
+        })
+        .into_js_value(),
+    )?;
+    set_fn(&obj, "commands", Closure::<dyn Fn() -> js_sys::Promise>::new(|| request("engine.commands", json!({}))).into_js_value())?;
+    set_fn(&obj, "inspect", Closure::<dyn Fn() -> js_sys::Promise>::new(|| request("ui.inspect", json!({}))).into_js_value())?;
+    set_fn(
+        &obj,
+        "screenshot",
+        Closure::<dyn Fn(JsValue) -> js_sys::Promise>::new(|params: JsValue| request("ui.screenshot", from_js(&params))).into_js_value(),
+    )?;
+    set_fn(
+        &obj,
+        "openFile",
+        Closure::<dyn Fn(String, js_sys::Uint8Array) -> JsValue>::new(|name: String, bytes: js_sys::Uint8Array| {
+            let queued = INBOX.with(|i| {
+                i.borrow().as_ref().is_some_and(|inbox| {
+                    inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes.to_vec()));
+                    true
+                })
+            });
+            repaint();
+            JsValue::from_bool(queued)
+        })
+        .into_js_value(),
+    )?;
+    set_fn(&obj, "captureDownloads", Closure::<dyn Fn(bool)>::new(|on: bool| CAPTURE.with(|c| c.set(on))).into_js_value())?;
+    set_fn(
+        &obj,
+        "files",
+        Closure::<dyn Fn() -> JsValue>::new(|| {
+            SAVED.with(|s| to_js(&Value::Array(s.borrow().list().map(|(n, size)| json!({"path": n, "size": size})).collect())))
+        })
+        .into_js_value(),
+    )?;
+    set_fn(
+        &obj,
+        "readFile",
+        Closure::<dyn Fn(String) -> Result<JsValue, JsValue>>::new(|name: String| {
+            SAVED.with(|s| {
+                s.borrow()
+                    .get(&name)
+                    .map(|b| js_sys::Uint8Array::from(b).into())
+                    .ok_or_else(|| js_sys::Error::new(&format!("{name}: not found")).into())
+            })
+        })
+        .into_js_value(),
+    )?;
+    let w = web_sys::window().ok_or("no window")?;
+    js_sys::Reflect::set(&w, &"vectorcraft".into(), &obj)?;
+    Ok(())
+}

apps/vectorcraft-web/src/main.rs

@@ -16,12 +16,16 @@
 //! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?lang=es` (any
 //! language code) stands in for the browser's languages when the interface language is Automatic.
 
+#[cfg(target_arch = "wasm32")]
+mod api;
 #[cfg(target_arch = "wasm32")]
 mod fonts;
 #[cfg(target_arch = "wasm32")]
 mod locks;
 #[cfg(any(target_arch = "wasm32", test))]
 mod pencil;
+#[cfg(any(target_arch = "wasm32", test))]
+mod saved_files;
 #[cfg(target_arch = "wasm32")]
 mod web;
 

apps/vectorcraft-web/src/saved_files.rs

@@ -0,0 +1,70 @@
+//! What the page keeps of the app's saves (`api.rs`): `readFile` reads them back.
+
+/// Saved files kept (the oldest go first).
+pub const MAX_SAVED: usize = 16;
+
+/// The last component of a `/` or `\` path.
+fn file_name(path: &str) -> &str {
+    path.rsplit(['/', '\\']).next().filter(|n| !n.is_empty()).unwrap_or(path)
+}
+
+/// Files by name, newest last: saving a name again replaces it.
+#[derive(Default)]
+pub struct SavedFiles(Vec<(String, Vec<u8>)>);
+
+impl SavedFiles {
+    /// Keep `bytes` under the last component of `path`.
+    pub fn keep(&mut self, path: &str, bytes: &[u8]) {
+        let name = file_name(path).to_string();
+        self.0.retain(|(n, _)| *n != name);
+        self.0.push((name, bytes.to_vec()));
+        let extra = self.0.len().saturating_sub(MAX_SAVED);
+        self.0.drain(..extra);
+    }
+
+    /// A kept file by its name, or by a path ending in it.
+    pub fn get(&self, name: &str) -> Option<&[u8]> {
+        let wanted = file_name(name);
+        self.0.iter().find(|(n, _)| n == wanted).map(|(_, b)| b.as_slice())
+    }
+
+    /// `(name, size)` of each kept file, oldest first.
+    pub fn list(&self) -> impl Iterator<Item = (&str, usize)> {
+        self.0.iter().map(|(n, b)| (n.as_str(), b.len()))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn keeps_by_name_replaces_and_reads_back_by_path() {
+        let mut s = SavedFiles::default();
+        s.keep("exports/poster.png", b"one");
+        s.keep(r"C:\out\poster.png", b"two");
+        s.keep("notes.txt", b"three");
+        assert_eq!(s.list().collect::<Vec<_>>(), vec![("poster.png", 3), ("notes.txt", 5)]);
+        assert_eq!(s.get("poster.png"), Some(&b"two"[..]));
+        assert_eq!(s.get("/exports/poster.png"), Some(&b"two"[..]));
+        assert_eq!(s.get("missing.png"), None);
+    }
+
+    #[test]
+    fn drops_the_oldest_past_the_cap() {
+        let mut s = SavedFiles::default();
+        for i in 0..MAX_SAVED + 3 {
+            s.keep(&format!("f{i}.png"), &[0]);
+        }
+        assert_eq!(s.list().count(), MAX_SAVED);
+        assert_eq!(s.get("f0.png"), None);
+        assert!(s.get(&format!("f{}.png", MAX_SAVED + 2)).is_some());
+    }
+
+    #[test]
+    fn a_trailing_separator_keeps_the_whole_name() {
+        let mut s = SavedFiles::default();
+        s.keep("odd/", b"x");
+        assert_eq!(s.get("odd/"), Some(&b"x"[..]));
+    }
+}

apps/vectorcraft-web/src/web.rs

@@ -19,7 +19,7 @@ use wasm_bindgen::JsCast as _;
 use crate::locks::WebLocks;
 use crate::pencil::SharedPointers;
 
-type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
+pub(crate) type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
 
 /// Where the pointer was over the canvas during the last file drag (CSS px from its top-left) and
 /// whether Shift was held: where dropped files land.
@@ -122,9 +122,18 @@ async fn run(host: Host, canvas: web_sys::HtmlCanvasElement, moving: Option<Movi
                         // The old services asked the old context for frames.
                         app.services = services;
                         app.status("The graphics were lost and have been restarted");
+                        crate::api::connect(None, host.inbox.clone(), ctx.clone());
                         app
                     }
-                    None => VectorcraftApp::new(Session::new(), services),
+                    None => {
+                        // `window.vectorcraft`: the page's control channel (crate::api).
+                        let (control_tx, control_rx) = std::sync::mpsc::channel();
+                        crate::api::connect(Some(control_tx), host.inbox.clone(), ctx.clone());
+                        if let Err(e) = crate::api::install() {
+                            log::error!("vectorcraft-web: couldn't install window.vectorcraft: {}", js_err(e));
+                        }
+                        VectorcraftApp::new(Session::new(), services).with_control(control_rx)
+                    }
                 };
                 Ok(Box::new(WebShell { app: Some(app), host, canvas: page, loss }))
             }),
@@ -386,6 +395,7 @@ impl eframe::App for WebShell {
             }
         }
         app.logic(ctx);
+        crate::api::poll_replies();
     }
 
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
@@ -399,6 +409,7 @@ impl eframe::App for WebShell {
         if let Some(app) = &mut self.app {
             app.ui(ui);
         }
+        crate::api::poll_replies();
     }
 }
 
@@ -544,6 +555,9 @@ impl RecoveryStore for BrowserStore {
 
 /// Trigger a browser download of `bytes` named after the last component of `path`.
 fn download(path: &str, bytes: &[u8]) -> Result<(), String> {
+    if crate::api::capture(path, bytes) {
+        return Ok(());
+    }
     let js = |e: wasm_bindgen::JsValue| format!("{e:?}");
     let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "vectorcraft".into());
     let window = web_sys::window().ok_or("no window")?;

apps/vectorcraft/Cargo.toml

@@ -72,10 +72,23 @@ objc2-core-text = { version = "0.3", default-features = false, features = ["std"
 pollster = "1"
 
 [target.'cfg(target_os = "linux")'.dependencies]
+# GNOME/Wayland needs client-side window controls without a bundled title font.
+winit = { version = "0.30", default-features = false, features = ["wayland-csd-adwaita-notitle"] }
+
 # Asks the Wayland compositor which GPU it draws with (linux-dmabuf feedback, src/compositor_gpu.rs),
 # so Automatic draws on that one. Both are already in the build through winit.
 wayland-client = "0.31"
-wayland-protocols = { version = "0.32", features = ["client"] }
+wayland-protocols = { version = "0.32", features = ["client", "unstable"] }
+# The save dialog's parent window on Wayland (src/portal_save.rs): an xdg-foreign handle (in
+# wayland-protocols' `unstable` set) made on the window's own connection. MIT, already in the build
+# through winit and rfd.
+wayland-backend = { version = "0.3", features = ["client_system"] }
+
+# The save dialog's file type (src/portal_save.rs, #2679): the desktop portal over D-Bus, on the
+# systems where rfd shows the portal's dialog. MIT, already in the build through accesskit. Pinned
+# exactly: review the diff before bumping.
+[target.'cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))'.dependencies]
+zbus = "=5.19.0"
 
 [build-dependencies]
 # Icon + VERSIONINFO for vectorcraft.exe; build.rs only uses it when targeting Windows.
@@ -84,3 +97,5 @@ winresource = "0.1"
 [dev-dependencies]
 # Bound socket buffers in real loopback transport deadline regressions.
 socket2 = { workspace = true }
+# src/portal_save.rs's tests build and read the portal's D-Bus values on every system.
+zbus = "=5.19.0"

apps/vectorcraft/src/control_server.rs

@@ -383,7 +383,10 @@ mod tests {
         });
         let mut reader = BufReader::new(client.try_clone().unwrap());
         for id in [1, 2] {
-            writeln!(client, "{}", json!({"id": id, "method": "inspect"})).unwrap();
+            // The client sends each line in one write. `writeln!` on the socket sends the JSON in many
+            // small writes, and when the machine is busy, a pause of more than the 120 ms line deadline
+            // between two of them closes the connection.
+            client.write_all(format!("{}\n", json!({"id": id, "method": "inspect"})).as_bytes()).unwrap();
             let mut line = String::new();
             reader.read_line(&mut line).unwrap();
             assert_eq!(serde_json::from_str::<Value>(&line).unwrap(), json!({"id": id, "ok": true}));

apps/vectorcraft/src/cursor_theme.rs

@@ -0,0 +1,212 @@
+//! Linux Wayland: tell winit where the cursor theme is (#2450).
+//!
+//! Without the cursor-shape protocol (GNOME 46 and others) winit loads the pointer from an Xcursor
+//! theme itself. When that lookup finds nothing, no pointer is ever set and the compositor keeps
+//! showing its default one, until the canvas hides the system pointer to paint a tool glyph
+//! (`CursorIcon::None`). Then the arrow never comes back over the panels and menus. The lookup
+//! fails in a Flatpak sandbox (`XCURSOR_PATH` unset, no cursor theme in the runtime) and where the
+//! `default` theme is a dangling symlink; the desktop's own setting names a theme that loads.
+//!
+//! Where no cursor theme can be found at all (KDE or sway without gsettings), the env fix does
+//! nothing: [`theme_missing`] tells the canvas to keep the system pointer visible beside the tool glyph.
+//!
+//! This reads the desktop's cursor theme and size and sets what the user left unset, once, before
+//! any thread starts and before the window opens.
+#![cfg_attr(not(target_os = "linux"), allow(dead_code))]
+
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+
+/// Where a Flatpak sandbox mounts the host's cursor themes (user and system).
+const FLATPAK_HOST_ICONS: [&str; 2] = ["/run/host/user-share/icons", "/run/host/share/icons"];
+
+/// The desktop's cursor settings (GNOME's `org.gnome.desktop.interface`).
+#[derive(Debug, Default, PartialEq)]
+pub struct DesktopCursor {
+    pub theme: Option<String>,
+    pub size: Option<u32>,
+}
+
+/// The variables to set, given the environment, the host icon folders that exist and the
+/// desktop's cursor settings. Empty unless this is a Wayland session; variables the user set
+/// stay as they are.
+pub fn plan(var: impl Fn(&str) -> Option<OsString>, host_icons: &[&str], desktop: DesktopCursor) -> Vec<(&'static str, OsString)> {
+    let set = |name: &str| var(name).is_some_and(|v| !v.is_empty());
+    if !(set("WAYLAND_DISPLAY") || set("WAYLAND_SOCKET")) {
+        return Vec::new();
+    }
+    let mut out = Vec::new();
+    if !set("XCURSOR_PATH") && !host_icons.is_empty() {
+        out.push(("XCURSOR_PATH", OsString::from(host_icons.join(":"))));
+    }
+    if !set("XCURSOR_THEME")
+        && let Some(theme) = desktop.theme.filter(|t| !t.is_empty())
+    {
+        out.push(("XCURSOR_THEME", OsString::from(theme)));
+    }
+    if !set("XCURSOR_SIZE")
+        && let Some(size) = desktop.size.filter(|s| (1..=512).contains(s))
+    {
+        out.push(("XCURSOR_SIZE", OsString::from(size.to_string())));
+    }
+    out
+}
+
+/// Xcursor's default search path when `XCURSOR_PATH` is unset (relative entries are in `$HOME`).
+const DEFAULT_ICON_DIRS: [&str; 5] = ["~/.local/share/icons", "~/.icons", "/usr/share/icons", "/usr/share/pixmaps", "/usr/X11R6/lib/X11/icons"];
+
+/// The themes `index.theme` lists after `Inherits=`.
+fn inherits(index: &str) -> Vec<String> {
+    index
+        .lines()
+        .find_map(|l| l.trim().strip_prefix("Inherits="))
+        .map(|v| v.split([',', ';']).map(|t| t.trim().to_owned()).filter(|t| !t.is_empty()).collect())
+        .unwrap_or_default()
+}
+
+/// Can Xcursor load a pointer for the environment's theme (`XCURSOR_THEME`, else `default`)? It does
+/// when the theme, or one it inherits from, has a `default` or `left_ptr` cursor file in a folder of
+/// `XCURSOR_PATH` (else Xcursor's default folders). `read` returns a file's text, `exists` tells
+/// whether a file is there.
+pub fn theme_usable(
+    var: impl Fn(&str) -> Option<OsString>,
+    home: Option<&Path>,
+    read: impl Fn(&Path) -> Option<String>,
+    exists: impl Fn(&Path) -> bool,
+) -> bool {
+    let dirs: Vec<PathBuf> = match var("XCURSOR_PATH").filter(|v| !v.is_empty()) {
+        Some(v) => std::env::split_paths(&v).collect(),
+        None => DEFAULT_ICON_DIRS
+            .iter()
+            .filter_map(|d| match d.strip_prefix("~/") {
+                Some(rest) => home.map(|h| h.join(rest)),
+                None => Some(PathBuf::from(d)),
+            })
+            .collect(),
+    };
+    let first = var("XCURSOR_THEME").and_then(|v| v.into_string().ok()).filter(|t| !t.is_empty()).unwrap_or_else(|| "default".into());
+    let mut todo = vec![first];
+    let mut seen: Vec<String> = Vec::new();
+    while let Some(theme) = todo.pop() {
+        // Bounded: themes inherit in short chains, and a cycle must end.
+        if seen.contains(&theme) || seen.len() >= 16 {
+            continue;
+        }
+        for dir in &dirs {
+            let base = dir.join(&theme);
+            if ["default", "left_ptr"].iter().any(|c| exists(&base.join("cursors").join(c))) {
+                return true;
+            }
+            if let Some(index) = read(&base.join("index.theme")) {
+                todo.extend(inherits(&index));
+            }
+        }
+        seen.push(theme);
+    }
+    false
+}
+
+/// On this machine, after [`apply`]: is there no cursor theme Xcursor can load? Then winit never
+/// sets a pointer, and the canvas must not hide the system one (#2450).
+pub fn theme_missing() -> bool {
+    let home = std::env::var_os("HOME").filter(|h| !h.is_empty()).map(PathBuf::from);
+    !theme_usable(|n| std::env::var_os(n), home.as_deref(), |p| std::fs::read_to_string(p).ok(), |p| p.exists())
+}
+
+/// The value of a `gsettings get` line: `'Adwaita'` becomes `Adwaita`, `24` stays `24`.
+fn gsettings_value(output: &str) -> &str {
+    output.trim().trim_matches('\'')
+}
+
+#[cfg(target_os = "linux")]
+fn desktop_cursor() -> DesktopCursor {
+    let get = |key: &str| {
+        let out = std::process::Command::new("gsettings").args(["get", "org.gnome.desktop.interface", key]).output().ok()?;
+        out.status.success().then(|| String::from_utf8_lossy(&out.stdout).into_owned())
+    };
+    DesktopCursor {
+        theme: get("cursor-theme").map(|v| gsettings_value(&v).to_owned()),
+        size: get("cursor-size").and_then(|v| gsettings_value(&v).parse().ok()),
+    }
+}
+
+/// Sets `XCURSOR_PATH`, `XCURSOR_THEME` and `XCURSOR_SIZE` where a Wayland session leaves them
+/// unset. Call first thing in `main`, while the process is single-threaded.
+#[cfg(target_os = "linux")]
+#[allow(unsafe_code)]
+pub fn apply() {
+    let host: Vec<&str> = FLATPAK_HOST_ICONS.iter().copied().filter(|p| std::path::Path::new(p).is_dir()).collect();
+    for (name, value) in plan(|n| std::env::var_os(n), &host, desktop_cursor()) {
+        log::debug!("cursor theme: {name}={value:?}");
+        // SAFETY: called at the top of `main`, before the app starts any thread.
+        unsafe { std::env::set_var(name, value) };
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn env<'a>(pairs: &'a [(&'a str, &'a str)]) -> impl Fn(&str) -> Option<OsString> + 'a {
+        move |name| pairs.iter().find(|(k, _)| *k == name).map(|(_, v)| OsString::from(v))
+    }
+
+    fn adwaita() -> DesktopCursor {
+        DesktopCursor { theme: Some("Adwaita".into()), size: Some(24) }
+    }
+
+    #[test]
+    fn a_wayland_session_gets_the_desktop_theme_and_the_host_icons() {
+        let got = plan(env(&[("WAYLAND_DISPLAY", "wayland-0")]), &["/run/host/share/icons"], adwaita());
+        assert_eq!(
+            got,
+            vec![
+                ("XCURSOR_PATH", OsString::from("/run/host/share/icons")),
+                ("XCURSOR_THEME", OsString::from("Adwaita")),
+                ("XCURSOR_SIZE", OsString::from("24")),
+            ]
+        );
+    }
+
+    #[test]
+    fn settings_the_user_made_and_other_sessions_stay_untouched() {
+        let set = [("WAYLAND_DISPLAY", "wayland-0"), ("XCURSOR_PATH", "/x"), ("XCURSOR_THEME", "Bibata"), ("XCURSOR_SIZE", "32")];
+        assert!(plan(env(&set), &["/run/host/share/icons"], adwaita()).is_empty());
+        assert!(plan(env(&[("DISPLAY", ":0")]), &["/run/host/share/icons"], adwaita()).is_empty());
+        // A theme-less desktop and an absurd size set nothing.
+        let odd = DesktopCursor { theme: Some(String::new()), size: Some(0) };
+        assert!(plan(env(&[("WAYLAND_DISPLAY", "wayland-0")]), &[], odd).is_empty());
+    }
+
+    #[test]
+    fn a_theme_is_usable_directly_or_through_inherits_and_missing_otherwise() {
+        let files = ["/i/Bibata/cursors/left_ptr", "/i/Breeze/index.theme", "/i/Loop/index.theme"];
+        // Compared as paths, so the joins match on Windows too, where they use `\`.
+        let exists = |p: &Path| files.iter().any(|f| Path::new(f) == p);
+        let read = |p: &Path| {
+            if p == Path::new("/i/Breeze/index.theme") {
+                Some("[Icon Theme]\nInherits=Other, Bibata\n".to_owned())
+            } else if p == Path::new("/i/Loop/index.theme") {
+                Some("Inherits=Loop\n".to_owned())
+            } else {
+                None
+            }
+        };
+        let with = |theme: &'static str| {
+            move |n: &str| (n == "XCURSOR_PATH").then(|| OsString::from("/i")).or((n == "XCURSOR_THEME").then(|| OsString::from(theme)))
+        };
+        assert!(theme_usable(with("Bibata"), None, read, exists));
+        assert!(theme_usable(with("Breeze"), None, read, exists));
+        // No such theme, a theme without cursors, an inheritance loop: nothing to load.
+        assert!(!theme_usable(with("Nope"), None, read, exists));
+        assert!(!theme_usable(with("Loop"), None, read, exists));
+        // Unset: Xcursor's default folders and the `default` theme.
+        assert!(!theme_usable(|_| None, Some(Path::new("/home/u")), read, exists));
+    }
+
+    #[test]
+    fn gsettings_output_is_unquoted() {
+        assert_eq!(gsettings_value("'Adwaita'\n"), "Adwaita");
+        assert_eq!(gsettings_value("24\n"), "24");
+    }
+}

apps/vectorcraft/src/mac_save_format.rs

@@ -0,0 +1,253 @@
+//! macOS: the Format menu on save sheets (#866). A save panel with two or more file types (Save As,
+//! Save a Copy, Save as Template and the first Save of a new document) is an `NSSavePanel` made here
+//! instead of by rfd, whose Cocoa backend lists the extensions of every filter but not their names.
+//! The panel gets a Format menu as its accessory view
+//! (<https://developer.apple.com/documentation/appkit/nssavepanel/accessoryview>) before
+//! `beginSheetModalForWindow:completionHandler:`
+//! (<https://developer.apple.com/documentation/appkit/nssavepanel/beginsheetmodal(for:completionhandler:)>)
+//! shows it: an accessory set after the sheet began made recent macOS versions dismiss the sheet at
+//! once (#1800, #1831, #1518). Choosing a format changes the extension in the name field and puts
+//! the format's extension first in the allowed file types, which AppKit adds to a name typed without
+//! one. The save command takes the format from the extension, so an extension typed by hand still
+//! decides it.
+//!
+//! The panel retains the accessory, and the completion handler holds the panel until the sheet
+//! closes; the popup's target is the accessory itself. The accessory holds the panel weakly, so
+//! closing the sheet releases both. Reading the window from its handle and subclassing `NSView` for
+//! the menu's action have no safe API; this module allows `unsafe_code`.
+#![allow(unsafe_code)]
+
+use std::sync::mpsc::{Receiver, channel};
+
+use block2::RcBlock;
+use objc2::rc::{Retained, Weak};
+use objc2::{DefinedClass, MainThreadMarker, MainThreadOnly, define_class, msg_send, sel};
+use objc2_app_kit::{NSModalResponse, NSModalResponseOK, NSPopUpButton, NSSavePanel, NSTextField, NSView};
+use objc2_foundation::{NSArray, NSObjectProtocol, NSPoint, NSRect, NSSize, NSString, NSURL};
+use raw_window_handle::{HasWindowHandle, RawWindowHandle};
+use vectorcraft_engine::cmd::fileio;
+use vectorcraft_ui_egui::{FilePick, i18n};
+
+type Filter = (&'static str, &'static [&'static str]);
+
+/// The accessory's height and the room around and between its label and menu, in points.
+const HEIGHT: f64 = 38.0;
+const MARGIN: f64 = 12.0;
+const GAP: f64 = 8.0;
+/// The Format menu's size, in points.
+const MENU: NSSize = NSSize::new(260.0, 26.0);
+
+struct Ivars {
+    panel: Weak<NSSavePanel>,
+    filters: Vec<Filter>,
+}
+
+define_class!(
+    // SAFETY: NSView has no extra subclassing requirements; the subclass implements no Drop.
+    #[unsafe(super = NSView)]
+    #[thread_kind = MainThreadOnly]
+    #[ivars = Ivars]
+    #[name = "VectorcraftSaveFormatAccessory"]
+    struct FormatAccessory;
+
+    // SAFETY: NSObjectProtocol has no additional requirements.
+    unsafe impl NSObjectProtocol for FormatAccessory {}
+
+    impl FormatAccessory {
+        // SAFETY: AppKit's target/action sends the popup as the single object argument.
+        #[unsafe(method(chooseFormat:))]
+        fn choose_format(&self, sender: &NSPopUpButton) {
+            let Some(panel) = self.ivars().panel.load() else { return };
+            let Some(index) = usize::try_from(sender.indexOfSelectedItem()).ok() else { return };
+            let Some(extension) = self.ivars().filters.get(index).and_then(|(_, extensions)| extensions.first()) else { return };
+            set_allowed_types(&panel, &self.ivars().filters, index);
+            let name = panel.nameFieldStringValue().to_string();
+            panel.setNameFieldStringValue(&NSString::from_str(&filename(&name, extension, &self.ivars().filters)));
+        }
+    }
+);
+
+/// The file types a Format menu lists: `filters` without "every file" ones. Empty when fewer than
+/// two remain, and the panel is then left to rfd.
+fn menu_formats(filters: &[Filter]) -> Vec<Filter> {
+    let named: Vec<Filter> = filters.iter().copied().filter(|(_, extensions)| !extensions.is_empty() && !extensions.contains(&"*")).collect();
+    if named.len() < 2 { Vec::new() } else { named }
+}
+
+/// The menu entry of the suggested name's type, or the first (the request's default).
+fn initial_format(name: &str, filters: &[Filter]) -> usize {
+    let extension = fileio::extension(name);
+    filters.iter().position(|(_, extensions)| extensions.iter().any(|x| extension.eq_ignore_ascii_case(x))).unwrap_or(0)
+}
+
+/// `name` with `extension`: a format's extension (one in the menu, or any other the app reads or
+/// writes) is replaced, and other dots stay part of the name (a version number).
+fn filename(name: &str, extension: &str, filters: &[Filter]) -> String {
+    if name.is_empty() {
+        return String::new();
+    }
+    let has = fileio::extension(name);
+    let known =
+        filters.iter().any(|(_, extensions)| extensions.iter().any(|x| has.eq_ignore_ascii_case(x))) || fileio::format_for_name(name).is_some();
+    if known { std::path::Path::new(name).with_extension(extension).to_string_lossy().into_owned() } else { format!("{name}.{extension}") }
+}
+
+/// The extensions a panel with menu `filters` allows, those of entry `selected` first. AppKit adds
+/// the first one to a name typed without an extension, and a name typed with another of them is
+/// saved in that format.
+fn allowed_types(filters: &[Filter], selected: usize) -> Vec<&'static str> {
+    let first = filters.get(selected).map_or(&[][..], |(_, extensions)| *extensions);
+    let others = filters.iter().enumerate().filter(|(i, _)| *i != selected).flat_map(|(_, (_, extensions))| extensions.iter());
+    first.iter().chain(others).copied().collect()
+}
+
+/// Set `panel`'s allowed file types ([`allowed_types`]).
+fn set_allowed_types(panel: &NSSavePanel, filters: &[Filter], selected: usize) {
+    let types: Vec<Retained<NSString>> = allowed_types(filters, selected).into_iter().map(NSString::from_str).collect();
+    // rfd sets the same deprecated property (`add_filters` in its `panel_ffi.rs`).
+    #[allow(deprecated)]
+    panel.setAllowedFileTypes(Some(&NSArray::from_retained_slice(&types)));
+}
+
+/// Show the save panel for `pick` as a sheet on `window`, with a Format menu, and answer on the
+/// receiver with the path picked (none when canceled). `None` when the request has fewer than two
+/// named file types, or `window` has no AppKit window; nothing is shown then.
+pub fn begin(window: &winit::window::Window, pick: &FilePick) -> Option<Receiver<Vec<String>>> {
+    let mtm = MainThreadMarker::new()?;
+    let filters = menu_formats(&pick.filters);
+    if filters.is_empty() {
+        return None;
+    }
+    let RawWindowHandle::AppKit(handle) = window.window_handle().ok()?.as_raw() else { return None };
+    // SAFETY: the handle's view is the window's content view, which AppKit keeps alive while the
+    // window is open, and winit hands out the handle only while it is.
+    let view = unsafe { handle.ns_view.cast::<NSView>().as_ref() };
+    let parent = view.window()?;
+    let panel = NSSavePanel::savePanel(mtm);
+    let selected = initial_format(&pick.name, &filters);
+    set_allowed_types(&panel, &filters, selected);
+    if let Some(folder) = &pick.folder {
+        panel.setDirectoryURL(Some(&NSURL::fileURLWithPath_isDirectory(&NSString::from_str(folder), true)));
+    }
+    panel.setExtensionHidden(false);
+    if !pick.name.is_empty() {
+        panel.setNameFieldStringValue(&NSString::from_str(&pick.name));
+    }
+    let accessory = accessory(mtm, &panel, filters, selected);
+    panel.setAccessoryView(Some(&accessory));
+    let (tx, rx) = channel();
+    let answered = panel.clone();
+    let handler = RcBlock::new(move |response: NSModalResponse| {
+        let picked = answered.URL().and_then(|url| url.path()).map(|p| p.to_string());
+        let paths = if response == NSModalResponseOK { picked.into_iter().collect() } else { Vec::new() };
+        // The app gone meanwhile has no use for the answer.
+        let _ = tx.send(paths);
+    });
+    // The panel and its accessory are set up; AppKit keeps the handler (and the panel it holds)
+    // until the sheet closes.
+    panel.beginSheetModalForWindow_completionHandler(&parent, &handler);
+    Some(rx)
+}
+
+/// The "Format:" label and menu of `filters`, `selected` chosen, that rename `panel`'s file.
+fn accessory(mtm: MainThreadMarker, panel: &NSSavePanel, filters: Vec<Filter>, selected: usize) -> Retained<FormatAccessory> {
+    let label = NSTextField::labelWithString(&NSString::from_str(i18n::t("Format:")), mtm);
+    label.sizeToFit();
+    let size = label.frame().size;
+    label.setFrameOrigin(NSPoint::new(MARGIN, (HEIGHT - size.height) / 2.0));
+    let x = MARGIN + size.width + GAP;
+    let popup =
+        NSPopUpButton::initWithFrame_pullsDown(NSPopUpButton::alloc(mtm), NSRect::new(NSPoint::new(x, (HEIGHT - MENU.height) / 2.0), MENU), false);
+    for (name, _) in &filters {
+        popup.addItemWithTitle(&NSString::from_str(i18n::tr_ctx(i18n::current(), "file-filter", name)));
+    }
+    // The filter list comes from the built-in format registry, small enough for NSInteger.
+    if let Ok(index) = isize::try_from(selected) {
+        popup.selectItemAtIndex(index);
+    }
+    let this = FormatAccessory::alloc(mtm).set_ivars(Ivars { panel: Weak::new(panel), filters });
+    let frame = NSRect::new(NSPoint::ZERO, NSSize::new(x + MENU.width + MARGIN, HEIGHT));
+    // SAFETY: NSView's designated initializer is called once on the allocated subclass.
+    let accessory: Retained<FormatAccessory> = unsafe { msg_send![super(this), initWithFrame: frame] };
+    // SAFETY: the accessory holds the popup as a subview and AppKit keeps the accessory while the
+    // sheet is open. The selector has the target/action signature NSControl calls it with.
+    unsafe {
+        popup.setTarget(Some(&accessory));
+        popup.setAction(Some(sel!(chooseFormat:)));
+    }
+    accessory.addSubview(&label);
+    accessory.addSubview(&popup);
+    accessory
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const FILTERS: &[Filter] = &[("VectorCraft", &["vectorcraft"]), ("SVG", &["svg"]), ("PDF", &["pdf"])];
+
+    /// Save, Save As and Save a Copy list every save format with the default first; a panel with one
+    /// named type, or one for every file, gets no menu, and rfd shows it.
+    #[test]
+    fn save_panels_with_several_formats_get_the_menu() {
+        let save = menu_formats(&fileio::save_filters("vectorcraft"));
+        assert!(save.len() >= 2, "{save:?}");
+        assert_eq!(save.first().map(|(_, e)| *e), Some(&["vectorcraft"][..]));
+        assert!(menu_formats(&fileio::save_filters("svg")).first().is_some_and(|(_, e)| e.contains(&"svg")));
+        assert!(menu_formats(&fileio::template_filters("template")).len() >= 2);
+        assert!(menu_formats(&[("PDF", &["pdf"])]).is_empty());
+        assert!(menu_formats(&[("PDF", &["pdf"]), ("All files", &["*"]), ("Any", &[])]).is_empty());
+        assert_eq!(menu_formats(&[("PDF", &["pdf"]), ("All files", &["*"]), ("SVG", &["svg"])]).len(), 2);
+    }
+
+    #[test]
+    fn the_suggested_name_selects_its_format_and_an_unknown_one_the_default() {
+        for (name, index) in [("Untitled-1", 0), ("a b.SVG", 1), ("art.pdf", 2), ("version.2", 0), ("", 0)] {
+            assert_eq!(initial_format(name, FILTERS), index, "{name}");
+        }
+    }
+
+    #[test]
+    fn choosing_a_format_changes_the_extension_and_keeps_the_name() {
+        for (name, expected) in [
+            ("図面 1.vectorcraft", "図面 1.svg"),
+            ("a.PDF", "a.svg"),
+            ("art", "art.svg"),
+            ("art.v2", "art.v2.svg"),
+            ("art.svg", "art.svg"),
+            ("old.drawcraft", "old.svg"),
+            ("photo.png", "photo.svg"),
+            ("", ""),
+        ] {
+            assert_eq!(filename(name, "svg", FILTERS), expected, "{name}");
+        }
+    }
+
+    /// A name typed without an extension gets the chosen format's: AppKit adds the first allowed
+    /// type. The others stay allowed.
+    #[test]
+    fn the_chosen_format_is_the_first_allowed_type() {
+        assert_eq!(allowed_types(FILTERS, 0), ["vectorcraft", "svg", "pdf"]);
+        assert_eq!(allowed_types(FILTERS, 1), ["svg", "vectorcraft", "pdf"]);
+        assert_eq!(allowed_types(FILTERS, 2), ["pdf", "vectorcraft", "svg"]);
+        assert_eq!(allowed_types(FILTERS, 9), ["vectorcraft", "svg", "pdf"]);
+    }
+
+    /// Each entry of the Save As menu gives a name the save command reads as that entry's format.
+    #[test]
+    fn each_menu_entry_names_a_file_the_save_command_writes_in_that_format() {
+        let filters = menu_formats(&fileio::save_filters("vectorcraft"));
+        for (label, extensions) in &filters {
+            let name = filename("Untitled-1.vectorcraft", extensions[0], &filters);
+            assert_eq!(fileio::format_for_name(&name).map(|f| f.label), Some(*label), "{name}");
+        }
+    }
+
+    /// The menu's label is translated in every language with complete menus.
+    #[test]
+    fn the_label_is_translated() {
+        for lang in i18n::Lang::all().filter(|l| l.complete_menus()) {
+            assert!(i18n::has(lang, "Format:"), "{}", lang.code());
+        }
+    }
+}

apps/vectorcraft/src/main.rs

@@ -27,6 +27,7 @@ mod clipboard;
 #[cfg(feature = "wgpu")]
 mod compositor_gpu;
 mod control_server;
+mod cursor_theme;
 #[cfg(feature = "wgpu")]
 mod gpu;
 mod logging;
@@ -35,11 +36,15 @@ mod mac_fonts;
 #[cfg(target_os = "macos")]
 mod mac_menu;
 #[cfg(target_os = "macos")]
+mod mac_save_format;
+#[cfg(target_os = "macos")]
 mod mac_screen_color;
 #[cfg(target_os = "macos")]
 mod mac_window;
 #[cfg(target_os = "macos")]
 mod open_documents;
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd", test))]
+mod portal_save;
 mod prefs_dir;
 mod printing;
 #[cfg(all(windows, not(target_vendor = "win7")))]
@@ -356,10 +361,20 @@ fn make_folder(request: &PickRequest) {
     }
 }
 
-/// Show `dialog` for `request` (on the calling thread, until it closes) → the paths picked.
+/// Show `dialog` for `request` (on the calling thread, until it closes) → the paths picked. On
+/// Linux and the BSDs a save dialog with two or more file types is the desktop portal's, over
+/// `parent`, and its answer also names the file type picked ([`portal_save`]); `dialog` shows when
+/// the portal can't.
 #[cfg(not(target_os = "macos"))]
-fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest) -> Vec<String> {
+#[cfg_attr(windows, allow(unused_variables))]
+fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest, parent: &Parent) -> Vec<String> {
     make_folder(request);
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    if let PickRequest::Save(pick) = request
+        && let Some(answer) = portal_save::pick(pick, parent.as_deref())
+    {
+        return answer;
+    }
     let paths = match request {
         PickRequest::Open(_) => dialog.pick_file().into_iter().collect(),
         PickRequest::OpenMany => dialog.pick_files().unwrap_or_default(),
@@ -372,7 +387,7 @@ fn show_dialog(dialog: rfd::FileDialog, request: &PickRequest) -> Vec<String> {
 /// Show the dialog for `request` over `parent` now → the paths picked.
 #[cfg(not(target_os = "macos"))]
 fn pick_now(request: PickRequest, parent: &Parent) -> Vec<String> {
-    show_dialog(file_dialog(&request, parent), &request)
+    show_dialog(file_dialog(&request, parent), &request, parent)
 }
 
 /// macOS shows no dialog in line: its modal loop would run inside winit's event handler, and an
@@ -386,6 +401,7 @@ fn pick_now(request: PickRequest, _parent: &Parent) -> Vec<String> {
 
 /// File → Show in Folder: select `path` in Finder / Explorer, or open its folder elsewhere.
 fn reveal(path: &str) -> Result<(), String> {
+    explorer_safe(path)?;
     reveal_command(path).spawn().map(|_| ()).map_err(|e| format!("can't show {path}: {e}"))
 }
 
@@ -427,11 +443,12 @@ fn start_pick(request: PickRequest, parent: &Parent, ui: &egui::Context) -> Opti
     let dialog = file_dialog(&request, parent);
     let (tx, rx) = std::sync::mpsc::channel();
     let ui = ui.clone();
+    let parent = parent.clone();
     std::thread::Builder::new()
         .name("file-dialog".into())
         .spawn(move || {
             // The app gone meanwhile has no use for the answer.
-            let _ = tx.send(show_dialog(dialog, &request));
+            let _ = tx.send(show_dialog(dialog, &request, &parent));
             ui.request_repaint();
         })
         .ok()?;
@@ -473,7 +490,7 @@ fn start_pick(request: PickRequest, parent: &Parent, ui: &egui::Context) -> Opti
         })
         .ok()?;
     make_folder(&request);
-    // rfd builds the panel and begins the sheet here, on the main thread (as it must).
+    // The panel is built and the sheet is begun below, on the main thread (as it must).
     let dialog = dialog_for(rfd::AsyncFileDialog::new().parent(window), &request);
     let path = |f: &rfd::FileHandle| f.path().to_string_lossy().to_string();
     let answer: SheetAnswer = match request {
@@ -485,12 +502,18 @@ fn start_pick(request: PickRequest, parent: &Parent, ui: &egui::Context) -> Opti
             let picked = dialog.pick_files();
             Box::pin(async move { picked.await.unwrap_or_default().iter().map(path).collect() })
         }
-        PickRequest::Save(_) => {
-            // Nothing is added to the sheet once rfd has begun it: an accessory view set then made
-            // recent macOS versions dismiss the sheet at once, so nothing could be saved (#1800).
-            let picked = dialog.save_file();
-            Box::pin(async move { picked.await.iter().map(path).collect() })
-        }
+        // A save panel with two or more named file types is built by `mac_save_format`, which sets
+        // up its Format menu before the sheet begins (#866); rfd shows the others.
+        PickRequest::Save(pick) => match mac_save_format::begin(window, &pick) {
+            // The dialog thread blocks here until the sheet answers.
+            Some(picked) => Box::pin(async move { picked.recv().unwrap_or_default() }),
+            None => {
+                // Nothing is added to the sheet once rfd has begun it: an accessory view set then
+                // made recent macOS versions dismiss the sheet at once (#1800).
+                let picked = dialog.save_file();
+                Box::pin(async move { picked.await.iter().map(path).collect() })
+            }
+        },
         PickRequest::Folder => {
             let picked = dialog.pick_folder();
             Box::pin(async move { picked.await.iter().map(path).collect() })
@@ -517,8 +540,10 @@ fn services(parent: Parent, ui: egui::Context) -> Services {
         start_pick: cfg!(unix).then(|| Box::new(move |request: PickRequest| start_pick(request, &p5, &ui)) as vectorcraft_ui_egui::picks::StartPick),
         dialogs_are_sheets: cfg!(target_os = "macos"),
         wayland,
+        no_cursor_theme: wayland && cursor_theme::theme_missing(),
         read: Some(Box::new(|p: &str| std::fs::read(p).map_err(|e| e.to_string()))),
         write: Some(Box::new(write_file)),
+        exists: Some(Box::new(|p: &str| std::path::Path::new(p).exists())),
         // Background Save and Export write from a worker thread.
         write_shared: Some(std::sync::Arc::new(write_file)),
         // Native saves stream into the file as they are encoded.
@@ -548,8 +573,15 @@ fn services(parent: Parent, ui: egui::Context) -> Services {
     }
 }
 
+/// Windows passes `path` to Explorer inside quotes it adds itself, so a path holding a quote (which
+/// no Windows file name has) is refused rather than split into other arguments.
+fn explorer_safe(path: &str) -> Result<(), String> {
+    if cfg!(windows) && path.contains('"') { Err(format!("can't open {path}: the path contains a quotation mark")) } else { Ok(()) }
+}
+
 /// Edit Original, Show Package: open `path` (a file or a folder) in the system's default app for it.
 fn open_file(path: &str) -> Result<(), String> {
+    explorer_safe(path)?;
     #[cfg(windows)]
     let mut c = {
         use std::os::windows::process::CommandExt as _;
@@ -646,6 +678,9 @@ Without a window (converting, scripting, the MCP server), use vectorcraft-cli:
 ";
 
 fn main() -> std::process::ExitCode {
+    // Before any thread starts: the pointer must find a cursor theme on Wayland (#2450).
+    #[cfg(target_os = "linux")]
+    cursor_theme::apply();
     // Validate roots before logging, font scans, preferences or the window: a missing value
     // must not clear an environment root and start the control channel without confinement.
     let mut control = automation_args::ControlArg::default();
@@ -774,14 +809,19 @@ fn main() -> std::process::ExitCode {
     let custom_titlebar = custom_titlebar(saved.as_ref());
     let options = native_options(custom_titlebar);
     // winit picks Wayland whenever `WAYLAND_DISPLAY` is set; Preferences › Performance › Linux
-    // Display Server › X11 opens the window through XWayland instead, where file drops work (#1151).
+    // Display Server › X11 opens the window through XWayland instead, where file drops work (#1151),
+    // and X11 (XWayland) When a Pen Is Attached does so when a pen is attached, where the pen draws (#2028).
     #[cfg(target_os = "linux")]
     let options = {
         let mut options = options;
         let pref = saved.as_ref().and_then(|ui| ui.engine_prefs.get("linuxDisplayServer")).and_then(serde_json::Value::as_str);
-        if xwayland::wanted(pref, |name| std::env::var_os(name)) {
+        if xwayland::wanted(pref, |name| std::env::var_os(name), xwayland::pen_attached) {
             if xwayland::x11_libraries_found() {
-                log::info!("opening the window through XWayland (Preferences › Performance › Linux Display Server)");
+                if pref == Some("x11WithPen") {
+                    log::info!("pen found: opening the window through XWayland (Preferences › Performance › Linux Display Server)");
+                } else {
+                    log::info!("opening the window through XWayland (Preferences › Performance › Linux Display Server)");
+                }
                 use winit::platform::x11::EventLoopBuilderExtX11 as _;
                 options.event_loop_builder = Some(Box::new(|builder| {
                     builder.with_x11();
@@ -841,8 +881,15 @@ fn main() -> std::process::ExitCode {
             "VectorCraft",
             options,
             Box::new(move |cc| {
-                let mut app = VectorcraftApp::new(Session::new(), services(cc.winit_window().cloned(), cc.egui_ctx.clone()));
+                let mut session = Session::new();
+                // The profiles loaded before come back before the preferences name any of them.
+                prefs_dir::attach_profile_store(&mut session);
+                prefs_dir::attach_plugin_store(&mut session);
+                let mut app = VectorcraftApp::new(session, services(cc.winit_window().cloned(), cc.egui_ctx.clone()));
                 load_prefs(&mut app, saved);
+                // The saved PDF presets live in their own folder (also read by vectorcraft-cli),
+                // which takes over from the copy the preferences file used to hold.
+                prefs_dir::attach_pdf_preset_store(&mut app.session);
                 // Fit the window to its monitor, or put it back where it was (still hidden).
                 if let Some(w) = cc.winit_window() {
                     app.ui.window = Some(window::restore(w, saved_window));
@@ -854,6 +901,8 @@ fn main() -> std::process::ExitCode {
                 app.session.swatch_libraries.set_user_dir(swatches);
                 let styles = prefs_path().and_then(|p| Some(p.parent()?.join("Graphic Styles").to_string_lossy().to_string()));
                 app.session.style_libraries.set_user_dir(styles);
+                // With the User Defined libraries listed, the persistent library panels reopen.
+                vectorcraft_ui_egui::panels::library_panel::restore(&mut app);
                 // So do the Libraries panel's libraries; runs without preferences (agents' test
                 // runs) keep theirs for the session only, never touching the user's.
                 if prefs_enabled() {
@@ -1023,9 +1072,9 @@ mod tests {
             .collect()
     }
 
-    /// Finder offers the app for every file File › Open reads (#295, #354) but Photoshop documents
-    /// (`UNASSOCIATED_EXTS`), takes over no other app's files, and hands them to the app rather than
-    /// to AppKit's document machinery.
+    /// Finder offers the app for every file File › Open reads (#295, #354) but those with an
+    /// extension in `UNASSOCIATED_EXTS`, takes over no other app's files, and hands them to the app
+    /// rather than to AppKit's document machinery.
     #[test]
     fn the_macos_bundle_opens_every_readable_format() {
         let plist = include_str!("../../../packaging/macos/Info.plist.in");
@@ -1041,4 +1090,116 @@ mod tests {
         assert!(types > 1 && plist.matches("<key>LSHandlerRank</key>").count() == types, "every document type has a rank");
         assert_eq!(plist.matches("<string>Owner</string>").count(), 2, "only VectorCraft documents and templates are owned");
     }
+
+    /// The MIME types a Linux desktop gives each extension in `OPEN_EXTS` but `UNASSOCIATED_EXTS`
+    /// (one row per type): shared-mime-info's, or one that `ai.storyteller.vectorcraft.mime.xml`
+    /// declares.
+    const LINUX_TYPES: &[(&str, &str)] = &[
+        ("vectorcraft", "application/x-vectorcraft"),
+        ("drawcraft", "application/x-vectorcraft"),
+        ("svg", "image/svg+xml"),
+        ("svgz", "image/svg+xml-compressed"),
+        ("pdf", "application/pdf"),
+        ("ai", "application/illustrator"), // brand-ok: shared-mime-info's type
+        ("ait", "application/x-ai-template"),
+        ("png", "image/png"),
+        ("jpg", "image/jpeg"),
+        ("jpeg", "image/jpeg"),
+        ("gif", "image/gif"),
+        ("webp", "image/webp"),
+        ("tif", "image/tiff"),
+        ("tiff", "image/tiff"),
+        ("bmp", "image/bmp"),
+        ("vctemplate", "application/x-vectorcraft-template"),
+        ("dxf", "image/vnd.dxf"),
+        ("emf", "image/emf"),
+        ("wmf", "image/wmf"),
+        ("eps", "image/x-eps"),
+        ("af", "application/x-affinity"),
+        ("afdesign", "application/x-affinity"),
+        ("afpub", "application/x-affinity"),
+    ];
+
+    /// The types in `LINUX_TYPES` that shared-mime-info defines. The MIME package declares every
+    /// other one.
+    const LINUX_SHARED_TYPES: &[&str] = &[
+        "image/svg+xml",
+        "image/svg+xml-compressed",
+        "application/pdf",
+        "application/illustrator", // brand-ok: shared-mime-info's type
+        "image/png",
+        "image/jpeg",
+        "image/gif",
+        "image/webp",
+        "image/tiff",
+        "image/bmp",
+        "image/vnd.dxf",
+        "image/emf",
+        "image/wmf",
+        "image/x-eps",
+    ];
+
+    /// Extensions in `LINUX_TYPES` whose type the MIME package matches by file content and not by a
+    /// glob, with the package's `<magic>` rule for that type (its lines joined, indentation removed).
+    const LINUX_BY_CONTENT: &[(&str, &str)] = &[(
+        "af",
+        // `MAGIC` at offset 0 and `DOCUMENT_KIND` at offset 8 (crates/affinity/src/container.rs).
+        r#"<magic><match type="string" offset="0" value="\x00\xff\x4b\x41"><match type="string" offset="8" value="nsrP"/></match></magic>"#,
+    )];
+
+    /// The desktop entry lists a MIME type for every extension in `OPEN_EXTS` but
+    /// `UNASSOCIATED_EXTS`, and the app's MIME package declares the types shared-mime-info doesn't
+    /// have.
+    #[test]
+    fn the_linux_desktop_entry_opens_every_readable_format() {
+        let desktop = include_str!("../../../packaging/linux/ai.storyteller.vectorcraft.desktop");
+        let mime = include_str!("../../../packaging/linux/ai.storyteller.vectorcraft.mime.xml");
+        let listed: Vec<&str> =
+            desktop.lines().find_map(|l| l.strip_prefix("MimeType=")).unwrap_or_default().split(';').filter(|t| !t.is_empty()).collect();
+        // Each type the MIME package declares, with the extensions of its globs and its `<magic>`
+        // rule (empty when it has none) in the form `LINUX_BY_CONTENT` gives.
+        let declared: Vec<(&str, Vec<&str>, String)> = mime
+            .split("<mime-type type=\"")
+            .skip(1)
+            .map(|block| {
+                let body = block.split("</mime-type>").next().unwrap_or_default();
+                let globs = body.split("<glob pattern=\"*.").skip(1).filter_map(|g| g.split('"').next()).collect();
+                let magic = match (body.find("<magic"), body.find("</magic>")) {
+                    (Some(start), Some(end)) => body[start..end + "</magic>".len()].lines().map(str::trim).collect(),
+                    _ => String::new(),
+                };
+                (block.split('"').next().unwrap_or_default(), globs, magic)
+            })
+            .collect();
+        let mut associated: Vec<&str> = fileio::OPEN_EXTS.iter().copied().filter(|e| !fileio::UNASSOCIATED_EXTS.contains(e)).collect();
+        let mut typed: Vec<&str> = LINUX_TYPES.iter().map(|(e, _)| *e).collect();
+        associated.sort_unstable();
+        typed.sort_unstable();
+        typed.dedup();
+        assert_eq!(typed, associated, "a MIME type for each extension the packaging associates with the app");
+        for (e, t) in LINUX_TYPES {
+            assert!(listed.contains(t), "the desktop entry doesn't list {t} (.{e})");
+            let package = declared.iter().find(|(name, ..)| name == t);
+            if LINUX_SHARED_TYPES.contains(t) {
+                assert!(package.is_none(), "{t} is shared-mime-info's, and the MIME package declares it again");
+                continue;
+            }
+            let Some((_, globs, magic)) = package else { panic!("the MIME package doesn't declare {t} (.{e})") };
+            if let Some((_, rule)) = LINUX_BY_CONTENT.iter().find(|(content, _)| content == e) {
+                assert!(!globs.contains(e), "{t} matches .{e} files by content only");
+                assert_eq!(magic, rule, "{t}'s magic rule for .{e} files");
+            } else {
+                assert!(globs.contains(e), "{t} has no *.{e} glob");
+            }
+        }
+        for t in &listed {
+            assert!(LINUX_TYPES.iter().any(|(_, known)| known == t), "the desktop entry lists {t}, which the app doesn't open");
+        }
+        for (t, globs, _) in &declared {
+            assert!(listed.contains(t), "the desktop entry doesn't list the declared {t}");
+            for g in globs {
+                assert!(LINUX_TYPES.contains(&(*g, *t)), "{t}'s *.{g} isn't a file the app opens as {t}");
+            }
+        }
+    }
 }

apps/vectorcraft/src/portal_save.rs

@@ -0,0 +1,529 @@
+//! Linux and the BSDs: the save dialog of a save with two or more file types (Save, Save As, Save a
+//! Copy, Save as Template; #2679), asked of the XDG desktop portal here
+//! (<https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.FileChooser.html>).
+//! rfd 0.17 sends no `current_filter` with `SaveFile` and reads only `uris` from the answer
+//! (PolyMeilex/rfd#341), and the GTK file chooser behind the portal keeps the typed name when the
+//! user picks another file type, so the type picked was lost. This call sends the first file type as
+//! `current_filter`, reads the one picked back, and answers its first extension after the path
+//! ([`vectorcraft_ui_egui::picks::PickAnswer`]); the app gives the name that type's extension.
+//! rfd shows the dialog when the portal can't (no session bus, no file chooser), with zenity as its
+//! own fallback. PhotoCraft's `portal_save.rs` (storytold/photocraft#6151) makes the same call.
+//!
+//! The dialog's parent is the window: `x11:<window id>` on X11, and on Wayland (Linux) a handle
+//! from the compositor's xdg-foreign protocol, as rfd names it (its `window_identifier`).
+
+use std::collections::HashMap;
+
+use vectorcraft_ui_egui::FilePick;
+use zbus::zvariant::{OwnedValue, Value};
+
+/// A file type in the dialog: its label and its extensions without the dot.
+type Filter = (String, Vec<String>);
+
+/// A save dialog to show.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+struct SaveRequest {
+    /// The portal's identifier of the parent window, or empty.
+    parent: String,
+    /// The suggested name; empty for none.
+    name: String,
+    folder: Option<String>,
+    /// The file types, labeled in the interface's language; the dialog starts on the first.
+    filters: Vec<Filter>,
+}
+
+impl SaveRequest {
+    /// The dialog for `pick` over the window `parent` names.
+    fn new(pick: &FilePick, parent: String) -> Self {
+        let lang = vectorcraft_ui_egui::i18n::current();
+        let filters = pick
+            .filters
+            .iter()
+            .map(|(label, exts)| {
+                (vectorcraft_ui_egui::i18n::tr_ctx(lang, "file-filter", label).to_string(), exts.iter().map(|e| e.to_string()).collect())
+            })
+            .collect();
+        Self { parent, name: pick.name.clone(), folder: pick.folder.clone(), filters }
+    }
+}
+
+/// What the dialog answered: the path, as typed, and the label of the file type picked.
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct Saved {
+    path: String,
+    filter: Option<String>,
+}
+
+/// `filter` as the portal takes it: its label and a `*.ext` pattern for each extension (`*` for
+/// every file), as rfd sends them.
+fn wire(filter: &Filter) -> (String, Vec<(u32, String)>) {
+    let globs = filter.1.iter().map(|e| (0, if e.is_empty() || e == "*" { "*".to_string() } else { format!("*.{e}") })).collect();
+    (filter.0.clone(), globs)
+}
+
+/// The `SaveFile` options for `request`, answering on `token`.
+fn options<'a>(request: &'a SaveRequest, token: &'a str) -> HashMap<&'static str, Value<'a>> {
+    let mut o = HashMap::from([("handle_token", Value::from(token))]);
+    if !request.name.is_empty() {
+        o.insert("current_name", Value::from(request.name.as_str()));
+    }
+    if let Some(folder) = &request.folder {
+        // A byte string ending in NUL, as the portal specifies.
+        let mut bytes = folder.as_bytes().to_vec();
+        bytes.push(0);
+        o.insert("current_folder", Value::from(bytes));
+    }
+    if let Some(first) = request.filters.first() {
+        o.insert("filters", Value::from(request.filters.iter().map(wire).collect::<Vec<_>>()));
+        o.insert("current_filter", Value::from(wire(first)));
+    }
+    o
+}
+
+/// The portal's `Response`: code 0 with the first of its `uris` and the label of its
+/// `current_filter`. Any other code ends the dialog without a file (1 is Cancel, 2 a dialog closed
+/// some other way), as rfd reads it.
+fn answer(code: u32, results: &HashMap<String, OwnedValue>) -> Result<Option<Saved>, String> {
+    if code != 0 {
+        return Ok(None);
+    }
+    let uris: Vec<String> = results
+        .get("uris")
+        .ok_or("no file in the portal's answer")?
+        .try_clone()
+        .map_err(|e| e.to_string())?
+        .try_into()
+        .map_err(|e: zbus::zvariant::Error| e.to_string())?;
+    let uri = uris.first().ok_or("no file in the portal's answer")?;
+    let path = file_uri_path(uri).ok_or_else(|| format!("not a local file: {uri}"))?;
+    let filter = results.get("current_filter").and_then(|v| {
+        let (label, _globs): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+        Some(label)
+    });
+    Ok(Some(Saved { path, filter }))
+}
+
+/// `file:///home/me/A%20b.svg` → `/home/me/A b.svg`; `None` for a file elsewhere (`file://host/`)
+/// or another scheme.
+fn file_uri_path(uri: &str) -> Option<String> {
+    let rest = uri.strip_prefix("file://")?;
+    let rest = rest.strip_prefix("localhost").unwrap_or(rest);
+    if !rest.starts_with('/') {
+        return None;
+    }
+    let mut out = Vec::with_capacity(rest.len());
+    let mut rest = rest.as_bytes();
+    while let Some((&b, tail)) = rest.split_first() {
+        let hex = tail.get(..2).filter(|h| b == b'%' && h.iter().all(u8::is_ascii_hexdigit));
+        match hex.and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u8::from_str_radix(h, 16).ok()) {
+            Some(decoded) => {
+                out.push(decoded);
+                rest = tail.get(2..).unwrap_or_default();
+            }
+            None => {
+                out.push(b);
+                rest = tail;
+            }
+        }
+    }
+    // `show_dialog` makes rfd's path a string with `to_string_lossy` too.
+    Some(String::from_utf8_lossy(&out).into_owned())
+}
+
+/// `saved` as the answer of the save dialog for `request`: the path, then the first extension of
+/// the file type picked, found by its label. Empty when the dialog was canceled.
+fn pick_answer(saved: Option<Saved>, request: &SaveRequest) -> Vec<String> {
+    let Some(saved) = saved else { return Vec::new() };
+    let picked = saved.filter.and_then(|label| request.filters.iter().find(|(l, _)| *l == label)).and_then(|(_, exts)| exts.first().cloned());
+    std::iter::once(saved.path).chain(picked).collect()
+}
+
+/// The portal's identifier of an X11 window.
+fn x11_parent(window: impl std::fmt::LowerHex) -> String {
+    format!("x11:{window:x}")
+}
+
+/// Show the portal's save dialog for `pick` over `window` and wait for it → the answer (see the
+/// module's comment). `None` when `pick` offers fewer than two file types, or the portal couldn't
+/// show the dialog; rfd shows it then.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+pub fn pick(pick: &FilePick, window: Option<&winit::window::Window>) -> Option<Vec<String>> {
+    if pick.filters.len() < 2 {
+        return None;
+    }
+    // The export stays until the dialog has answered: the handle is valid while it lives.
+    let (parent, _export) = window.map(parent).unwrap_or_default();
+    let request = SaveRequest::new(pick, parent);
+    let saved = zbus::blocking::Connection::session().map_err(|e| e.to_string()).and_then(|conn| save_file(&conn, &request));
+    match saved {
+        Ok(saved) => Some(pick_answer(saved, &request)),
+        Err(e) => {
+            log::info!("the portal's save dialog failed ({e}): rfd shows it");
+            None
+        }
+    }
+}
+
+/// Ask the portal on `conn` for the save dialog of `request` and wait for its answer.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+fn save_file(conn: &zbus::blocking::Connection, request: &SaveRequest) -> Result<Option<Saved>, String> {
+    use std::sync::atomic::{AtomicU32, Ordering};
+
+    use zbus::blocking::Proxy;
+    use zbus::zvariant::OwnedObjectPath;
+
+    const DESKTOP: &str = "org.freedesktop.portal.Desktop";
+    const REQUEST: &str = "org.freedesktop.portal.Request";
+    static NEXT: AtomicU32 = AtomicU32::new(0);
+    let sender = conn.unique_name().ok_or("no name on the session bus")?.as_str().trim_start_matches(':').replace('.', "_");
+    let token = format!("vectorcraft_save_{}_{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed));
+    let path = format!("/org/freedesktop/portal/desktop/request/{sender}/{token}");
+    // Listen before asking, so that an answer that comes at once is not missed.
+    let mut replies = Proxy::new(conn, DESKTOP, path.as_str(), REQUEST).and_then(|p| p.receive_signal("Response")).map_err(|e| e.to_string())?;
+    let chooser = Proxy::new(conn, DESKTOP, "/org/freedesktop/portal/desktop", "org.freedesktop.portal.FileChooser").map_err(|e| e.to_string())?;
+    // The title is empty, as rfd sends it for a save.
+    let handle: OwnedObjectPath = chooser.call("SaveFile", &(request.parent.as_str(), "", options(request, &token))).map_err(|e| e.to_string())?;
+    // A portal older than version 0.9 ignores `handle_token` and answers on the request path it
+    // returns.
+    let reply = if handle.as_str() == path {
+        replies.next()
+    } else {
+        Proxy::new(conn, DESKTOP, handle.as_str(), REQUEST).and_then(|p| p.receive_signal("Response")).map_err(|e| e.to_string())?.next()
+    }
+    .ok_or("the save dialog closed without an answer")?;
+    let (code, results): (u32, HashMap<String, OwnedValue>) = reply.body().deserialize().map_err(|e| e.to_string())?;
+    answer(code, &results)
+}
+
+/// The portal's identifier of `window` when it is an X11 window.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+fn x11_window(window: &winit::window::Window) -> Option<String> {
+    use winit::raw_window_handle::{HasWindowHandle as _, RawWindowHandle};
+    match window.window_handle().ok()?.as_raw() {
+        RawWindowHandle::Xlib(h) => Some(x11_parent(h.window)),
+        RawWindowHandle::Xcb(h) => Some(x11_parent(h.window.get())),
+        _ => None,
+    }
+}
+
+/// The portal's identifier of `window`, and on Wayland the export that keeps it valid; empty when
+/// the window has neither an X11 id nor a Wayland handle.
+#[cfg(target_os = "linux")]
+fn parent(window: &winit::window::Window) -> (String, Option<wayland::Export>) {
+    if let Some(id) = x11_window(window) {
+        return (id, None);
+    }
+    match wayland::export(window) {
+        Some(export) => (format!("wayland:{}", export.handle), Some(export)),
+        None => (String::new(), None),
+    }
+}
+
+/// The portal's identifier of `window`: its X11 id, else empty (no Wayland export is made off
+/// Linux).
+#[cfg(any(target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+fn parent(window: &winit::window::Window) -> (String, Option<()>) {
+    (x11_window(window).unwrap_or_default(), None)
+}
+
+/// The Wayland window's handle for the portal: an xdg-foreign v2 export of its surface
+/// (<https://wayland.app/protocols/xdg-foreign-unstable-v2>), made as rfd's `window_identifier`
+/// makes it.
+#[cfg(target_os = "linux")]
+mod wayland {
+    use wayland_client::globals::{GlobalListContents, registry_queue_init};
+    use wayland_client::protocol::wl_registry::{self, WlRegistry};
+    use wayland_client::protocol::wl_surface::WlSurface;
+    use wayland_client::{Connection, Dispatch, Proxy, QueueHandle};
+    use wayland_protocols::xdg::foreign::zv2::client::zxdg_exported_v2::{self, ZxdgExportedV2};
+    use wayland_protocols::xdg::foreign::zv2::client::zxdg_exporter_v2::{self, ZxdgExporterV2};
+
+    /// A window exported for the portal: `handle` names it until this is dropped.
+    pub struct Export {
+        pub handle: String,
+        exported: ZxdgExportedV2,
+        conn: Connection,
+    }
+
+    impl Drop for Export {
+        fn drop(&mut self) {
+            self.exported.destroy();
+            let _ = self.conn.flush();
+        }
+    }
+
+    /// The events the export waits for.
+    #[derive(Default)]
+    struct State {
+        handle: Option<String>,
+    }
+
+    impl Dispatch<WlRegistry, GlobalListContents> for State {
+        fn event(_: &mut Self, _: &WlRegistry, _: wl_registry::Event, _: &GlobalListContents, _: &Connection, _: &QueueHandle<Self>) {}
+    }
+
+    impl Dispatch<ZxdgExporterV2, ()> for State {
+        fn event(_: &mut Self, _: &ZxdgExporterV2, _: zxdg_exporter_v2::Event, _: &(), _: &Connection, _: &QueueHandle<Self>) {}
+    }
+
+    impl Dispatch<ZxdgExportedV2, ()> for State {
+        fn event(state: &mut Self, _: &ZxdgExportedV2, event: zxdg_exported_v2::Event, _: &(), _: &Connection, _: &QueueHandle<Self>) {
+            if let zxdg_exported_v2::Event::Handle { handle } = event {
+                state.handle = Some(handle);
+            }
+        }
+    }
+
+    /// Export `window`'s surface on the window's own Wayland connection, with an event queue of its
+    /// own → `None` when the compositor has no xdg-foreign v2 or answers no handle.
+    pub fn export(window: &winit::window::Window) -> Option<Export> {
+        let (conn, surface) = surface(window)?;
+        let (globals, mut queue) = registry_queue_init::<State>(&conn).ok()?;
+        let qh = queue.handle();
+        let exporter: ZxdgExporterV2 = globals.bind(&qh, 1..=1, ()).ok()?;
+        let exported = exporter.export_toplevel(&surface, &qh, ());
+        let mut state = State::default();
+        let answered = queue.roundtrip(&mut state);
+        exporter.destroy();
+        match (answered, state.handle) {
+            (Ok(_), Some(handle)) => Some(Export { handle, exported, conn }),
+            _ => {
+                exported.destroy();
+                let _ = conn.flush();
+                log::info!("the compositor gave no xdg-foreign handle: the save dialog has no parent window");
+                None
+            }
+        }
+    }
+
+    /// `window`'s Wayland connection and surface, from its raw handles.
+    #[allow(unsafe_code)]
+    fn surface(window: &winit::window::Window) -> Option<(Connection, WlSurface)> {
+        use wayland_backend::sys::client::{Backend, ObjectId};
+        use winit::raw_window_handle::{HasDisplayHandle as _, HasWindowHandle as _, RawDisplayHandle, RawWindowHandle};
+        let (RawWindowHandle::Wayland(w), RawDisplayHandle::Wayland(d)) =
+            (window.window_handle().ok()?.as_raw(), window.display_handle().ok()?.as_raw())
+        else {
+            return None;
+        };
+        // SAFETY: the display is winit's open `wl_display`, which outlives `window` (the caller
+        // holds it until the export is dropped); a backend made from a foreign display does not
+        // close it when dropped.
+        let backend = unsafe { Backend::from_foreign_display(d.display.as_ptr().cast()) };
+        let conn = Connection::from_backend(backend);
+        // SAFETY: the pointer is the window's live `wl_surface` proxy on that display.
+        let id = unsafe { ObjectId::from_ptr(WlSurface::interface(), w.surface.as_ptr().cast()) }.ok()?;
+        let surface = WlSurface::from_id(&conn, id).ok()?;
+        Some((conn, surface))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn request() -> SaveRequest {
+        let pick = FilePick {
+            name: "Untitled-1.vectorcraft".into(),
+            folder: Some("/home/me/Art".into()),
+            filters: vec![("VectorCraft", &["vectorcraft"]), ("SVG", &["svg"]), ("PDF-compatible .ai", &["ai"])],
+        };
+        SaveRequest::new(&pick, "x11:3a0000f".into())
+    }
+
+    /// The dialog starts on the first file type (the document's format) and shows the suggested
+    /// name in its folder.
+    #[test]
+    fn the_request_names_the_file_type_the_dialog_starts_on() {
+        let request = request();
+        let o = options(&request, "t1");
+        assert_eq!(o.get("current_filter"), Some(&Value::from(("VectorCraft".to_string(), vec![(0u32, "*.vectorcraft".to_string())]))));
+        let filters = vec![
+            ("VectorCraft".to_string(), vec![(0u32, "*.vectorcraft".to_string())]),
+            ("SVG".to_string(), vec![(0u32, "*.svg".to_string())]),
+            ("PDF-compatible .ai".to_string(), vec![(0u32, "*.ai".to_string())]),
+        ];
+        assert_eq!(o.get("filters"), Some(&Value::from(filters)));
+        assert_eq!(o.get("current_name"), Some(&Value::from("Untitled-1.vectorcraft")));
+        assert_eq!(o.get("current_folder"), Some(&Value::from(b"/home/me/Art\0".to_vec())));
+        assert_eq!(o.get("handle_token"), Some(&Value::from("t1")));
+        let bare = SaveRequest { name: String::new(), folder: None, filters: Vec::new(), ..request };
+        let o = options(&bare, "t2");
+        assert_eq!(o.keys().copied().collect::<Vec<_>>(), ["handle_token"]);
+    }
+
+    /// The portal's answer as a D-Bus dictionary: `uris` and `current_filter`.
+    fn results(uri: &str, filter: Option<&str>) -> HashMap<String, OwnedValue> {
+        let mut r = HashMap::new();
+        r.insert("uris".to_string(), OwnedValue::try_from(Value::from(vec![uri.to_string()])).unwrap());
+        if let Some(label) = filter {
+            let picked = Value::from((label.to_string(), vec![(0u32, "*.ai".to_string())]));
+            r.insert("current_filter".to_string(), OwnedValue::try_from(picked).unwrap());
+        }
+        r
+    }
+
+    /// The file type picked comes back with the path as typed, and its first extension follows
+    /// the path in the answer.
+    #[test]
+    fn the_answer_carries_the_file_type_picked() {
+        let request = request();
+        let saved = answer(0, &results("file:///home/me/Art/poster", Some("PDF-compatible .ai"))).unwrap();
+        assert_eq!(saved, Some(Saved { path: "/home/me/Art/poster".into(), filter: Some("PDF-compatible .ai".into()) }));
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster", "ai"]);
+        // A portal that names no file type, or one the dialog did not offer: the path alone.
+        let saved = answer(0, &results("file:///home/me/Art/poster.svg", None)).unwrap();
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster.svg"]);
+        let saved = answer(0, &results("file:///home/me/Art/poster", Some("PNG"))).unwrap();
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster"]);
+    }
+
+    /// Cancel (1) and a dialog closed another way (2) answer no file; an answer without a local file
+    /// is an error, and rfd shows the dialog instead.
+    #[test]
+    fn a_canceled_dialog_answers_no_file() {
+        let request = request();
+        for code in [1, 2] {
+            assert_eq!(answer(code, &HashMap::new()), Ok(None));
+            assert!(pick_answer(None, &request).is_empty());
+        }
+        assert!(answer(0, &HashMap::new()).is_err());
+        assert!(answer(0, &results("sftp://host/poster.svg", Some("SVG"))).is_err());
+    }
+
+    #[test]
+    fn file_uris_become_local_paths() {
+        assert_eq!(file_uri_path("file:///home/me/Untitled-1.vectorcraft").as_deref(), Some("/home/me/Untitled-1.vectorcraft"));
+        assert_eq!(file_uri_path("file:///home/me/A%20b%C3%A9.svg").as_deref(), Some("/home/me/A bé.svg"));
+        assert_eq!(file_uri_path("file://localhost/tmp/x.pdf").as_deref(), Some("/tmp/x.pdf"));
+        // A `%` without two hex digits after it stays as it is.
+        assert_eq!(file_uri_path("file:///tmp/100%+1%2").as_deref(), Some("/tmp/100%+1%2"));
+        assert_eq!(file_uri_path("file://host/x.svg"), None);
+        assert_eq!(file_uri_path("sftp://host/x.svg"), None);
+    }
+
+    #[test]
+    fn x11_windows_are_named_by_their_id() {
+        assert_eq!(x11_parent(0x3a0000f), "x11:3a0000f");
+    }
+
+    /// What the mock portal answers to each `SaveFile` call: the response code, and the file and
+    /// the label of the file type "picked".
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    type Script = Vec<(u32, Option<(&'static str, &'static str)>)>;
+
+    /// What each `SaveFile` call carried: `current_name` and the label of `current_filter`.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    type Seen = std::sync::Arc<std::sync::Mutex<Vec<(Option<String>, Option<String>)>>>;
+
+    /// A session bus of its own (`dbus-daemon`) with a mock `org.freedesktop.portal.FileChooser`
+    /// that answers `SaveFile` from `script`, as PhotoCraft's portal tests run it. With `own_paths`
+    /// it is a portal older than 0.9, which answers on a request path of its own. `None` when there
+    /// is no `dbus-daemon` to run.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    fn mock_portal(script: Script, own_paths: bool) -> Option<(zbus::blocking::Connection, Seen, std::process::Child)> {
+        use std::io::BufRead as _;
+
+        use zbus::zvariant::OwnedObjectPath;
+        let mut daemon = std::process::Command::new("dbus-daemon")
+            .args(["--session", "--nofork", "--print-address=1"])
+            .stdout(std::process::Stdio::piped())
+            .spawn()
+            .ok()?;
+        let mut address = String::new();
+        std::io::BufReader::new(daemon.stdout.take()?).read_line(&mut address).ok()?;
+        let address = address.trim().to_string();
+        let server =
+            zbus::blocking::connection::Builder::address(address.as_str()).ok()?.name("org.freedesktop.portal.Desktop").ok()?.build().ok()?;
+        let seen = Seen::default();
+        let log = seen.clone();
+        std::thread::spawn(move || {
+            let mut script = script.into_iter();
+            for msg in zbus::blocking::MessageIterator::from(&server) {
+                let Ok(msg) = msg else { break };
+                let header = msg.header();
+                if header.message_type() != zbus::message::Type::MethodCall || header.member().map(|m| m.as_str()) != Some("SaveFile") {
+                    continue;
+                }
+                let Ok((_parent, _title, options)) = msg.body().deserialize::<(String, String, HashMap<String, OwnedValue>)>() else { break };
+                let text = |key: &str| options.get(key).and_then(|v| String::try_from(v.try_clone().ok()?).ok());
+                let filter = options.get("current_filter").and_then(|v| {
+                    let (label, _): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+                    Some(label)
+                });
+                let calls = log.lock().map(|mut l| {
+                    l.push((text("current_name"), filter));
+                    l.len()
+                });
+                let Some(sender) = header.sender().map(|s| s.as_str().trim_start_matches(':').replace('.', "_")) else { break };
+                let token = if own_paths { format!("old{}", calls.unwrap_or_default()) } else { text("handle_token").unwrap_or_default() };
+                let path = format!("/org/freedesktop/portal/desktop/request/{sender}/{token}");
+                let Ok(handle) = OwnedObjectPath::try_from(path.as_str()) else { break };
+                if server.reply(&header, &handle).is_err() {
+                    break;
+                }
+                if own_paths {
+                    // As a person answers the dialog: after the caller listened on the path returned.
+                    std::thread::sleep(std::time::Duration::from_millis(300));
+                }
+                let (code, pick) = script.next().unwrap_or((2, None));
+                let mut results: HashMap<&str, Value<'_>> = HashMap::new();
+                if let Some((uri, label)) = pick {
+                    results.insert("uris", Value::from(vec![uri.to_string()]));
+                    results.insert("current_filter", Value::from((label.to_string(), vec![(0u32, "*.x".to_string())])));
+                }
+                let to = header.sender().cloned().map(zbus::names::BusName::from);
+                if server.emit_signal(to, path.as_str(), "org.freedesktop.portal.Request", "Response", &(code, results)).is_err() {
+                    break;
+                }
+            }
+        });
+        let client = zbus::blocking::connection::Builder::address(address.as_str()).ok()?.build().ok()?;
+        Some((client, seen, daemon))
+    }
+
+    /// Through a real D-Bus: the call starts the dialog on the first file type with the suggested
+    /// name, and the answer names the file and the type picked; Cancel answers no file.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    #[test]
+    fn the_portal_is_asked_on_the_first_file_type_and_answers_the_one_picked() {
+        let script = vec![(0, Some(("file:///home/me/Art/poster", "PDF-compatible .ai"))), (1, None)];
+        let Some((conn, seen, mut daemon)) = mock_portal(script, false) else {
+            eprintln!("no dbus-daemon: skipped");
+            return;
+        };
+        let request = request();
+        let saved = save_file(&conn, &request).unwrap();
+        assert_eq!(pick_answer(saved, &request), ["/home/me/Art/poster", "ai"]);
+        assert_eq!(save_file(&conn, &request), Ok(None));
+        let seen = seen.lock().map(|s| s.clone()).unwrap_or_default();
+        assert_eq!(seen.first(), Some(&(Some("Untitled-1.vectorcraft".to_string()), Some(request.filters[0].0.clone()))));
+        let _ = daemon.kill();
+    }
+
+    /// A portal older than 0.9 answers on the request path it returns, and the answer is awaited
+    /// there.
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd"))]
+    #[test]
+    fn the_answer_is_awaited_on_the_path_the_portal_returns() {
+        let Some((conn, _seen, mut daemon)) = mock_portal(vec![(0, Some(("file:///tmp/card", "SVG")))], true) else {
+            eprintln!("no dbus-daemon: skipped");
+            return;
+        };
+        let request = request();
+        assert_eq!(pick_answer(save_file(&conn, &request).unwrap(), &request), ["/tmp/card", "svg"]);
+        let _ = daemon.kill();
+    }
+
+    /// The labels go to the dialog in the interface's language, which is how the answer is matched.
+    #[test]
+    fn the_file_types_are_labeled_as_the_other_dialogs_label_them() {
+        let request = request();
+        let labels: Vec<&str> = request.filters.iter().map(|(l, _)| l.as_str()).collect();
+        let lang = vectorcraft_ui_egui::i18n::current();
+        let expected: Vec<&str> =
+            ["VectorCraft", "SVG", "PDF-compatible .ai"].iter().map(|l| vectorcraft_ui_egui::i18n::tr_ctx(lang, "file-filter", l)).collect();
+        assert_eq!(labels, expected);
+        assert_eq!(request.parent, "x11:3a0000f");
+    }
+}

apps/vectorcraft/src/prefs_dir.rs

@@ -24,6 +24,39 @@ pub fn install_fonts() {
     }
 }
 
+/// The folder `name` next to the settings, for what the user keeps: none in a run without
+/// preferences (`VECTORCRAFT_NO_PREFS`), which keeps nothing.
+fn store_dir(name: &str) -> Option<PathBuf> {
+    if std::env::var_os("VECTORCRAFT_NO_PREFS").is_some() {
+        return None;
+    }
+    Some(prefs_path_for("VectorCraft", "vectorcraft")?.parent()?.join(name))
+}
+
+/// Register the ICC profiles `color.loadProfile` kept in the `Color Profiles` folder (#2174), and
+/// keep the ones loaded from now on there. Before anything names a profile.
+pub fn attach_profile_store(session: &mut vectorcraft_engine::Session) {
+    if let Some(dir) = store_dir("Color Profiles") {
+        session.attach_profile_store(dir);
+    }
+}
+
+/// Install the plug-ins Install Plug-in kept in the `Plug-ins` folder (#2541), and keep the ones
+/// installed from now on there.
+pub fn attach_plugin_store(session: &mut vectorcraft_engine::Session) {
+    if let Some(dir) = store_dir("Plug-ins") {
+        session.attach_plugin_store(dir);
+    }
+}
+
+/// Take the saved PDF presets from the `PDF Presets` folder (#2168), and keep the ones saved from
+/// now on there. After the preferences were restored: the folder is the one place the presets live.
+pub fn attach_pdf_preset_store(session: &mut vectorcraft_engine::Session) {
+    if let Some(dir) = store_dir("PDF Presets") {
+        session.attach_pdf_preset_store(dir);
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

apps/vectorcraft/src/printing.rs

@@ -43,11 +43,32 @@ mod system {
         let settings = craft_print::Job { printer: job.printer.map(str::to_string), title: job.title.into(), ..Default::default() };
         craft_print::submit(job.pdf, &settings).map(|note| if note.is_empty() { note } else { format!(" ({note})") }).map_err(|e| e.to_string())
     }
+    #[cfg(windows)]
+    pub(crate) fn setup_command(printer: Option<&str>, default_printer: Option<&str>) -> Command {
+        let target = printer.map(str::trim).filter(|p| !p.is_empty()).or_else(|| default_printer.map(str::trim).filter(|p| !p.is_empty()));
+        if let Some(name) = target {
+            let mut cmd = Command::new("rundll32.exe");
+            cmd.args(["printui.dll,PrintUIEntry", "/e", "/n", name]);
+            cmd
+        } else {
+            let mut cmd = Command::new("explorer");
+            cmd.arg("ms-settings:printers");
+            cmd
+        }
+    }
     pub fn setup(printer: Option<&str>) -> Result<(), String> {
         #[cfg(windows)]
         {
-            let _ = printer;
-            Command::new("explorer").arg("ms-settings:printers").spawn().map(|_| ()).map_err(|e| e.to_string())
+            let list = printers();
+            let default = list.iter().find(|p| p.default).or_else(|| list.first()).map(|p| p.name.as_str());
+            // Only an installed printer's own name reaches the command line: `printer` can come
+            // from a command or MCP, and PrintUIEntry reads options from its arguments.
+            let printer = printer.map(str::trim).filter(|p| list.iter().any(|q| q.name == *p));
+            let mut cmd = setup_command(printer, default);
+            match cmd.spawn() {
+                Ok(_) => Ok(()),
+                Err(_) => Command::new("explorer").arg("ms-settings:printers").spawn().map(|_| ()).map_err(|e| e.to_string()),
+            }
         }
         #[cfg(target_os = "macos")]
         {
@@ -68,3 +89,41 @@ mod system {
         }
     }
 }
+
+#[cfg(all(test, windows, not(any(feature = "windows7", target_vendor = "win7"))))]
+mod tests {
+    use super::system::setup_command;
+    use std::ffi::OsStr;
+
+    #[test]
+    fn setup_command_uses_printui_for_specified_printer() {
+        let cmd = setup_command(Some("Office Laser"), None);
+        assert_eq!(cmd.get_program(), "rundll32.exe");
+        let args: Vec<&OsStr> = cmd.get_args().collect();
+        assert_eq!(args, ["printui.dll,PrintUIEntry", "/e", "/n", "Office Laser"]);
+    }
+
+    #[test]
+    fn setup_command_falls_back_to_default_printer() {
+        let cmd = setup_command(None, Some("Default Proofer"));
+        assert_eq!(cmd.get_program(), "rundll32.exe");
+        let args: Vec<&OsStr> = cmd.get_args().collect();
+        assert_eq!(args, ["printui.dll,PrintUIEntry", "/e", "/n", "Default Proofer"]);
+    }
+
+    #[test]
+    fn setup_command_trims_whitespace_and_skips_empty() {
+        let cmd = setup_command(Some("  "), Some("Default Proofer"));
+        assert_eq!(cmd.get_program(), "rundll32.exe");
+        let args: Vec<&OsStr> = cmd.get_args().collect();
+        assert_eq!(args, ["printui.dll,PrintUIEntry", "/e", "/n", "Default Proofer"]);
+    }
+
+    #[test]
+    fn setup_command_falls_back_to_settings_when_no_printer() {
+        let cmd = setup_command(None, None);
+        assert_eq!(cmd.get_program(), "explorer");
+        let args: Vec<&OsStr> = cmd.get_args().collect();
+        assert_eq!(args, ["ms-settings:printers"]);
+    }
+}

apps/vectorcraft/src/profile.rs

@@ -1,29 +1,184 @@
 //! Native profile paths. Isolated profiles never migrate preferences from a user's old profile.
+//!
+//! In order:
+//! 1. `VECTORCRAFT_CONFIG_DIR`, when set (tests, agents, custom setups).
+//! 2. **Portable mode** (#1366), as in PhotoCraft: a marker file ([`PORTABLE_MARKERS`]) in the
+//!    install folder puts the settings in `VectorCraftData` beside it, so a portable copy leaves
+//!    nothing in `%APPDATA%`. The install folder is the executable's; on macOS the one holding
+//!    `VectorCraft.app` (nothing is written inside a signed bundle), for an AppImage the one holding
+//!    the `.AppImage` file (`$APPIMAGE`; the executable runs from a read-only mount). The Windows
+//!    portable zip ships with `portable.txt`; the MSI doesn't. The first time `VectorCraftData` is
+//!    created, the settings in the user's profile are copied into it, so a portable zip that gains
+//!    the marker keeps its users' settings. If the folder can't be written (read-only medium,
+//!    Program Files), a warning is logged and the platform folder is used. A portable copy never
+//!    reads the old DrawCraft profile, and a run without preferences (`VECTORCRAFT_NO_PREFS`) never
+//!    looks for the marker.
+//! 3. The platform convention.
 
 use std::ffi::OsString;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
+use std::sync::OnceLock;
+
+/// Files in the install folder that switch on portable mode (either one; contents are ignored).
+pub const PORTABLE_MARKERS: [&str; 2] = ["portable.txt", "VectorCraft.portable"];
+/// The settings folder created in the install folder in portable mode.
+pub const PORTABLE_DATA_DIR: &str = "VectorCraftData";
 
 pub fn prefs_path(legacy: bool) -> Option<PathBuf> {
-    prefs_path_with(std::env::consts::OS, legacy, |key| std::env::var_os(key))
+    prefs_path_with(std::env::consts::OS, legacy, |key| std::env::var_os(key), portable_dir)
 }
 
-fn prefs_path_with(os: &str, legacy: bool, env: impl Fn(&str) -> Option<OsString>) -> Option<PathBuf> {
+/// `portable` is the portable settings folder, if any: only asked for when no override is set and
+/// preferences are in use.
+fn prefs_path_with(os: &str, legacy: bool, env: impl Fn(&str) -> Option<OsString>, portable: impl FnOnce() -> Option<PathBuf>) -> Option<PathBuf> {
     if let Some(root) = env("VECTORCRAFT_CONFIG_DIR") {
         // Never fall back to DrawCraft's real profile when the isolated file does not exist.
         return (!legacy && !root.is_empty()).then(|| PathBuf::from(root).join("ui.json"));
     }
+    // A run without preferences reads and writes nothing, so it must not create the portable folder.
+    if env("VECTORCRAFT_NO_PREFS").is_none()
+        && let Some(dir) = portable()
+    {
+        // A portable copy is self-contained: DrawCraft's old profile is not read into it.
+        return (!legacy).then(|| dir.join("ui.json"));
+    }
+    platform_dir(os, legacy, &env).map(|p| p.join("ui.json"))
+}
+
+/// The platform's settings folder of VectorCraft, or of DrawCraft (`legacy`).
+fn platform_dir(os: &str, legacy: bool, env: &impl Fn(&str) -> Option<OsString>) -> Option<PathBuf> {
     let (name, lower) = if legacy { ("DrawCraft", "drawcraft") } else { ("VectorCraft", "vectorcraft") };
-    let base = match os {
+    match os {
         "macos" => env("HOME").map(|p| PathBuf::from(p).join("Library/Application Support").join(name)),
         "windows" => env("APPDATA").map(|p| PathBuf::from(p).join(name)),
         _ => env("XDG_CONFIG_HOME").map(PathBuf::from).or_else(|| env("HOME").map(|p| PathBuf::from(p).join(".config"))).map(|p| p.join(lower)),
+    }
+}
+
+/// The portable settings folder of this copy, looked for once per process (it probes the disk, and
+/// the settings path is asked for many times).
+fn portable_dir() -> Option<PathBuf> {
+    static DIR: OnceLock<Option<PathBuf>> = OnceLock::new();
+    DIR.get_or_init(|| {
+        let os = std::env::consts::OS;
+        let env = |key: &str| std::env::var_os(key);
+        let install = install_dir(os, &std::env::current_exe().ok()?, &env)?;
+        portable_dir_in(&install, platform_dir(os, false, &env).as_deref()).unwrap_or_else(|warning| {
+            // Only the log: `eprintln!` panics when standard error is a closed pipe, and the logger
+            // keeps early records for the log file.
+            log::warn!("{warning}");
+            None
+        })
+    })
+    .clone()
+}
+
+/// The folder the user sees the app in, where the portable marker is looked for: the executable's;
+/// on macOS the one holding `VectorCraft.app` when the executable sits in its `Contents/MacOS` (a
+/// signed bundle is never written into); on Linux the one holding the `.AppImage` file when
+/// `$APPIMAGE` names it (the executable itself runs from a read-only mount).
+fn install_dir(os: &str, exe: &Path, env: &impl Fn(&str) -> Option<OsString>) -> Option<PathBuf> {
+    let exe_dir = exe.parent()?;
+    let dir = match os {
+        "macos" => app_bundle_parent(exe_dir).unwrap_or(exe_dir).to_path_buf(),
+        "windows" => exe_dir.to_path_buf(),
+        _ => {
+            let appimage = env("APPIMAGE").map(PathBuf::from);
+            let beside = appimage.as_deref().and_then(Path::parent).filter(|p| !p.as_os_str().is_empty());
+            beside.unwrap_or(exe_dir).to_path_buf()
+        }
     };
-    base.map(|p| p.join("ui.json"))
+    Some(dir)
+}
+
+/// The folder holding `X.app` when `exe_dir` is `X.app/Contents/MacOS`.
+fn app_bundle_parent(exe_dir: &Path) -> Option<&Path> {
+    let contents = exe_dir.parent().filter(|_| exe_dir.file_name() == Some("MacOS".as_ref()))?;
+    let bundle = contents.parent().filter(|_| contents.file_name() == Some("Contents".as_ref()))?;
+    bundle.extension().filter(|ext| *ext == "app").and(bundle.parent())
+}
+
+/// `<install_dir>/VectorCraftData` when a portable marker sits in `install_dir`, created if missing;
+/// `None` without a marker, and the warning to log when there is one but that folder can't be
+/// written. The first time the folder is created, the settings in `previous` (the user's profile
+/// folder, when it exists) are copied into it, so a portable zip that gains the marker keeps its
+/// users' settings. `previous` is never changed; a copy that fails halfway is logged and left as it
+/// is, and a later start finds the folder and copies nothing.
+fn portable_dir_in(install_dir: &Path, previous: Option<&Path>) -> Result<Option<PathBuf>, String> {
+    let Some(marker) = PORTABLE_MARKERS.iter().map(|m| install_dir.join(m)).find(|p| p.is_file()) else { return Ok(None) };
+    let data = install_dir.join(PORTABLE_DATA_DIR);
+    let first_start = !data.exists();
+    if let Err(e) = ensure_writable(&data) {
+        return Err(format!(
+            "portable mode ({} found) but {} isn't writable ({e}); settings are kept in the user's settings folder instead",
+            marker.display(),
+            data.display()
+        ));
+    }
+    if first_start && let Some(previous) = previous.filter(|p| p.is_dir()) {
+        match copy_dir(previous, &data) {
+            Ok(()) => log::info!("portable mode: copied the settings from {} to {}", previous.display(), data.display()),
+            Err(e) => log::warn!("portable mode: the settings in {} were only partly copied to {}: {e}", previous.display(), data.display()),
+        }
+    }
+    Ok(Some(data))
+}
+
+/// Create `dir` and prove a file can be written in it (a folder can exist yet be read-only).
+fn ensure_writable(dir: &Path) -> std::io::Result<()> {
+    std::fs::create_dir_all(dir)?;
+    let probe = dir.join(format!(".write-test-{}", std::process::id()));
+    std::fs::write(&probe, b"")?;
+    // A leftover probe is harmless; don't give up portable mode over it.
+    let _ = std::fs::remove_file(&probe);
+    Ok(())
+}
+
+/// Copy the contents of `from` into `to` (which exists), going on past entries that can't be
+/// copied; the error says how many were skipped and why the first one was.
+fn copy_dir(from: &Path, to: &Path) -> Result<(), String> {
+    let mut skipped = 0usize;
+    let mut first: Option<String> = None;
+    copy_dir_into(from, to, &mut |why| {
+        skipped += 1;
+        first.get_or_insert(why);
+    });
+    match first {
+        None => Ok(()),
+        Some(why) => Err(format!("{skipped} skipped, the first because {why}")),
+    }
+}
+
+fn copy_dir_into(from: &Path, to: &Path, skip: &mut impl FnMut(String)) {
+    let entries = match std::fs::read_dir(from) {
+        Ok(entries) => entries,
+        Err(e) => return skip(format!("{}: {e}", from.display())),
+    };
+    for entry in entries {
+        let entry = match entry {
+            Ok(entry) => entry,
+            Err(e) => {
+                skip(format!("{}: {e}", from.display()));
+                continue;
+            }
+        };
+        let (src, dst) = (entry.path(), to.join(entry.file_name()));
+        // A symbolic link is copied as what it points to, or skipped when that is a folder.
+        let copied = match entry.file_type() {
+            Ok(kind) if kind.is_dir() => std::fs::create_dir_all(&dst).map(|()| copy_dir_into(&src, &dst, skip)),
+            Ok(_) => std::fs::copy(&src, &dst).map(|_| ()),
+            Err(e) => Err(e),
+        };
+        if let Err(e) = copied {
+            skip(format!("{}: {e}", src.display()));
+        }
+    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
 
     fn environment(key: &str) -> Option<OsString> {
         match key {
@@ -34,33 +189,202 @@ mod tests {
         }
     }
 
+    /// No portable marker in the install folder.
+    fn installed() -> Option<PathBuf> {
+        None
+    }
+
     #[test]
     fn isolated_profile_has_no_legacy_fallback_on_any_platform() {
         for os in ["macos", "windows", "linux"] {
             let env = |key: &str| {
                 if key == "VECTORCRAFT_CONFIG_DIR" { Some("/isolated".into()) } else { environment(key) }
             };
-            assert_eq!(prefs_path_with(os, false, env), Some("/isolated/ui.json".into()));
-            assert_eq!(prefs_path_with(os, true, env), None);
+            assert_eq!(prefs_path_with(os, false, env, installed), Some("/isolated/ui.json".into()));
+            assert_eq!(prefs_path_with(os, true, env, installed), None);
         }
     }
 
     #[test]
     fn empty_override_does_not_fall_back_to_user_files() {
         let env = |key: &str| if key == "VECTORCRAFT_CONFIG_DIR" { Some(OsString::new()) } else { environment(key) };
-        assert_eq!(prefs_path_with("macos", false, env), None);
-        assert_eq!(prefs_path_with("macos", true, env), None);
+        assert_eq!(prefs_path_with("macos", false, env, installed), None);
+        assert_eq!(prefs_path_with("macos", true, env, installed), None);
     }
 
     #[test]
     fn unset_override_keeps_platform_paths_and_legacy_migration() {
-        assert_eq!(prefs_path_with("macos", false, environment), Some("/user/Library/Application Support/VectorCraft/ui.json".into()));
-        assert_eq!(prefs_path_with("macos", true, environment), Some("/user/Library/Application Support/DrawCraft/ui.json".into()));
-        assert_eq!(prefs_path_with("windows", false, environment), Some("/roaming/VectorCraft/ui.json".into()));
-        assert_eq!(prefs_path_with("linux", false, environment), Some("/xdg-config/vectorcraft/ui.json".into()));
+        assert_eq!(prefs_path_with("macos", false, environment, installed), Some("/user/Library/Application Support/VectorCraft/ui.json".into()));
+        assert_eq!(prefs_path_with("macos", true, environment, installed), Some("/user/Library/Application Support/DrawCraft/ui.json".into()));
+        assert_eq!(prefs_path_with("windows", false, environment, installed), Some("/roaming/VectorCraft/ui.json".into()));
+        assert_eq!(prefs_path_with("linux", false, environment, installed), Some("/xdg-config/vectorcraft/ui.json".into()));
         assert_eq!(
-            prefs_path_with("linux", true, |key| if key == "HOME" { environment(key) } else { None }),
+            prefs_path_with("linux", true, |key| if key == "HOME" { environment(key) } else { None }, installed),
             Some("/user/.config/drawcraft/ui.json".into())
         );
     }
+
+    #[test]
+    fn portable_mode_keeps_the_settings_beside_the_executable_and_skips_the_drawcraft_profile() {
+        let portable = || Some(PathBuf::from("/usb/VectorCraft/VectorCraftData"));
+        for os in ["macos", "windows", "linux"] {
+            assert_eq!(prefs_path_with(os, false, environment, portable), Some("/usb/VectorCraft/VectorCraftData/ui.json".into()), "{os}");
+            // A portable copy is self-contained: the one-time read of DrawCraft's old settings is skipped.
+            assert_eq!(prefs_path_with(os, true, environment, portable), None, "{os}");
+        }
+    }
+
+    #[test]
+    fn the_config_dir_override_wins_over_portable_mode_without_probing_it() {
+        let env = |key: &str| if key == "VECTORCRAFT_CONFIG_DIR" { Some("/isolated".into()) } else { environment(key) };
+        let portable = || -> Option<PathBuf> { panic!("the portable folder is not looked for under VECTORCRAFT_CONFIG_DIR") };
+        assert_eq!(prefs_path_with("windows", false, env, portable), Some("/isolated/ui.json".into()));
+        assert_eq!(prefs_path_with("windows", true, env, portable), None);
+    }
+
+    #[test]
+    fn a_run_without_preferences_never_looks_for_the_portable_folder() {
+        let env = |key: &str| if key == "VECTORCRAFT_NO_PREFS" { Some("1".into()) } else { environment(key) };
+        let portable = || -> Option<PathBuf> { panic!("the portable folder is not looked for under VECTORCRAFT_NO_PREFS") };
+        assert_eq!(prefs_path_with("windows", false, env, portable), Some("/roaming/VectorCraft/ui.json".into()));
+        assert_eq!(prefs_path_with("windows", true, env, portable), Some("/roaming/DrawCraft/ui.json".into()));
+    }
+
+    #[test]
+    fn on_macos_the_marker_is_looked_for_beside_the_app_bundle() {
+        let bundled = Path::new("/Apps/VectorCraft.app/Contents/MacOS/vectorcraft");
+        assert_eq!(install_dir("macos", bundled, &environment), Some("/Apps".into()));
+        // A bare executable (the CLI zip) and other platforms: the executable's own folder.
+        assert_eq!(install_dir("macos", Path::new("/Apps/vectorcraft-cli"), &environment), Some("/Apps".into()));
+        assert_eq!(install_dir("windows", bundled, &environment), Some("/Apps/VectorCraft.app/Contents/MacOS".into()));
+        assert_eq!(install_dir("linux", bundled, &environment), Some("/Apps/VectorCraft.app/Contents/MacOS".into()));
+    }
+
+    #[test]
+    fn an_appimage_looks_for_the_marker_beside_the_appimage_file() {
+        let mounted = Path::new("/tmp/.mount_vc/usr/bin/vectorcraft");
+        let appimage = |key: &str| if key == "APPIMAGE" { Some("/home/user/Apps/VectorCraft.AppImage".into()) } else { environment(key) };
+        assert_eq!(install_dir("linux", mounted, &appimage), Some("/home/user/Apps".into()));
+        assert_eq!(install_dir("linux", mounted, &environment), Some("/tmp/.mount_vc/usr/bin".into()));
+        let empty = |key: &str| if key == "APPIMAGE" { Some(OsString::new()) } else { environment(key) };
+        assert_eq!(install_dir("linux", mounted, &empty), Some("/tmp/.mount_vc/usr/bin".into()));
+        // The variable means nothing on other platforms.
+        assert_eq!(install_dir("windows", mounted, &appimage), Some("/tmp/.mount_vc/usr/bin".into()));
+        assert_eq!(install_dir("macos", mounted, &appimage), Some("/tmp/.mount_vc/usr/bin".into()));
+    }
+
+    fn temp(tag: &str) -> PathBuf {
+        static N: AtomicUsize = AtomicUsize::new(0);
+        let d = std::env::temp_dir().join(format!("vectorcraft-profile-{tag}-{}-{}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    #[test]
+    fn either_marker_beside_the_executable_makes_a_writable_data_folder() {
+        for marker in PORTABLE_MARKERS {
+            let exe = temp("portable");
+            std::fs::write(exe.join(marker), b"").unwrap();
+            let dir = portable_dir_in(&exe, None).unwrap().unwrap();
+            assert_eq!(dir, exe.join(PORTABLE_DATA_DIR), "{marker}");
+            assert!(dir.is_dir(), "the data folder is created");
+            assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 0, "the write probe is removed");
+            let _ = std::fs::remove_dir_all(&exe);
+        }
+    }
+
+    #[test]
+    fn a_fake_app_bundle_keeps_the_marker_and_the_data_outside_the_bundle() {
+        let folder = temp("bundle");
+        let exe = folder.join("VectorCraft.app/Contents/MacOS/vectorcraft");
+        std::fs::create_dir_all(exe.parent().unwrap()).unwrap();
+        std::fs::write(folder.join("portable.txt"), b"").unwrap();
+        let install = install_dir("macos", &exe, &environment).unwrap();
+        assert_eq!(portable_dir_in(&install, None), Ok(Some(folder.join(PORTABLE_DATA_DIR))));
+        assert!(!exe.parent().unwrap().join(PORTABLE_DATA_DIR).exists(), "nothing is written inside the bundle");
+        // A marker dropped inside the bundle is not looked at.
+        std::fs::remove_file(folder.join("portable.txt")).unwrap();
+        std::fs::write(exe.parent().unwrap().join("portable.txt"), b"").unwrap();
+        let _ = std::fs::remove_dir_all(folder.join(PORTABLE_DATA_DIR));
+        assert_eq!(portable_dir_in(&install, None), Ok(None));
+        let _ = std::fs::remove_dir_all(&folder);
+    }
+
+    #[test]
+    fn without_a_marker_file_there_is_no_portable_folder() {
+        let exe = temp("installed");
+        assert_eq!(portable_dir_in(&exe, None), Ok(None));
+        // A folder named like the marker is not a marker.
+        std::fs::create_dir_all(exe.join("portable.txt")).unwrap();
+        assert_eq!(portable_dir_in(&exe, None), Ok(None));
+        assert!(!exe.join(PORTABLE_DATA_DIR).exists(), "no data folder without a marker");
+        let _ = std::fs::remove_dir_all(&exe);
+    }
+
+    #[test]
+    fn an_unwritable_portable_folder_is_reported_instead_of_used() {
+        let exe = temp("unwritable");
+        std::fs::write(exe.join("portable.txt"), b"").unwrap();
+        // A file where the data folder should go: it can't be created, on every platform.
+        std::fs::write(exe.join(PORTABLE_DATA_DIR), b"in the way").unwrap();
+        let warning = portable_dir_in(&exe, None).unwrap_err();
+        assert!(warning.contains("portable") && warning.contains(PORTABLE_DATA_DIR), "{warning}");
+        let _ = std::fs::remove_dir_all(&exe);
+    }
+
+    #[test]
+    fn the_first_start_copies_the_user_profile_into_the_data_folder_once() {
+        let exe = temp("upgrade");
+        std::fs::write(exe.join("portable.txt"), b"").unwrap();
+        let previous = temp("previous-profile");
+        std::fs::write(previous.join("ui.json"), b"{\"theme\":\"dark\"}").unwrap();
+        std::fs::create_dir_all(previous.join("Swatches/Mine")).unwrap();
+        std::fs::write(previous.join("Swatches/Mine/warm.ase"), b"ase").unwrap();
+
+        let data = portable_dir_in(&exe, Some(&previous)).unwrap().unwrap();
+        assert_eq!(data, exe.join(PORTABLE_DATA_DIR));
+        assert_eq!(std::fs::read(data.join("ui.json")).unwrap(), b"{\"theme\":\"dark\"}", "the settings file is copied");
+        assert_eq!(std::fs::read(data.join("Swatches/Mine/warm.ase")).unwrap(), b"ase", "nested folders are copied");
+        assert_eq!(std::fs::read(previous.join("ui.json")).unwrap(), b"{\"theme\":\"dark\"}", "the source is left as it is");
+        assert!(previous.join("Swatches/Mine/warm.ase").is_file(), "the source is left as it is");
+
+        // A second start finds the folder and copies nothing, whatever changed on either side.
+        std::fs::write(data.join("ui.json"), b"{\"theme\":\"light\"}").unwrap();
+        std::fs::write(previous.join("ui.json"), b"{\"theme\":\"newer\"}").unwrap();
+        std::fs::write(previous.join("later.txt"), b"").unwrap();
+        assert_eq!(portable_dir_in(&exe, Some(&previous)), Ok(Some(data.clone())));
+        assert_eq!(std::fs::read(data.join("ui.json")).unwrap(), b"{\"theme\":\"light\"}", "the portable settings are not overwritten");
+        assert!(!data.join("later.txt").exists(), "nothing is copied after the first start");
+
+        let _ = std::fs::remove_dir_all(&exe);
+        let _ = std::fs::remove_dir_all(&previous);
+    }
+
+    #[test]
+    fn without_a_user_profile_the_data_folder_starts_empty() {
+        let exe = temp("fresh");
+        std::fs::write(exe.join("portable.txt"), b"").unwrap();
+        let missing = exe.join("no-such-profile");
+        let data = portable_dir_in(&exe, Some(&missing)).unwrap().unwrap();
+        assert_eq!(std::fs::read_dir(&data).unwrap().count(), 0);
+        let _ = std::fs::remove_dir_all(&exe);
+    }
+
+    #[test]
+    fn a_copy_that_fails_halfway_reports_what_it_skipped_and_keeps_the_rest() {
+        let from = temp("copy-from");
+        let to = temp("copy-to");
+        std::fs::write(from.join("kept.txt"), b"kept").unwrap();
+        std::fs::create_dir_all(from.join("blocked")).unwrap();
+        std::fs::write(from.join("blocked/inner.txt"), b"").unwrap();
+        // A file where the sub-folder should go: that entry can't be copied, the others can.
+        std::fs::write(to.join("blocked"), b"in the way").unwrap();
+        let error = copy_dir(&from, &to).unwrap_err();
+        assert!(error.starts_with("1 skipped"), "{error}");
+        assert!(error.contains("blocked"), "{error}");
+        assert_eq!(std::fs::read(to.join("kept.txt")).unwrap(), b"kept");
+        let _ = std::fs::remove_dir_all(&from);
+        let _ = std::fs::remove_dir_all(&to);
+    }
 }

apps/vectorcraft/src/xwayland.rs

@@ -1,11 +1,15 @@
 //! Linux: Preferences › Performance › Linux Display Server › X11 opens the window through XWayland
 //! on a Wayland session, where dropped files arrive (winit 0.30 has no Wayland drag and drop,
-//! #1151). Only when XWayland can run the window: an X display is set and the X11 libraries winit
-//! loads at runtime are installed. Otherwise the window opens on Wayland, so a missing library
-//! never keeps the app from starting.
+//! #1151). X11 (XWayland) When a Pen Is Attached does so only when a pen is attached as the app
+//! starts: winit 0.30 doesn't bind the Wayland tablet protocol, and XWayland hands the pen to X11
+//! windows as a pointer (#2028). Only when XWayland can run the window: an X display is set and
+//! the X11 libraries winit loads at runtime are installed. Otherwise the window opens on Wayland,
+//! so a missing library never keeps the app from starting.
 //!
 //! The library check comes from PhotoCraft's `linux_libs.rs`: no `dlopen` (that needs `unsafe`),
-//! just the dynamic linker's cache (`ldconfig -p`) and the usual library directories.
+//! just the dynamic linker's cache (`ldconfig -p`) and the usual library directories. The pen
+//! check comes from PhotoCraft's `tablet.rs`: the input devices the kernel lists in
+//! `/proc/bus/input/devices`.
 #![cfg_attr(not(target_os = "linux"), allow(dead_code))]
 
 use std::ffi::OsString;
@@ -16,12 +20,50 @@ use std::path::{Path, PathBuf};
 const X11_LIBS: &[&str] =
     &["libX11.so.6", "libX11-xcb.so.1", "libxcb.so.1", "libXcursor.so.1", "libXi.so.6", "libxkbcommon.so.0", "libxkbcommon-x11.so.0"];
 
-/// Whether the saved `linuxDisplayServer` and the environment ask for XWayland: `x11` chosen, a
-/// Wayland session (winit picks Wayland whenever `WAYLAND_DISPLAY` or `WAYLAND_SOCKET` is set)
-/// and an X display to open.
-pub fn wanted(pref: Option<&str>, var: impl Fn(&str) -> Option<OsString>) -> bool {
+/// Whether the saved `linuxDisplayServer` and the environment ask for XWayland: `x11` chosen, or
+/// `x11WithPen` chosen and `pen` finding a pen; a Wayland session (winit picks Wayland whenever
+/// `WAYLAND_DISPLAY` or `WAYLAND_SOCKET` is set); and an X display to open. `pen` runs only for
+/// `x11WithPen`, after the session checks.
+pub fn wanted(pref: Option<&str>, var: impl Fn(&str) -> Option<OsString>, pen: impl FnOnce() -> bool) -> bool {
     let set = |name: &str| var(name).is_some_and(|v| !v.is_empty());
-    pref == Some("x11") && (set("WAYLAND_DISPLAY") || set("WAYLAND_SOCKET")) && set("DISPLAY")
+    let session = (set("WAYLAND_DISPLAY") || set("WAYLAND_SOCKET")) && set("DISPLAY");
+    match pref {
+        Some("x11") => session,
+        Some("x11WithPen") => session && pen(),
+        _ => false,
+    }
+}
+
+/// `BTN_TOOL_PEN` (linux/input-event-codes.h): the key that a pen tablet's stylus, a pen display's
+/// pen or a pen-enabled touchscreen's pen reports.
+const BTN_TOOL_PEN: u32 = 0x140;
+/// `ABS_X` and `ABS_Y` (linux/input-event-codes.h): the absolute axes every pen reports.
+const ABS_X: u32 = 0x00;
+const ABS_Y: u32 = 0x01;
+
+/// Is a pen attached? Reads `/proc/bus/input/devices`; a file that can't be read has no pen.
+pub fn pen_attached() -> bool {
+    std::fs::read_to_string("/proc/bus/input/devices").is_ok_and(|devices| has_pen(&devices))
+}
+
+/// Is a pen among the input devices `/proc/bus/input/devices` lists? A pen is a device whose
+/// `B: KEY=` bitmap has `BTN_TOOL_PEN` and whose `B: ABS=` bitmap has `ABS_X` and `ABS_Y`, as
+/// libinput asks of a tablet tool. A virtual keyboard made with uinput can claim every key code,
+/// `BTN_TOOL_PEN` included, but has no absolute axes.
+fn has_pen(devices: &str) -> bool {
+    devices.split("\n\n").any(|device| {
+        let bitmap = |name: &str| device.lines().find_map(|l| l.strip_prefix(name));
+        bitmap("B: KEY=").is_some_and(|keys| bit_set(keys, BTN_TOOL_PEN))
+            && bitmap("B: ABS=").is_some_and(|axes| bit_set(axes, ABS_X) && bit_set(axes, ABS_Y))
+    })
+}
+
+/// Bit `bit` of a `/proc/bus/input/devices` bitmap: hex words of the kernel's `long`, most
+/// significant first. Short or malformed bitmaps have no bits set.
+fn bit_set(bitmap: &str, bit: u32) -> bool {
+    let bits = usize::BITS;
+    let word = usize::try_from(bit / bits).unwrap_or(usize::MAX);
+    bitmap.split_whitespace().rev().nth(word).and_then(|w| u64::from_str_radix(w, 16).ok()).is_some_and(|w| (w >> (bit % bits)) & 1 == 1)
 }
 
 /// Are all the libraries an X11 window needs found on this system? Libraries the check can't find
@@ -98,18 +140,88 @@ mod tests {
         move |k| pairs.iter().find(|(name, _)| *name == k).map(|(_, v)| OsString::from(v))
     }
 
+    fn no_probe() -> bool {
+        panic!("the pen check ran")
+    }
+
     #[test]
     fn xwayland_only_when_chosen_on_wayland_with_an_x_display() {
         let wayland = env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", ":0")]);
-        assert!(wanted(Some("x11"), &wayland));
-        assert!(wanted(Some("x11"), env(&[("WAYLAND_SOCKET", "3"), ("DISPLAY", ":0")])));
-        assert!(!wanted(Some("automatic"), &wayland));
-        assert!(!wanted(None, &wayland));
-        assert!(!wanted(Some("wayland"), &wayland));
+        assert!(wanted(Some("x11"), &wayland, no_probe));
+        assert!(wanted(Some("x11"), env(&[("WAYLAND_SOCKET", "3"), ("DISPLAY", ":0")]), no_probe));
+        assert!(!wanted(Some("automatic"), &wayland, no_probe));
+        assert!(!wanted(None, &wayland, no_probe));
+        assert!(!wanted(Some("wayland"), &wayland, no_probe));
         // An X11 session already opens on X11; without an X display there is no XWayland to use.
-        assert!(!wanted(Some("x11"), env(&[("DISPLAY", ":0")])));
-        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", "")])));
-        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0")])));
+        assert!(!wanted(Some("x11"), env(&[("DISPLAY", ":0")]), no_probe));
+        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", "")]), no_probe));
+        assert!(!wanted(Some("x11"), env(&[("WAYLAND_DISPLAY", "wayland-0")]), no_probe));
+    }
+
+    /// X11 (XWayland) When a Pen Is Attached (#2028): XWayland on a Wayland session with an X
+    /// display when a pen is found, the session's own display server otherwise. The pen check
+    /// runs only on such a session.
+    #[test]
+    fn the_pen_choice_opens_xwayland_only_with_a_pen() {
+        let wayland = env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", ":0")]);
+        assert!(wanted(Some("x11WithPen"), &wayland, || true));
+        assert!(wanted(Some("x11WithPen"), env(&[("WAYLAND_SOCKET", "3"), ("DISPLAY", ":0")]), || true));
+        assert!(!wanted(Some("x11WithPen"), &wayland, || false));
+        assert!(!wanted(Some("x11WithPen"), env(&[("DISPLAY", ":0")]), no_probe));
+        assert!(!wanted(Some("x11WithPen"), env(&[("WAYLAND_DISPLAY", "wayland-0")]), no_probe));
+        assert!(!wanted(Some("x11WithPen"), env(&[("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", "")]), no_probe));
+    }
+
+    /// `/proc/bus/input/devices` of a laptop with a Wacom Intuos Pro attached (64-bit longs: the
+    /// pen's `KEY=1c03 0 0 0 0 0` has bit 0x140, `BTN_TOOL_PEN`), from PhotoCraft's tests.
+    const WITH_PEN: &str = "I: Bus=0011 Vendor=0001 Product=0001 Version=ab83\n\
+        N: Name=\"AT Translated Set 2 keyboard\"\n\
+        H: Handlers=sysrq kbd event3 leds\n\
+        B: KEY=402000000 3803078f800d001 feffffdfffefffff fffffffffffffffe\n\
+        \n\
+        I: Bus=0018 Vendor=06cb Product=ce26 Version=0100\n\
+        N: Name=\"SYNA2B33:00 06CB:CE26 Touchpad\"\n\
+        H: Handlers=mouse1 event7\n\
+        B: KEY=e520 10000 0 0 0 0\n\
+        B: ABS=2e0800000000003\n\
+        \n\
+        I: Bus=0003 Vendor=056a Product=0357 Version=0110\n\
+        N: Name=\"Wacom Intuos Pro M Pen\"\n\
+        H: Handlers=mouse2 event10\n\
+        B: KEY=1c03 0 0 0 0 0\n\
+        B: ABS=1000f000003\n";
+
+    /// A uinput virtual keyboard that claims every key code, `BTN_TOOL_PEN` included, and has no
+    /// absolute axes (`EV=20013`, no `B: ABS=` line), from PhotoCraft's tests.
+    const VIRTUAL_KEYBOARD: &str = "I: Bus=0003 Vendor=1234 Product=5678 Version=0111\n\
+        N: Name=\"Virtual Keyboard\"\n\
+        H: Handlers=sysrq rfkill kbd event256 leds \n\
+        B: EV=20013\n\
+        B: KEY=ffffffffff 0 7ffffff000301ff 1000f7fffffff 7fe001fffff000f 7ffffffffffffff ffffffff0003fdff 7fff8fff00ff03ff 1ffffffffffff07 ffffffffffffffff ffffffffffefffff fffffffffffffffe\n";
+
+    #[test]
+    fn a_pen_is_a_device_with_btn_tool_pen_and_absolute_axes() {
+        assert!(has_pen(WITH_PEN));
+        let without = WITH_PEN.split("\n\n").take(2).collect::<Vec<_>>().join("\n\n");
+        assert!(!has_pen(&without), "a touchpad's BTN_TOOL_FINGER (0x145) is not a pen");
+        // A pen display reports the pen with its own axes.
+        assert!(has_pen("N: Name=\"Wacom One Pen\"\nB: KEY=1c03 0 0 0 0 0\nB: ABS=3\n"));
+        // Axes without ABS_X or ABS_Y, or no axes at all, are no pen.
+        assert!(!has_pen("B: KEY=1c03 0 0 0 0 0\nB: ABS=1000f000002\n"));
+        assert!(!has_pen("B: KEY=1c03 0 0 0 0 0\nB: ABS=1000f000001\n"));
+        let pen_without_axes = WITH_PEN.lines().filter(|l| !l.starts_with("B: ABS=1000f")).collect::<Vec<_>>().join("\n");
+        assert!(!has_pen(&pen_without_axes));
+        // The virtual keyboard claims the key but is no pen, and a real pen beside it is still found.
+        assert!(VIRTUAL_KEYBOARD.lines().find_map(|l| l.strip_prefix("B: KEY=")).is_some_and(|k| bit_set(k, BTN_TOOL_PEN)));
+        assert!(!has_pen(VIRTUAL_KEYBOARD));
+        assert!(has_pen(&format!("{VIRTUAL_KEYBOARD}\n{WITH_PEN}")));
+        // Short or malformed bitmaps are no pen, never a panic.
+        for keys in ["", "B: KEY=", "B: KEY=1", "B: KEY=zz 0 0 0 0 0", "B: KEY=ffffffffffffffffff 0 0 0 0 0", "B: KEY=0 0 0 0 0 0 0 0"] {
+            assert!(!has_pen(&format!("{keys}\nB: ABS=3")), "{keys:?}");
+        }
+        for abs in ["B: ABS=", "B: ABS=zz", "B: ABS=ffffffffffffffffff", "B: ABS=0 0"] {
+            assert!(!has_pen(&format!("B: KEY=1c03 0 0 0 0 0\n{abs}")), "{abs:?}");
+        }
     }
 
     #[test]

assets/icons/dc-appearance.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><rect x="4" y="4" width="10" height="10" fill="currentColor" fill-opacity="0.4"/><rect x="10" y="10" width="10" height="10"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><circle cx="6" cy="7" r="2" fill="currentColor" fill-opacity="0.45"/><path d="M10 7h10"/><circle cx="6" cy="12" r="2" fill="currentColor" fill-opacity="0.45"/><path d="M10 12h8"/><circle cx="6" cy="17" r="2" fill="currentColor" fill-opacity="0.45"/><path d="M10 17h11"/></svg>

assets/icons/dc-objects-on-path.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M3 18C8 6 16 6 21 14"/><rect x="3.6" y="11.6" width="3.6" height="3.6"/><rect x="10.2" y="6.7" width="3.6" height="3.6"/><rect x="16.8" y="9.2" width="3.6" height="3.6"/></svg>

contributors/people.toml

@@ -115,3 +115,28 @@ sync_github_name = false
 real_name = "Kamil Kwiatkowski"
 display_name = "Kamil Kwiatkowski"
 sync_github_name = false
+
+[people.marcoarnulfo]
+real_name = "Marco Arnulfo"
+display_name = "Marco Arnulfo"
+sync_github_name = false
+
+[people.theromis]
+sync_github_name = true
+
+[people.dennismutuku2005]
+sync_github_name = true
+
+[people.krinry]
+display_name = "krinry"
+sync_github_name = true
+
+[people.makesomethingshit]
+sync_github_name = true
+
+[people.MiQ71]
+real_name = "Mirko Kerezovic"
+sync_github_name = false
+
+[people.KaboomFox]
+sync_github_name = true

crates/brush/src/lib.rs

@@ -287,6 +287,8 @@ pub struct ArtBrush {
     pub width: f64,
     pub flip_along: bool,
     pub flip_across: bool,
+    /// When true, art is placed on each run between sharp corners so folds do not overlap.
+    pub overlap: bool,
     pub colorization: Colorization,
 }
 
@@ -304,6 +306,7 @@ impl Default for ArtBrush {
             width: 100.0,
             flip_along: false,
             flip_across: false,
+            overlap: false,
             colorization: Colorization::Tints,
         }
     }

crates/brush/src/tests.rs

@@ -152,6 +152,28 @@ fn art_brush_between_guides_keeps_ends() {
     assert!(near(h.x0, 280.0, 1e-6) && near(h.x1, 300.0, 1e-6), "{h:?}");
 }
 
+#[test]
+fn art_brush_overlap_splits_at_corners() {
+    let mut bp = BezPath::new();
+    bp.move_to((0.0, 0.0));
+    bp.line_to((100.0, 0.0));
+    bp.line_to((100.0, 100.0));
+    let brush = |overlap: bool| Brush {
+        name: "a".into(),
+        kind: BrushKind::Art(ArtBrush {
+            art: rect_art(10.0, 4.0),
+            scale: ArtScale::Stretch,
+            overlap,
+            colorization: Colorization::None,
+            ..Default::default()
+        }),
+    };
+    let one = stroke_pieces(&Document::new(1.0, 1.0), &brush(false), &bp, &stroke(1.0));
+    let two = stroke_pieces(&Document::new(1.0, 1.0), &brush(true), &bp, &stroke(1.0));
+    assert_eq!(one.len(), 1, "one bent copy along the whole path");
+    assert_eq!(two.len(), 2, "one copy per run between corners");
+}
+
 #[test]
 fn art_brush_follows_curves() {
     let bp = shapes::ellipse(Rect::new(0.0, 0.0, 200.0, 200.0)).to_bezpath();

crates/brush/src/warp.rs

@@ -154,35 +154,65 @@ fn bend(t: &Track, art: &Node, b: Rect, along: AlongMap, cross: f64) -> Option<N
     warp_node(art, &f, flat_tol, MAX_SEG / along.max_scale(), cross.abs())
 }
 
+/// Arc-length spans to place art on when [`ArtBrush::overlap`] is on: one run between each sharp
+/// corner (the whole path when it has none).
+fn art_runs(t: &Track) -> Vec<(f64, f64)> {
+    let l = t.len();
+    let corners = t.corner_positions();
+    if corners.is_empty() {
+        return vec![(0.0, l)];
+    }
+    if t.closed {
+        let first = corners[0].1;
+        let mut bounds = corners.iter().map(|c| c.1).collect::<Vec<_>>();
+        bounds.push(first + l);
+        return bounds.windows(2).map(|w| (w[0], w[1])).collect();
+    }
+    let mut bounds = vec![0.0];
+    bounds.extend(corners.iter().map(|c| c.1));
+    bounds.push(l);
+    bounds.windows(2).map(|w| (w[0], w[1])).collect()
+}
+
+fn art_on_run(a: &ArtBrush, t: &Track, s0: f64, s1: f64, art: &Node, b: Rect, cross: f64) -> Option<Node> {
+    let l = s1 - s0;
+    if l <= 1e-9 {
+        return None;
+    }
+    let w = b.width();
+    let (along, cross) = match a.scale {
+        ArtScale::Stretch => (AlongMap::linear(w, s0, s1), cross),
+        ArtScale::Proportional => {
+            let k = l / w;
+            (AlongMap::linear(w, s0, s1), k * a.width / 100.0)
+        }
+        ArtScale::BetweenGuides { start, end } => {
+            let (g0, g1) = (start.clamp(0.0, 1.0) * w, end.clamp(0.0, 1.0) * w);
+            let (g0, g1) = (g0.min(g1), g0.max(g1));
+            let fixed = (g0 + (w - g1)) * cross;
+            if fixed >= l || g1 - g0 < 1e-9 {
+                (AlongMap::linear(w, s0, s1), cross)
+            } else {
+                (AlongMap { xs: [0.0, g0, g1, w], ss: [s0, s0 + g0 * cross, s1 - (w - g1) * cross, s1] }, cross)
+            }
+        }
+    };
+    bend(t, art, b, along, cross)
+}
+
 pub(crate) fn art(a: &ArtBrush, bp: &BezPath, weight: f64) -> Vec<Node> {
     let Some((art, b)) = oriented(&a.art, a.direction, a.flip_along, a.flip_across) else { return vec![] };
     let cross = weight * a.width / 100.0;
     let mut out = vec![];
     for t in tracks(bp, 0.05) {
-        let l = t.len();
-        if l <= 1e-9 {
+        if t.len() <= 1e-9 {
             continue;
         }
-        let w = b.width();
-        let (along, cross) = match a.scale {
-            ArtScale::Stretch => (AlongMap::linear(w, 0.0, l), cross),
-            ArtScale::Proportional => {
-                let k = l / w;
-                (AlongMap::linear(w, 0.0, l), k * a.width / 100.0)
+        let runs = if a.overlap { art_runs(&t) } else { vec![(0.0, t.len())] };
+        for (s0, s1) in runs {
+            if let Some(n) = art_on_run(a, &t, s0, s1, &art, b, cross) {
+                out.push(n);
             }
-            ArtScale::BetweenGuides { start, end } => {
-                let (g0, g1) = (start.clamp(0.0, 1.0) * w, end.clamp(0.0, 1.0) * w);
-                let (g0, g1) = (g0.min(g1), g0.max(g1));
-                let fixed = (g0 + (w - g1)) * cross;
-                if fixed >= l || g1 - g0 < 1e-9 {
-                    (AlongMap::linear(w, 0.0, l), cross)
-                } else {
-                    (AlongMap { xs: [0.0, g0, g1, w], ss: [0.0, g0 * cross, l - (w - g1) * cross, l] }, cross)
-                }
-            }
-        };
-        if let Some(n) = bend(&t, &art, b, along, cross) {
-            out.push(n);
         }
     }
     out

crates/cad/src/import/tests.rs

@@ -965,6 +965,41 @@ fn drawings_the_export_writes_read_back() {
     }
 }
 
+#[test]
+fn closed_control_point_splines_stay_closed_through_export_and_import() {
+    // (explicitly closed, ends where it starts): coincident endpoints alone do not close a path.
+    let cases = [(true, true), (true, false), (false, true), (false, false)];
+    let mut doc = Document::new(200.0, 100.0);
+    let layer = doc.layers[0].id;
+    for (i, &(closed, returns)) in cases.iter().enumerate() {
+        let mut b = kurbo::BezPath::new();
+        b.move_to((20.0, 20.0));
+        b.curve_to((80.0, 0.0), (80.0, 80.0), (20.0, 80.0));
+        if returns {
+            b.curve_to((0.0, 80.0), (0.0, 20.0), (20.0, 20.0));
+        }
+        if closed {
+            b.close_path();
+        }
+        let id = doc.alloc_id();
+        let black = Appearance::basic(Paint::None, Paint::solid(Color::rgb8(0, 0, 0)), 1.0);
+        doc.insert(Some(layer), i, Node::path(id, vectorcraft_geom::PathData::from_bezpath(&b), black)).unwrap();
+    }
+    for version in crate::DxfVersion::ALL.into_iter().filter(|v| *v >= crate::DxfVersion::R13) {
+        let opts = crate::DxfOptions { version, unit: Unit::Points, region: doc.artboards[0].rect, ..crate::DxfOptions::default() };
+        let out = crate::export(&doc, &opts).unwrap();
+        let text = std::str::from_utf8(&out.bytes).unwrap();
+        assert_eq!(text.matches("\nSPLINE\n").count(), cases.len(), "{version:?}: curves are written as SPLINE entities");
+        let back = leaves(&open(&out.bytes, &points()).document);
+        assert_eq!(back.len(), cases.len(), "{version:?}");
+        for (n, &(closed, returns)) in back.iter().zip(&cases) {
+            let path = n.path_data().unwrap();
+            assert_eq!(path.subpaths.len(), 1, "{version:?}");
+            assert_eq!(path.subpaths[0].closed, closed, "{version:?}: closed {closed}, returns {returns}");
+        }
+    }
+}
+
 #[test]
 fn info_lists_layers_layouts_and_version() {
     let tables = [(0, "TABLE"), (2, "LAYER"), (0, "LAYER"), (2, "0"), (62, "7"), (0, "LAYER"), (2, "Walls"), (62, "1"), (0, "ENDTAB")];

crates/cad/src/scene.rs

@@ -56,6 +56,84 @@ struct Sub {
     closed: bool,
 }
 
+/// A subpath close enough to a circle to preserve as a native DXF CIRCLE/ARC. VectorCraft's
+/// ellipse helper uses the standard four-cubic circle approximation, so recognition needs a small
+/// relative tolerance rather than exact control-point tests.
+struct CircularSub {
+    centre: Point,
+    radius: f64,
+    samples: Vec<Point>,
+}
+
+fn cubic_point(p0: Point, p1: Point, p2: Point, p3: Point, t: f64) -> Point {
+    let u = 1.0 - t;
+    let a = u * u * u;
+    let b = 3.0 * u * u * t;
+    let c = 3.0 * u * t * t;
+    let d = t * t * t;
+    Point::new(a * p0.x + b * p1.x + c * p2.x + d * p3.x, a * p0.y + b * p1.y + c * p2.y + d * p3.y)
+}
+
+/// Conservatively fit a curved subpath to one circle. Straight segments are never promoted. The
+/// 5e-4 radial tolerance is just above the maximum radial error of the usual kappa cubic circle
+/// approximation (~2.7e-4 r), while rejecting visibly elliptical or arbitrary cubic curves.
+fn circular_subpath(sub: &Sub) -> Option<CircularSub> {
+    if sub.segs.is_empty() || sub.segs.iter().any(|s| matches!(s, Seg::Line(_))) {
+        return None;
+    }
+    let mut samples = vec![sub.start];
+    let mut from = sub.start;
+    for seg in &sub.segs {
+        let Seg::Cubic(a, b, to) = *seg else { return None };
+        for i in 1..=8 {
+            samples.push(cubic_point(from, a, b, to, f64::from(i) / 8.0));
+        }
+        from = to;
+    }
+    if samples.len() < 4 {
+        return None;
+    }
+    let mut anchors = vec![sub.start];
+    anchors.extend(sub.segs.iter().map(|s| s.end()));
+    if sub.closed && anchors.last().is_some_and(|p| p.distance(sub.start) <= 1e-9) {
+        anchors.pop();
+    }
+    let (p0, p1, p2) = if anchors.len() >= 3 {
+        (anchors[0], anchors[anchors.len() / 3], anchors[anchors.len() * 2 / 3])
+    } else {
+        (samples[0], samples[samples.len() / 2], *samples.last()?)
+    };
+    let d = 2.0 * (p0.x * (p1.y - p2.y) + p1.x * (p2.y - p0.y) + p2.x * (p0.y - p1.y));
+    let scale2 = p0.distance(p1).max(p1.distance(p2)).max(p2.distance(p0)).powi(2);
+    if !d.is_finite() || d.abs() <= scale2 * 1e-9 {
+        return None;
+    }
+    let q0 = p0.x * p0.x + p0.y * p0.y;
+    let q1 = p1.x * p1.x + p1.y * p1.y;
+    let q2 = p2.x * p2.x + p2.y * p2.y;
+    let centre = Point::new(
+        (q0 * (p1.y - p2.y) + q1 * (p2.y - p0.y) + q2 * (p0.y - p1.y)) / d,
+        (q0 * (p2.x - p1.x) + q1 * (p0.x - p2.x) + q2 * (p1.x - p0.x)) / d,
+    );
+    let radius = centre.distance(p0);
+    if !centre.x.is_finite() || !centre.y.is_finite() || !radius.is_finite() || radius <= 1e-9 {
+        return None;
+    }
+    let tolerance = (radius * 5e-4).max(1e-6);
+    if samples.iter().any(|p| (centre.distance(*p) - radius).abs() > tolerance) {
+        return None;
+    }
+    Some(CircularSub { centre, radius, samples })
+}
+
+fn angle_deg(p: Point, centre: Point) -> f64 {
+    (p.y - centre.y).atan2(p.x - centre.x).to_degrees().rem_euclid(360.0)
+}
+
+fn on_ccw_arc(start: f64, end: f64, angle: f64) -> bool {
+    (angle - start).rem_euclid(360.0) <= (end - start).rem_euclid(360.0) + 1e-7
+}
+
 /// The subpaths of `bp` (quadratics raised to cubics).
 fn subpaths(bp: &BezPath) -> Vec<Sub> {
     let mut out = vec![];
@@ -576,6 +654,10 @@ impl<'a> Scene<'a> {
                     pts.pop();
                 }
                 self.polyline(&pts, sub.closed, style, width);
+            } else if (v.handles() || width.is_none()) && self.circular(&sub, style) {
+                // Native circles/arcs are preferred by CAD/CAM software. In R12, however, a
+                // stroked curve must stay on the flattened POLYLINE path so groups 40/41 retain
+                // its width. Non-circular curves continue through the existing fallback.
             } else if v.handles() {
                 self.spline(&sub, style);
             } else {
@@ -636,6 +718,73 @@ impl<'a> Scene<'a> {
         self.e.entity("SEQEND", end, h, &layer, style, "");
     }
 
+    /// Write a safely recognized circular subpath as a native DXF CIRCLE or ARC. Returns false
+    /// when the curve is not circular enough, leaving the caller to write it as a spline/polyline.
+    fn circular(&mut self, sub: &Sub, style: &EntityStyle) -> bool {
+        let Some(last) = sub.segs.last().map(|s| s.end()) else { return false };
+        let geometrically_closed = last.distance(sub.start) <= 1e-9;
+        // ClosePath can add an implicit straight closing edge. Do not replace that geometry with
+        // a full CIRCLE; likewise, an open curve that returns to its start is not an ARC. Check
+        // before fitting, updating extents or allocating an entity handle.
+        if sub.closed != geometrically_closed {
+            return false;
+        }
+        let Some(circle) = circular_subpath(sub) else { return false };
+        let centre = self.to_dxf * circle.centre;
+        let radius = circle.radius * self.k.abs();
+        if !centre.x.is_finite() || !centre.y.is_finite() || !radius.is_finite() || radius <= 1e-12 {
+            return false;
+        }
+
+        // Count sampled points in the drawing extents. For a full circle include all cardinal
+        // points exactly; for an arc, the dense samples conservatively cover its visible span.
+        if sub.closed {
+            let r = circle.radius;
+            for p in [
+                Point::new(circle.centre.x - r, circle.centre.y),
+                Point::new(circle.centre.x + r, circle.centre.y),
+                Point::new(circle.centre.x, circle.centre.y - r),
+                Point::new(circle.centre.x, circle.centre.y + r),
+            ] {
+                self.pt(p);
+            }
+        } else {
+            for p in &circle.samples {
+                self.pt(*p);
+            }
+        }
+
+        let layer = self.layer.clone();
+        let h = self.handle();
+        if sub.closed {
+            self.e.entity("CIRCLE", h, fixed::MODEL_RECORD, &layer, style, "AcDbCircle");
+            self.e.xyz(10, centre.x, centre.y);
+            self.e.num(40, radius);
+            self.e.normal();
+            return true;
+        }
+
+        let start = self.to_dxf * sub.start;
+        let end = self.to_dxf * last;
+        let middle = self.to_dxf * circle.samples[circle.samples.len() / 2];
+        let mut a0 = angle_deg(start, centre);
+        let mut a1 = angle_deg(end, centre);
+        let am = angle_deg(middle, centre);
+        if !on_ccw_arc(a0, a1, am) {
+            std::mem::swap(&mut a0, &mut a1);
+        }
+        self.e.entity("ARC", h, fixed::MODEL_RECORD, &layer, style, "AcDbCircle");
+        self.e.xyz(10, centre.x, centre.y);
+        self.e.num(40, radius);
+        self.e.normal();
+        if self.o.version.handles() {
+            self.e.raw(100, "AcDbArc");
+        }
+        self.e.num(50, a0);
+        self.e.num(51, a1);
+        true
+    }
+
     /// A curved subpath as one cubic B-spline whose clamped knots repeat at every joint, so it
     /// passes through every anchor (straight segments become straight cubics).
     fn spline(&mut self, sub: &Sub, style: &EntityStyle) {

crates/cad/src/tests.rs

@@ -143,8 +143,8 @@ fn lines_are_lwpolylines_curves_splines_and_fills_hatches() {
     let out = export(&d, &opts(&d)).unwrap();
     assert_eq!(
         kinds(&out),
-        ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "SPLINE"],
-        "the fill's outline and hatch, then the stroke, then the ellipse's stroke"
+        ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "CIRCLE"],
+        "the fill's outline and hatch, then the stroke, then the circle's stroke"
     );
     let e = entities(&out);
     // The rectangle, y up from the artboard's bottom-left corner: 10..110 × 40..90.
@@ -164,11 +164,9 @@ fn lines_are_lwpolylines_curves_splines_and_fills_hatches() {
     assert_eq!((get(&e[0], 370), get(&e[2], 370)), (None, Some("35")));
     let hatch = &e[1];
     assert_eq!((get(hatch, 2), get(hatch, 70), get(hatch, 91), get(hatch, 93)), (Some("SOLID"), Some("1"), Some("1"), Some("4")));
-    // The ellipse: four cubics through clamped knots.
-    let spline = &e[3];
-    assert_eq!((get(spline, 71), get(spline, 73)), (Some("3"), Some("13")));
-    assert_eq!(get(spline, 70), Some("9"), "closed planar spline (#1299): 1 = closed, 8 = planar");
-    assert_eq!(all(spline, 40), [0.0, 0.0, 0.0, 0.0, 1.0, 1.0, 1.0, 2.0, 2.0, 2.0, 3.0, 3.0, 3.0, 4.0, 4.0, 4.0, 4.0]);
+    // The circular ellipse is preserved as a native circle (#1299).
+    let circle = &e[3];
+    assert_eq!((all(circle, 10), all(circle, 20), all(circle, 40)), (vec![150.0], vec![50.0], vec![30.0]));
     // R14 has lightweight polylines but no lineweights: the stroke is a polyline width.
     let r14 = export(&d, &DxfOptions { version: DxfVersion::R14, ..opts(&d) }).unwrap();
     assert_eq!(get(&entities(&r14)[2], 43), Some("1"));
@@ -177,16 +175,77 @@ fn lines_are_lwpolylines_curves_splines_and_fills_hatches() {
     // R13 has splines and hatches, and polylines of vertices.
     let r13 = export(&d, &DxfOptions { version: DxfVersion::R13, ..opts(&d) }).unwrap();
     let poly = ["POLYLINE", "VERTEX", "VERTEX", "VERTEX", "VERTEX", "SEQEND"];
-    assert_eq!(kinds(&r13), [&poly[..], &["HATCH"], &poly, &["SPLINE"]].concat());
-    // R12: polylines only; the fill is its outline, the ellipse flattened.
+    assert_eq!(kinds(&r13), [&poly[..], &["HATCH"], &poly, &["CIRCLE"]].concat());
+    // R12: visible stroke widths live on old POLYLINE entities, including curved strokes.
     let r12 = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
     let k = kinds(&r12);
     assert!(k.iter().all(|k| matches!(k.as_str(), "POLYLINE" | "VERTEX" | "SEQEND")), "{k:?}");
     assert_eq!(k.iter().filter(|k| *k == "POLYLINE").count(), 3);
-    assert!(k.iter().filter(|k| *k == "VERTEX").count() > 20, "the ellipse is flattened");
+    assert_eq!(k.iter().filter(|k| *k == "CIRCLE").count(), 0);
     assert!(r12.warnings.iter().any(|w| w.contains("R12 has no fills")), "{:?}", r12.warnings);
 }
 
+#[test]
+fn circles_and_circular_arcs_are_native_dxf_entities() {
+    let d = doc_with(|d| {
+        let circle = shapes::ellipse(Rect::new(20.0, 20.0, 80.0, 80.0));
+        let c = Point::new(120.0, 50.0);
+        let r = 30.0;
+        let k = r * shapes::KAPPA;
+        let mut arc = vectorcraft_geom::BezPath::new();
+        arc.move_to(Point::new(c.x + r, c.y));
+        arc.curve_to(Point::new(c.x + r, c.y - k), Point::new(c.x + k, c.y - r), Point::new(c.x, c.y - r));
+        vec![
+            path(d, circle, Paint::None, Paint::solid(Color::BLACK), 1.0),
+            path(d, PathData::from_bezpath(&arc), Paint::None, Paint::solid(Color::BLACK), 1.0),
+        ]
+    });
+    for version in DxfVersion::ALL.into_iter().filter(|version| *version != DxfVersion::R12) {
+        let out = export(&d, &DxfOptions { version, ..opts(&d) }).unwrap();
+        let e = entities(&out);
+        assert_eq!(e.iter().map(|x| kind(x)).collect::<Vec<_>>(), ["CIRCLE", "ARC"], "{version:?}");
+        assert_eq!((all(&e[0], 10), all(&e[0], 20), all(&e[0], 40)), (vec![50.0], vec![50.0], vec![30.0]), "{version:?}");
+        assert_eq!((all(&e[1], 10), all(&e[1], 20), all(&e[1], 40)), (vec![120.0], vec![50.0], vec![30.0]), "{version:?}");
+        assert_eq!((all(&e[1], 50), all(&e[1], 51)), (vec![0.0], vec![90.0]), "{version:?}");
+    }
+
+    // An actual ellipse is not close enough to a circle and remains a spline.
+    let ellipse = doc_with(|d| vec![path(d, shapes::ellipse(Rect::new(20.0, 20.0, 100.0, 60.0)), Paint::None, Paint::solid(Color::BLACK), 1.0)]);
+    assert_eq!(kinds(&export(&ellipse, &opts(&ellipse)).unwrap()), ["SPLINE"]);
+}
+
+#[test]
+fn r12_stroked_circles_keep_polyline_width() {
+    let d = doc_with(|d| vec![path(d, shapes::ellipse(Rect::new(20.0, 20.0, 80.0, 80.0)), Paint::None, Paint::solid(Color::BLACK), 3.0)]);
+    let out = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
+    let e = entities(&out);
+    assert_eq!(kind(&e[0]), "POLYLINE");
+    assert_eq!((get(&e[0], 40), get(&e[0], 41)), (Some("3"), Some("3")));
+    assert!(!e.iter().any(|entity| kind(entity) == "CIRCLE"));
+}
+
+#[test]
+fn closed_circular_arc_with_a_closing_chord_is_not_a_circle() {
+    let d = doc_with(|d| {
+        let c = Point::new(50.0, 50.0);
+        let r = 30.0;
+        let k = r * shapes::KAPPA;
+        let mut arc = vectorcraft_geom::BezPath::new();
+        arc.move_to(Point::new(c.x + r, c.y));
+        arc.curve_to(Point::new(c.x + r, c.y - k), Point::new(c.x + k, c.y - r), Point::new(c.x, c.y - r));
+        arc.curve_to(Point::new(c.x - k, c.y - r), Point::new(c.x - r, c.y - k), Point::new(c.x - r, c.y));
+        arc.curve_to(Point::new(c.x - r, c.y + k), Point::new(c.x - k, c.y + r), Point::new(c.x, c.y + r));
+        arc.close_path();
+        vec![path(d, PathData::from_bezpath(&arc), Paint::None, Paint::solid(Color::BLACK), 1.0)]
+    });
+
+    let modern = export(&d, &opts(&d)).unwrap();
+    assert_eq!(kinds(&modern), ["SPLINE"]);
+    let r12 = export(&d, &DxfOptions { version: DxfVersion::R12, ..opts(&d) }).unwrap();
+    assert!(kinds(&r12).iter().any(|k| k == "POLYLINE"));
+    assert!(!kinds(&r12).iter().any(|k| k == "CIRCLE"));
+}
+
 #[test]
 fn spline_closed_flags_follow_path_intent_across_versions_without_changing_geometry() {
     let cases = [(true, true), (true, false), (false, false), (false, true)];
@@ -353,7 +412,7 @@ fn alter_paths_writes_strokes_as_filled_outlines() {
     // Each fill and stroke: its outlines, then its hatch.
     let fill = ["LWPOLYLINE", "HATCH"];
     let rect_stroke = ["LWPOLYLINE", "LWPOLYLINE", "HATCH"];
-    assert_eq!(kinds(&out), [&fill[..], &rect_stroke, &["SPLINE", "SPLINE", "HATCH"]].concat());
+    assert_eq!(kinds(&out), [&fill[..], &rect_stroke, &["CIRCLE", "CIRCLE", "HATCH"]].concat());
     // The rectangle's stroke: an outer and an inner boundary.
     assert_eq!(get(&entities(&out)[4], 91), Some("2"));
     // Preserve Appearance outlines only the strokes a line can't draw.
@@ -362,9 +421,9 @@ fn alter_paths_writes_strokes_as_filled_outlines() {
     if let Some(st) = d.node_mut(rect).and_then(|n| n.appearance.stroke_mut()) {
         st.align = vectorcraft_doc::StrokeAlign::Outside;
     }
-    assert_eq!(kinds(&export(&d, &opts(&d)).unwrap()), [&fill[..], &rect_stroke, &["SPLINE"]].concat());
+    assert_eq!(kinds(&export(&d, &opts(&d)).unwrap()), [&fill[..], &rect_stroke, &["CIRCLE"]].concat());
     let editable = export(&d, &DxfOptions { preserve: Preserve::Editability, ..opts(&d) }).unwrap();
-    assert_eq!(kinds(&editable), ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "SPLINE"]);
+    assert_eq!(kinds(&editable), ["LWPOLYLINE", "HATCH", "LWPOLYLINE", "CIRCLE"]);
     assert!(editable.warnings.iter().any(|w| w.contains("stroke alignment")));
 }
 
@@ -451,7 +510,7 @@ fn crop_leaves_out_art_outside_the_region() {
     let d = shapes_doc();
     // Only the ellipse (120..180) reaches into 115..200.
     let o = DxfOptions { region: Rect::new(115.0, 0.0, 200.0, 100.0), crop: true, ..opts(&d) };
-    assert_eq!(kinds(&export(&d, &o).unwrap()), ["SPLINE"]);
+    assert_eq!(kinds(&export(&d, &o).unwrap()), ["CIRCLE"]);
     assert_eq!(kinds(&export(&d, &DxfOptions { crop: false, ..o }).unwrap()).len(), 4);
 }
 

crates/color/src/cms/generic.rs

@@ -171,9 +171,25 @@ impl GenericCmyk {
         xyz_to_lab(self.to_xyz(cmyk))
     }
 
-    /// Display sRGB: media-relative (paper shows as white) or absolute (simulate paper colour).
-    pub fn to_srgb(&self, cmyk: [f32; 4], absolute: bool) -> [f32; 3] {
-        xyz_to_srgb(if absolute { self.to_xyz(cmyk) } else { self.to_xyz_rel(cmyk) })
+    /// Display XYZ: media-relative (paper shows as white) or absolute (simulate paper colour).
+    /// With `bpc` (media-relative only) the press black displays as black, undoing the
+    /// compensation [`Self::gamut_map`] applies on the way in, so sRGB black separated to the
+    /// darkest rich black shows as black again.
+    pub fn display_xyz(&self, cmyk: [f32; 4], absolute: bool, bpc: bool) -> [f32; 3] {
+        if absolute {
+            return self.to_xyz(cmyk);
+        }
+        let x = self.to_xyz_rel(cmyk);
+        if !bpc {
+            return x;
+        }
+        let bp = self.black_rel;
+        [0, 1, 2].map(|i| ((x[i] - bp[i]) / (1.0 - bp[i] / D50[i])).max(0.0))
+    }
+
+    /// Display sRGB, see [`Self::display_xyz`].
+    pub fn to_srgb(&self, cmyk: [f32; 4], absolute: bool, bpc: bool) -> [f32; 3] {
+        xyz_to_srgb(self.display_xyz(cmyk, absolute, bpc))
     }
 
     /// Lab of the darkest printable black (media-relative).
@@ -425,11 +441,12 @@ impl GenericCmyk {
         self.from_lab(srgb_to_lab(rgb), intent, bpc)
     }
 
-    /// ΔE2000 between an sRGB colour and its best (relative colorimetric) reproduction.
-    pub fn gamut_error(&self, src: Lab) -> f32 {
-        let target = self.gamut_map(src, Intent::RelativeColorimetric, false);
+    /// ΔE2000 between a colour and its best (relative colorimetric) reproduction as it displays
+    /// (with `bpc`, the press black showing as black).
+    pub fn gamut_error(&self, src: Lab, bpc: bool) -> f32 {
+        let target = self.gamut_map(src, Intent::RelativeColorimetric, bpc);
         let cmyk = self.separate(target);
-        delta_e2000(self.to_lab_rel(cmyk), target)
+        delta_e2000(xyz_to_lab(self.display_xyz(cmyk, false, bpc)), src)
     }
 }
 

crates/color/src/cms/icc.rs

@@ -320,9 +320,14 @@ fn labelled(mut p: ColorProfile, name: &str) -> ColorProfile {
 /// Grid points per input channel of the CMYK → Lab table and of the Lab → CMYK table.
 const A2B_GRID: usize = 9;
 const B2A_GRID: usize = 17;
+/// Grid points per Lab channel of the gamut table.
+const GAMUT_GRID: usize = 9;
 
 /// A CMYK output profile sampled from a conversion: `to_lab` (CMYK → media-relative Lab) in a
 /// 9⁴ table, `from_lab` (Lab → CMYK, gamut-mapped) in a 17³ table, Lab PCS (ICC v4 encoding).
+/// It carries every tag ICC.1 requires of an output profile: the tables for all three intents
+/// and the gamut tag (Windows rejects a CMYK profile without them, so Photos couldn't show a CMYK
+/// TIFF that embedded one, #2707).
 pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, from_lab: impl Fn(lab::Lab) -> [f32; 4]) -> ColorProfile {
     let unit = |i: usize, n: usize| i as f32 / (n - 1) as f32;
     let q = |v: f32| (v.clamp(0.0, 1.0) * 65535.0).round() as u16;
@@ -337,6 +342,13 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
         let [l, a, b] = [2, 1, 0].map(|d| unit(i / B2A_GRID.pow(d) % B2A_GRID, B2A_GRID));
         b2a.extend(from_lab(lab::Lab::new(l * 100.0, a * 255.0 - 128.0, b * 255.0 - 128.0)).map(q));
     }
+    // Gamut: 0 where a colour separates and comes back within a ΔE of 3, else out of gamut.
+    let mut gamut = Vec::with_capacity(GAMUT_GRID.pow(3));
+    for i in 0..GAMUT_GRID.pow(3) {
+        let [l, a, b] = [2, 1, 0].map(|d| unit(i / GAMUT_GRID.pow(d) % GAMUT_GRID, GAMUT_GRID));
+        let want = lab::Lab::new(l * 100.0, a * 255.0 - 128.0, b * 255.0 - 128.0);
+        gamut.push(if lab::delta_e2000(want, to_lab(from_lab(want))) <= 3.0 { 0 } else { u16::MAX });
+    }
     let identity = |n: usize| vec![ToneReprCurve::Parametric(vec![1.0]); n];
     let table = |inputs: usize, outputs: usize, grid: usize, clut: Vec<u16>| {
         let mut grid_points = [0u8; 16];
@@ -346,8 +358,9 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
             num_output_channels: outputs as u8,
             grid_points,
             clut: Some(LutStore::Store16(clut)),
-            // A curves sit on the device side, B curves on the PCS side.
-            a_curves: identity(4),
+            // A curves sit on the device side (the gamut tag's is its one output), B curves on the
+            // PCS side.
+            a_curves: identity(inputs + outputs - 3),
             b_curves: identity(3),
             m_curves: vec![],
             matrix: Matrix3d::IDENTITY,
@@ -356,6 +369,7 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
     };
     let a2b = table(4, 3, A2B_GRID, a2b);
     let b2a = table(3, 4, B2A_GRID, b2a);
+    let gamut = table(3, 1, GAMUT_GRID, gamut);
     let mut p = ColorProfile::default();
     p.profile_class = ProfileClass::OutputDevice;
     p.color_space = DataColorSpace::Cmyk;
@@ -364,9 +378,12 @@ pub(super) fn cmyk_profile(name: &str, to_lab: impl Fn([f32; 4]) -> lab::Lab, fr
     p.white_point = moxcms::WHITE_POINT_D50.to_xyzd();
     p.media_white_point = Some(p.white_point);
     p.lut_a_to_b_perceptual = Some(a2b.clone());
+    p.lut_a_to_b_saturation = Some(a2b.clone());
     p.lut_a_to_b_colorimetric = Some(a2b);
     p.lut_b_to_a_perceptual = Some(b2a.clone());
+    p.lut_b_to_a_saturation = Some(b2a.clone());
     p.lut_b_to_a_colorimetric = Some(b2a);
+    p.gamut = Some(gamut);
     labelled(p, name)
 }
 

crates/color/src/cms/mod.rs

@@ -257,9 +257,25 @@ pub fn register_icc(bytes: &[u8], name: Option<String>) -> Result<ProfileInfo, C
     Ok(info)
 }
 
-/// A number that changes whenever [`register_icc`] registers a profile: conversions through a
-/// profile looked up by name, such as those of a [`ProofTarget::Cmyk`] proof, give the same colors
-/// as long as the number stays the same.
+/// Forget a profile [`register_icc`] registered (by its name); `false` when there is none of that
+/// name (the built-in profiles can't be removed). Settings that name it no longer resolve, so a
+/// caller checks [`active_settings`] first.
+pub fn unregister_icc(name: &str) -> bool {
+    let mut u = USER.write().unwrap_or_else(|e| e.into_inner());
+    let before = u.len();
+    u.retain(|x| x.name != name);
+    let removed = u.len() != before;
+    drop(u);
+    if removed {
+        clear_proof_cache();
+        PROFILES_GENERATION.fetch_add(1, Ordering::Relaxed);
+    }
+    removed
+}
+
+/// A number that changes whenever [`register_icc`] registers a profile or [`unregister_icc`]
+/// removes one: conversions through a profile looked up by name, such as those of a
+/// [`ProofTarget::Cmyk`] proof, give the same colors as long as the number stays the same.
 pub fn profiles_generation() -> u64 {
     PROFILES_GENERATION.load(Ordering::Relaxed)
 }
@@ -346,10 +362,10 @@ impl Cms {
         }
     }
 
-    fn cmyk_to_srgb_in(space: &CmykSpace, cmyk: [f32; 4], absolute: bool) -> [f32; 3] {
+    fn cmyk_to_srgb_in(space: &CmykSpace, cmyk: [f32; 4], absolute: bool, bpc: bool) -> [f32; 3] {
         let cmyk = cmyk.map(|v| v.clamp(0.0, 1.0));
         match space {
-            CmykSpace::Generic(g) => g.to_srgb(cmyk, absolute),
+            CmykSpace::Generic(g) => g.to_srgb(cmyk, absolute, bpc),
             CmykSpace::Device => naive_cmyk_to_rgb(cmyk),
             CmykSpace::Icc(p) => {
                 let i = if absolute { Intent::AbsoluteColorimetric } else { Intent::RelativeColorimetric };
@@ -376,7 +392,7 @@ impl Cms {
         {
             return v;
         }
-        Self::cmyk_to_srgb_in(&self.cmyk, cmyk, absolute)
+        Self::cmyk_to_srgb_in(&self.cmyk, cmyk, absolute, self.settings.bpc)
     }
     /// CMYK in the working space → working RGB with `intent`. An ICC CMYK profile converts
     /// directly into the RGB profile: not through display sRGB, which would clip colours a wider
@@ -408,6 +424,15 @@ impl Cms {
             _ => lab::srgb_to_lab(self.cmyk_to_srgb(cmyk, false)),
         }
     }
+    /// Lab of working-space CMYK as it displays: [`Self::cmyk_to_lab`] plus, for the built-in
+    /// Generic CMYK, the black-point compensation of [`Self::cmyk_to_srgb`] (its press black shows
+    /// as black). Unclipped, for interpolating tables.
+    pub fn cmyk_display_lab(&self, cmyk: [f32; 4]) -> Lab {
+        match &self.cmyk {
+            CmykSpace::Generic(g) => lab::xyz_to_lab(g.display_xyz(cmyk.map(|v| v.clamp(0.0, 1.0)), false, self.settings.bpc)),
+            _ => self.cmyk_to_lab(cmyk),
+        }
+    }
     /// Lab → working CMYK with `intent`.
     pub fn lab_to_cmyk(&self, l: Lab, intent: Intent) -> [f32; 4] {
         match &self.cmyk {
@@ -429,7 +454,7 @@ impl Cms {
     /// CIE Lab (D50) of any colour.
     pub fn lab(&self, c: &Color) -> Lab {
         match *c {
-            Color::Cmyk { c, m, y, k } => self.cmyk_to_lab([c, m, y, k]),
+            Color::Cmyk { c, m, y, k } => self.cmyk_display_lab([c, m, y, k]),
             Color::Lab { l, a, b } => Lab::new(l, a, b),
             _ => lab::srgb_to_lab(self.display_rgb(c)),
         }
@@ -490,7 +515,7 @@ impl Cms {
             Color::Rgb { .. } | Color::Lab { .. } => {
                 let src = self.lab(c);
                 match &self.cmyk {
-                    CmykSpace::Generic(g) => g.gamut_error(src),
+                    CmykSpace::Generic(g) => g.gamut_error(src, self.settings.bpc),
                     CmykSpace::Device => 0.0,
                     CmykSpace::Icc(_) => {
                         let back = self.cmyk_to_srgb(self.to_cmyk(c, Intent::RelativeColorimetric), false);
@@ -523,7 +548,7 @@ impl Cms {
             ProofTarget::Cmyk(name) => match cmyk_space(name) {
                 Ok(sp) => {
                     let cmyk = Self::srgb_to_cmyk_in(&sp, srgb, proof.intent, self.settings.bpc);
-                    Self::cmyk_to_srgb_in(&sp, cmyk, proof.simulate_paper)
+                    Self::cmyk_to_srgb_in(&sp, cmyk, proof.simulate_paper, self.settings.bpc)
                 }
                 Err(_) => srgb,
             },
@@ -534,7 +559,7 @@ impl Cms {
     pub fn proof_cmyk_to_srgb(&self, cmyk: [f32; 4], proof: &ProofSetup) -> [f32; 3] {
         match &proof.target {
             ProofTarget::Cmyk(name) => match cmyk_space(name) {
-                Ok(sp) => Self::cmyk_to_srgb_in(&sp, cmyk, proof.simulate_paper),
+                Ok(sp) => Self::cmyk_to_srgb_in(&sp, cmyk, proof.simulate_paper, self.settings.bpc),
                 Err(_) => self.cmyk_to_srgb(cmyk, proof.simulate_paper),
             },
             _ => self.cmyk_to_srgb(cmyk, proof.simulate_paper),

crates/color/src/cms/tests.rs

@@ -245,6 +245,20 @@ fn loads_system_cmyk_icc() {
     assert_eq!(c.cmyk_to_srgb([0.0; 4], false).map(|v| (v * 255.0).round() as u8), [255, 255, 255]);
 }
 
+/// With black-point compensation, sRGB black separates to the press's darkest black and that black
+/// displays as black again (hex 000000 -> C67 M67 Y67 K100 -> 000000, not a dark grey).
+#[test]
+fn generic_cmyk_black_round_trips_with_bpc() {
+    let c = cms();
+    let cmyk = c.srgb_to_cmyk([0.0; 3], Intent::RelativeColorimetric);
+    let back = c.cmyk_to_srgb(cmyk, false).map(|v| (v * 255.0).round() as u8);
+    assert_eq!(back, [0, 0, 0], "{cmyk:?}");
+    // The paper still shows as white, and without compensation the press black stays a dark grey.
+    assert_eq!(c.cmyk_to_srgb([0.0; 4], false), [1.0, 1.0, 1.0]);
+    let raw = cms_no_bpc().cmyk_to_srgb(cmyk, false);
+    assert!(raw.iter().all(|v| *v > 0.05), "{raw:?}");
+}
+
 #[test]
 fn lab_colours_round_trip_through_the_cms() {
     let c = cms_no_bpc();

crates/color/src/cms/tests_icc.rs

@@ -22,7 +22,8 @@ fn cmyk_profiles_convert_like_the_cms() {
         assert_eq!(parse(&bytes).color_space, moxcms::DataColorSpace::Cmyk);
         let p = IccProfile::from_bytes(None, &bytes).unwrap();
         assert_eq!((p.name.as_str(), p.kind), (name, ProfileKind::Cmyk));
-        let cms = Cms::new(&ColorSettings { cmyk: name.into(), ..Default::default() }).unwrap();
+        // The encoded profile converts without black-point compensation, so compare without it.
+        let cms = Cms::new(&ColorSettings { cmyk: name.into(), bpc: false, ..Default::default() }).unwrap();
         for cmyk in [[0.0; 4], [1.0, 0.0, 0.0, 0.0], [0.2, 0.7, 0.1, 0.3], [0.0, 0.0, 0.0, 1.0], [0.5, 0.5, 0.5, 0.0]] {
             let want = cms.cmyk_to_srgb(cmyk, false);
             let got = p.to_srgb(&cmyk, Intent::RelativeColorimetric).unwrap();
@@ -134,3 +135,20 @@ fn written_profiles_align_their_tags() {
         }
     }
 }
+
+/// #2707: the CMYK profiles written here carry every tag ICC.1 requires of an output profile (the
+/// tables of all three intents and the gamut tag): Windows rejects one without them, and Photos
+/// then can't show a CMYK TIFF that embeds it.
+#[test]
+fn cmyk_profiles_have_the_tags_of_an_output_profile() {
+    for name in BUILTIN_CMYK {
+        let icc = icc_bytes(name).unwrap();
+        let be = |at: usize| u32::from_be_bytes([icc[at], icc[at + 1], icc[at + 2], icc[at + 3]]) as usize;
+        let tags: Vec<&[u8]> = (0..be(128)).map(|i| &icc[132 + 12 * i..136 + 12 * i]).collect();
+        for want in [b"desc", b"cprt", b"wtpt", b"A2B0", b"A2B1", b"A2B2", b"B2A0", b"B2A1", b"B2A2", b"gamt"] {
+            assert!(tags.contains(&&want[..]), "{name}: no {}", String::from_utf8_lossy(want));
+        }
+        let p = parse(&icc);
+        assert!(p.lut_a_to_b_saturation.is_some() && p.lut_b_to_a_saturation.is_some() && p.gamut.is_some(), "{name}");
+    }
+}

crates/color/src/freeform.rs

@@ -11,6 +11,7 @@
 use kurbo::{Affine, BezPath, CubicBez, ParamCurve, ParamCurveNearest, Point, Rect};
 use serde::{Deserialize, Serialize};
 
+use crate::cms::{self, Model};
 use crate::{Color, Gradient, GradientStop};
 
 /// The spread a new point gets.
@@ -157,11 +158,12 @@ impl Freeform {
         f
     }
 
-    /// Colour the points along `g`, first to last.
+    /// Color the points along `g`, first to last, mixing neighboring stops in the model they share
+    /// ([`Color::lerp_keep_model`]).
     pub fn recolor(&mut self, g: &Gradient) {
         let n = self.points.len();
         for (k, p) in self.points.iter_mut().enumerate() {
-            (p.color, p.opacity) = g.sample(k as f32 / (n - 1).max(1) as f32);
+            (p.color, p.opacity) = g.sample_with(k as f32 / (n - 1).max(1) as f32, Color::lerp_keep_model);
         }
     }
 
@@ -230,10 +232,10 @@ impl Freeform {
         best
     }
 
-    /// The colour and opacity at `p` for a painted box whose [`spread_scale`] is `scale`.
+    /// The color and opacity at `p` for a painted box whose [`spread_scale`] is `scale`, as
+    /// [`Self::model_field`] mixes them.
     pub fn sample(&self, p: Point, scale: f64) -> (Color, f32) {
-        let ([r, g, b], a) = self.field(scale).sample(p);
-        (Color::rgb(r, g, b), a)
+        self.model_field(scale).sample(p)
     }
 
     /// The colour field, with colours converted and lines tessellated once (for sampling many
@@ -265,6 +267,32 @@ impl Freeform {
         Field { points, pieces, eps: 1e-9 * (scale.abs() + 1.0) }
     }
 
+    /// [`Self::field`] mixing the colors in the model every point shares instead of display RGB:
+    /// the C, M, Y and K inks (as a CMYK document drawn by ink planes mixes them), the Gray ink,
+    /// or the RGB or Lab components. Points in different models mix in display RGB, as
+    /// [`Self::field`] mixes them, and the field gives that color in the working RGB space.
+    pub fn model_field(&self, scale: f64) -> ModelField {
+        let Some(model) = self.shared_model() else { return ModelField { model: None, first: self.field(scale), k: None } };
+        let parts = |c: &Color| match *c {
+            Color::Rgb { r, g, b } => [r, g, b, 0.0],
+            Color::Cmyk { c, m, y, k } => [c, m, y, k],
+            Color::Gray { k } => [k, 0.0, 0.0, 0.0],
+            Color::Lab { l, a, b } => [l, a, b, 0.0],
+        };
+        let first = self.field_with(scale, &|c| {
+            let [x, y, z, _] = parts(c);
+            [x, y, z]
+        });
+        let k = (model == Model::Cmyk).then(|| self.field_with(scale, &|c| [parts(c)[3], 0.0, 0.0]));
+        ModelField { model: Some(model), first, k }
+    }
+
+    /// The color model every point is in (`None` without points or when their models differ).
+    pub fn shared_model(&self) -> Option<Model> {
+        let m = self.points.first()?.color.model();
+        self.points.iter().all(|p| p.color.model() == m).then_some(m)
+    }
+
     /// Add a point; returns its index.
     pub fn add_point(&mut self, p: FreeformPoint) -> usize {
         self.points.push(p);
@@ -324,8 +352,9 @@ impl Freeform {
         true
     }
 
-    /// Insert a point on segment `segment` of line `line` at curve parameter `t`, with the colour,
-    /// opacity and spread between the segment's ends. Returns the new point's index.
+    /// Insert a point on segment `segment` of line `line` at curve parameter `t`, with the color
+    /// (in the model the ends share, [`Color::lerp_keep_model`]), opacity and spread between the
+    /// segment's ends. Returns the new point's index.
     pub fn split_line(&mut self, line: usize, segment: usize, t: f64) -> Option<usize> {
         let c = *self.segments(line).get(segment)?;
         let l = &self.lines[line];
@@ -334,7 +363,7 @@ impl Freeform {
         let u = t as f32;
         let p = FreeformPoint {
             at: c.eval(t),
-            color: a.color.lerp(&b.color, u),
+            color: a.color.lerp_keep_model(&b.color, u),
             opacity: a.opacity + (b.opacity - a.opacity) * u,
             spread: a.spread + (b.spread - a.spread) * u,
         };
@@ -440,6 +469,41 @@ impl Field {
     }
 }
 
+/// A freeform gradient ready to sample in its points' color model ([`Freeform::model_field`]).
+#[derive(Clone, Debug)]
+pub struct ModelField {
+    /// The model the points share (`None` when their models differ).
+    model: Option<Model>,
+    /// The first three components (C, M and Y; R, G and B; L, a and b; display RGB when the
+    /// models differ), or the Gray ink as the first of the three values.
+    first: Field,
+    /// The K ink of a CMYK field.
+    k: Option<Field>,
+}
+
+impl ModelField {
+    /// The model the points share (`None` when their models differ).
+    pub fn model(&self) -> Option<Model> {
+        self.model
+    }
+
+    /// The color and opacity at `p`: in the points' shared model, else in the working RGB space.
+    pub fn sample(&self, p: Point) -> (Color, f32) {
+        let ([x, y, z], a) = self.first.sample(p);
+        let c = match self.model {
+            None => {
+                let [r, g, b] = cms::active().srgb_to_rgb([x, y, z]);
+                Color::rgb(r, g, b)
+            }
+            Some(Model::Rgb) => Color::rgb(x, y, z),
+            Some(Model::Cmyk) => Color::cmyk(x, y, z, self.k.as_ref().map_or(0.0, |k| k.sample(p).0[0])),
+            Some(Model::Gray) => Color::gray(x),
+            Some(Model::Lab) => Color::lab(x, y, z),
+        };
+        (c, a)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -477,6 +541,31 @@ mod tests {
         assert!(close(c.to_rgb(), [0.5, 0.0, 0.5]) && (o - 0.75).abs() < 1e-6, "{c:?}");
     }
 
+    #[test]
+    fn the_sample_mixes_in_the_model_the_points_share() {
+        let halfway = |a: Color, b: Color| {
+            let mut f = two(0.0);
+            (f.points[0].color, f.points[1].color) = (a, b);
+            f.sample(Point::new(50.0, 0.0), 50.0).0
+        };
+        let near = |a: Color, b: Color| match (a, b) {
+            (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => {
+                [c - c2, m - m2, y - y2, k - k2].iter().all(|d| d.abs() < 1e-5)
+            }
+            (Color::Gray { k }, Color::Gray { k: k2 }) => (k - k2).abs() < 1e-5,
+            (Color::Lab { l, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => [l - l2, a - a2, b - b2].iter().all(|d| d.abs() < 1e-4),
+            _ => false,
+        };
+        let c = halfway(Color::cmyk(1.0, 0.0, 0.0, 0.0), Color::cmyk(0.0, 0.0, 0.0, 1.0));
+        assert!(near(c, Color::cmyk(0.5, 0.0, 0.0, 0.5)), "{c:?}");
+        let c = halfway(Color::gray(0.2), Color::gray(0.6));
+        assert!(near(c, Color::gray(0.4)), "{c:?}");
+        let c = halfway(Color::lab(50.0, 10.0, -20.0), Color::lab(70.0, 30.0, 0.0));
+        assert!(near(c, Color::lab(60.0, 20.0, -10.0)), "{c:?}");
+        // Points in different models mix in RGB.
+        assert!(matches!(halfway(Color::cmyk(1.0, 0.0, 0.0, 0.0), red()), Color::Rgb { .. }));
+    }
+
     #[test]
     fn spread_keeps_the_colour_pure_inside_and_falls_off_outside() {
         // Scale 100: a 0.2 spread is a 20 pt disc.

crates/color/src/lib.rs

@@ -181,6 +181,10 @@ impl Color {
             _ => {}
         }
         let h = s.strip_prefix('#').unwrap_or(s);
+        // `from_str_radix` accepts a leading `+`, so check the digits first.
+        if !h.chars().all(|c| c.is_ascii_hexdigit()) {
+            return None;
+        }
         let p = |i: usize, n: usize| u8::from_str_radix(h.get(i..i + n)?, 16).ok();
         match h.len() {
             3 => Some(Color::rgb8(p(0, 1)? * 17, p(1, 1)? * 17, p(2, 1)? * 17)),
@@ -237,6 +241,17 @@ impl Color {
         let b = other.to_rgb();
         Color::rgb(a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t, a[2] + (b[2] - a[2]) * t)
     }
+    /// Linear interpolation in the model both colors share when it is CMYK, Gray or Lab, else in
+    /// display RGB ([`Color::lerp`]).
+    pub fn lerp_keep_model(&self, other: &Color, t: f32) -> Color {
+        let l = |x: f32, y: f32| x + (y - x) * t;
+        match (*self, *other) {
+            (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => Color::cmyk(l(c, c2), l(m, m2), l(y, y2), l(k, k2)),
+            (Color::Gray { k }, Color::Gray { k: k2 }) => Color::gray(l(k, k2)),
+            (Color::Lab { l: l1, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => Color::lab(l(l1, l2), l(a, a2), l(b, b2)),
+            _ => self.lerp(other, t),
+        }
+    }
     /// The colour model this colour is authored in.
     pub fn model(&self) -> cms::Model {
         match self {
@@ -383,7 +398,9 @@ impl Paint {
     }
     /// Apply `f` to the colours of this paint that can link to a swatch (a solid colour, each
     /// gradient stop) with their link and tint; `f` returns true when it changed them. A colour
-    /// left without a link gets tint 1. Returns whether anything changed.
+    /// left without a link gets tint 1. A freeform gradient's points, which it draws from, go
+    /// through `f` too, as unlinked colours (a link `f` gives them is dropped). Returns whether
+    /// anything changed.
     pub fn map_links(&mut self, f: &mut dyn FnMut(&mut Color, &mut Option<String>, &mut f32) -> bool) -> bool {
         let mut one = |c: &mut Color, link: &mut Option<String>, tint: &mut f32| {
             let changed = f(c, link, tint);
@@ -394,7 +411,12 @@ impl Paint {
         };
         match self {
             Paint::Solid { color, swatch, tint } => one(color, swatch, tint),
-            Paint::Gradient(g) => g.gradient.stops.iter_mut().fold(false, |ch, s| one(&mut s.color, &mut s.swatch, &mut s.tint) | ch),
+            Paint::Gradient(g) => {
+                let stops = g.gradient.stops.iter_mut().fold(false, |ch, s| one(&mut s.color, &mut s.swatch, &mut s.tint) | ch);
+                let points =
+                    g.freeform.iter_mut().flat_map(|ff| ff.points.iter_mut()).fold(false, |ch, p| one(&mut p.color, &mut None, &mut 1.0) | ch);
+                stops | points
+            }
             _ => false,
         }
     }
@@ -412,6 +434,14 @@ mod tests {
         assert_eq!(Color::from_hex("zz"), None);
     }
 
+    #[test]
+    fn hex_rejects_sign_characters() {
+        for bad in ["#+1+2+3", "+f+f+f", "#-1-2-3", "#+12+34+56", "#+f+f+f+f", "#12345+"] {
+            assert_eq!(Color::from_hex(bad), None, "{bad}");
+        }
+        assert_eq!(Color::from_hex("#123"), Color::from_hex("#112233"));
+    }
+
     #[test]
     fn hsb_roundtrip() {
         for hex in ["#ff0000", "#00ff00", "#0000ff", "#336699", "#ffffff", "#000000", "#c0ffee"] {

crates/doc/Cargo.toml

@@ -14,6 +14,8 @@ vectorcraft-color = { workspace = true }
 kurbo = { workspace = true }
 image = { workspace = true }
 tiff = { workspace = true }
+# 1-bit TIFFs compressed with CCITT Group 3 (Compression 2 and 3).
+hayro-ccitt = { workspace = true }
 zune-jpeg = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

crates/doc/src/appearance.rs

@@ -739,9 +739,10 @@ pub struct Appearance {
     pub items: Vec<AppearanceItem>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub effects: Vec<Effect>,
-    /// Groups, layers and type: how many items paint below the object's contents (its members, or
-    /// type's characters), the slot of the Appearance panel's Contents (Characters) row. `None`:
-    /// every item paints above the contents (see [`Self::contents_at`]).
+    /// Groups, layers, type and images: how many items paint below the object's contents (its
+    /// members, type's characters, or an image's pixels), the slot of the Appearance panel's
+    /// Contents (Characters) row. `None`: every item paints above the contents (see
+    /// [`Self::contents_at`]).
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub contents_index: Option<usize>,
 }

crates/doc/src/blend.rs

@@ -33,13 +33,7 @@ use crate::text::TextObject;
 
 /// Interpolate two colours in their shared model (display RGB when the models differ).
 pub fn lerp_color(a: &Color, b: &Color, t: f32) -> Color {
-    let l = |x: f32, y: f32| x + (y - x) * t;
-    match (*a, *b) {
-        (Color::Cmyk { c, m, y, k }, Color::Cmyk { c: c2, m: m2, y: y2, k: k2 }) => Color::cmyk(l(c, c2), l(m, m2), l(y, y2), l(k, k2)),
-        (Color::Gray { k }, Color::Gray { k: k2 }) => Color::gray(l(k, k2)),
-        (Color::Lab { l: l1, a, b }, Color::Lab { l: l2, a: a2, b: b2 }) => Color::lab(l(l1, l2), l(a, a2), l(b, b2)),
-        _ => a.lerp(b, t),
-    }
+    a.lerp_keep_model(b, t)
 }
 
 fn lerp_f32(x: f32, y: f32, t: f32) -> f32 {

crates/doc/src/cancel.rs

@@ -0,0 +1,142 @@
+//! Cooperative cancellation and progress for long-running work (exports, flattening, baking).
+//!
+//! A host that wants to be able to stop a call (the MCP server, on `notifications/cancelled`)
+//! runs it inside [`scope`] with a [`CancelToken`]. Code deep below, which has no handle on the
+//! host, calls [`check`] (or [`is_cancelled`] where it can't return an error) at points where
+//! stopping is safe, and returns [`Cancelled`] up through the same `Result`s it already has. The
+//! token is tied to the thread that entered the scope, so concurrent sessions on other threads
+//! (and tests running in parallel) never see each other's cancellation, and code outside any
+//! scope is never cancelled.
+//!
+//! Work that stops early leaves nothing behind: callers drop whatever was half built and report
+//! the error, so a cancelled command changes nothing.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+/// A flag one thread raises and another polls. Cloning shares the flag.
+#[derive(Clone, Debug, Default)]
+pub struct CancelToken(Arc<AtomicBool>);
+
+impl CancelToken {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Ask for the work holding this token to stop.
+    pub fn cancel(&self) {
+        self.0.store(true, Ordering::Relaxed);
+    }
+
+    pub fn is_cancelled(&self) -> bool {
+        self.0.load(Ordering::Relaxed)
+    }
+}
+
+/// The error of work that stopped because it was cancelled.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Cancelled;
+
+impl std::fmt::Display for Cancelled {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("cancelled")
+    }
+}
+
+impl std::error::Error for Cancelled {}
+
+/// Receives progress: `(done, total, what is being done)`. `total` is 0 when it isn't known.
+pub type ProgressSink = Rc<dyn Fn(u64, u64, &str)>;
+
+struct Scope {
+    token: CancelToken,
+    sink: Option<ProgressSink>,
+}
+
+thread_local! {
+    static CURRENT: RefCell<Option<Scope>> = const { RefCell::new(None) };
+}
+
+/// Puts the previous scope back, also when the work inside unwinds.
+struct Restore(Option<Scope>);
+
+impl Drop for Restore {
+    fn drop(&mut self) {
+        let previous = self.0.take();
+        // `try_with`: during thread teardown the slot may be gone; nothing to restore then.
+        let _ = CURRENT.try_with(|c| *c.borrow_mut() = previous);
+    }
+}
+
+/// Run `f` with `token` (and an optional progress `sink`) in effect on this thread.
+pub fn scope<T>(token: &CancelToken, sink: Option<ProgressSink>, f: impl FnOnce() -> T) -> T {
+    let previous = CURRENT.with(|c| c.borrow_mut().replace(Scope { token: token.clone(), sink }));
+    let _restore = Restore(previous);
+    f()
+}
+
+/// Has the work running on this thread been cancelled? Always false outside a [`scope`].
+pub fn is_cancelled() -> bool {
+    CURRENT.with(|c| c.borrow().as_ref().is_some_and(|s| s.token.is_cancelled()))
+}
+
+/// Is this thread running inside a [`scope`], so that a cancel can reach it?
+pub fn is_cancellable() -> bool {
+    CURRENT.with(|c| c.borrow().is_some())
+}
+
+/// `Err(Cancelled)` when the work running on this thread has been cancelled.
+pub fn check() -> Result<(), Cancelled> {
+    if is_cancelled() { Err(Cancelled) } else { Ok(()) }
+}
+
+/// Report that `done` of `total` steps (0: unknown) are finished. A no-op outside a [`scope`]
+/// that has a sink.
+pub fn progress(done: u64, total: u64, what: &str) {
+    // The sink runs outside the borrow, so it may itself call back into this module.
+    let sink = CURRENT.with(|c| c.borrow().as_ref().and_then(|s| s.sink.clone()));
+    if let Some(sink) = sink {
+        sink(done, total, what);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_work_inside_the_scope_is_cancelled() {
+        let t = CancelToken::new();
+        assert_eq!(check(), Ok(()));
+        scope(&t, None, || {
+            assert_eq!(check(), Ok(()));
+            t.cancel();
+            assert_eq!(check(), Err(Cancelled));
+            // A nested scope with its own token shadows, then restores.
+            scope(&CancelToken::new(), None, || assert_eq!(check(), Ok(())));
+            assert!(is_cancelled());
+        });
+        assert!(!is_cancelled(), "the scope ended");
+    }
+
+    #[test]
+    fn progress_reaches_the_sink_and_the_scope_survives_a_panic() {
+        let seen = Rc::new(RefCell::new(vec![]));
+        let sink: ProgressSink = {
+            let seen = seen.clone();
+            Rc::new(move |d, t, w| seen.borrow_mut().push((d, t, w.to_string())))
+        };
+        let t = CancelToken::new();
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            scope(&t, Some(sink), || {
+                progress(1, 3, "page");
+                panic!("boom");
+            })
+        }));
+        assert!(r.is_err());
+        progress(2, 3, "after");
+        assert_eq!(*seen.borrow(), vec![(1, 3, "page".to_string())]);
+    }
+}

crates/doc/src/cmyk.rs

@@ -2,10 +2,12 @@
 //!
 //! Two encodings hold them: a four-component JPEG, whose samples are stored inverted with Adobe's
 //! marker (the convention JPEG readers and PDF writers take a CMYK JPEG to follow), and a CMYK
-//! TIFF (8 or 16 bits, chunky, ink amounts as they are). [`ImageBlob::cmyk_tiff`] writes the
-//! latter, Deflate-compressed. Every other image decodes to RGB(A) only.
+//! TIFF (8 or 16 bits, ink amounts as they are, each pixel's inks together or one plane per ink).
+//! [`ImageBlob::cmyk_tiff`] writes the latter, inks together, Deflate-compressed. Every other image
+//! decodes to RGB(A) only.
 
 use std::io::Cursor;
+use std::sync::Arc;
 
 use zune_jpeg::zune_core::bytestream::ZCursor;
 use zune_jpeg::zune_core::colorspace::ColorSpace;
@@ -54,25 +56,136 @@ fn is_tiff(bytes: &[u8]) -> bool {
     bytes.starts_with(b"II*\0") || bytes.starts_with(b"MM\0*")
 }
 
-/// The colour type of TIFF `bytes` and its decoder.
+/// The width and height of the first image of TIFF `bytes` when it has more strips or tiles than
+/// the `tiff` decoder can count: strips per plane times planes past `u32::MAX`, or tiles per plane
+/// times planes past `usize::MAX`. A file that stores one plane per channel (PlanarConfiguration 2)
+/// has a plane for each channel; other files have one. The decoder multiplies these counts without
+/// a check, which panics where overflow checks are on. Such an image, when it is at least a pixel
+/// wide, claims at least 2^32 samples.
+/// Where a tag repeats, the value giving the most strips or tiles counts. `None` for other images
+/// and for bytes that aren't a TIFF.
+pub fn oversized_tiff(bytes: &[u8]) -> Option<(u32, u32)> {
+    let le = bytes.starts_with(b"II*\0");
+    if !le && !bytes.starts_with(b"MM\0*") {
+        return None;
+    }
+    let u16_at = |at: usize| -> Option<u16> {
+        let b: [u8; 2] = bytes.get(at..at.checked_add(2)?)?.try_into().ok()?;
+        Some(if le { u16::from_le_bytes(b) } else { u16::from_be_bytes(b) })
+    };
+    let u32_at = |at: usize| -> Option<u32> {
+        let b: [u8; 4] = bytes.get(at..at.checked_add(4)?)?.try_into().ok()?;
+        Some(if le { u32::from_le_bytes(b) } else { u32::from_be_bytes(b) })
+    };
+    let ifd = usize::try_from(u32_at(4)?).ok()?;
+    // (tag, the entry's single BYTE, SHORT, LONG or IFD value, which sits in the entry, or its
+    // single LONG8 or IFD8 value that fits in 32 bits, which sits where the entry points)
+    let entry = |i: usize| -> Option<(u16, Option<u32>)> {
+        let e = ifd.checked_add(i.checked_mul(12)?.checked_add(2)?)?;
+        let (ty, count, at) = (u16_at(e.checked_add(2)?)?, u32_at(e.checked_add(4)?)?, e.checked_add(8)?);
+        let value = match (ty, count) {
+            (1, 1) => bytes.get(at).map(|&b| u32::from(b)),
+            (3, 1) => u16_at(at).map(u32::from),
+            (4 | 13, 1) => u32_at(at),
+            (16 | 18, 1) => {
+                let at = usize::try_from(u32_at(at)?).ok()?;
+                let (lo, hi) = (u32_at(at)?, u32_at(at.checked_add(4)?)?);
+                let wide = if le { u64::from(hi) << 32 | u64::from(lo) } else { u64::from(lo) << 32 | u64::from(hi) };
+                u32::try_from(wide).ok()
+            }
+            _ => None,
+        };
+        Some((u16_at(e)?, value))
+    };
+    let (mut width, mut height, mut planes, mut planar) = (0u32, 0u32, 1u32, false);
+    let (mut rows, mut tile_w, mut tile_h) = (None::<u32>, None::<u32>, None::<u32>);
+    let least = |was: Option<u32>, v: u32| Some(was.map_or(v, |w| w.min(v)));
+    for i in 0..usize::from(u16_at(ifd)?) {
+        let Some((tag, value)) = entry(i) else { break };
+        let Some(v) = value else { continue };
+        match tag {
+            256 => width = width.max(v),
+            257 => height = height.max(v),
+            277 => planes = planes.max(v),
+            278 => rows = least(rows, v),
+            284 => planar |= v == 2,
+            322 => tile_w = least(tile_w, v),
+            323 => tile_h = least(tile_h, v),
+            _ => {}
+        }
+    }
+    let planes = if planar { u128::from(planes) } else { 1 };
+    let tiles = match (tile_w, tile_h) {
+        (Some(tw @ 1..), Some(th @ 1..)) => u128::from(width.div_ceil(tw)) * u128::from(height.div_ceil(th)) * planes > usize::MAX as u128,
+        _ => false,
+    };
+    let rows = rows.unwrap_or(height);
+    let strips = rows > 0 && u128::from(height.saturating_sub(1) / rows + 1) * planes > u128::from(u32::MAX);
+    (tiles || strips).then_some((width, height))
+}
+
+/// The color type of TIFF `bytes` and its decoder; `None` for [`oversized_tiff`] images too.
 fn tiff(bytes: &[u8]) -> Option<(tiff::ColorType, tiff::decoder::Decoder<Cursor<&[u8]>>)> {
-    if !is_tiff(bytes) {
+    if !is_tiff(bytes) || oversized_tiff(bytes).is_some() {
         return None;
     }
     let mut d = tiff::decoder::Decoder::new(Cursor::new(bytes)).ok()?;
     Some((d.colortype().ok()?, d))
 }
 
+/// Does the TIFF `d` reads store one plane per channel (PlanarConfiguration 2)?
+fn planar(d: &mut tiff::decoder::Decoder<Cursor<&[u8]>>) -> bool {
+    d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1)
+}
+
+/// The samples of the `n` pixels of the TIFF `d` reads, `per` to a pixel (the number its color
+/// type has), pixel by pixel and 8 bits each (16-bit samples to their high byte), whether the file
+/// stores each pixel's samples together or one plane per channel. `None` when they don't decode to
+/// that many samples, which includes images whose planes together need more than the decoder's
+/// limit (256 MB of samples).
+fn read_samples(d: &mut tiff::decoder::Decoder<Cursor<&[u8]>>, n: usize, per: usize) -> Option<Vec<u8>> {
+    let mut buf = tiff::decoder::DecodingResult::U8(Vec::new());
+    let layout = d.read_image_to_buffer(&mut buf).ok()?;
+    let data = match buf {
+        tiff::decoder::DecodingResult::U8(v) => v,
+        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
+        _ => return None,
+    };
+    if Some(data.len()) != n.checked_mul(per) {
+        return None;
+    }
+    if layout.planes <= 1 {
+        return Some(data);
+    }
+    if layout.planes != per {
+        return None;
+    }
+    let planes: Vec<&[u8]> = data.chunks_exact(n).collect();
+    Some((0..n).flat_map(|i| planes.iter().map(move |p| p.get(i).copied().unwrap_or(0))).collect())
+}
+
 impl ImageBlob {
     /// A CMYK TIFF of ink amounts `inks` (Deflate-compressed); `None` when it can't be written.
     pub fn cmyk_tiff(inks: &Inks) -> Option<Self> {
-        use tiff::encoder::{Compression, TiffEncoder, colortype::CMYK8, compression::DeflateLevel};
+        Self::cmyk_tiff_at(inks, None)
+    }
+
+    /// [`ImageBlob::cmyk_tiff`], declaring the resolution `ppi` (horizontal, vertical pixels per
+    /// inch) when it is given and both are finite and above 0.
+    pub fn cmyk_tiff_at(inks: &Inks, ppi: Option<(f64, f64)>) -> Option<Self> {
+        use tiff::encoder::{Compression, Rational, TiffEncoder, colortype::CMYK8, compression::DeflateLevel};
+        use tiff::tags::{ResolutionUnit, Tag};
         let mut out = Cursor::new(Vec::new());
-        TiffEncoder::new(&mut out)
-            .ok()?
-            .with_compression(Compression::Deflate(DeflateLevel::Balanced))
-            .write_image::<CMYK8>(inks.width, inks.height, &inks.data)
-            .ok()?;
+        let mut enc = TiffEncoder::new(&mut out).ok()?.with_compression(Compression::Deflate(DeflateLevel::Balanced));
+        let mut img = enc.new_image::<CMYK8>(inks.width, inks.height).ok()?;
+        if let Some((x, y)) = ppi.filter(|(x, y)| [x, y].iter().all(|v| v.is_finite() && **v > 0.0)) {
+            // Ten-thousandths of a pixel per inch.
+            let r = |v: f64| Rational { n: (v * 10_000.0).round() as u32, d: 10_000 };
+            img.encoder().write_tag(Tag::XResolution, r(x)).ok()?;
+            img.encoder().write_tag(Tag::YResolution, r(y)).ok()?;
+            img.encoder().write_tag(Tag::ResolutionUnit, ResolutionUnit::Inch).ok()?;
+        }
+        img.write_data(&inks.data).ok()?;
         Some(Self::new("image/tiff", out.into_inner()))
     }
 
@@ -88,6 +201,53 @@ impl ImageBlob {
         let bytes = self.bytes.as_slice();
         if bytes.starts_with(&[0xFF, 0xD8]) { jpeg_inks(bytes) } else { tiff_inks(bytes) }
     }
+
+    /// The ink amounts around pixel (`x`, `y`) of a CMYK image, in the pixel space of an image
+    /// object of `object` (width, height) pixels: the average of the `size` × `size` pixels centered
+    /// on it, clipped to the image, as C, M, Y and K bytes. `None` outside the image and for images
+    /// [`Self::cmyk`] doesn't read. The inks of the last CMYK image are kept for the next sample
+    /// (the Eyedropper samples one image click after click), as [`Self::sample_object`] keeps its
+    /// pixels.
+    pub fn sample_cmyk_object(&self, x: f64, y: f64, object: (u32, u32), size: u32) -> Option<[u8; 4]> {
+        thread_local! {
+            static LAST: std::cell::RefCell<Option<(String, Arc<Inks>)>> = const { std::cell::RefCell::new(None) };
+        }
+        if !self.is_cmyk() {
+            return None;
+        }
+        let key = self.content_key();
+        let inks = LAST.with_borrow_mut(|last| match last {
+            Some((k, inks)) if *k == key => Some(inks.clone()),
+            _ => {
+                let inks = Arc::new(self.cmyk()?);
+                *last = Some((key, inks.clone()));
+                Some(inks)
+            }
+        })?;
+        let k = |n: u32, of: u32| n as f64 / of.max(1) as f64;
+        sample_inks(&inks, x * k(inks.width, object.0), y * k(inks.height, object.1), size)
+    }
+}
+
+/// [`ImageBlob::sample_cmyk_object`] of `inks` at (`x`, `y`) in their own pixel space.
+fn sample_inks(inks: &Inks, x: f64, y: f64, size: u32) -> Option<[u8; 4]> {
+    let (w, h) = (i64::from(inks.width), i64::from(inks.height));
+    let (cx, cy) = (x.floor() as i64, y.floor() as i64);
+    if !(0..w).contains(&cx) || !(0..h).contains(&cy) {
+        return None;
+    }
+    let r = i64::from(size.max(1)) / 2;
+    let (mut sum, mut n) = ([0u64; 4], 0u64);
+    for py in (cy - r).max(0)..=(cy + r).min(h - 1) {
+        for px in (cx - r).max(0)..=(cx + r).min(w - 1) {
+            let i = usize::try_from((py * w + px) * 4).ok()?;
+            let p = inks.data.get(i..i + 4)?;
+            sum.iter_mut().zip(p).for_each(|(s, v)| *s += u64::from(*v));
+            n += 1;
+        }
+    }
+    let c = |v: u64| ((v + n / 2) / n) as u8;
+    Some(sum.map(c))
 }
 
 /// The ink amounts of a four-component JPEG (its samples inverted back; YCCK converted to CMYK
@@ -119,34 +279,42 @@ fn jpeg_inks(bytes: &[u8]) -> Option<Inks> {
     Inks::new(w, h, data)
 }
 
-/// The ink amounts of a chunky CMYK TIFF (16-bit samples to 8 bits).
+/// The ink amounts of a CMYK TIFF (16-bit samples to 8 bits), its inks stored together or one plane
+/// per ink.
 fn tiff_inks(bytes: &[u8]) -> Option<Inks> {
     let (kind, mut d) = tiff(bytes)?;
     let (w, h) = d.dimensions().ok()?;
-    // Planar samples (one plane per ink) would read as interleaved.
-    let planar = d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
-    if !matches!(kind, tiff::ColorType::CMYK(8 | 16)) || planar || pixels(w, h).is_none() {
+    if !matches!(kind, tiff::ColorType::CMYK(8 | 16)) {
         return None;
     }
-    let data = match d.read_image().ok()? {
-        tiff::decoder::DecodingResult::U8(v) => v,
-        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
-        _ => return None,
-    };
-    Inks::new(w, h, data)
+    let n = usize::try_from(pixels(w, h)?).ok()?;
+    Inks::new(w, h, read_samples(&mut d, n, 4)?)
+}
+
+/// CMYK TIFF `bytes` as Open and Place store them: as they are, or, when they store one plane per
+/// ink, which the image decoder doesn't read, their ink amounts written again by
+/// [`ImageBlob::cmyk_tiff_at`] with the resolution `ppi`. `None` for other images and for CMYK
+/// TIFFs whose inks [`ImageBlob::cmyk`] doesn't read.
+pub fn stored_cmyk_tiff(bytes: &[u8], ppi: Option<(f64, f64)>) -> Option<Vec<u8>> {
+    let inks = tiff_inks(bytes)?;
+    let (_, mut d) = tiff(bytes)?;
+    if !planar(&mut d) {
+        return Some(bytes.to_vec());
+    }
+    ImageBlob::cmyk_tiff_at(&inks, ppi).map(|b| Arc::unwrap_or_clone(b.bytes))
 }
 
 /// A TIFF whose pixels have samples after their colour, which the image decoder doesn't read at
 /// all, as RGBA pixels: CMYK with an alpha channel (5 samples), each colour converted by `rgb` (ink
 /// amounts 0..1 → sRGB 0..1; the inks can't be kept with the transparency, so they show as RGB),
 /// and grayscale with extra samples, of which the first is the alpha when the file says so (other
-/// channels are left out). Associated (premultiplied) alpha is divided back out. `None` for other
-/// images, planar ones and ones larger than [`MAX_CMYK_PIXELS`].
+/// channels are left out). Associated (premultiplied) alpha is divided back out. The samples may be
+/// stored together or one plane per channel. `None` for other images and ones larger than
+/// [`MAX_CMYK_PIXELS`].
 pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3]) -> Option<image::RgbaImage> {
     use tiff::tags::Tag;
     let (kind, mut d) = tiff(bytes)?;
     let (w, h) = d.dimensions().ok()?;
-    let planar = d.find_tag_unsigned::<u16>(Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
     // 0: white is zero, 1: black is zero (the two grayscales).
     let photometric = d.find_tag_unsigned::<u16>(Tag::PhotometricInterpretation).ok().flatten();
     // ExtraSamples 1: associated alpha (premultiplied colour), 2: unassociated alpha, 0: not alpha.
@@ -159,18 +327,8 @@ pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3])
         }
         _ => return None,
     };
-    if planar {
-        return None;
-    }
     let n = usize::try_from(pixels(w, h)?).ok()?;
-    let data: Vec<u8> = match d.read_image().ok()? {
-        tiff::decoder::DecodingResult::U8(v) => v,
-        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
-        _ => return None,
-    };
-    if Some(data.len()) != n.checked_mul(samples) {
-        return None;
-    }
+    let data = read_samples(&mut d, n, samples)?;
     let mut out = Vec::with_capacity(n * 4);
     for p in data.chunks_exact(samples) {
         let opacity = if alpha { p.get(colour).copied().unwrap_or(u8::MAX) } else { u8::MAX };
@@ -191,6 +349,162 @@ pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3])
     image::RgbaImage::from_raw(w, h, out)
 }
 
+/// Why a TIFF compressed with CCITT Group 3 wasn't read ([`group3_tiff_rgba`]).
+#[derive(Clone, Debug, PartialEq, thiserror::Error)]
+pub enum Group3Error {
+    /// Its pixels would take more than [`crate::MAX_RASTER_ALLOC`] as RGBA.
+    #[error("an image of {w} × {h} pixels is too large to draw")]
+    TooLarge { w: u32, h: u32 },
+    /// A strip or tile ends before its last row or can't be decoded (it holds a code the decoder
+    /// doesn't read, such as T.4's uncompressed mode, or a row of the wrong width), or a tile is
+    /// larger than [`crate::MAX_RASTER_ALLOC`] allows as RGBA.
+    #[error("could not decode image: {0}")]
+    Damaged(hayro_ccitt::DecodeError),
+}
+
+/// The pixels of a 1-bit TIFF compressed with CCITT Group 3, which the image decoder doesn't read,
+/// as RGBA. Compression 2 is modified Huffman coding with each row starting at a byte and no EOL
+/// codes. Compression 3 is ITU-T T.4 coding with an EOL code before each row: one-dimensional rows,
+/// or with T4Options bit 0, rows that a tag bit marks as one-dimensional or as coded against the
+/// row above. Fill bits before an EOL are skipped. Rows in T.4's uncompressed mode (T4Options
+/// bit 1) can't be decoded. Each strip or tile is coded on its own. White runs are 0 bits and black
+/// runs are 1 bits, as libtiff writes them, and PhotometricInterpretation 0 shows 0 bits as white
+/// and 1 shows them as black. FillOrder 2 (each byte's lowest bit first) is read too. Together, the
+/// strips and tiles are read from at most as many bytes as the file has. `None` for other images;
+/// an error when the pixels would take more than [`crate::MAX_RASTER_ALLOC`] as RGBA, a tile is
+/// larger than that allowance, or a strip or tile can't be decoded or ends before its last row.
+pub fn group3_tiff_rgba(bytes: &[u8]) -> Option<Result<image::RgbaImage, Group3Error>> {
+    use hayro_ccitt::{DecodeError, DecodeSettings, DecoderContext, EncodingMode};
+    use tiff::tags::Tag;
+    let (kind, mut d) = tiff(bytes)?;
+    let compression = d.find_tag_unsigned::<u16>(Tag::Compression).ok().flatten()?;
+    let (w, h) = d.dimensions().ok()?;
+    if kind != tiff::ColorType::Gray(1) || !matches!(compression, 2 | 3) || w == 0 || h == 0 {
+        return None;
+    }
+    // The level of a 0 bit (a white run): white when white is zero (0), black when black is zero (1).
+    let zero = match d.find_tag_unsigned::<u16>(Tag::PhotometricInterpretation).ok().flatten() {
+        Some(0) => u8::MAX,
+        Some(1) => 0,
+        _ => return None,
+    };
+    if u64::from(w) * u64::from(h) > crate::MAX_RASTER_ALLOC / 4 {
+        return Some(Err(Group3Error::TooLarge { w, h }));
+    }
+    let t4_options = d.find_tag_unsigned::<u32>(Tag::Unknown(292)).ok().flatten().unwrap_or(0);
+    let lsb_first = d.find_tag_unsigned::<u16>(Tag::FillOrder).ok().flatten() == Some(2);
+    let encoding = if compression == 3 && t4_options & 1 != 0 {
+        // Each row's tag bit says how it is coded.
+        EncodingMode::Group3_2D { k: 2 }
+    } else {
+        EncodingMode::Group3_1D
+    };
+    // The width and height of each strip or tile, and the tags of their offsets and byte counts.
+    let tiled = d.get_chunk_type() == tiff::decoder::ChunkType::Tile;
+    let (cw, ch, offsets, counts) = if tiled {
+        let tw = d.find_tag_unsigned::<u32>(Tag::TileWidth).ok().flatten().filter(|&v| v > 0)?;
+        let th = d.find_tag_unsigned::<u32>(Tag::TileLength).ok().flatten().filter(|&v| v > 0)?;
+        (tw, th, Tag::TileOffsets, Tag::TileByteCounts)
+    } else {
+        let rows = d.find_tag_unsigned::<u32>(Tag::RowsPerStrip).ok().flatten().filter(|&v| v > 0).map_or(h, |r| r.min(h));
+        (w, rows, Tag::StripOffsets, Tag::StripByteCounts)
+    };
+    let damaged = |e: DecodeError| Some(Err(Group3Error::Damaged(e)));
+    // A tile is held to the allowance the image is held to; a strip is no larger than the image.
+    if u64::from(cw) * u64::from(ch) > crate::MAX_RASTER_ALLOC / 4 {
+        return damaged(DecodeError::Overflow);
+    }
+    let offsets = d.find_tag_unsigned_vec::<u64>(offsets).ok().flatten().unwrap_or_default();
+    let counts = d.find_tag_unsigned_vec::<u64>(counts).ok().flatten().unwrap_or_default();
+    let across = w.div_ceil(cw);
+    let chunks = u64::from(across) * u64::from(h.div_ceil(ch));
+    if chunks > offsets.len().min(counts.len()) as u64 {
+        return damaged(DecodeError::UnexpectedEof);
+    }
+    let mut gray = vec![zero; usize::try_from(u64::from(w) * u64::from(h)).ok()?];
+    let mut budget = bytes.len();
+    for (i, (&offset, &count)) in (0..chunks).zip(offsets.iter().zip(&counts)) {
+        let (x0, y0) = (u32::try_from(i % u64::from(across)).ok()? * cw, u32::try_from(i / u64::from(across)).ok()? * ch);
+        let Some(start) = usize::try_from(offset).ok().filter(|&s| s <= bytes.len()) else {
+            return damaged(DecodeError::UnexpectedEof);
+        };
+        let len = usize::try_from(count).unwrap_or(usize::MAX).min(bytes.len() - start).min(budget);
+        budget -= len;
+        let data = bytes.get(start..start + len)?;
+        let data: std::borrow::Cow<[u8]> = if lsb_first { data.iter().map(|b| b.reverse_bits()).collect() } else { data.into() };
+        let settings = DecodeSettings {
+            columns: cw,
+            // A tile is coded whole; the last strip only has the image's remaining rows.
+            rows: if tiled { ch } else { ch.min(h - y0) },
+            end_of_block: compression == 3,
+            end_of_line: compression == 3,
+            rows_are_byte_aligned: compression == 2,
+            encoding,
+            invert_black: false,
+        };
+        let mut rows = Rows { out: &mut gray, width: w, height: h, x0, y0, x: 0, y: 0, zero };
+        if let Err(e) = hayro_ccitt::decode(&data, &mut rows, &mut DecoderContext::new(settings)) {
+            return damaged(e);
+        }
+        // The data ended, or six EOL codes came, before the strip's or tile's last row.
+        if rows.y < settings.rows {
+            return damaged(DecodeError::UnexpectedEof);
+        }
+    }
+    let gray = image::GrayImage::from_raw(w, h, gray)?;
+    Some(Ok(image::DynamicImage::ImageLuma8(gray).to_rgba8()))
+}
+
+/// Where a strip or tile of a Group 3 TIFF ([`group3_tiff_rgba`]) puts its decoded pixels: `out`
+/// holds the image's levels row by row, `width` × `height`, and the strip or tile starts at (`x0`,
+/// `y0`). Pixels past the image's right or bottom edge (a tile's padding) are dropped.
+struct Rows<'a> {
+    out: &'a mut [u8],
+    width: u32,
+    height: u32,
+    x0: u32,
+    y0: u32,
+    /// The next pixel in the strip or tile.
+    x: u64,
+    y: u32,
+    /// The level of a white run.
+    zero: u8,
+}
+
+impl Rows<'_> {
+    /// The next `n` pixels of the row, a white run's or a black run's.
+    fn run(&mut self, white: bool, n: u64) {
+        let level = if white { self.zero } else { u8::MAX - self.zero };
+        let row = u64::from(self.y0) + u64::from(self.y);
+        let left = u64::from(self.x0) + self.x;
+        let right = left.saturating_add(n).min(u64::from(self.width));
+        if row < u64::from(self.height) && left < right {
+            let at = row * u64::from(self.width);
+            if let (Ok(a), Ok(b)) = (usize::try_from(at + left), usize::try_from(at + right))
+                && let Some(px) = self.out.get_mut(a..b)
+            {
+                px.fill(level);
+            }
+        }
+        self.x = self.x.saturating_add(n);
+    }
+}
+
+impl hayro_ccitt::Decoder for Rows<'_> {
+    fn push_pixel(&mut self, white: bool) {
+        self.run(white, 1);
+    }
+
+    fn push_pixel_chunk(&mut self, white: bool, chunk_count: u32) {
+        self.run(white, u64::from(chunk_count) * 8);
+    }
+
+    fn next_line(&mut self) {
+        self.y = self.y.saturating_add(1);
+        self.x = 0;
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -246,6 +560,64 @@ mod tests {
         assert_eq!(gray(0), [255, 255, 255, 255, 51, 51, 51, 255, 0, 0, 0, 255], "a channel that isn't alpha: opaque");
     }
 
+    /// A header claiming more tiles than can be counted: (2^32 − 1)² pixels in tiles of one pixel,
+    /// times 2 planes.
+    #[test]
+    fn tiffs_with_more_tiles_than_can_be_counted_are_oversized() {
+        let header = |planar: u32| {
+            let mut f = b"II*\0\x08\0\0\0".to_vec();
+            let entries = [(256u16, u32::MAX), (257, u32::MAX), (258, 8), (262, 1), (277, 2), (284, planar), (322, 1), (323, 1), (324, 0), (325, 0)];
+            f.extend(u16::try_from(entries.len()).unwrap().to_le_bytes());
+            for (tag, v) in entries {
+                f.extend([tag.to_le_bytes(), 4u16.to_le_bytes()].concat());
+                f.extend([1u32.to_le_bytes(), v.to_le_bytes()].concat());
+            }
+            f.extend([0; 4]);
+            f
+        };
+        assert_eq!(oversized_tiff(&header(2)), Some((u32::MAX, u32::MAX)));
+        assert_eq!(oversized_tiff(&header(1)), None, "one plane: (2^32 − 1)² tiles can be counted in 64 bits");
+        assert!(tiff(&header(2)).is_none(), "not decoded");
+    }
+
+    /// A header claiming more strips than can be counted: 2^31 + 1 rows, a strip each, times 2
+    /// planes. The decoder counts strips when the file has strip offsets, tile sizes or not, and
+    /// reads a LONG8 value from where the entry points.
+    #[test]
+    fn tiffs_with_more_strips_than_can_be_counted_are_oversized() {
+        // Each entry holds one value of type 3 (SHORT), 4 (LONG) or 16 (LONG8, after the directory).
+        let header = |entries: &[(u16, u16, u32)]| {
+            let after = 8 + 2 + 12 * entries.len() + 4;
+            let mut f = b"II*\0\x08\0\0\0".to_vec();
+            f.extend(u16::try_from(entries.len()).unwrap().to_le_bytes());
+            let mut wide = vec![];
+            for &(tag, ty, v) in entries {
+                f.extend([tag.to_le_bytes(), ty.to_le_bytes()].concat());
+                f.extend(1u32.to_le_bytes());
+                if ty == 16 {
+                    f.extend(u32::try_from(after + wide.len()).unwrap().to_le_bytes());
+                    wide.extend(u64::from(v).to_le_bytes());
+                } else {
+                    f.extend(v.to_le_bytes());
+                }
+            }
+            f.extend([0; 4]);
+            f.extend(wide);
+            f
+        };
+        let tall = 1u32 << 31 | 1;
+        let strips = [(256, 4, 1), (257, 4, tall), (258, 3, 8), (262, 3, 1), (273, 4, 0), (277, 3, 2), (278, 4, 1), (279, 4, 0), (284, 3, 2)];
+        assert_eq!(oversized_tiff(&header(&strips)), Some((1, tall)));
+        let tile_sizes = [&strips[..], &[(322, 4, u32::MAX), (323, 4, u32::MAX)]].concat();
+        assert_eq!(oversized_tiff(&header(&tile_sizes)), Some((1, tall)), "tile sizes without tile offsets");
+        let mut long8 = strips;
+        long8[1] = (257, 16, tall);
+        assert_eq!(oversized_tiff(&header(&long8)), Some((1, tall)), "ImageLength as a LONG8");
+        for h in [header(&tile_sizes), header(&long8)] {
+            assert!(tiff(&h).is_none(), "not decoded");
+        }
+    }
+
     fn inks() -> Inks {
         Inks::new(3, 2, vec![0, 40, 100, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 12, 34, 56, 78]).unwrap()
     }
@@ -261,6 +633,20 @@ mod tests {
         assert_eq!(rgb.get_pixel(1, 0).0, [0, 255, 255]);
     }
 
+    #[test]
+    fn a_cmyk_image_samples_its_ink_amounts() {
+        let b = ImageBlob::cmyk_tiff(&inks()).unwrap();
+        assert_eq!(b.sample_cmyk_object(0.5, 0.5, (3, 2), 1), Some([0, 40, 100, 0]));
+        // An object of 6 × 4 pixels showing these 3 × 2: (5, 3) is the last pixel.
+        assert_eq!(b.sample_cmyk_object(5.0, 3.0, (6, 4), 1), Some([12, 34, 56, 78]));
+        // 3 × 3 around (1, 0), clipped to the image: all six pixels averaged.
+        assert_eq!(b.sample_cmyk_object(1.5, 0.5, (3, 2), 3), Some([45, 55, 69, 56]));
+        assert_eq!(b.sample_cmyk_object(3.5, 0.5, (3, 2), 1), None, "outside");
+        let mut png = Vec::new();
+        image::RgbaImage::new(2, 2).write_to(&mut Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        assert_eq!(ImageBlob::png(png).sample_cmyk_object(0.5, 0.5, (2, 2), 1), None, "an RGB image has no inks");
+    }
+
     #[test]
     fn a_cmyk_jpeg_reads_back_as_ink_amounts() {
         // A flat CMYK JPEG: Adobe's inverted samples with its marker.

crates/doc/src/corners.rs

@@ -5,7 +5,7 @@
 use std::borrow::Cow;
 use std::collections::BTreeSet;
 
-use vectorcraft_geom::corners::{Corner, cut_corners, path_corners};
+use vectorcraft_geom::corners::{Corner, cut_corners, fitted_radii, path_corners};
 use vectorcraft_geom::shapes::{self, CornerKind};
 use vectorcraft_geom::{Affine, PathData, Rect};
 
@@ -23,6 +23,8 @@ pub struct LiveCorners<'a> {
     /// The corners that can be cut, in anchor order ([`path_corners`] of `base`).
     pub corners: Vec<Corner>,
     radii: Vec<f64>,
+    /// The radius each of `corners` is drawn with ([`fitted_radii`]).
+    drawn: Vec<f64>,
     kinds: Vec<CornerKind>,
     /// For each anchor of the path as drawn (per subpath), the anchor of `base` it comes from.
     sources: Vec<Vec<usize>>,
@@ -54,7 +56,9 @@ impl<'a> LiveCorners<'a> {
                 })
                 .collect()
         };
-        Some(Self { corners: path_corners(&base), base, xf, radii, kinds, sources })
+        let corners = path_corners(&base);
+        let drawn = fitted_radii(&corners, &radii);
+        Some(Self { corners, base, xf, radii, drawn, kinds, sources })
     }
 
     /// The Live Corners of a path object.
@@ -73,6 +77,11 @@ impl<'a> LiveCorners<'a> {
         self.radii.get(index).copied().unwrap_or(0.0)
     }
 
+    /// The radius corner `index` is drawn with, in document units: its own, no larger than its
+    /// neighbours leave room for (0 for an anchor that is no corner).
+    pub fn drawn_radius(&self, index: usize) -> f64 {
+        self.corners.binary_search_by_key(&index, |c| c.index).ok().and_then(|i| self.drawn.get(i)).copied().unwrap_or(0.0)
+    }
     /// The kind corner `index` is cut with.
     pub fn kind(&self, index: usize) -> CornerKind {
         self.kinds.get(index).copied().unwrap_or_default()

crates/doc/src/graph.rs

@@ -196,6 +196,57 @@ macro_rules! ids {
 ids!(PiePosition { Even => "even", Ratio => "ratio", Stacked => "stacked" });
 ids!(PieSort { None => "none", All => "all", First => "first" });
 
+/// Object › Graph › Column › Column Type: how a column design fills a column or bar. Vertically Scaled stretches it
+/// along the value axis to the column's length at the column's width; Uniformly Scaled scales it both ways to that
+/// length, centered on the column; Repeating stacks copies that each stand for [`ColumnDesign::each`]; Sliding scales the
+/// part above its guide line (in a bar, right of it) in proportion to the column's width and stretches the rest.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ColumnType {
+    #[default]
+    Vertical,
+    Uniform,
+    Repeating,
+    Sliding,
+}
+
+/// Object › Graph › Column › For Fractions: a repeating design's last copy, for the part of a value less than one
+/// design, is cut off (Chop) or scaled down along the value axis (Scale).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Fractions {
+    #[default]
+    Chop,
+    Scale,
+}
+
+ids!(ColumnType { Vertical => "vertical", Uniform => "uniform", Repeating => "repeating", Sliding => "sliding" });
+ids!(Fractions { Chop => "chop", Scale => "scale" });
+
+/// Object › Graph › Column: the graph design a series' columns or bars are drawn with, and how it fills them.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct ColumnDesign {
+    pub design: String,
+    #[serde(skip_serializing_if = "ColumnType::is_default")]
+    pub column_type: ColumnType,
+    /// Repeating: the value one copy of the design stands for (Each Design Represents).
+    pub each: f64,
+    #[serde(skip_serializing_if = "Fractions::is_default")]
+    pub fractions: Fractions,
+}
+
+impl ColumnDesign {
+    /// Each Design Represents for a new column design.
+    pub const EACH: f64 = 10.0;
+}
+
+impl Default for ColumnDesign {
+    fn default() -> Self {
+        Self { design: String::new(), column_type: ColumnType::Vertical, each: Self::EACH, fractions: Fractions::Chop }
+    }
+}
+
 /// Graph Type › Value Axis: which side of the plot the value axis is drawn on.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -345,6 +396,11 @@ pub struct GraphSpec {
     /// series index, for line, scatter and radar series; `None` and missing entries draw the default square.
     #[serde(skip_serializing_if = "Vec::is_empty")]
     pub series_markers: Vec<Option<String>>,
+    /// Object › Graph › Column: the graph design each series' columns or bars (and legend swatch) are drawn with, by
+    /// series index, for column, stacked column, bar and stacked bar series; `None` and missing entries draw plain
+    /// columns.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub series_columns: Vec<Option<ColumnDesign>>,
     /// Graph Type › Tick Marks for the value axis (the left one, or the bottom one of bar graphs) and the right one:
     /// length, and tick marks per division (0 and 1 = one, at the labels).
     #[serde(skip_serializing_if = "TickLength::is_short")]
@@ -430,17 +486,22 @@ impl GraphSpec {
         let cells = self.cells();
         let width = cells.iter().map(Vec::len).max().unwrap_or(0).max(self.series.len());
         let mut out = String::from(",");
-        out.push_str(&(0..width).map(|s| self.series.get(s).cloned().unwrap_or_default()).collect::<Vec<_>>().join(","));
+        // Quote a label holding a separator, quote or line break (inner quotes doubled), or one with
+        // surrounding spaces; `always` also quotes blank and numeric labels so they stay labels.
+        let field = |c: &str, always: bool| {
+            let special = c.contains([',', '\t', '"', '\n', '\r']) || c != c.trim();
+            if special || (always && (c.trim().is_empty() || c.trim().parse::<f64>().is_ok())) {
+                format!("\"{}\"", c.replace('"', "\"\""))
+            } else {
+                c.to_string()
+            }
+        };
+        out.push_str(&(0..width).map(|s| field(self.series.get(s).map(String::as_str).unwrap_or_default(), false)).collect::<Vec<_>>().join(","));
         out.push('\n');
         let labelled = !self.categories.is_empty();
         for (i, r) in cells.iter().enumerate() {
             if labelled {
-                let c = self.categories.get(i).map(String::as_str).unwrap_or_default();
-                if c.trim().is_empty() || c.trim().parse::<f64>().is_ok() || c != c.trim() {
-                    out.push_str(&format!("\"{c}\""));
-                } else {
-                    out.push_str(c);
-                }
+                out.push_str(&field(self.categories.get(i).map(String::as_str).unwrap_or_default(), true));
                 out.push(',');
             }
             out.push_str(&r.iter().map(|v| v.map(|v| v.to_string()).unwrap_or_default()).collect::<Vec<_>>().join(","));
@@ -474,6 +535,7 @@ impl Default for GraphSpec {
             right_axis_min: None,
             right_axis_max: None,
             series_markers: vec![],
+            series_columns: vec![],
             label_styles: LabelStyles::default(),
             first_row_in_front: false,
             first_column_in_front: false,

crates/doc/src/hit.rs

@@ -1,11 +1,12 @@
 //! Hit testing over the document tree.
 
 use std::collections::HashSet;
+use std::sync::OnceLock;
 
 use vectorcraft_geom::hit::{fill_contains, stroke_contains};
-use vectorcraft_geom::{Point, Rect};
+use vectorcraft_geom::{BezPath, FillRule, Point, Rect};
 
-use crate::{Document, Node, NodeId, NodeKind, SymbolBoxes};
+use crate::{AppearanceItem, Document, Node, NodeId, NodeKind, SymbolBoxes};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum HitKind {
@@ -62,14 +63,37 @@ pub struct HitOptions {
     /// (point type's baseline, area type's frame, type on a path's path), not anywhere in its
     /// bounds.
     pub type_path_only: bool,
+    /// Guide objects (paths made into guides) are not hittable: View › Guides › Lock Guides is
+    /// on or the guides are hidden.
+    pub skip_guides: bool,
 }
 
 impl Default for HitOptions {
     fn default() -> Self {
-        Self { tol: 3.0, outline: false, path_only: false, type_path_only: false, scope: None }
+        Self { tol: 3.0, outline: false, path_only: false, type_path_only: false, skip_guides: false, scope: None }
     }
 }
 
+/// The shapes that an image's own fills and strokes paint, each with its fill rule and the fill or
+/// stroke that paints it (none for fills and strokes that paint nothing). Effects are evaluated
+/// above this crate, so the engine registers one with [`set_image_paint`].
+pub type ImagePaint = fn(&Node) -> Vec<(BezPath, FillRule, AppearanceItem)>;
+
+static IMAGE_PAINT: OnceLock<ImagePaint> = OnceLock::new();
+
+/// Register how the shapes of an image's own fills and strokes are found (the first registration
+/// stays).
+pub fn set_image_paint(f: ImagePaint) {
+    // Already set: the same engine, registered by another session.
+    let _ = IMAGE_PAINT.set(f);
+}
+
+/// The shapes that the image `n`'s own fills and strokes paint ([`set_image_paint`]), none while
+/// nothing is registered.
+pub(crate) fn image_paint(n: &Node) -> Vec<(BezPath, FillRule, AppearanceItem)> {
+    IMAGE_PAINT.get().map_or_else(Vec::new, |f| f(n))
+}
+
 /// Topmost editable object under `p`.
 pub fn hit_test(doc: &Document, p: Point, opt: HitOptions) -> Option<Hit> {
     hit_test_skipping(doc, p, opt, &|_| false, true)
@@ -169,6 +193,80 @@ fn objects_at_repeated(doc: &Document, p: Point, opt: HitOptions, scope: Option<
     tops
 }
 
+/// The most objects [`locked_objects_at`] lists.
+pub const MAX_LOCKED_AT: usize = 20;
+
+/// The locked objects under `p`, topmost first, at most [`MAX_LOCKED_AT`]: each object whose own
+/// lock is on and that a click at `p` would hit if it were not locked. A locked group is listed,
+/// not what it holds. Hidden objects and everything on hidden, locked and template layers are left
+/// out. While a pattern is edited only its tile layer is searched, and in isolation mode
+/// (`opt.scope`) only what is inside the isolated group or object.
+pub fn locked_objects_at(doc: &Document, p: Point, opt: HitOptions) -> Vec<NodeId> {
+    let symbols = doc.symbol_boxes();
+    let mut out = Vec::new();
+    if let Some(scope) = opt.scope
+        && let Some(isolated) = doc.node(scope)
+    {
+        if isolated.is_container() {
+            locked_children(isolated, p, opt, &symbols, &mut out);
+        } else if isolated.visible && isolated.locked && locked_hit(isolated, p, opt, &symbols) {
+            out.push(isolated.id);
+        }
+        return out;
+    }
+    for layer in doc.layers.iter().rev() {
+        if !layer.visible || layer.locked || layer.is_template() || doc.pattern_edit.as_ref().is_some_and(|e| e.layer != layer.id) {
+            continue;
+        }
+        let opt = if matches!(layer.kind, NodeKind::Layer { preview: false, .. }) { HitOptions { outline: true, ..opt } } else { opt };
+        locked_children(layer, p, opt, &symbols, &mut out);
+    }
+    out
+}
+
+/// [`locked_objects_at`] through the children of `parent`, front first: a locked child is tested
+/// whole, and an unlocked layer, group, blend or envelope in Edit Contents is searched inside.
+fn locked_children(parent: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes, out: &mut Vec<NodeId>) {
+    let Some(children) = parent.children() else { return };
+    if parent.clips() && children.first().is_some_and(|clip| !clip_contains(clip, p)) {
+        return;
+    }
+    for i in hit_order(parent, children, p) {
+        if out.len() >= MAX_LOCKED_AT {
+            return;
+        }
+        let Some(c) = children.get(i) else { continue };
+        if !may_hit(parent, i, c, p, opt, symbols, false) || c.is_layer() && (c.locked || c.is_template()) {
+            continue;
+        }
+        if c.locked {
+            if locked_hit(c, p, opt, symbols) {
+                out.push(c.id);
+            }
+            continue;
+        }
+        match &c.kind {
+            NodeKind::Layer { preview: false, .. } => locked_children(c, p, HitOptions { outline: true, ..opt }, symbols, out),
+            NodeKind::Layer { .. }
+            | NodeKind::Group { .. }
+            | NodeKind::Intertwine { .. }
+            | NodeKind::Blend { .. }
+            | NodeKind::Envelope { editing: true, .. } => locked_children(c, p, opt, symbols, out),
+            _ => {}
+        }
+    }
+}
+
+/// Would a click at `p` hit the locked object `n` if it were not locked?
+fn locked_hit(n: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes) -> bool {
+    let inside = || hit_children(n, p, opt, symbols, &|_| false, &mut Vec::new(), false).is_some();
+    match &n.kind {
+        NodeKind::Group { .. } | NodeKind::Intertwine { .. } | NodeKind::Envelope { editing: true, .. } => inside(),
+        NodeKind::Blend { .. } => inside() || hit_leaf(n, p, opt, symbols).is_some(),
+        _ => hit_leaf(n, p, opt, symbols).is_some(),
+    }
+}
+
 /// [`hit_test`] passing over the nodes `skip` names (and their contents). Symbol instances are
 /// measured by their art ([`Node::geometric_bounds_with`]).
 fn hit_test_skipping(doc: &Document, p: Point, opt: HitOptions, skip: &dyn Fn(NodeId) -> bool, editable_only: bool) -> Option<Hit> {
@@ -220,31 +318,51 @@ fn edits_contents(n: &Node) -> bool {
 /// Is `p` inside the region `clip` clips to ([`Node::clip_shapes`])? Text counts by its frame:
 /// glyph outlines need the font engine, above this crate.
 fn clip_contains(clip: &Node, p: Point) -> bool {
+    clip_regions(clip).iter().any(|(bp, rule)| fill_contains(bp, *rule, p))
+}
+
+/// The regions `clip` clips to ([`Node::clip_shapes`]), text counted by its frame as in
+/// [`clip_contains`].
+fn clip_regions(clip: &Node) -> Vec<(vectorcraft_geom::BezPath, vectorcraft_geom::FillRule)> {
     let frame = |n: &Node| {
         let b = n.geometric_bounds()?;
         Some(Node::path(n.id, vectorcraft_geom::shapes::rectangle(b), Default::default()))
     };
-    clip.clip_shapes(Some(&frame)).iter().any(|(bp, rule)| fill_contains(bp, *rule, p))
+    clip.clip_shapes(Some(&frame))
 }
 
 /// Can a click at `p` hit `c`, the child `i` of `parent`, or something inside it? Not when it is
 /// hidden, when it can't be edited (`editable_only`), when it is the part of a Shaper group that
 /// isn't shown, or when `p` is outside its reach.
 fn may_hit(parent: &Node, i: usize, c: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes, editable_only: bool) -> bool {
-    let source_isolated = |n: &Node| n.children().and_then(|children| children.first()).is_some_and(|source| Some(source.id) == opt.scope);
-    if parent.extras().shaper.is_some() && (i == 0) != source_isolated(parent) {
+    if shaper_hides(parent, i, opt.scope) {
         return false;
     }
     // Read-only samples can read locked/template art; hidden art never participates.
     if !c.visible || editable_only && (c.locked || c.is_template()) {
         return false;
     }
+    if opt.skip_guides && matches!(c.kind, NodeKind::Path { guide: true, .. }) {
+        return false;
+    }
     // (An envelope's content sits where it was, not where the envelope draws it.)
     edits_contents(c)
-        || c.extras().shaper.is_some() && source_isolated(c)
+        || c.extras().shaper.is_some() && source_of(c, opt.scope)
         || c.reach_bounds_with(symbols).is_none_or(|b| b.inflate(opt.tol, opt.tol).contains(p))
 }
 
+/// Is the first child of `n` the isolated container `scope`?
+fn source_of(n: &Node, scope: Option<NodeId>) -> bool {
+    n.children().and_then(|children| children.first()).is_some_and(|source| Some(source.id) == scope)
+}
+
+/// Do clicks and marquees skip the child `i` of `parent` with `scope` isolated? For a Shaper
+/// Group that is its original shapes (its first child), or, in Construction mode, when they are
+/// isolated, the art the group shows.
+fn shaper_hides(parent: &Node, i: usize, scope: Option<NodeId>) -> bool {
+    parent.extras().shaper.is_some() && (i == 0) != source_of(parent, scope)
+}
+
 fn hit_children(
     parent: &Node,
     p: Point,
@@ -342,12 +460,23 @@ fn hit_leaf(n: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes) -> Optio
             n.geometric_bounds().filter(|b| b.inflate(opt.tol, opt.tol).contains(p))?;
             on_type_path(n, t, p, opt.tol).then_some(HitKind::Outline)
         }
-        NodeKind::Text(_)
-        | NodeKind::Image(_)
-        | NodeKind::PlacedDocument(_)
-        | NodeKind::SymbolInstance { .. }
-        | NodeKind::Blend { .. }
-        | NodeKind::Envelope { .. } => n.geometric_bounds_with(symbols).filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds),
+        // An image is hit within its frame, and where its own fills and strokes paint
+        // ([`image_paint`]) except in outline mode.
+        NodeKind::Image(_) => {
+            if n.geometric_bounds_with(symbols).is_some_and(|b| b.inflate(opt.tol, opt.tol).contains(p)) {
+                return Some(HitKind::Bounds);
+            }
+            if opt.outline {
+                return None;
+            }
+            image_paint(n).iter().rev().find_map(|(bp, rule, item)| match item {
+                AppearanceItem::Stroke(s) => s.hits(bp, *rule, p, opt.tol).then_some(HitKind::Stroke),
+                AppearanceItem::Fill(_) => (!opt.path_only && fill_contains(bp, *rule, p)).then_some(HitKind::Fill),
+            })
+        }
+        NodeKind::Text(_) | NodeKind::PlacedDocument(_) | NodeKind::SymbolInstance { .. } | NodeKind::Blend { .. } | NodeKind::Envelope { .. } => {
+            n.geometric_bounds_with(symbols).filter(|b| b.inflate(opt.tol, opt.tol).contains(p)).map(|_| HitKind::Bounds)
+        }
         NodeKind::Repeat(r) => r.expand().iter().find_map(|g| hit_any(g, p, opt, symbols)),
         NodeKind::Mesh(m) => {
             let bp = m.outline().to_bezpath();
@@ -390,15 +519,39 @@ fn hit_any(n: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes) -> Option
     }
 }
 
+/// The path of compound path `n` under `p`, for the Group Selection tool: the one whose outline is
+/// within `tol`, else the innermost one whose area holds `p` (a hole inside an outer shape, an
+/// island inside a hole). `None` when `n` isn't a compound path or no part is under `p`.
+pub fn compound_part_at(n: &Node, p: Point, tol: f64) -> Option<NodeId> {
+    let NodeKind::Compound { children, rule } = &n.kind else { return None };
+    let parts: Vec<_> = children.iter().rev().filter_map(|c| c.path_data().map(|pd| (c.id, pd.to_bezpath(), pd.bounds()))).collect();
+    if let Some((id, ..)) = parts.iter().find(|(_, bp, _)| stroke_contains(bp, 0.0, tol, p)) {
+        return Some(*id);
+    }
+    // The innermost by the size of its box.
+    let size = |b: &Option<Rect>| b.map_or(f64::INFINITY, |b| b.area());
+    parts.iter().filter(|(_, bp, _)| fill_contains(bp, *rule, p)).min_by(|a, b| size(&a.2).total_cmp(&size(&b.2))).map(|(id, ..)| *id)
+}
+
 /// Objects (children of layers, or of `scope` in isolation mode) touched by a marquee rect. Symbol
-/// instances are measured by their art ([`Node::geometric_bounds_with`]).
+/// instances are measured by their art ([`Node::geometric_bounds_with`]). The art of a clip group
+/// or of a layer with a clipping mask counts only when the marquee meets the region its clipping
+/// path clips to, and then only within that region's bounds.
 pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) -> Vec<NodeId> {
     let mut out = Vec::new();
-    let tops: Vec<&std::sync::Arc<Node>> = match scope.and_then(|s| doc.node(s)) {
-        Some(s) => match s.children() {
-            Some(c) => c.iter().collect(),
+    // `tops` pairs each object with the part of `r` in which the marquee can touch it.
+    let tops: Vec<(&std::sync::Arc<Node>, Rect)> = match scope.and_then(|s| doc.node(s)) {
+        Some(s) => match (s.children(), marquee_in(s, r)) {
+            (Some(c), Some(r)) => c.iter().enumerate().filter(|(i, _)| !shaper_hides(s, *i, scope)).map(|(_, c)| (c, r)).collect(),
+            (Some(_), None) => vec![],
             // A single object isolated: only it.
-            None => doc.parent_of(s.id).and_then(|p| doc.node(p)).and_then(Node::children).into_iter().flatten().filter(|c| c.id == s.id).collect(),
+            (None, _) => doc
+                .parent_of(s.id)
+                .and_then(|p| doc.node(p))
+                .and_then(|p| Some((p.children()?, marquee_in(p, r)?)))
+                .into_iter()
+                .flat_map(|(c, r)| c.iter().filter(|c| c.id == s.id).map(move |c| (c, r)))
+                .collect(),
         },
         // The objects of the layers, looking through sublayers (hidden, locked and template ones
         // are left out).
@@ -406,28 +559,36 @@ pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) ->
             .layers
             .iter()
             .filter(|l| l.visible && !l.locked && !l.is_template() && doc.pattern_edit.as_ref().is_none_or(|e| e.layer == l.id))
-            .flat_map(|l| layer_objects(l))
+            .flat_map(|l| layer_objects(l, r))
             .collect(),
     };
-    fn layer_objects(l: &Node) -> Vec<&std::sync::Arc<Node>> {
+    /// The objects of layer `l`, each with the part of `r` that the clipping masks of `l` and of
+    /// the sublayers it is in leave.
+    fn layer_objects(l: &Node, r: Rect) -> Vec<(&std::sync::Arc<Node>, Rect)> {
         let mut out = vec![];
+        let Some(r) = marquee_in(l, r) else { return out };
         for c in l.children().into_iter().flatten() {
             if c.is_layer() {
                 if c.visible && !c.locked && !c.is_template() {
-                    out.extend(layer_objects(c));
+                    out.extend(layer_objects(c, r));
                 }
             } else {
-                out.push(c);
+                out.push((c, r));
             }
         }
         out
     }
-    fn touches(n: &Node, s: &SymbolBoxes, r: Rect) -> bool {
+    /// Does the marquee `r` touch `n`? It skips the children of a Shaper Group that clicks skip
+    /// ([`shaper_hides`]). An Intertwine group is touched by its members, and a repeat is touched
+    /// by the copies it draws, as clicks hit them. Objects of every other kind except paths,
+    /// compound paths, layers and groups are touched by their box.
+    fn touches(n: &Node, s: &SymbolBoxes, r: Rect, scope: Option<NodeId>) -> bool {
         match &n.kind {
             NodeKind::Path { path, .. } => vectorcraft_geom::hit::intersects_rect(path, r),
-            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Compound { children, .. } => {
-                children.iter().any(|c| c.visible && touches(c, s, r))
-            }
+            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Intertwine { children } => marquee_in(n, r)
+                .is_some_and(|r| children.iter().enumerate().any(|(i, c)| c.visible && !shaper_hides(n, i, scope) && touches(c, s, r, scope))),
+            NodeKind::Compound { children, .. } => children.iter().any(|c| c.visible && touches(c, s, r, scope)),
+            NodeKind::Repeat(spec) => spec.expand().iter().any(|copy| touches(copy, s, r, scope)),
             // A box with no width or no height (an instance of a symbol that draws a straight
             // line) is touched where the marquee crosses it.
             _ => n.geometric_bounds_with(s).is_some_and(|b| {
@@ -436,36 +597,67 @@ pub fn marquee(doc: &Document, r: Rect, scope: Option<NodeId>, leaves: bool) ->
             }),
         }
     }
-    fn collect_leaves(n: &Node, s: &SymbolBoxes, r: Rect, out: &mut Vec<NodeId>) {
+    fn collect_leaves(n: &Node, s: &SymbolBoxes, r: Rect, scope: Option<NodeId>, out: &mut Vec<NodeId>) {
         match &n.kind {
-            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } => {
-                for c in children {
-                    if c.visible && !c.locked {
-                        collect_leaves(c, s, r, out);
+            NodeKind::Layer { children, .. } | NodeKind::Group { children, .. } | NodeKind::Intertwine { children } => {
+                let Some(r) = marquee_in(n, r) else { return };
+                for (i, c) in children.iter().enumerate() {
+                    if c.visible && !c.locked && !shaper_hides(n, i, scope) {
+                        collect_leaves(c, s, r, scope, out);
                     }
                 }
             }
             _ => {
-                if touches(n, s, r) {
+                if touches(n, s, r, scope) {
                     out.push(n.id);
                 }
             }
         }
     }
     let symbols = doc.symbol_boxes();
-    for t in tops {
+    for (t, r) in tops {
         if !t.visible || t.locked {
             continue;
         }
         if leaves {
-            collect_leaves(t, &symbols, r, &mut out);
-        } else if touches(t, &symbols, r) {
+            collect_leaves(t, &symbols, r, scope, &mut out);
+        } else if touches(t, &symbols, r, scope) {
             out.push(t.id);
         }
     }
     out
 }
 
+/// The part of a marquee `r` in which it can touch the children of `parent`. For a clip group or a
+/// layer with a clipping mask, this is what [`marquee_in_clip`] returns for its clipping path (None
+/// when the marquee misses it); otherwise it is all of `r`.
+fn marquee_in(parent: &Node, r: Rect) -> Option<Rect> {
+    match parent.children().and_then(|c| c.first()) {
+        Some(clip) if parent.clips() => marquee_in_clip(clip, r),
+        _ => Some(r),
+    }
+}
+
+/// The part of a marquee `r` in which it can touch the art that `clip` clips (the clipping path of
+/// a clip group or of a layer with a clipping mask): `r` cut to the bounds of the regions `clip`
+/// clips to ([`clip_regions`]), or `None` when `r` meets none of those regions. Within those
+/// bounds, art outside a region that is not a rectangle still counts.
+fn marquee_in_clip(clip: &Node, r: Rect) -> Option<Rect> {
+    use vectorcraft_geom::kurbo::Shape;
+    let regions = clip_regions(clip);
+    // The edge of a region is its outline with each open subpath closed, as `fill_contains` fills it.
+    let meets = |(bp, rule): &(vectorcraft_geom::BezPath, vectorcraft_geom::FillRule)| {
+        let mut edge = vectorcraft_geom::PathData::from_bezpath(bp);
+        edge.subpaths.iter_mut().for_each(|sp| sp.closed = true);
+        fill_contains(bp, *rule, r.center()) || vectorcraft_geom::hit::intersects_rect(&edge, r)
+    };
+    if !regions.iter().any(meets) {
+        return None;
+    }
+    let bounds = regions.iter().map(|(bp, _)| bp.bounding_box()).reduce(|a, b| a.union(b))?;
+    Some(r.intersect(bounds))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -539,6 +731,224 @@ mod tests {
         assert!(marquee(&d, Rect::new(100.0, 100.0, 105.0, 105.0), None, false).is_empty());
     }
 
+    /// The art of a 200 pt wide rectangle clipped to its left half (0..100 × 0..100): the mask and
+    /// the art, in that order.
+    fn half_clipped(d: &mut Document) -> (Node, Node) {
+        let mask = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default());
+        let art = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 200.0, 100.0)), Appearance::default_art());
+        (mask, art)
+    }
+
+    /// #2345: a marquee touches a clip group only where its art shows. Over the clipped-away
+    /// half alone it selects nothing, and around a rectangle drawn beside the group's mask it
+    /// takes that rectangle alone; reaching into the mask takes the group. The same holds for
+    /// Group Selection's leaves and in isolation mode.
+    #[test]
+    fn a_marquee_leaves_a_clip_group_by_its_clipped_away_art() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        let (mask, art) = half_clipped(&mut d);
+        let (g, art_id, beside) = (d.alloc_id(), art.id, d.alloc_id());
+        let mut clip = Node::group(g, vec![Arc::new(mask), Arc::new(art)]);
+        clip.set_clips(true);
+        d.insert(Some(l), 0, clip).unwrap();
+        d.insert(Some(l), 1, Node::path(beside, shapes::rectangle(Rect::new(150.0, 80.0, 190.0, 130.0)), Appearance::default_art())).unwrap();
+        // This marquee crosses only the hidden art's top and right edges.
+        let hidden = Rect::new(150.0, -10.0, 210.0, 50.0);
+        assert!(marquee(&d, hidden, None, false).is_empty());
+        assert!(marquee(&d, hidden, None, true).is_empty());
+        assert!(marquee(&d, hidden, Some(g), false).is_empty());
+        assert!(marquee(&d, hidden, Some(art_id), false).is_empty());
+        // This marquee surrounds the rectangle beside and crosses the hidden art's bottom edge.
+        assert_eq!(marquee(&d, Rect::new(140.0, 70.0, 195.0, 140.0), None, false), vec![beside]);
+        // This marquee crosses the shown half's top edge and goes on into the hidden half.
+        let shown = Rect::new(50.0, -10.0, 160.0, 10.0);
+        assert_eq!(marquee(&d, shown, None, false), vec![g]);
+        assert!(marquee(&d, shown, None, true).contains(&art_id));
+        assert_eq!(marquee(&d, shown, Some(g), false).len(), 2, "the mask and the art");
+    }
+
+    /// #2345: in the corner of a diamond mask's box, outside the diamond, a marquee over the
+    /// clipped art's corner leaves the clip group. An open mask clips to its area closed by a
+    /// straight line, and a marquee across that line takes the art it reaches inside.
+    #[test]
+    fn a_marquee_must_meet_the_clipping_path_itself() {
+        // A clip group of a mask through `pts` (closed or open) over the art `art`.
+        let clipped = |pts: &[(f64, f64)], closed: bool, art: Rect| {
+            let mut d = Document::new(200.0, 200.0);
+            let l = d.layers[0].id;
+            let mut mask = vectorcraft_geom::BezPath::new();
+            mask.move_to(pts[0]);
+            for &p in &pts[1..] {
+                mask.line_to(p);
+            }
+            if closed {
+                mask.close_path();
+            }
+            let mask = Node::path(d.alloc_id(), vectorcraft_geom::PathData::from_bezpath(&mask), Appearance::default());
+            let art = Node::path(d.alloc_id(), shapes::rectangle(art), Appearance::default_art());
+            let g = d.alloc_id();
+            let mut clip = Node::group(g, vec![Arc::new(mask), Arc::new(art)]);
+            clip.set_clips(true);
+            d.insert(Some(l), 0, clip).unwrap();
+            (d, g)
+        };
+        let (d, g) = clipped(&[(50.0, 0.0), (100.0, 50.0), (50.0, 100.0), (0.0, 50.0)], true, Rect::new(0.0, 0.0, 100.0, 100.0));
+        assert!(marquee(&d, Rect::new(-10.0, -10.0, 10.0, 10.0), None, false).is_empty());
+        assert_eq!(marquee(&d, Rect::new(-10.0, 40.0, 10.0, 60.0), None, false), vec![g], "over the diamond's left point");
+        // The mask is the triangle above the line from (0, 0) to (100, 100), and the art lies inside it.
+        let (d, g) = clipped(&[(0.0, 0.0), (100.0, 0.0), (100.0, 100.0)], false, Rect::new(55.0, 40.0, 70.0, 50.0));
+        assert_eq!(marquee(&d, Rect::new(40.0, 45.0, 60.0, 70.0), None, false), vec![g]);
+    }
+
+    /// #2345: the objects of a layer or sublayer with a clipping mask are touched only where the
+    /// mask shows them, as in a clip group.
+    #[test]
+    fn a_marquee_leaves_art_a_layer_clips_away() {
+        for sublayer in [false, true] {
+            let mut d = Document::new(300.0, 200.0);
+            let l = d.layers[0].id;
+            let beside = d.alloc_id();
+            d.insert(Some(l), 0, Node::path(beside, shapes::rectangle(Rect::new(150.0, 80.0, 190.0, 130.0)), Appearance::default_art())).unwrap();
+            let masked = d.alloc_id();
+            let mut layer = Node::layer(masked, "Masked", crate::LayerColor::Preset(2));
+            layer.set_clips(true);
+            d.insert(sublayer.then_some(l), 9, layer).unwrap();
+            let (mask, art) = half_clipped(&mut d);
+            let (mask_id, art_id) = (mask.id, art.id);
+            d.insert(Some(masked), 0, mask).unwrap();
+            d.insert(Some(masked), 1, art).unwrap();
+            assert!(marquee(&d, Rect::new(150.0, -10.0, 210.0, 50.0), None, false).is_empty(), "sublayer: {sublayer}");
+            assert_eq!(marquee(&d, Rect::new(140.0, 70.0, 195.0, 140.0), None, false), vec![beside], "sublayer: {sublayer}");
+            assert_eq!(marquee(&d, Rect::new(50.0, -10.0, 160.0, 10.0), None, false), vec![mask_id, art_id], "sublayer: {sublayer}");
+        }
+    }
+
+    /// A marquee touches a Shaper Group only by the art it shows, as clicks do ([`may_hit`]): over
+    /// the original shape of a face the group erased it selects nothing, with Group Selection's
+    /// leaves too, and over a face it shows it takes the group. With the original shapes isolated
+    /// (Construction mode) it takes the original shape it reaches.
+    #[test]
+    fn a_marquee_leaves_a_shaper_group_by_its_original_shapes() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        // Two original squares, 0..100 and 50..150; the group shows only the first one's face.
+        let square = |x: f64| shapes::rectangle(Rect::new(x, 0.0, x + 100.0, 100.0));
+        let a = Node::path(d.alloc_id(), square(0.0), Appearance::default_art());
+        let b = Node::path(d.alloc_id(), square(50.0), Appearance::default_art());
+        let b_id = b.id;
+        let mut sources = Node::group(d.alloc_id(), vec![Arc::new(a), Arc::new(b)]);
+        sources.name = Some(crate::shaper::SOURCES.into());
+        sources.opacity = 0.0;
+        let sources_id = sources.id;
+        let mut face = Node::path(d.alloc_id(), square(0.0), Appearance::default_art());
+        face.name = Some(format!("{}0", crate::shaper::FILL_PREFIX));
+        let face_id = face.id;
+        let g = d.alloc_id();
+        let mut group = Node::group(g, vec![Arc::new(sources), Arc::new(face)]);
+        group.extras_mut().shaper = Some(Box::default());
+        d.insert(Some(l), 0, group).unwrap();
+        // This marquee crosses only the right edge of the second square, whose face is erased.
+        let erased = Rect::new(140.0, 40.0, 160.0, 60.0);
+        assert!(hit_test(&d, Point::new(150.0, 50.0), HitOptions::default()).is_none(), "a click there misses");
+        assert!(marquee(&d, erased, None, false).is_empty());
+        assert!(marquee(&d, erased, None, true).is_empty());
+        assert!(marquee(&d, erased, Some(g), false).is_empty());
+        // This marquee crosses the shown face's left edge.
+        let shown = Rect::new(-10.0, 40.0, 10.0, 60.0);
+        assert_eq!(marquee(&d, shown, None, false), vec![g]);
+        assert_eq!(marquee(&d, shown, None, true), vec![face_id]);
+        assert_eq!(marquee(&d, shown, Some(g), false), vec![face_id]);
+        // Construction mode: the original shapes are the objects.
+        assert_eq!(marquee(&d, erased, Some(sources_id), false), vec![b_id]);
+    }
+
+    /// A marquee touches an Intertwine group by its members, as it touches a plain group (#1103) and
+    /// as clicks do: in the gap between two members, or inside one member's fill, it selects nothing.
+    /// Across a member's edge it selects the group, and with the leaves that Direct and Group
+    /// Selection take, or in isolation mode, it selects the member.
+    #[test]
+    fn a_marquee_meets_an_intertwine_group_by_its_members() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        // Two squares, 0..100 and 150..250, with a gap between them inside the group's box.
+        let square = |x: f64| shapes::rectangle(Rect::new(x, 0.0, x + 100.0, 100.0));
+        let mut a = Node::path(d.alloc_id(), square(0.0), Appearance::default_art());
+        a.extras_mut().intertwine = Some(Box::new(shapes::rectangle(Rect::new(50.0, 0.0, 100.0, 100.0))));
+        let b = Node::path(d.alloc_id(), square(150.0), Appearance::default_art());
+        let (a_id, g) = (a.id, d.alloc_id());
+        d.insert(Some(l), 0, Node::new(g, NodeKind::Intertwine { children: vec![Arc::new(a), Arc::new(b)] })).unwrap();
+        let gap = Rect::new(110.0, 40.0, 140.0, 60.0);
+        assert!(hit_test(&d, gap.center(), HitOptions::default()).is_none(), "a click in the gap misses");
+        assert!(marquee(&d, gap, None, false).is_empty());
+        assert!(marquee(&d, gap, None, true).is_empty());
+        assert!(marquee(&d, gap, Some(g), false).is_empty());
+        assert!(marquee(&d, Rect::new(20.0, 20.0, 40.0, 40.0), None, false).is_empty(), "inside a member's fill");
+        // This marquee crosses the first square's left edge.
+        let edge = Rect::new(-10.0, 40.0, 10.0, 60.0);
+        assert_eq!(marquee(&d, edge, None, false), vec![g]);
+        assert_eq!(marquee(&d, edge, None, true), vec![a_id]);
+        assert_eq!(marquee(&d, edge, Some(g), false), vec![a_id]);
+    }
+
+    /// A marquee touches a repeat by the copies it draws, as clicks do: between two copies of a
+    /// grid repeat it selects nothing, and across a copy's edge it takes the repeat.
+    #[test]
+    fn a_marquee_meets_a_repeat_by_its_copies() {
+        let mut d = Document::new(300.0, 200.0);
+        let l = d.layers[0].id;
+        let source = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 20.0, 20.0)), Appearance::default_art());
+        // Copies at 0..20, 40..60 and 80..100.
+        let kind = crate::pattern::RepeatKind::Grid {
+            h_spacing: 20.0,
+            v_spacing: 20.0,
+            rows: 1,
+            cols: 3,
+            grid_type: crate::pattern::TileType::Grid,
+            flip_rows: false,
+            flip_cols: false,
+        };
+        let r = d.alloc_id();
+        d.insert(Some(l), 0, Node::new(r, NodeKind::Repeat(crate::pattern::RepeatSpec { kind, source: vec![Arc::new(source)] }))).unwrap();
+        let gap = Rect::new(25.0, 5.0, 35.0, 15.0);
+        assert!(hit_test(&d, gap.center(), HitOptions::default()).is_none(), "a click between copies misses");
+        assert!(marquee(&d, gap, None, false).is_empty());
+        assert!(marquee(&d, gap, None, true).is_empty());
+        assert_eq!(marquee(&d, Rect::new(35.0, 5.0, 45.0, 15.0), None, false), vec![r], "across the second copy's left edge");
+        assert_eq!(marquee(&d, Rect::new(35.0, 5.0, 45.0, 15.0), None, true), vec![r]);
+    }
+
+    /// A blend and an envelope are clicked anywhere in their box, and a marquee touches them there
+    /// too: inside the box, away from every key object's and the content's outline, it takes them.
+    #[test]
+    fn a_marquee_meets_blends_and_envelopes_by_their_box() {
+        let mut d = Document::new(300.0, 300.0);
+        let l = d.layers[0].id;
+        let square = |id, x: f64, y: f64| Arc::new(Node::path(id, shapes::rectangle(Rect::new(x, y, x + 20.0, y + 20.0)), Appearance::default_art()));
+        let blend = d.alloc_id();
+        let keys = vec![square(d.alloc_id(), 0.0, 0.0), square(d.alloc_id(), 100.0, 0.0)];
+        d.insert(Some(l), 0, Node::new(blend, NodeKind::Blend { children: keys, spec: Default::default() })).unwrap();
+        let envelope = d.alloc_id();
+        let content = vec![Arc::new(Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 150.0, 100.0, 250.0)), Appearance::default_art()))];
+        let e = Node::new(
+            envelope,
+            NodeKind::Envelope {
+                content,
+                kind: Box::new(crate::live::EnvelopeKind::Warp { style: "arc".to_string(), bend: 0.0, h: 0.0, v: 0.0, horizontal: true }),
+                fidelity: 100.0,
+                editing: false,
+                options: Default::default(),
+                frame: Box::new(vectorcraft_geom::Affine::IDENTITY),
+            },
+        );
+        d.insert(Some(l), 1, e).unwrap();
+        for (r, id) in [(Rect::new(50.0, 5.0, 60.0, 15.0), blend), (Rect::new(40.0, 190.0, 60.0, 210.0), envelope)] {
+            assert_eq!(hit_test(&d, r.center(), HitOptions::default()).map(|h| h.leaf), Some(id));
+            assert_eq!(marquee(&d, r, None, false), vec![id]);
+            assert_eq!(marquee(&d, r, None, true), vec![id]);
+        }
+    }
+
     /// Art in a sublayer is an object of its own: a click or a marquee takes it, not the
     /// sublayer; hidden, locked and template sublayers block both.
     #[test]
@@ -901,6 +1311,69 @@ world",
         assert!(hit_test(&d, Point::new(10.0, 10.0), HitOptions::default()).is_none());
     }
 
+    /// Insert `n` locked at the top of `parent`.
+    fn insert_locked(d: &mut Document, parent: NodeId, mut n: Node) -> NodeId {
+        let id = n.id;
+        n.locked = true;
+        d.insert(Some(parent), usize::MAX, n).unwrap();
+        id
+    }
+
+    /// `locked_objects_at`: the locked objects under the point, topmost first. A locked group is
+    /// listed rather than its contents, and a locked object in an unlocked group is listed itself.
+    /// Hidden objects, locked layers and the art outside an isolated group are left out.
+    #[test]
+    fn locked_objects_at_lists_the_locked_stack() {
+        let mut d = Document::new(200.0, 200.0);
+        let l = d.layers[0].id;
+        let rect =
+            |d: &mut Document, x: f64| Node::path(d.alloc_id(), shapes::rectangle(Rect::new(x, 0.0, x + 50.0, 50.0)), Appearance::default_art());
+        let (a, b) = (rect(&mut d, 0.0), rect(&mut d, 10.0));
+        let (a, b) = (insert_locked(&mut d, l, a), insert_locked(&mut d, l, b));
+        let (mut inner, locked_group) = (rect(&mut d, 20.0), d.alloc_id());
+        inner.locked = true;
+        let inner_id = inner.id;
+        let mut g = Node::group(locked_group, vec![Arc::new(inner)]);
+        g.locked = true;
+        d.insert(Some(l), usize::MAX, g).unwrap();
+        let open_group = d.alloc_id();
+        let mut child = rect(&mut d, 25.0);
+        child.locked = true;
+        let child_id = child.id;
+        let free = rect(&mut d, 25.0);
+        d.insert(Some(l), usize::MAX, Node::group(open_group, vec![Arc::new(child), Arc::new(free)])).unwrap();
+        let at = |d: &Document, x: f64, scope| locked_objects_at(d, Point::new(x, 25.0), HitOptions { scope, ..HitOptions::default() });
+        assert_eq!(at(&d, 30.0, None), [child_id, locked_group, b, a]);
+        assert!(!at(&d, 30.0, None).contains(&inner_id), "the locked group stands for what it holds");
+        assert_eq!(at(&d, 5.0, None), [a]);
+        assert!(at(&d, 150.0, None).is_empty());
+        // Isolated, only the group's own objects are looked at.
+        assert_eq!(at(&d, 30.0, Some(open_group)), [child_id]);
+        // A hidden object is left out, and nothing on a locked or hidden layer is listed.
+        d.node_mut(b).unwrap().visible = false;
+        assert_eq!(at(&d, 30.0, None), [child_id, locked_group, a]);
+        d.node_mut(l).unwrap().locked = true;
+        assert!(at(&d, 30.0, None).is_empty());
+        d.node_mut(l).unwrap().locked = false;
+        d.node_mut(l).unwrap().visible = false;
+        assert!(at(&d, 30.0, None).is_empty());
+    }
+
+    /// `locked_objects_at` lists at most `MAX_LOCKED_AT` objects, the topmost ones.
+    #[test]
+    fn locked_objects_at_stops_at_its_limit() {
+        let mut d = Document::new(100.0, 100.0);
+        let l = d.layers[0].id;
+        let ids: Vec<NodeId> = (0..MAX_LOCKED_AT + 5)
+            .map(|_| {
+                let n = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default_art());
+                insert_locked(&mut d, l, n)
+            })
+            .collect();
+        let found = locked_objects_at(&d, Point::new(25.0, 25.0), HitOptions::default());
+        assert_eq!(found, ids.iter().rev().take(MAX_LOCKED_AT).copied().collect::<Vec<_>>());
+    }
+
     #[test]
     fn visible_sampling_reads_locked_art_and_layers_but_excludes_hidden_art() {
         let mut d = Document::new(200.0, 200.0);

crates/doc/src/lib.rs

@@ -8,6 +8,7 @@
 pub mod appearance;
 pub mod assets;
 pub mod blend;
+pub mod cancel;
 pub mod clipnest;
 pub mod cmyk;
 pub mod corners;
@@ -20,16 +21,22 @@ pub mod inks;
 mod inline;
 pub mod intertwine;
 pub mod shared;
+mod symbol_export_type;
+mod symbol_nine_slice;
 mod symbol_registration;
 pub use inline::{SYMBOL_HALF, SYMBOL_SIZES};
 pub use shared::Shared;
+pub use symbol_export_type::{SYMBOL_EXPORT_TYPE, SymbolExportType};
+pub use symbol_nine_slice::{SYMBOL_NINE_SLICE, SymbolNineSlice};
 pub use symbol_registration::{SYMBOL_REGISTRATION, SymbolRegistration};
 pub mod links;
 pub mod live;
+pub mod live_paint;
 pub mod marks;
 mod mem;
 pub mod metadata;
 pub mod node;
+pub mod objects_on_path;
 pub mod orient;
 pub mod overprint;
 pub mod pattern;
@@ -87,17 +94,18 @@ pub use assets::ExportAsset;
 pub use corners::LiveCorners;
 pub use depth::MAX_DEPTH;
 pub use graph::{
-    GraphDesign, GraphKind, GraphSpec, LabelStyles, MAX_GRAPH_CATEGORIES, MAX_GRAPH_SERIES, PiePosition, PieSort, SeriesPaint, TickLength,
-    ValueAxisSide,
+    ColumnDesign, ColumnType, Fractions, GraphDesign, GraphKind, GraphSpec, LabelStyles, MAX_GRAPH_CATEGORIES, MAX_GRAPH_SERIES, PiePosition,
+    PieSort, SeriesPaint, TickLength, ValueAxisSide,
 };
 pub use hit::{Hit, HitKind};
 pub use links::{LinkInfo, PlacementOptions};
 pub use live::{BlendOrientation, BlendSpacing, BlendSpec, EnvelopeKind, GradientMesh, MeshPoint};
+pub use live_paint::{GapOptions, GapSize};
 pub use metadata::{CopyrightStatus, DocMetadata};
 pub use node::Knockout;
 pub use node::Scaling;
 pub use node::{Extras, ExtrasMut, ImageObject, LAYER_COLORS, LayerColor, LiveShape, Node, NodeExtras, NodeId, NodeKind, OpacityMask};
-pub use node::{ImageMap, ObjectAttributes};
+pub use node::{ImageMap, MAX_SVG_SCRIPTS, ObjectAttributes, SVG_EVENTS};
 pub use orient::OrientedBox;
 pub use pattern::{Overlap, PatternDef, PatternEdit, RepeatKind, RepeatSpec, TileType};
 pub use perspective::PerspectiveAttachment;
@@ -110,9 +118,9 @@ pub use setup::{Background, DocSetup, ExportText, GridSize, Quotes};
 pub use slices::{CellAlign, CellVAlign, Slice, SliceArea, SliceKind, SliceOptions, SliceSource};
 pub use style_libs::StyleLibrary;
 pub use text::{
-    AreaFit, AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, Digits, FirstBaseline, InlineArt, Justify, Kinsoku, LeadingModel,
-    Mojikumi, ParaDirection, ParaStyle, PathAlign, PathEffect, ScriptMetrics, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef,
-    TextWrap, VerticalAlign, WrapShape,
+    AreaFit, AreaOptions, Burasagari, CharAlign, CharPosition, CharStyle, Composer, Digits, FirstBaseline, HyphenationOptions, InlineArt,
+    JustificationOptions, Justify, Kinsoku, LeadingModel, Mojikumi, ParaDirection, ParaStyle, PathAlign, PathEffect, ScriptMetrics,
+    SingleWordJustify, TabAlign, TabStop, TextKind, TextObject, TextRun, TextStyleDef, TextWrap, VerticalAlign, WrapShape,
 };
 pub use trace::TraceView;
 pub use variables::{DataSet, DataValue, Variable, VariableKind, Variables};
@@ -208,13 +216,33 @@ impl Unit {
     /// The rulers' label step at `zoom` (screen pixels per point), in this unit: the first of
     /// 1, 2, 5 × 10ⁿ that puts labels at least 50 pixels apart. Ticks mark every tenth of it.
     pub fn ruler_step(self, zoom: f64) -> f64 {
-        const STEPS: [f64; 19] =
+        const DECIMAL: [f64; 19] =
             [0.01, 0.02, 0.05, 0.1, 0.2, 0.5, 1.0, 2.0, 5.0, 10.0, 25.0, 50.0, 100.0, 200.0, 500.0, 1000.0, 2000.0, 5000.0, 10000.0];
-        STEPS.iter().copied().find(|s| s * self.points() * zoom >= 50.0).unwrap_or(10000.0)
+        // An inch is divided in half, not in ten: a tenth of an inch is not a mark an inch ruler
+        // carries, so below an inch the steps are binary fractions (#2827). Labelling stops at a
+        // sixteenth; zooming in past that leaves the labels where they are and only the ticks
+        // between them grow denser, down to a hundred and twenty-eighth
+        // ([`Self::ruler_minor`]). A label is at most six characters that way ("0.0625"), which
+        // the left ruler has room for when it spells one down the ruler a character at a time.
+        // From an inch up the ladder is the shared one.
+        const BINARY: [f64; 15] = [1.0 / 16.0, 0.125, 0.25, 0.5, 1.0, 2.0, 5.0, 10.0, 25.0, 50.0, 100.0, 200.0, 500.0, 1000.0, 10000.0];
+        let steps: &[f64] = if self.ruler_halves() { &BINARY } else { &DECIMAL };
+        steps.iter().copied().find(|s| s * self.points() * zoom >= 50.0).unwrap_or(10000.0)
+    }
+    /// Does this unit's ruler divide a step in half rather than in ten? Inches do; the metric
+    /// units, points, pixels and picas are read in tenths.
+    fn ruler_halves(self) -> bool {
+        matches!(self, Unit::Inches)
+    }
+    /// The unlabelled ticks between two labels, `step` apart ([`Self::ruler_step`]): an eighth of
+    /// the step on an inch ruler, so every tick is a binary fraction of an inch and they stay about
+    /// as dense as the tenths elsewhere; a tenth of it otherwise.
+    pub fn ruler_minor(self, step: f64) -> f64 {
+        if self.ruler_halves() { step / 8.0 } else { step / 10.0 }
     }
     /// `v` (points) on the nearest ruler tick at `zoom` ([`Self::ruler_step`]).
     pub fn snap_to_ruler_tick(self, v: f64, zoom: f64) -> f64 {
-        let tick = self.ruler_step(zoom) / 10.0 * self.points();
+        let tick = self.ruler_minor(self.ruler_step(zoom)) * self.points();
         (v / tick).round() * tick
     }
     pub fn from_pt(self, v: f64) -> f64 {
@@ -267,7 +295,12 @@ impl Unit {
     pub fn named(name: &str) -> Option<Unit> {
         let letters = |s: &'static str| s.chars().filter(char::is_ascii_alphanumeric).map(|c| c.to_ascii_lowercase());
         let given = || name.chars().filter(char::is_ascii_alphanumeric).map(|c| c.to_ascii_lowercase());
-        Unit::ALL.into_iter().find(|u| letters(u.label()).eq(given()) || u.suffix().chars().eq(given()))
+        // Feet and Feet & Inches share the suffix `ft`: it names the plain unit, so Feet & Inches
+        // is left to its label and key.
+        Unit::ALL
+            .into_iter()
+            .find(|u| letters(u.label()).eq(given()))
+            .or_else(|| Unit::ALL.into_iter().filter(|u| *u != Unit::FeetInches).find(|u| u.suffix().chars().eq(given())))
     }
     /// A point value as the canvas measurement labels show it: two decimals and the suffix
     /// (`12.50 mm`).
@@ -589,6 +622,23 @@ pub struct ImageBlob {
     pub proxy: Option<Arc<Vec<u8>>>,
 }
 
+/// What the rulers measure from (View › Rulers): the active artboard's origin, the default of a
+/// new document, or one origin for the whole document.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum RulerMode {
+    #[default]
+    Artboard,
+    Global,
+}
+
+impl RulerMode {
+    /// The mode of a document saved before the choice existed: global, as its rulers measured.
+    pub fn legacy() -> Self {
+        Self::Global
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Document {
     pub version: u32,
@@ -602,6 +652,15 @@ pub struct Document {
     /// The rulers' zero point in document coordinates. Moving it changes measurements, never art.
     #[serde(default, skip_serializing_if = "skip::is_default")]
     pub ruler_origin: Point,
+    /// View › Rulers › Change to Global / Artboard Rulers: whether the rulers and position fields
+    /// measure from [`Self::ruler_origin`] (global) or from the active artboard's own origin.
+    /// Documents saved before the choice existed measured globally and open that way.
+    #[serde(default = "RulerMode::legacy")]
+    pub rulers: RulerMode,
+    /// Artboard rulers' zero point of each artboard (by [`Artboard::id`]), as an offset from its
+    /// top-left corner; an artboard not listed measures from that corner.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub artboard_ruler_origins: BTreeMap<u32, Vec2>,
     #[serde(default)]
     pub color_mode: ColorMode,
     pub artboards: Vec<Artboard>,
@@ -692,6 +751,10 @@ pub struct Document {
     /// save time only, so changing the view never marks the document modified.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub last_view: Option<SavedView>,
+    /// View → Show Transparency Grid when the document was saved. Written at save time only,
+    /// like [`Document::last_view`]; older files open with the grid hidden.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub transparency_grid: bool,
     /// The layers, sublayers and groups open in the Layers panel when the document was saved; they
     /// reopen that way. `None`: the default, only the top-level layers open. Written at save time
     /// only, like [`Document::last_view`].
@@ -724,6 +787,10 @@ pub struct Document {
     /// export settings are Export for Screens' ([`Document::export_settings`]).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub assets: Vec<ExportAsset>,
+    /// Window › SVG Interactivity › Link JavaScript Files: the JavaScript files (paths or URLs, as
+    /// given) SVG export links with `<script>` elements, in order.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub svg_scripts: Vec<String>,
     /// Puppet Warp pins on the selected artwork while the tool edits it ([`PuppetPins`]): editing
     /// state, never saved.
     #[serde(skip)]
@@ -745,6 +812,14 @@ fn yes() -> bool {
     true
 }
 
+/// Is point `p` on the artboard at `rect`, its edges included, within a millionth of a point? This
+/// is the rule [`Document::art_on_artboard`] applies to art flush with an edge (#890), where
+/// `Rect::contains` leaves out the right and bottom edges.
+pub fn artboard_holds(rect: Rect, p: Point) -> bool {
+    let r = rect.inflate(1e-6, 1e-6);
+    r.x0 <= p.x && p.x <= r.x1 && r.y0 <= p.y && p.y <= r.y1
+}
+
 /// Listed nodes by parent: the parent's index path (empty for the top-level layers), then the index
 /// of each listed child in it, in order, with the child's place in the list.
 type Places = BTreeMap<Vec<usize>, Vec<(usize, usize)>>;
@@ -752,6 +827,12 @@ type Places = BTreeMap<Vec<usize>, Vec<(usize, usize)>>;
 pub const FORMAT_VERSION: u32 = 1;
 
 impl Document {
+    /// Document Raster Effects Settings › Resolution in ppi, 1 to 2400 (72 when the stored value
+    /// isn't a number).
+    pub fn raster_ppi(&self) -> f64 {
+        Some(self.raster_effects_ppi).filter(|v| v.is_finite()).unwrap_or(72.0).clamp(1.0, 2400.0)
+    }
+
     /// The ruler zero point, or zero on both axes when either stored coordinate is invalid.
     /// Rulers, coordinate fields and guide snapping use the same supported range.
     pub fn ruler_origin_or_zero(&self) -> Point {
@@ -759,6 +840,27 @@ impl Document {
         if origin.is_finite() && origin.x.abs() <= MAX_COORD && origin.y.abs() <= MAX_COORD { origin } else { Point::ZERO }
     }
 
+    /// Where the rulers measure from with artboard `index` active: [`Self::ruler_origin_or_zero`]
+    /// with global rulers; with artboard rulers that artboard's top-left corner moved by its own
+    /// offset (the first artboard's when `index` is out of range, the global zero point when the
+    /// document has no artboard or the result is out of the supported range).
+    pub fn ruler_origin_for(&self, index: usize) -> Point {
+        if self.rulers == RulerMode::Global {
+            return self.ruler_origin_or_zero();
+        }
+        let Some(ab) = self.artboards.get(index).or_else(|| self.artboards.first()) else { return self.ruler_origin_or_zero() };
+        let corner = Point::new(ab.rect.x0, ab.rect.y0);
+        let offset = self.artboard_ruler_origins.get(&ab.id).copied().unwrap_or(Vec2::ZERO);
+        let origin = corner + offset;
+        if origin.is_finite() && origin.x.abs() <= MAX_COORD && origin.y.abs() <= MAX_COORD {
+            origin
+        } else if corner.is_finite() && corner.x.abs() <= MAX_COORD && corner.y.abs() <= MAX_COORD {
+            corner
+        } else {
+            Point::ZERO
+        }
+    }
+
     /// A new RGB document with one artboard of `size` and one layer ("Layer 1").
     pub fn new(width: f64, height: f64) -> Self {
         Self::new_with_mode(width, height, ColorMode::Rgb)
@@ -773,6 +875,8 @@ impl Document {
             template: false,
             units: Unit::Points,
             ruler_origin: Point::ZERO,
+            rulers: RulerMode::Artboard,
+            artboard_ruler_origins: BTreeMap::new(),
             color_mode: mode,
             artboards: vec![Artboard {
                 id: 1,
@@ -810,6 +914,7 @@ impl Document {
             metadata: DocMetadata::default(),
             raster_effects: RasterEffectsSettings::default(),
             last_view: None,
+            transparency_grid: false,
             layers_open: None,
             color_profiles: ColorProfiles::default(),
             export_settings: Default::default(),
@@ -818,6 +923,7 @@ impl Document {
             slices_clip_to_artboard: true,
             print_setup: None,
             assets: vec![],
+            svg_scripts: vec![],
             puppet: None,
             dimensions: false,
             index: Default::default(),
@@ -1290,9 +1396,24 @@ impl Document {
         let symbols = self.symbol_boxes();
         self.layers.iter().fold(None, |acc, l| vectorcraft_geom::union_opt(acc, l.visual_bounds_with(&symbols)))
     }
-    /// Artboard index containing point `p` (topmost = last).
+    /// Artboard index containing point `p` (topmost = last), its edges included
+    /// ([`Document::artboard_holding`]).
     pub fn artboard_at(&self, p: Point) -> Option<usize> {
-        self.artboards.iter().rposition(|a| a.rect.contains(p))
+        self.artboard_holding(p, true)
+    }
+    /// Index of the artboard that holds point `p`: the first (the last when `topmost`) that holds it
+    /// inside or on its left or top edge, else the first (the last) that holds it by
+    /// [`artboard_holds`]: on its right or bottom edge, or within a millionth of a point outside an
+    /// edge. On an edge two artboards share, the artboard to the right of it or below it holds the
+    /// point, except at the end of the edge that lies on that artboard's bottom or right edge, such
+    /// as the point where both artboards' bottom edges meet; there the first (the last) holds it.
+    pub fn artboard_holding(&self, p: Point, topmost: bool) -> Option<usize> {
+        let pick = |on: &dyn Fn(Rect) -> bool| {
+            let on = |i: &usize| self.artboards.get(*i).is_some_and(|a| on(a.rect));
+            let mut all = 0..self.artboards.len();
+            if topmost { all.rfind(on) } else { all.find(on) }
+        };
+        pick(&|r| r.contains(p)).or_else(|| pick(&|r| artboard_holds(r, p)))
     }
     /// The art that moves with an artboard at `rect`: top-level objects (children of layers and
     /// sublayers) lying entirely inside it, with symbol instances measured by their art. Locked and
@@ -1415,6 +1536,7 @@ impl Document {
             n += usize::from(*k);
         }
         sel.guides = sel.guides.iter().filter_map(|i| to.get(*i).copied().flatten()).collect();
+        sel.key_guide = sel.key_guide.and_then(|i| to.get(i).copied().flatten());
         let before = self.guides.len();
         let mut flags = kept.into_iter();
         self.guides.retain(|_| flags.next().unwrap_or(true));
@@ -1460,9 +1582,17 @@ impl Document {
         {
             dimension.source = None;
         }
+        let mut renamed = std::collections::HashMap::new();
         if let Some(ch) = n.children_mut() {
             let old: Vec<Arc<Node>> = std::mem::take(ch);
             *ch = old.iter().map(|c| Arc::new(self.reid(c))).collect();
+            renamed.extend(old.iter().zip(ch.iter()).map(|(o, c)| (o.id, c.id)));
+        }
+        // An Objects on Path group names its path and its objects by id: the copy names the copies.
+        if let Some(e) = n.extras_if_any()
+            && let Some(on_path) = &mut e.objects_on_path
+        {
+            on_path.rename(&renamed);
         }
         n
     }
@@ -1578,6 +1708,83 @@ impl Document {
             o.insert(name.into(), serde_json::json!(reg.0));
         }
     }
+
+    /// Move the stored registration when a symbol is renamed.
+    pub fn rename_symbol_registration(&mut self, from: &str, to: &str) {
+        if from == to {
+            return;
+        }
+        let reg = self.symbol_registration(from);
+        self.set_symbol_registration(from, SymbolRegistration::CENTER);
+        self.set_symbol_registration(to, reg);
+    }
+
+    /// Symbol Options › Export Type for `name` (default: Movie Clip).
+    pub fn symbol_export_type(&self, name: &str) -> SymbolExportType {
+        self.unknown.get(SYMBOL_EXPORT_TYPE).and_then(|m| m.get(name)).and_then(SymbolExportType::from_value).unwrap_or_default()
+    }
+
+    /// Set or clear (when Movie Clip, the default) the export type stored for `name`.
+    pub fn set_symbol_export_type(&mut self, name: &str, kind: SymbolExportType) {
+        if kind.is_default() {
+            self.clear_symbol_export_type(name);
+            return;
+        }
+        let m = self.unknown.entry(SYMBOL_EXPORT_TYPE.to_string()).or_insert_with(|| serde_json::json!({}));
+        let Some(o) = m.as_object_mut() else { return };
+        o.insert(name.into(), serde_json::json!(kind.id()));
+    }
+
+    /// Drop any stored export type for `name` (Movie Clip default).
+    pub fn clear_symbol_export_type(&mut self, name: &str) {
+        let Some(m) = self.unknown.get_mut(SYMBOL_EXPORT_TYPE) else { return };
+        let Some(o) = m.as_object_mut() else { return };
+        o.remove(name);
+        if o.is_empty() {
+            self.unknown.remove(SYMBOL_EXPORT_TYPE);
+        }
+    }
+
+    /// Move the stored export type when a symbol is renamed.
+    pub fn rename_symbol_export_type(&mut self, from: &str, to: &str) {
+        if from == to {
+            return;
+        }
+        let kind = self.symbol_export_type(from);
+        self.clear_symbol_export_type(from);
+        self.set_symbol_export_type(to, kind);
+    }
+
+    /// Symbol Options › 9-slice guides for `name`: `None` when 9-slice scaling is off (default).
+    pub fn symbol_nine_slice(&self, name: &str) -> Option<SymbolNineSlice> {
+        self.unknown.get(SYMBOL_NINE_SLICE).and_then(|m| m.get(name)).and_then(SymbolNineSlice::from_value)
+    }
+
+    /// Turn 9-slice scaling on with `guides`, or off with `None`, for `name`.
+    pub fn set_symbol_nine_slice(&mut self, name: &str, guides: Option<SymbolNineSlice>) {
+        let Some(g) = guides else {
+            let Some(o) = self.unknown.get_mut(SYMBOL_NINE_SLICE).and_then(|m| m.as_object_mut()) else { return };
+            o.remove(name);
+            if o.is_empty() {
+                self.unknown.remove(SYMBOL_NINE_SLICE);
+            }
+            return;
+        };
+        let m = self.unknown.entry(SYMBOL_NINE_SLICE.to_string()).or_insert_with(|| serde_json::json!({}));
+        if let Some(o) = m.as_object_mut() {
+            o.insert(name.into(), g.to_value());
+        }
+    }
+
+    /// Move the stored 9-slice guides when a symbol is renamed.
+    pub fn rename_symbol_nine_slice(&mut self, from: &str, to: &str) {
+        if from == to {
+            return;
+        }
+        let g = self.symbol_nine_slice(from);
+        self.set_symbol_nine_slice(from, None);
+        self.set_symbol_nine_slice(to, g);
+    }
 }
 
 fn default_graphic_styles() -> Vec<GraphicStyle> {
@@ -1626,6 +1833,46 @@ mod tests {
     use super::*;
     use vectorcraft_geom::shapes;
 
+    /// Zooming in on an inch ruler divided the inch into tenths (#2827). Its steps below an inch
+    /// are binary fractions now, and the minor ticks between them stay binary too; every other
+    /// unit is still read in tenths.
+    #[test]
+    fn an_inch_ruler_steps_in_binary_fractions() {
+        let step = |u: Unit, zoom: f64| u.ruler_step(zoom);
+        // Every inch step at or below an inch is 1/2^k, never a tenth or a fifth.
+        for zoom in [1.0, 2.0, 5.0, 7.5, 10.0, 20.0, 40.0, 100.0, 400.0] {
+            let s = step(Unit::Inches, zoom);
+            if s <= 1.0 {
+                let k = s.recip();
+                assert_eq!(k, k.round(), "{s} at zoom {zoom} is 1/k for a whole k");
+                assert!((k.round() as u64).is_power_of_two(), "{s} at zoom {zoom} is 1/2^k");
+            }
+            // A label step always leaves at least 50 px, which is what the ladder is picked for.
+            assert!(s * Unit::Inches.points() * zoom >= 50.0, "zoom {zoom}");
+        }
+        // The steps the report named: tenths became quarters, eighths and sixteenths.
+        assert_eq!(step(Unit::Inches, 5.0), 0.25);
+        assert_eq!(step(Unit::Inches, 10.0), 0.125);
+        assert_eq!(step(Unit::Inches, 20.0), 0.0625);
+        // An inch and wider is unchanged.
+        assert_eq!(step(Unit::Inches, 1.0), 1.0);
+        // Labelling stops at a sixteenth, as the report says Illustrator's does, so zooming in
+        // further only adds ticks. A label therefore never needs more than the six characters of
+        // "0.0625", which the left ruler has room for when it spells one out a character per line.
+        for zoom in [20.0, 50.0, 100.0, 400.0, 1600.0] {
+            assert_eq!(step(Unit::Inches, zoom), 0.0625, "zoom {zoom}");
+        }
+        // The unlabelled ticks go on down to a hundred and twenty-eighth: the 32nds, 64ths and
+        // 128ths the report expects to appear unlabelled when zoomed in close.
+        assert_eq!(Unit::Inches.ruler_minor(0.0625), 1.0 / 128.0);
+        // The minor ticks: an eighth of the step on an inch ruler, a tenth elsewhere.
+        assert_eq!(Unit::Inches.ruler_minor(0.25), 0.03125);
+        assert_eq!(Unit::Millimeters.ruler_minor(25.0), 2.5);
+        assert_eq!(Unit::Points.ruler_minor(100.0), 10.0);
+        // Other units keep the decimal ladder, so a tenth and a fifth still appear.
+        assert!([0.1, 0.2, 0.5, 1.0, 2.0, 5.0, 10.0, 25.0].contains(&step(Unit::Millimeters, 5.0)), "{}", step(Unit::Millimeters, 5.0));
+    }
+
     fn doc_with_rects() -> (Document, NodeId, NodeId) {
         let mut d = Document::new(612.0, 792.0);
         let layer = d.layers[0].id;
@@ -1696,6 +1943,44 @@ mod tests {
         assert_eq!(d.art_on_artboard(Rect::new(0.0, 0.0, 15.0, 15.0), false), vec![id]);
     }
 
+    #[test]
+    fn artboard_at_counts_the_right_and_bottom_edges() {
+        // Artboard 0 is (0, 0) to (100, 100), artboard 1 is to its right and artboard 2 below it.
+        let mut d = Document::new(100.0, 100.0);
+        for rect in [Rect::new(100.0, 0.0, 200.0, 100.0), Rect::new(0.0, 100.0, 100.0, 200.0)] {
+            let mut a = d.artboards[0].clone();
+            a.rect = rect;
+            d.artboards.push(a);
+        }
+        let held = |d: &Document, x: f64, y: f64| (d.artboard_at(Point::new(x, y)), d.artboard_holding(Point::new(x, y), false));
+        // Each artboard's own right and bottom edges, edges with roundoff, and points beyond them.
+        assert_eq!(held(&d, 200.0, 50.0), (Some(1), Some(1)), "right edge");
+        assert_eq!(held(&d, 150.0, 100.0), (Some(1), Some(1)), "bottom edge");
+        assert_eq!(held(&d, 200.0, 100.0), (Some(1), Some(1)), "bottom right corner");
+        assert_eq!(held(&d, 100.0, 150.0), (Some(2), Some(2)), "right edge");
+        assert_eq!(held(&d, 50.0, 200.0 + 1e-9), (Some(2), Some(2)), "roundoff past the bottom edge");
+        assert_eq!(held(&d, -1e-9, 50.0), (Some(0), Some(0)), "roundoff past the left edge");
+        assert_eq!(held(&d, 200.001, 50.0), (None, None));
+        assert_eq!(held(&d, 50.0, 200.001), (None, None));
+        // On an edge two artboards share, the artboard to the right of it or below it holds the
+        // point, in either list order, except at the end of the edge that lies on that artboard's
+        // bottom or right edge.
+        assert_eq!(held(&d, 100.0, 50.0), (Some(1), Some(1)));
+        assert_eq!(held(&d, 50.0, 100.0), (Some(2), Some(2)));
+        // The bottom edges of artboards 0 and 1 meet at (100, 100), which is also artboard 2's top
+        // right corner: the first holds the point, or the last when `topmost`.
+        assert_eq!(held(&d, 100.0, 100.0), (Some(2), Some(0)), "shared corner");
+        d.artboards.swap(0, 1);
+        assert_eq!(held(&d, 100.0, 50.0), (Some(0), Some(0)));
+        // Where two artboards overlap, the topmost holds the point, or the first one when not
+        // `topmost`.
+        let mut inner = d.artboards[1].clone();
+        inner.rect = Rect::new(10.0, 10.0, 90.0, 90.0);
+        d.artboards.push(inner);
+        assert_eq!(held(&d, 50.0, 50.0), (Some(3), Some(1)));
+        assert_eq!(held(&d, 90.0, 50.0), (Some(1), Some(1)), "inside artboard 1, on the right edge of artboard 3");
+    }
+
     #[test]
     fn find_and_paths() {
         let (d, a, b) = doc_with_rects();

crates/doc/src/live.rs

@@ -730,19 +730,35 @@ impl GradientMesh {
             .to_point()
     }
 
-    /// Bilinear colour and opacity of patch (r, c) at local (u, v).
+    /// Bilinear colour and opacity of patch (r, c) at local (u, v). Corners all in CMYK (or all
+    /// grey) mix in that space, as a PDF shading mixes in its own colour space: the inks come out
+    /// exact, and a CMYK document separates no colour to draw them. Other corners mix in RGB.
     pub fn color_at(&self, r: usize, c: usize, u: f64, v: f64) -> (Color, f32) {
         let q =
             [&self.points[self.idx(r, c)], &self.points[self.idx(r, c + 1)], &self.points[self.idx(r + 1, c)], &self.points[self.idx(r + 1, c + 1)]];
         let w = [(1.0 - u) * (1.0 - v), u * (1.0 - v), (1.0 - u) * v, u * v];
+        let op = q.iter().zip(w).map(|(p, w)| p.opacity * w as f32).sum();
+        let cmyk: Option<Vec<[f32; 4]>> =
+            q.iter().map(|p| if let Color::Cmyk { c, m, y, k } = p.color { Some([c, m, y, k]) } else { None }).collect();
+        if let Some(inks) = cmyk {
+            let mut mix = [0.0f32; 4];
+            for (ink, w) in inks.iter().zip(w) {
+                for (m, x) in mix.iter_mut().zip(ink) {
+                    *m += x * w as f32;
+                }
+            }
+            let [c, m, y, k] = mix;
+            return (Color::Cmyk { c, m, y, k }, op);
+        }
+        let grey: Option<Vec<f32>> = q.iter().map(|p| if let Color::Gray { k } = p.color { Some(k) } else { None }).collect();
+        if let Some(ks) = grey {
+            return (Color::Gray { k: ks.iter().zip(w).map(|(k, w)| k * w as f32).sum() }, op);
+        }
         let mut rgb = [0.0f32; 3];
-        let mut op = 0.0f32;
-        for k in 0..4 {
-            let c = q[k].color.to_rgb();
-            for (ch, x) in rgb.iter_mut().zip(c) {
-                *ch += x * w[k] as f32;
+        for (p, w) in q.iter().zip(w) {
+            for (ch, x) in rgb.iter_mut().zip(p.color.to_rgb()) {
+                *ch += x * w as f32;
             }
-            op += q[k].opacity * w[k] as f32;
         }
         (Color::rgb(rgb[0], rgb[1], rgb[2]), op)
     }
@@ -1823,4 +1839,19 @@ mod tests {
         assert!(m.remove_point_lines(i));
         assert_eq!((m.rows, m.cols), (1, 1));
     }
+
+    /// Corners all in CMYK mix in CMYK (the inks halfway), not in RGB.
+    #[test]
+    fn a_cmyk_mesh_mixes_its_inks() {
+        let cyan = Color::Cmyk { c: 1.0, m: 0.0, y: 0.0, k: 0.0 };
+        let mut m = GradientMesh::for_path(&shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), 1, 1, cyan, MeshAppearance::Flat, 0.0).unwrap();
+        m.points[0].color = Color::Cmyk { c: 0.0, m: 0.0, y: 0.0, k: 1.0 };
+        let (c, op) = m.color_at(0, 0, 0.0, 0.0);
+        assert_eq!((c, op), (Color::Cmyk { c: 0.0, m: 0.0, y: 0.0, k: 1.0 }, 1.0));
+        let Color::Cmyk { c, k, .. } = m.color_at(0, 0, 0.5, 0.5).0 else { panic!("mixed out of CMYK") };
+        assert!((c - 0.75).abs() < 1e-6 && (k - 0.25).abs() < 1e-6, "{c} {k}");
+        // A corner in another space mixes them all in RGB.
+        m.points[1].color = Color::rgb(1.0, 0.0, 0.0);
+        assert!(matches!(m.color_at(0, 0, 0.5, 0.5).0, Color::Rgb { .. }));
+    }
 }

crates/doc/src/live_paint.rs

@@ -0,0 +1,130 @@
+//! Live Paint groups' Gap Options (Object › Live Paint › Gap Options): whether paint stops at small
+//! gaps between the group's paths, how wide a gap it stops at, and the color gaps preview in.
+//! A group without options has Gap Detection off.
+
+use serde::{Deserialize, Serialize};
+
+use crate::node::{LAYER_COLORS, Node};
+
+/// Paint Stops At: the widest gap Gap Detection closes.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum GapSize {
+    /// Small Gaps: [`GapSize::SMALL`] points.
+    #[default]
+    Small,
+    /// Medium Gaps: [`GapSize::MEDIUM`] points.
+    Medium,
+    /// Large Gaps: [`GapSize::LARGE`] points.
+    Large,
+    /// Custom: this many points, over 0 up to [`GapSize::MAX`].
+    Custom(f64),
+}
+
+impl GapSize {
+    pub const SMALL: f64 = 3.0;
+    pub const MEDIUM: f64 = 6.0;
+    pub const LARGE: f64 = 12.0;
+    /// The widest custom gap.
+    pub const MAX: f64 = 72.0;
+
+    /// The preset sizes with their ids, smallest first.
+    pub const PRESETS: [(Self, &'static str); 3] = [(Self::Small, "small"), (Self::Medium, "medium"), (Self::Large, "large")];
+
+    /// The widest gap it closes, in points.
+    pub fn points(self) -> f64 {
+        match self {
+            Self::Small => Self::SMALL,
+            Self::Medium => Self::MEDIUM,
+            Self::Large => Self::LARGE,
+            Self::Custom(pt) => pt,
+        }
+    }
+
+    /// The id of a preset size (`small`, `medium` or `large`); None for a custom size.
+    pub fn id(self) -> Option<&'static str> {
+        Self::PRESETS.iter().find(|(s, _)| *s == self).map(|(_, id)| *id)
+    }
+
+    /// A preset size by its id (any case), or a custom size from a number of points over 0 up to
+    /// [`GapSize::MAX`].
+    pub fn parse(v: &serde_json::Value) -> Option<Self> {
+        match v {
+            serde_json::Value::String(id) => Self::PRESETS.iter().find(|(_, i)| i.eq_ignore_ascii_case(id.trim())).map(|(s, _)| *s),
+            v => v.as_f64().filter(|pt| *pt > 0.0 && *pt <= Self::MAX).map(Self::Custom),
+        }
+    }
+}
+
+/// Gap Preview Color for a group that has none set: the layer color Red.
+pub const DEFAULT_GAP_COLOR: [u8; 3] = LAYER_COLORS[1].1;
+
+/// A Live Paint group's Gap Options.
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct GapOptions {
+    /// Gap Detection: paint stops at gaps up to `size` wide.
+    pub detect: bool,
+    /// Paint Stops At.
+    pub size: GapSize,
+    /// Gap Preview Color: the color gaps show in.
+    pub color: [u8; 3],
+}
+
+impl Default for GapOptions {
+    fn default() -> Self {
+        Self { detect: false, size: GapSize::Small, color: DEFAULT_GAP_COLOR }
+    }
+}
+
+impl GapOptions {
+    /// The widest gap paint stops at, in points; None with Gap Detection off.
+    pub fn max_gap(&self) -> Option<f64> {
+        self.detect.then(|| self.size.points())
+    }
+}
+
+impl Node {
+    /// The Gap Options of a Live Paint group (the defaults when it has none set).
+    pub fn gap_options(&self) -> GapOptions {
+        self.extras().live_paint_gaps.as_deref().copied().unwrap_or_default()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn sizes_parse_from_ids_and_points() {
+        for (size, id) in GapSize::PRESETS {
+            assert_eq!(GapSize::parse(&json!(id)), Some(size));
+            assert_eq!(GapSize::parse(&json!(id.to_ascii_uppercase())), Some(size));
+            assert_eq!(size.id(), Some(id));
+        }
+        assert_eq!(GapSize::parse(&json!("Medium")).map(GapSize::points), Some(6.0));
+        assert_eq!(GapSize::parse(&json!("large")).map(GapSize::points), Some(12.0));
+        assert_eq!(GapSize::parse(&json!(4.5)), Some(GapSize::Custom(4.5)));
+        assert_eq!(GapSize::Custom(4.5).points(), 4.5);
+        assert_eq!(GapSize::Custom(4.5).id(), None);
+        for bad in [json!(0), json!(-1), json!(72.5), json!("tiny"), json!(null), json!(true)] {
+            assert_eq!(GapSize::parse(&bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    fn options_round_trip_and_default_to_no_detection() {
+        let mut g = Node::group(crate::NodeId(1), vec![]);
+        assert_eq!(g.gap_options(), GapOptions::default());
+        assert_eq!(g.gap_options().max_gap(), None);
+        let set = GapOptions { detect: true, size: GapSize::Custom(5.0), color: [1, 2, 3] };
+        g.extras_mut().live_paint_gaps = Some(Box::new(set));
+        assert_eq!(g.gap_options().max_gap(), Some(5.0));
+        let text = serde_json::to_string(&g).unwrap();
+        let back: Node = serde_json::from_str(&text).unwrap();
+        assert_eq!(back.gap_options(), set);
+        let bare: GapOptions = serde_json::from_value(json!({"detect": true})).unwrap();
+        assert_eq!(bare, GapOptions { detect: true, ..GapOptions::default() });
+    }
+}

crates/doc/src/mem.rs

@@ -250,8 +250,12 @@ fn node_bytes(n: &Node, other: Option<&Node>) -> usize {
     if let Some(e) = n.extras_box() {
         b += ALLOC + size_of::<NodeExtras>();
         b += boxed(&e.mask) + boxed(&e.graph) + boxed(&e.shaper) + boxed(&e.attrs) + boxed(&e.slice) + boxed(&e.perspective);
+        b += boxed(&e.dimension) + boxed(&e.live_paint_gaps);
         b += e.trace.as_ref().map_or(0, |t| ALLOC + size_of::<Value>() + json_bytes(t));
         b += e.intertwine.as_deref().map_or(0, |a| ALLOC + size_of::<PathData>() + path_bytes(a));
+        b += e.objects_on_path.as_deref().map_or(0, |o| {
+            ALLOC + size_of::<crate::objects_on_path::ObjectsOnPath>() + o.members.capacity() * size_of::<crate::objects_on_path::Member>()
+        });
     }
     b += match &n.kind {
         NodeKind::Path { path, live, .. } => path_bytes(path) + boxed(live),

crates/doc/src/metadata.rs

@@ -82,6 +82,31 @@ impl DocMetadata {
     }
 }
 
+/// The time exported files record: PDF `CreationDate` and `ModDate`, the PNG `Creation Time`
+/// entry, a zip entry's date, and a saved document's `created` and `modified`. It is the clock,
+/// unless `SOURCE_DATE_EPOCH` is set, which replaces it so that the same commands produce the same
+/// bytes twice (#2880).
+///
+/// The raw clock stays in [`now_unix`], which is what a heartbeat is judged by and what seeds
+/// encryption: neither may be pinned by the environment.
+pub fn output_time() -> Option<i64> {
+    pinned_or(|n| std::env::var(n).ok(), now_unix)
+}
+
+/// [`output_time`] with the environment and the clock supplied, so a test can show that the
+/// variable is preferred and that the clock answers whenever it does not.
+fn pinned_or(get: impl Fn(&str) -> Option<String>, clock: impl Fn() -> Option<i64>) -> Option<i64> {
+    stamp_from_env(get).or_else(clock)
+}
+
+/// `SOURCE_DATE_EPOCH` as Unix seconds: the reproducible-builds variable
+/// (<https://reproducible-builds.org/specs/source-date-epoch/>), a non-negative decimal integer of
+/// seconds since the epoch. `None` when it is unset, blank, negative or not an integer, and then
+/// the clock decides — an export is never refused over the environment.
+fn stamp_from_env(get: impl Fn(&str) -> Option<String>) -> Option<i64> {
+    get("SOURCE_DATE_EPOCH")?.trim().parse::<i64>().ok().filter(|t| *t >= 0)
+}
+
 /// The current time as Unix seconds (UTC); `None` where the platform has no clock (the web build).
 #[cfg(not(target_arch = "wasm32"))]
 pub fn now_unix() -> Option<i64> {
@@ -148,4 +173,38 @@ mod tests {
         );
         assert!(DocMetadata::default().png_text("").is_empty());
     }
+
+    /// `SOURCE_DATE_EPOCH` replaces the clock in exported output only when it is a non-negative
+    /// decimal integer; anything else leaves the clock to decide, so an export is never refused.
+    #[test]
+    fn source_date_epoch_is_read_only_as_a_non_negative_integer() {
+        let env = |v: Option<&'static str>| move |n: &str| v.filter(|_| n == "SOURCE_DATE_EPOCH").map(str::to_owned);
+        assert_eq!(stamp_from_env(env(Some("1791208980"))), Some(1_791_208_980));
+        assert_eq!(stamp_from_env(env(Some("0"))), Some(0));
+        assert_eq!(stamp_from_env(env(Some("  1791208980  "))), Some(1_791_208_980));
+        for bad in ["", "   ", "-1", "later", "1791208980.5", "1e9", "99999999999999999999"] {
+            assert_eq!(stamp_from_env(env(Some(bad))), None, "{bad:?}");
+        }
+        assert_eq!(stamp_from_env(env(None)), None, "unset");
+        // Another variable never stands in for it.
+        assert_eq!(stamp_from_env(|_| Some("1791208980".to_owned())), Some(1_791_208_980));
+        assert_eq!(stamp_from_env(|n: &str| (n == "TZ").then(|| "1791208980".to_owned())), None);
+    }
+
+    /// What a file records: the variable when it is usable, the clock whenever it is not. The
+    /// environment and the clock are passed in, so no test changes this process's environment --
+    /// that is `unsafe` under edition 2024 and would reach every other test running beside it.
+    #[test]
+    fn a_pinned_epoch_is_preferred_and_the_clock_answers_otherwise() {
+        let env = |v: Option<&'static str>| move |_: &str| v.map(str::to_owned);
+        let clock = || Some(1_000_000);
+        assert_eq!(pinned_or(env(Some("1791208980")), clock), Some(1_791_208_980), "the variable wins over the clock");
+        assert_eq!(pinned_or(env(Some("0")), clock), Some(0), "including the epoch itself");
+        for ignored in [None, Some(""), Some("-1"), Some("later")] {
+            assert_eq!(pinned_or(env(ignored), clock), Some(1_000_000), "{ignored:?} leaves it to the clock");
+        }
+        // A platform with no clock and no variable has no date to record.
+        assert_eq!(pinned_or(env(None), || None), None);
+        assert_eq!(pinned_or(env(Some("1791208980")), || None), Some(1_791_208_980), "the variable needs no clock");
+    }
 }

crates/doc/src/node.rs

@@ -6,7 +6,7 @@ use serde::{Deserialize, Serialize};
 use vectorcraft_color::{BlendMode, Color, Paint};
 use vectorcraft_geom::corners::cut_corners;
 use vectorcraft_geom::shapes::{self, CornerKind};
-use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect};
+use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Point, Rect, Shape};
 
 use crate::appearance::Appearance;
 use crate::live::{BlendSpec, EnvelopeKind, GradientMesh, Outliner};
@@ -102,6 +102,8 @@ pub enum LiveShape {
     },
     Polygon {
         radius: f64,
+        /// 3–1000, as [`LiveShape::set_sides`] gives it; a file's count is clamped when read.
+        #[serde(deserialize_with = "de_sides")]
         sides: u32,
         xf: Affine,
         /// Corner radii in document units, by vertex from the first one clockwise (none: sharp).
@@ -326,6 +328,12 @@ fn all_round(kinds: &[CornerKind]) -> bool {
     kinds.iter().all(|k| *k == CornerKind::Round)
 }
 
+/// A polygon's side count read from a file, clamped as the commands clamp it: the outline and its
+/// corner lists hold one entry per side, so a huge count would allocate gigabytes.
+fn de_sides<'de, D: serde::Deserializer<'de>>(d: D) -> Result<u32, D::Error> {
+    u32::deserialize(d).map(|n| n.clamp(3, 1000))
+}
+
 /// Whether `a` only moves (no rotation, scale, shear or reflection).
 fn moves_only(a: Affine) -> bool {
     let [a0, a1, a2, a3, _, _] = a.as_coeffs();
@@ -570,6 +578,11 @@ pub struct NodeExtras {
     /// Object › Intertwine: as a member of an Intertwine group, the area (document coordinates,
     /// filled non-zero) where this object is drawn over the group's other members.
     pub intertwine: Option<Box<PathData>>,
+    /// Live Paint group: its Gap Options (Object › Live Paint › Gap Options; `None`: the defaults).
+    pub live_paint_gaps: Option<Box<crate::live_paint::GapOptions>>,
+    /// Object › Objects on Path: the group's path and the objects attached to it (see
+    /// [`crate::objects_on_path`]).
+    pub objects_on_path: Option<Box<crate::objects_on_path::ObjectsOnPath>>,
 }
 
 /// No extras: what [`Node::extras`] gives for a node without any.
@@ -587,6 +600,8 @@ static NO_EXTRAS: NodeExtras = NodeExtras {
     perspective: None,
     dimension: None,
     intertwine: None,
+    live_paint_gaps: None,
+    objects_on_path: None,
 };
 
 /// A node's [`NodeExtras`], if it has any ([`Node::extras`]). Extras that are all unset equal
@@ -720,6 +735,8 @@ impl Serialize for Node {
             e.perspective.is_none(),
             e.dimension.is_none(),
             e.intertwine.is_none(),
+            e.live_paint_gaps.is_none(),
+            e.objects_on_path.is_none(),
         ];
         let mut st = s.serialize_struct("Node", skips.iter().filter(|s| !**s).count())?;
         let mut skip = skips.into_iter();
@@ -757,6 +774,8 @@ impl Serialize for Node {
         field!("perspective", &e.perspective);
         field!("dimension", &e.dimension);
         field!("intertwine", &e.intertwine);
+        field!("live_paint_gaps", &e.live_paint_gaps);
+        field!("objects_on_path", &e.objects_on_path);
         st.end()
     }
 }
@@ -814,6 +833,10 @@ struct NodeWire {
     dimension: Option<Box<crate::dimension::Dimension>>,
     #[serde(default)]
     intertwine: Option<Box<PathData>>,
+    #[serde(default)]
+    live_paint_gaps: Option<Box<crate::live_paint::GapOptions>>,
+    #[serde(default)]
+    objects_on_path: Option<Box<crate::objects_on_path::ObjectsOnPath>>,
 }
 
 impl From<NodeWire> for Node {
@@ -832,6 +855,8 @@ impl From<NodeWire> for Node {
             perspective: w.perspective,
             dimension: w.dimension,
             intertwine: w.intertwine,
+            live_paint_gaps: w.live_paint_gaps,
+            objects_on_path: w.objects_on_path,
         };
         Node {
             id: w.id,
@@ -1017,6 +1042,7 @@ impl Node {
         match &self.kind {
             NodeKind::Layer { .. } => "Layer",
             NodeKind::Group { clip: true, .. } => "Clip Group",
+            NodeKind::Group { .. } if self.extras().objects_on_path.is_some() => "Objects on Path",
             NodeKind::Group { .. } => "Group",
             NodeKind::Path { live: Some(l), .. } => l.label(),
             NodeKind::Path { guide: true, .. } => "Guide",
@@ -1079,8 +1105,10 @@ impl Node {
     }
     /// A quick box round everything the object can paint, for culling clicks: paths and compound
     /// paths grow their geometric bounds by the farthest their strokes can reach from any path
-    /// ([`Appearance::outset`]) instead of measuring along their shape. Symbol instances are
-    /// measured as in [`Node::visual_bounds`].
+    /// ([`Appearance::outset`]) instead of measuring along their shape. An image's box takes in
+    /// the shapes its own fills and strokes paint ([`crate::hit::set_image_paint`]). Groups, layers
+    /// without a clipping mask and Intertwine groups take in their members' boxes, grown by their
+    /// own strokes. Symbol instances are measured as in [`Node::visual_bounds`].
     pub fn reach_bounds(&self) -> Option<Rect> {
         self.reach(None)
     }
@@ -1098,6 +1126,22 @@ impl Node {
                 let o = self.appearance.outset();
                 self.geometric(symbols).map(|b| b.inflate(o, o))
             }
+            // The members' reach, grown by the container's own strokes.
+            NodeKind::Layer { children, clip: false, .. } | NodeKind::Group { children, clip: false } => {
+                let o = self.appearance.outset();
+                children
+                    .iter()
+                    .skip(usize::from(self.extras().shaper.is_some()))
+                    .fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.reach(symbols)))
+                    .map(|b| b.inflate(o, o))
+            }
+            NodeKind::Intertwine { children } => children.iter().fold(None, |acc, c| vectorcraft_geom::union_opt(acc, c.reach(symbols))),
+            // The frame and each shape the image's own fills and strokes paint, a stroke's grown by
+            // the farthest it can reach from its shape.
+            NodeKind::Image(_) => crate::hit::image_paint(self).iter().fold(self.geometric(symbols), |acc, (bp, _, item)| {
+                let o = if let crate::AppearanceItem::Stroke(s) = item { s.reach() } else { 0.0 };
+                vectorcraft_geom::union_opt(acc, (!bp.elements().is_empty()).then(|| bp.bounding_box().inflate(o, o)))
+            }),
             _ => self.visual(symbols),
         }
     }
@@ -1147,9 +1191,9 @@ impl Node {
         }
     }
     /// Visual bounds: what the object paints, its strokes included (paths and compound paths
-    /// measure theirs along their own shape, see [`Appearance::stroked_bounds`]). A symbol
-    /// instance is measured as in [`Node::geometric_bounds`], grown by its own strokes' reach
-    /// ([`Node::visual_bounds_with`] measures its art).
+    /// measure theirs along their own shape, see [`Appearance::stroked_bounds`]). An image is
+    /// measured by its frame. A symbol instance is measured as in [`Node::geometric_bounds`],
+    /// grown by its own strokes' reach ([`Node::visual_bounds_with`] measures its art).
     pub fn visual_bounds(&self) -> Option<Rect> {
         self.visual(None)
     }
@@ -1217,6 +1261,15 @@ impl Node {
                 let o = self.appearance.outset() + symbols.map_or(0.0, |s| s.brush_pad(symbol));
                 self.projected(Some(b)).map(|b| b.inflate(o, o))
             }
+            NodeKind::Text(t) => {
+                // The characters' strokes paint around the glyphs, scaled with the type.
+                let k = Scaling::factor(t.xf).unwrap_or(1.0);
+                let chars = t.runs.iter().map(|r| r.style.stroke_outset()).fold(0.0, f64::max) * k;
+                let o = self.appearance.outset().max(chars);
+                self.geometric(symbols).map(|b| b.inflate(o, o))
+            }
+            // An image is measured by its frame, without its own fills and strokes.
+            NodeKind::Image(_) => self.geometric(symbols),
             _ => {
                 let o = self.appearance.outset();
                 self.geometric(symbols).map(|b| b.inflate(o, o))
@@ -1236,6 +1289,12 @@ impl Node {
         {
             dimension.transform(a);
         }
+        // The frames of the objects attached to a path move with them.
+        if let Some(e) = self.extras_if_any()
+            && let Some(on_path) = &mut e.objects_on_path
+        {
+            on_path.transform(a);
+        }
         if !self.is_layer() {
             self.bbox_angle = crate::orient::transformed_angle(self.bbox_angle, a);
         }
@@ -1668,11 +1727,11 @@ impl Node {
 
 impl Node {
     /// The Appearance panel's row for what this object's own fills and strokes paint around:
-    /// "Contents" for a group or layer (its members), "Characters" for type; `None` for objects
-    /// whose fills and strokes paint their own geometry.
+    /// "Contents" for a group or layer (its members) and for an image (its pixels), "Characters"
+    /// for type; `None` for objects whose fills and strokes paint their own geometry.
     pub fn contents_label(&self) -> Option<&'static str> {
         match self.kind {
-            NodeKind::Group { .. } | NodeKind::Layer { .. } => Some("Contents"),
+            NodeKind::Group { .. } | NodeKind::Layer { .. } | NodeKind::Image(_) => Some("Contents"),
             NodeKind::Text(_) => Some("Characters"),
             _ => None,
         }
@@ -1699,8 +1758,41 @@ pub struct ObjectAttributes {
     /// `("pivot", "100,180")`), kept from import to export (`object.setProps {data}`).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub data: Vec<(String, String)>,
+    /// Window › SVG Interactivity: the JavaScript each event runs, in the panel's order
+    /// (`("onclick", "alert(1)")`, one entry per event of [`SVG_EVENTS`]). SVG export writes them as
+    /// the element's event attributes; nothing in VectorCraft runs them.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub events: Vec<(String, String)>,
 }
 
+/// The events the SVG Interactivity panel attaches JavaScript to, by the names of the SVG event
+/// attributes that run it.
+pub const SVG_EVENTS: [&str; 19] = [
+    "onfocusin",
+    "onfocusout",
+    "onactivate",
+    "onmousedown",
+    "onmouseup",
+    "onclick",
+    "onmouseover",
+    "onmousemove",
+    "onmouseout",
+    "onkeydown",
+    "onkeypress",
+    "onkeyup",
+    "onload",
+    "onerror",
+    "onabort",
+    "onunload",
+    "onzoom",
+    "onresize",
+    "onscroll",
+];
+
+/// The most JavaScript files a document links (`Document::svg_scripts`): SVG import keeps the
+/// first ones and warns about the rest, and `svgInteractivity.addFile` refuses another.
+pub const MAX_SVG_SCRIPTS: usize = 64;
+
 /// The Attributes panel's Image Map shapes.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
@@ -2015,6 +2107,7 @@ mod tests {
             e.attrs = Some(Box::default());
             e.slice = Some(Box::default());
             e.perspective = Some(Box::new(crate::PerspectiveAttachment::new("left", 1.0)));
+            e.live_paint_gaps = Some(Box::default());
         }
         /// The top-level keys of a JSON object, in the order written.
         struct Keys(Vec<String>);
@@ -2056,6 +2149,7 @@ mod tests {
             "slice",
             "bbox_angle",
             "perspective",
+            "live_paint_gaps",
         ];
         assert_eq!(keys, order);
         assert_eq!(serde_json::from_value::<Node>(v).unwrap(), n);
@@ -2104,6 +2198,24 @@ mod tests {
         assert_eq!(path.label(), "Path");
     }
 
+    /// A polygon read from a file has 3 to 1000 sides, as the commands give it: selecting one
+    /// with four billion made its outline and corner lists allocate tens of gigabytes.
+    #[test]
+    fn a_polygon_from_a_file_has_3_to_1000_sides() {
+        let read = |sides: u32| {
+            let json = serde_json::json!({"shape": "polygon", "radius": 10.0, "sides": sides, "xf": [1, 0, 0, 1, 0, 0]});
+            serde_json::from_value::<LiveShape>(json).unwrap()
+        };
+        let sides_of = |l: &LiveShape| match l {
+            LiveShape::Polygon { sides, .. } => *sides,
+            _ => panic!("not a polygon: {l:?}"),
+        };
+        let huge = read(4_000_000_000);
+        assert_eq!([0, 5, 1000].map(|n| sides_of(&read(n))), [3, 5, 1000]);
+        assert_eq!(sides_of(&huge), 1000);
+        assert_eq!(huge.polygon_outline().anchor_count(), 1000);
+    }
+
     #[test]
     fn a_polygon_reports_and_takes_its_radius_angle_and_equal_sides() {
         let close = |a: f64, b: f64| (a - b).abs() < 1e-9;
@@ -2336,6 +2448,25 @@ mod tests {
         assert_eq!(p.visual_bounds(), Some(Rect::new(-0.5, -0.5, 10.5, 10.5)));
     }
 
+    /// Type's visual bounds grow by how far its character strokes paint past the glyphs: half the
+    /// weight centred, the whole weight outside, nothing inside; scaled with the type.
+    #[test]
+    fn type_visual_bounds_grow_with_the_character_stroke() {
+        use crate::appearance::StrokeAlign;
+        use crate::text::{CharStyle, TextObject};
+        let style = CharStyle { stroke: vectorcraft_color::Paint::solid(vectorcraft_color::Color::BLACK), stroke_width: 4.0, ..Default::default() };
+        let mut t = TextObject::point(vectorcraft_geom::Point::new(0.0, 0.0), "Ab", style);
+        t.xf = Affine::scale(2.0) * t.xf;
+        let node = |t: &TextObject| Node::new(NodeId(1), NodeKind::Text(Box::new(t.clone())));
+        let g = node(&t).geometric_bounds().unwrap();
+        for (align, grow) in [(StrokeAlign::Center, 4.0), (StrokeAlign::Outside, 8.0), (StrokeAlign::Inside, 0.0)] {
+            t.runs[0].style.stroke_align = align;
+            assert_eq!(node(&t).visual_bounds(), Some(g.inflate(grow, grow)), "{align:?}");
+        }
+        t.runs[0].style.stroke = vectorcraft_color::Paint::None;
+        assert_eq!(node(&t).visual_bounds(), Some(g), "no stroke, no growth");
+    }
+
     /// A group holding a path, a compound, an image and a nested group, as a file writes it.
     fn nested_group() -> Node {
         let path = |id| Node::path(NodeId(id), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::default_art());

crates/doc/src/objects_on_path.rs

@@ -0,0 +1,335 @@
+//! Object › Objects on Path: objects attached to a path and spread along it.
+//!
+//! An Objects on Path group is an ordinary group ([`NodeKind::Group`]) with an [`ObjectsOnPath`]
+//! record in its extras ([`crate::node::NodeExtras::objects_on_path`]). One child is the path, and
+//! the other children are the attached objects, kept where they are drawn: the group draws, hits,
+//! saves and exports as a group. The record lists the objects in their order along the path, each
+//! with the frame it is drawn in and the angle that frame is turned by. [`place`] spreads them
+//! evenly along the path from its first anchor (the first object sits on that anchor, and the last
+//! one sits on the end of an open path), puts the attachment point of each one
+//! ([`ObjectsOnPath::pivot`]) on the path, and turns its frame to the path's direction there,
+//! tilted by [`ObjectsOnPath::rotate`].
+//!
+//! Behavior: <https://helpx.adobe.com/illustrator/using/objects-on-path.html>.
+
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+
+use serde::{Deserialize, Serialize};
+use vectorcraft_geom::{Affine, PathData, Point};
+
+use crate::blend::Spine;
+use crate::symbols::SymbolBoxes;
+use crate::{Node, NodeId, NodeKind};
+
+/// The center of the nine reference points.
+pub const CENTER: u8 = 4;
+
+fn center() -> u8 {
+    CENTER
+}
+
+/// What makes a group an Objects on Path group (see the module docs).
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ObjectsOnPath {
+    /// The child of the group that is the path.
+    pub path: NodeId,
+    /// The attached objects, in their order along the path.
+    #[serde(default)]
+    pub members: Vec<Member>,
+    /// Pivot: the reference point of each object that attaches to the path, 0 to 8, row by row
+    /// from the top left of the object's bounds in its frame (4: the center).
+    #[serde(default = "center")]
+    pub pivot: u8,
+    /// Rotate: the counter-clockwise degrees each object is turned from upright on the path. An
+    /// upright object has its frame's x axis along the path's direction at its attachment point.
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    pub rotate: f64,
+}
+
+/// An object attached to the path of an Objects on Path group.
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(from = "MemberWire")]
+pub struct Member {
+    pub id: NodeId,
+    /// The object's frame, mapped to the document: the object's art is drawn in this frame.
+    pub frame: Affine,
+    /// The angle the frame is turned by (radians, the document's axes): the path's direction at
+    /// the object's attachment point plus the tilt from Rotate when it was placed, or the angle of
+    /// the frame's x axis before then.
+    pub angle: f64,
+}
+
+/// A [`Member`] as read from a file: without `angle`, the angle of the frame's x axis.
+#[derive(Deserialize)]
+struct MemberWire {
+    id: NodeId,
+    frame: Affine,
+    #[serde(default)]
+    angle: Option<f64>,
+}
+
+impl From<MemberWire> for Member {
+    fn from(w: MemberWire) -> Self {
+        let angle = w.angle.filter(|a| a.is_finite()).unwrap_or_else(|| x_angle(w.frame));
+        Self { id: w.id, frame: w.frame, angle }
+    }
+}
+
+/// The angle of `frame`'s x axis (radians, the document's axes).
+fn x_angle(frame: Affine) -> f64 {
+    let [a0, a1, ..] = frame.as_coeffs();
+    a1.atan2(a0)
+}
+
+impl Member {
+    /// `n` in its frame as drawn ([`upright_frame`]).
+    pub fn new(n: &Node) -> Self {
+        let frame = upright_frame(n);
+        Self { id: n.id, frame, angle: x_angle(frame) }
+    }
+}
+
+impl ObjectsOnPath {
+    /// A record for the objects `members` (in their order along the path) attached to `path`, each
+    /// in its frame as drawn ([`upright_frame`]).
+    pub fn new(path: NodeId, members: &[&Node], pivot: u8, rotate: f64) -> Self {
+        let members = members.iter().map(|n| Member::new(n)).collect();
+        Self { path, members, pivot: pivot.min(8), rotate: if rotate.is_finite() { rotate } else { 0.0 } }
+    }
+    /// The frames go with the group, and each frame's angle becomes the transformed path's
+    /// direction at the object plus the tilt, so that [`place`] keeps each object's scale, shear
+    /// and reflection when it spreads the objects along the transformed path again. A reflection
+    /// also reverses Rotate: the objects keep the mirrored tilt to the mirrored path.
+    pub fn transform(&mut self, a: Affine) {
+        let before = tilt(self.rotate);
+        if a.determinant() < 0.0 && self.rotate != 0.0 {
+            self.rotate = -self.rotate;
+        }
+        let after = tilt(self.rotate);
+        let [a0, a1, a2, a3, _, _] = a.as_coeffs();
+        for m in &mut self.members {
+            m.frame = a * m.frame;
+            let (sin, cos) = (m.angle - before).sin_cos();
+            let (x, y) = (a0 * cos + a2 * sin, a1 * cos + a3 * sin);
+            if x.is_finite() && y.is_finite() && (x != 0.0 || y != 0.0) {
+                m.angle = y.atan2(x) + after;
+            }
+        }
+    }
+    /// The children given new ids (a copy of the group): the path and the objects by their new ids.
+    pub fn rename(&mut self, ids: &HashMap<NodeId, NodeId>) {
+        let to = |id: NodeId| ids.get(&id).copied().unwrap_or(id);
+        self.path = to(self.path);
+        for m in &mut self.members {
+            m.id = to(m.id);
+        }
+    }
+    /// The group's children changed from `before` to `after`: a new child at the index of a member
+    /// that is gone replaces it (Break Link to Symbol, for one), keeping its place on the path.
+    pub fn follow_replacements(&mut self, before: &[Arc<Node>], after: &[Arc<Node>]) {
+        let now: HashSet<NodeId> = after.iter().map(|c| c.id).collect();
+        let then: HashSet<NodeId> = before.iter().map(|c| c.id).collect();
+        let listed: HashSet<NodeId> = self.members.iter().map(|m| m.id).collect();
+        let mut ids = HashMap::new();
+        for (old, new) in before.iter().zip(after) {
+            if listed.contains(&old.id) && !now.contains(&old.id) && !then.contains(&new.id) && new.id != self.path {
+                ids.insert(old.id, new.id);
+            }
+        }
+        if !ids.is_empty() {
+            self.rename(&ids);
+        }
+    }
+}
+
+/// Is `n` an Objects on Path group?
+pub fn is_objects_on_path(n: &Node) -> bool {
+    matches!(n.kind, NodeKind::Group { .. }) && n.extras().objects_on_path.is_some()
+}
+
+/// The path of `n` if it is a path object an Objects on Path group can attach objects to: a path
+/// (not a guide) whose first subpath has some length.
+pub fn attachable_path(n: &Node) -> Option<&PathData> {
+    match &n.kind {
+        NodeKind::Path { path, guide: false, .. } if Spine::new(path).is_some_and(|s| s.length() > 1e-9) => Some(path),
+        _ => None,
+    }
+}
+
+/// The frame `n` is drawn in when it is attached: the page's axes turned by its rotation
+/// ([`Node::bbox_angle`]) less the nearest multiple of 90°, about the center of its bounds. Placed in
+/// that frame, an object stands square to the path or across it.
+pub fn upright_frame(n: &Node) -> Affine {
+    let a = n.bbox_angle;
+    let off = if a.is_finite() { a - (a / 90.0).round() * 90.0 } else { 0.0 };
+    match n.geometric_bounds() {
+        Some(b) if off.abs() > 1e-9 => Affine::rotate_about(-off.to_radians(), b.center()),
+        _ => Affine::IDENTITY,
+    }
+}
+
+/// Where `n` objects attach along `path` (its first subpath): the point and the direction there
+/// (radians, as `atan2` gives in the document's axes). They are spread evenly by length from the
+/// first anchor: on an open path the last one is at its end, on a closed path the gaps go all the way
+/// around. `None` for a path without length.
+pub fn stops(path: &PathData, n: usize) -> Option<Vec<(Point, f64)>> {
+    let spine = Spine::new(path)?;
+    let len = spine.length();
+    if !len.is_finite() || len <= 1e-9 {
+        return None;
+    }
+    let closed = path.subpaths.first().is_some_and(|s| s.closed);
+    let gaps = if closed { n } else { n.saturating_sub(1) }.max(1);
+    Some((0..n).map(|i| spine.at_length(len * i as f64 / gaps as f64)).collect())
+}
+
+/// The tilt Rotate gives (radians, the document's axes, where y points down): `rotate` degrees
+/// counter-clockwise on the page.
+fn tilt(rotate: f64) -> f64 {
+    -rotate.to_radians()
+}
+
+/// The frame that puts the attachment point `pivot` of `n` (drawn in `m`'s frame) at `at`, turned
+/// by `angle` (radians, the document's axes) instead of `m`'s angle: the frame's own scale, shear
+/// and reflection are kept. Symbol instances are measured by their art (`symbols`).
+fn placed_frame(n: &Node, symbols: &SymbolBoxes, m: &Member, pivot: u8, at: Point, angle: f64) -> Option<Affine> {
+    let det = m.frame.determinant();
+    if !det.is_finite() || det.abs() < 1e-12 || !at.x.is_finite() || !at.y.is_finite() || !angle.is_finite() || !m.angle.is_finite() {
+        return None;
+    }
+    let mut local = n.clone();
+    local.transform(m.frame.inverse(), false);
+    let q = vectorcraft_geom::reference_point(local.geometric_bounds_with(symbols)?, usize::from(pivot.min(8)));
+    let [a0, a1, a2, a3, _, _] = m.frame.as_coeffs();
+    let shape = Affine::rotate(-m.angle) * Affine::new([a0, a1, a2, a3, 0.0, 0.0]);
+    Some(Affine::translate(at.to_vec2()) * Affine::rotate(angle) * shape * Affine::translate(-q.to_vec2()))
+}
+
+/// Is `a` the identity, give or take rounding?
+fn negligible(a: Affine) -> bool {
+    let [a0, a1, a2, a3, a4, a5] = a.as_coeffs();
+    (a0 - 1.0).abs() < 1e-9 && a1.abs() < 1e-9 && a2.abs() < 1e-9 && (a3 - 1.0).abs() < 1e-9 && a4.abs() < 1e-6 && a5.abs() < 1e-6
+}
+
+/// Put the objects of Objects on Path group `g` on its path (see the module docs). Before that, the
+/// record lets go of the objects that are no longer in the group, and children it does not list
+/// (other than the path) join it at the end of the path. A group whose path is gone, or is no
+/// longer a path object, becomes a plain group. Symbol instances are measured by their art
+/// (`symbols`, from the document the group is in). Returns whether `g` changed.
+pub fn place(g: &mut Node, symbols: &SymbolBoxes) -> bool {
+    let Some(mut rec) = g.extras().objects_on_path.as_deref().cloned() else { return false };
+    let old = rec.clone();
+    let NodeKind::Group { children, .. } = &mut g.kind else { return false };
+    let path_id = rec.path;
+    let Some(path) = children.iter().find(|c| c.id == path_id).filter(|c| matches!(c.kind, NodeKind::Path { .. })) else {
+        g.extras_mut().objects_on_path = None;
+        return true;
+    };
+    let path = attachable_path(path).cloned();
+    let at: HashMap<NodeId, usize> = children.iter().enumerate().map(|(i, c)| (c.id, i)).collect();
+    rec.members.retain(|m| m.id != path_id && at.contains_key(&m.id));
+    let mut listed: HashSet<NodeId> = rec.members.iter().map(|m| m.id).collect();
+    for c in children.iter() {
+        if c.id != path_id && listed.insert(c.id) {
+            rec.members.push(Member::new(c));
+        }
+    }
+    let mut moved = false;
+    if let Some(stops) = path.and_then(|p| stops(&p, rec.members.len())) {
+        let turn = tilt(rec.rotate);
+        for (m, (p, dir)) in rec.members.iter_mut().zip(stops) {
+            let Some(c) = at.get(&m.id).and_then(|i| children.get_mut(*i)) else { continue };
+            let Some(next) = placed_frame(c, symbols, m, rec.pivot, p, dir + turn) else { continue };
+            let delta = next * m.frame.inverse();
+            if !negligible(delta) {
+                Arc::make_mut(c).transform(delta, false);
+                *m = Member { id: m.id, frame: next, angle: dir + turn };
+                moved = true;
+            }
+        }
+    }
+    if rec != old {
+        g.extras_mut().objects_on_path = Some(Box::new(rec));
+        return true;
+    }
+    moved
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use vectorcraft_geom::{Rect, shapes};
+
+    fn rect(id: u64, r: Rect) -> Node {
+        Node::path(NodeId(id), shapes::rectangle(r), Default::default())
+    }
+
+    #[test]
+    fn stops_spread_from_the_first_anchor() {
+        let open = shapes::line(Point::new(0.0, 0.0), Point::new(300.0, 0.0));
+        let s = stops(&open, 4).unwrap();
+        let xs: Vec<f64> = s.iter().map(|(p, _)| p.x.round()).collect();
+        assert_eq!(xs, [0.0, 100.0, 200.0, 300.0], "first at the start, last at the end of an open path");
+        let closed = shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0));
+        let s = stops(&closed, 4).unwrap();
+        let mut pts: Vec<(i64, i64)> = s.iter().map(|(p, _)| (p.x.round() as i64, p.y.round() as i64)).collect();
+        pts.sort();
+        assert_eq!(pts, [(0, 0), (0, 100), (100, 0), (100, 100)], "a closed path spreads them all the way round");
+        assert!(stops(&shapes::line(Point::ZERO, Point::ZERO), 2).is_none());
+    }
+
+    #[test]
+    fn upright_frames_round_the_rotation_to_a_right_angle() {
+        let mut n = rect(1, Rect::new(0.0, 0.0, 10.0, 10.0));
+        assert_eq!(upright_frame(&n), Affine::IDENTITY);
+        n.bbox_angle = 90.0;
+        assert_eq!(upright_frame(&n), Affine::IDENTITY);
+        n.bbox_angle = 30.0;
+        let f = upright_frame(&n);
+        let [a0, a1, ..] = f.as_coeffs();
+        assert!((a1.atan2(a0).to_degrees() + 30.0).abs() < 1e-9, "a frame turned 30° counter-clockwise");
+    }
+
+    #[test]
+    fn a_symbol_instance_is_placed_by_its_art() {
+        // The art is a 40 × 10 box to the right of and below the origin, not the 20 × 20 square
+        // around it that instances are measured by without the symbols.
+        let mut d = crate::Document::new(400.0, 400.0);
+        d.symbols.push(crate::Symbol { name: "Bar".into(), art: Arc::new(rect(9, Rect::new(0.0, 0.0, 40.0, 10.0))) });
+        let line = Node::path(NodeId(1), shapes::line(Point::new(100.0, 300.0), Point::new(300.0, 300.0)), Default::default());
+        let instance = Node::new(NodeId(2), NodeKind::SymbolInstance { symbol: "Bar".into(), xf: Affine::IDENTITY });
+        let other = rect(3, Rect::new(0.0, 0.0, 10.0, 10.0));
+        let members = [&instance, &other];
+        let mut g = Node::new(
+            NodeId(4),
+            NodeKind::Group { children: vec![Arc::new(line), Arc::new(instance.clone()), Arc::new(other.clone())], clip: false },
+        );
+        g.extras_mut().objects_on_path = Some(Box::new(ObjectsOnPath::new(NodeId(1), &members, 7, 0.0)));
+        let symbols = d.symbol_boxes();
+        assert!(place(&mut g, &symbols));
+        let placed = g.children().and_then(|c| c.iter().find(|c| c.id == NodeId(2)).cloned()).unwrap();
+        let b = placed.geometric_bounds_with(&symbols).unwrap();
+        assert!((b.y1 - 300.0).abs() < 1e-9 && (b.center().x - 100.0).abs() < 1e-9, "the art's bottom middle on the start: {b:?}");
+    }
+
+    #[test]
+    fn a_member_saved_without_its_angle_reads_the_angle_of_its_frame() {
+        let m = Member { id: NodeId(2), frame: Affine::rotate(0.5), angle: 0.5 };
+        let mut v = serde_json::to_value(m).unwrap();
+        assert_eq!(serde_json::from_value::<Member>(v.clone()).unwrap(), m);
+        v.as_object_mut().unwrap().remove("angle");
+        let back: Member = serde_json::from_value(v).unwrap();
+        assert!((back.angle - 0.5).abs() < 1e-12, "{back:?}");
+    }
+
+    #[test]
+    fn a_group_without_its_path_is_a_plain_group() {
+        let a = rect(2, Rect::new(0.0, 0.0, 10.0, 10.0));
+        let mut g = Node::new(NodeId(3), NodeKind::Group { children: vec![Arc::new(a.clone())], clip: false });
+        g.extras_mut().objects_on_path = Some(Box::new(ObjectsOnPath::new(NodeId(1), &[&a], CENTER, 0.0)));
+        let d = crate::Document::new(100.0, 100.0);
+        assert!(place(&mut g, &d.symbol_boxes()));
+        assert!(!is_objects_on_path(&g));
+    }
+}

crates/doc/src/overprint.rs

@@ -94,26 +94,27 @@ impl Node {
     }
 }
 
-/// Draw the overprinting fills and strokes of `a`'s subtree with Multiply (those with a blend
+/// Draw the overprinting fills and strokes of `a`'s subtree with Darken (those with a blend
 /// mode of their own keep it), copying only the nodes on the way to them: on screen and on a
-/// printed plate this approximates their inks printing over the inks below. With `discard_white`
+/// printed plate this approximates their inks printing over the inks below. Darken keeps the
+/// stronger ink of each plate (and each additive channel), so a colour overprinting itself stays
+/// that colour, where Multiply would darken it. With `discard_white`
 /// (Document Setup → Discard White Overprint) white fills and strokes knock out instead.
-pub fn multiply_overprints(a: &mut Arc<Node>, discard_white: bool) {
+pub fn darken_overprints(a: &mut Arc<Node>, discard_white: bool) {
     if !a.has_overprint() {
         return;
     }
     let n = Arc::make_mut(a);
-    let multiplies =
-        |overprint: bool, blend: BlendMode, paint: &Paint| overprint && blend == BlendMode::Normal && !(discard_white && is_white(paint));
+    let darkens = |overprint: bool, blend: BlendMode, paint: &Paint| overprint && blend == BlendMode::Normal && !(discard_white && is_white(paint));
     for it in &mut n.appearance.items {
         match it {
-            crate::AppearanceItem::Fill(l) if multiplies(l.overprint, l.blend, &l.paint) => l.blend = BlendMode::Multiply,
-            crate::AppearanceItem::Stroke(l) if multiplies(l.overprint, l.blend, &l.paint) => l.blend = BlendMode::Multiply,
+            crate::AppearanceItem::Fill(l) if darkens(l.overprint, l.blend, &l.paint) => l.blend = BlendMode::Darken,
+            crate::AppearanceItem::Stroke(l) if darkens(l.overprint, l.blend, &l.paint) => l.blend = BlendMode::Darken,
             _ => {}
         }
     }
     for c in n.children_mut().into_iter().flatten() {
-        multiply_overprints(c, discard_white);
+        darken_overprints(c, discard_white);
     }
 }
 

crates/doc/src/pattern.rs

@@ -248,9 +248,20 @@ impl PatternDef {
         let ab = self.art_bounds().unwrap_or(self.tile).union(self.tile) - self.tile.origin().to_vec2();
         let (sx, sy) = self.tile_type.steps(w, h);
         // Shifts of brick/hex rows or columns are < one tile.
-        let (i0, i1) = (((region.x0 - ab.x1 - w) / sx).floor() as i64 - 1, ((region.x1 - ab.x0 + w) / sx).ceil() as i64 + 1);
-        let (j0, j1) = (((region.y0 - ab.y1 - h) / sy).floor() as i64 - 1, ((region.y1 - ab.y0 + h) / sy).ceil() as i64 + 1);
-        if (i1 - i0).saturating_mul(j1 - j0) > 250_000 {
+        // A region whose tile indices do not fit in integers (or are not finite) gives none, as does
+        // one with more than 250,000 positions or none.
+        let index = |v: f64| (v.abs() < 9.0e18).then_some(v as i64);
+        let (Some(i0), Some(i1), Some(j0), Some(j1)) = (
+            index(((region.x0 - ab.x1 - w) / sx).floor()),
+            index(((region.x1 - ab.x0 + w) / sx).ceil()),
+            index(((region.y0 - ab.y1 - h) / sy).floor()),
+            index(((region.y1 - ab.y0 + h) / sy).ceil()),
+        ) else {
+            return vec![];
+        };
+        let (i0, i1, j0, j1) = (i0 - 1, i1 + 1, j0 - 1, j1 + 1);
+        let (ni, nj) = (i1.saturating_sub(i0), j1.saturating_sub(j0));
+        if ni < 1 || nj < 1 || ni.saturating_mul(nj) > 250_000 {
             return vec![];
         }
         let mut out = vec![];
@@ -282,8 +293,15 @@ impl PatternDef {
         out
     }
     /// Instances covering `region` (document space) as plain nodes for a pattern painted with
-    /// `paint_xf` (pattern space → document), fresh-id-less (id 0). Used by exporters and Expand.
+    /// `paint_xf` (pattern space → document), fresh-id-less (id 0). Used by exporters and Distort
+    /// Pattern Fills; Expand uses [`Self::instances_in_with`].
     pub fn instances_in(&self, paint_xf: Affine, region: Rect) -> Vec<Node> {
+        self.instances_in_with(paint_xf, region, false)
+    }
+    /// [`Self::instances_in`], each instance placed with `scaling` (what scales with `paint_xf`
+    /// besides geometry).
+    pub fn instances_in_with(&self, paint_xf: Affine, region: Rect, scaling: impl Into<crate::node::Scaling>) -> Vec<Node> {
+        let scaling = scaling.into();
         let inv = paint_xf.inverse();
         let pr = inv.transform_rect_bbox(region);
         let mut out = vec![];
@@ -291,7 +309,7 @@ impl PatternDef {
             let m = paint_xf * self.instance_xf(o);
             for a in &self.art {
                 let mut n = (**a).clone();
-                n.transform(m, false);
+                place_art(&mut n, m, scaling);
                 zero_ids(&mut n);
                 out.push(n);
             }
@@ -300,6 +318,31 @@ impl PatternDef {
     }
 }
 
+/// Transform pattern art `n` by `m` with `scaling`, as a pattern places its art: the opacity masks
+/// in it move with it, unlinked ones included (the canvas draws a tile's art and masks together).
+pub fn place_art(n: &mut Node, m: Affine, scaling: impl Into<crate::node::Scaling>) {
+    let scaling = scaling.into();
+    n.transform(m, scaling);
+    place_unlinked_masks(n, m, scaling);
+}
+
+/// Transform the art of the unlinked opacity masks of `n` and its descendants by `m`, the masks
+/// inside mask art included.
+fn place_unlinked_masks(n: &mut Node, m: Affine, scaling: crate::node::Scaling) {
+    if let Some(mask) = n.extras_if_any().and_then(|e| e.mask.as_mut()) {
+        let linked = mask.linked;
+        let art = Arc::make_mut(&mut mask.art);
+        // A linked mask's art moved with `n`; an unlinked one's moves here.
+        if !linked {
+            art.transform(m, scaling);
+        }
+        place_unlinked_masks(art, m, scaling);
+    }
+    for c in n.children_mut().into_iter().flatten() {
+        place_unlinked_masks(Arc::make_mut(c), m, scaling);
+    }
+}
+
 fn zero_ids(n: &mut Node) {
     n.id = NodeId(0);
     if let Some(ch) = n.children_mut() {
@@ -670,6 +713,18 @@ mod tests {
         assert!(close(*d2.offsets_covering(Rect::new(0.0, 0.0, 30.0, 20.0)).last().unwrap(), Vec2::new(20.0, 10.0)));
     }
 
+    #[test]
+    fn a_region_too_large_to_count_has_no_offsets() {
+        // A pattern scaled by 1e-20 covers a 100 pt square with a region of 1e22 pt.
+        let def = PatternDef::new("p", vec![sq(0.0, 0.0, 10.0)]);
+        assert!(def.offsets_covering(Rect::new(-1e22, -1e22, 1e22, 1e22)).is_empty());
+        assert!(def.offsets_covering(Rect::new(f64::NEG_INFINITY, 0.0, f64::INFINITY, 10.0)).is_empty());
+        // Far out, a region one tile wide and 1e12 pt tall still counts its rows.
+        assert!(def.offsets_covering(Rect::new(1e18, 0.0, 1e18, 1e12)).is_empty());
+        let tiny = Affine::scale(1e-20);
+        assert!(def.instances_in(tiny, Rect::new(0.0, 0.0, 100.0, 100.0)).is_empty());
+    }
+
     #[test]
     fn instances_follow_paint_xf() {
         let def = PatternDef::new("p", vec![sq(100.0, 100.0, 10.0)]);
@@ -679,6 +734,33 @@ mod tests {
         assert!(n.iter().all(|n| n.id == NodeId(0)));
     }
 
+    #[test]
+    fn instances_carry_unlinked_masks_with_them() {
+        let mut art = (*sq(100.0, 100.0, 10.0)).clone();
+        let mut mask = crate::node::OpacityMask::new((*sq(100.0, 100.0, 5.0)).clone(), true);
+        mask.linked = false;
+        art.extras_mut().mask = Some(Box::new(mask));
+        let def = PatternDef::new("p", vec![Arc::new(art)]);
+        for n in def.instances_in(Affine::translate((3.0, 0.0)), Rect::new(0.0, 0.0, 20.0, 10.0)) {
+            let (b, m) = (n.geometric_bounds().unwrap(), n.extras().mask.as_ref().unwrap());
+            assert_eq!(m.art.geometric_bounds().unwrap().origin(), b.origin(), "the mask moves with its art");
+            assert!(!m.linked, "the mask stays unlinked");
+        }
+        // An unlinked mask inside a linked mask's art moves too.
+        let mut inner = (*sq(100.0, 100.0, 5.0)).clone();
+        let mut nested = crate::node::OpacityMask::new((*sq(100.0, 100.0, 2.0)).clone(), true);
+        nested.linked = false;
+        inner.extras_mut().mask = Some(Box::new(nested));
+        let mut art = (*sq(100.0, 100.0, 10.0)).clone();
+        art.extras_mut().mask = Some(Box::new(crate::node::OpacityMask::new(inner, true)));
+        let def = PatternDef::new("p", vec![Arc::new(art)]);
+        for n in def.instances_in(Affine::translate((3.0, 0.0)), Rect::new(0.0, 0.0, 20.0, 10.0)) {
+            let outer = n.extras().mask.as_ref().unwrap();
+            let nested = outer.art.extras().mask.as_ref().unwrap();
+            assert_eq!(nested.art.geometric_bounds().unwrap().origin(), n.geometric_bounds().unwrap().origin());
+        }
+    }
+
     #[test]
     fn preview_offsets_count() {
         let mut def = PatternDef::new("p", vec![sq(0.0, 0.0, 10.0)]);

crates/doc/src/pixels.rs

@@ -11,15 +11,20 @@ use crate::ImageBlob;
 /// address and aborts when an allocation fails, so it keeps the decoder's own 512 MB.
 pub const MAX_RASTER_ALLOC: u64 = if cfg!(target_arch = "wasm32") { 512 << 20 } else { 2 << 30 };
 
-/// The pixels of encoded image `bytes` as RGBA; `None` when they can't be decoded or would take
-/// more than `max` bytes as RGBA. The size is read from the header first: the decoder's own limit
-/// is on the file's samples, and a grey image is a quarter of what it becomes here (#1717).
+/// The pixels of encoded image `bytes` as RGBA; `None` when they can't be decoded, would take
+/// more than `max` bytes as RGBA, or need more than `max` bytes to decode. The size is read from
+/// the header first: the decoder's limit is on the file's samples, and a gray image is a quarter
+/// of what it becomes here (#1717).
 fn rgba_within(bytes: &[u8], max: u64) -> Option<image::RgbaImage> {
     let (w, h) = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().ok()?.into_dimensions().ok()?;
-    if u64::from(w) * u64::from(h) * 4 > max {
+    if u64::from(w) * u64::from(h) > max / 4 {
         return None;
     }
-    Some(image::load_from_memory(bytes).ok()?.to_rgba8())
+    let mut reader = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().ok()?;
+    let mut limits = image::Limits::default();
+    limits.max_alloc = Some(max);
+    reader.limits(limits);
+    Some(reader.decode().ok()?.into_rgba8())
 }
 
 impl ImageBlob {
@@ -74,6 +79,59 @@ impl ImageBlob {
         sample_pixels(&img, x * k(img.width(), object.0), y * k(img.height(), object.1), size)
     }
 
+    /// The colours of a `rows` × `cols` mesh laid over the image: `(rows + 1) * (cols + 1)` straight
+    /// RGBA samples, row-major, one per grid line crossing (row 0 is the top). Each is the
+    /// alpha-weighted average of the area around the crossing, one grid cell wide and high (a
+    /// quarter of each of the neighbouring cells), not a single pixel. A crossing over transparent
+    /// pixels gets their average colour at alpha 0. `None` when `rows` or `cols` is 0 or the
+    /// image can't be decoded.
+    pub fn grid_samples(&self, rows: u32, cols: u32) -> Option<Vec<[u8; 4]>> {
+        if rows == 0 || cols == 0 {
+            return None;
+        }
+        let img = self.decoded()?;
+        let (w, h) = (img.width() as usize, img.height() as usize);
+        if w == 0 || h == 0 {
+            return None;
+        }
+        // The pixel columns [from, to) around grid line `i` of `n`, at least one pixel wide.
+        let span = |i: u32, n: u32, len: usize| {
+            let at = |k: f64| (k / n as f64 * len as f64).round().clamp(0.0, len as f64) as usize;
+            let (from, to) = (at(i as f64 - 0.5), at(i as f64 + 0.5));
+            let from = from.min(len - 1);
+            (from, to.max(from + 1))
+        };
+        let mut out = Vec::with_capacity((rows as usize + 1) * (cols as usize + 1));
+        for r in 0..=rows {
+            let (y0, y1) = span(r, rows, h);
+            for c in 0..=cols {
+                let (x0, x1) = span(c, cols, w);
+                let (mut sum, mut plain, mut alpha, mut n) = ([0u64; 3], [0u64; 3], 0u64, 0u64);
+                for y in y0..y1 {
+                    for x in x0..x1 {
+                        let [pr, pg, pb, pa] = img.get_pixel(x as u32, y as u32).0;
+                        let a = pa as u64;
+                        for (k, v) in [pr, pg, pb].into_iter().enumerate() {
+                            sum[k] += v as u64 * a;
+                            plain[k] += v as u64;
+                        }
+                        alpha += a;
+                        n += 1;
+                    }
+                }
+                let n = n.max(1);
+                out.push(if alpha == 0 {
+                    let m = |k: usize| ((plain[k] + n / 2) / n) as u8;
+                    [m(0), m(1), m(2), 0]
+                } else {
+                    let m = |k: usize| ((sum[k] + alpha / 2) / alpha) as u8;
+                    [m(0), m(1), m(2), ((alpha + n / 2) / n) as u8]
+                });
+            }
+        }
+        Some(out)
+    }
+
     /// The decoded pixels (the last image decoded is kept for the next sample).
     fn decoded(&self) -> Option<Arc<image::RgbaImage>> {
         thread_local! {
@@ -131,6 +189,35 @@ mod tests {
         image::load_from_memory(&b.bytes).unwrap().to_rgba8().pixels().map(|p| p.0).collect()
     }
 
+    /// A GIF whose `w` × `h` screen holds one opaque red pixel at the top left. The file holds no
+    /// other pixels, and the decoder makes them transparent.
+    fn gif_with_one_red_pixel(w: u16, h: u16) -> Vec<u8> {
+        let mut gif = b"GIF89a".to_vec();
+        gif.extend_from_slice(&w.to_le_bytes());
+        gif.extend_from_slice(&h.to_le_bytes());
+        // Flags for a global color table of two colors, the background and aspect bytes, then the
+        // table: red and black.
+        gif.extend_from_slice(&[0x80, 0, 0, 255, 0, 0, 0, 0, 0]);
+        // A 1 × 1 image at (0, 0), its LZW data (clear, color 0, end), and the end of the file.
+        gif.extend_from_slice(&[0x2C, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2, 2, 0x44, 0x01, 0, 0x3B]);
+        gif
+    }
+
+    /// The pixels are decoded within the allowance, not within the decoder's own 512 MB: an RGBA
+    /// image of 11,586 × 11,586 pixels (536,941,584 bytes) is recolored and sampled.
+    #[test]
+    fn pixels_past_the_decoders_own_limit_are_decoded_within_the_allowance() {
+        let (w, h) = (11_586, 11_586);
+        let rgba = u64::from(w) * u64::from(h) * 4;
+        assert!(rgba > 512 << 20);
+        let gif = gif_with_one_red_pixel(w, h);
+        assert!(rgba_within(&gif, rgba - 1).is_none(), "past the allowance");
+        let b = ImageBlob::new("image/gif", gif);
+        assert!(b.map_rgb(|[r, g, bl]| [bl, g, r]).is_some(), "red becomes blue");
+        assert_eq!(b.sample(0.5, 0.5, 1), Some([255, 0, 0, 255]));
+        assert_eq!(b.sample(f64::from(w) - 0.5, f64::from(h) - 0.5, 1), None, "transparent");
+    }
+
     /// #1717: the RGBA size is checked from the header, before anything is decoded: a grey image
     /// the decoder's own limit lets through is four times that as RGBA.
     #[test]
@@ -143,6 +230,38 @@ mod tests {
         assert!(rgba_within(b"not an image", u64::MAX).is_none());
     }
 
+    /// A little-endian TIFF whose header gives `w` × `h` 8-bit gray pixels in one strip. The file holds
+    /// no pixel data.
+    fn tiff_header(w: u32, h: u32) -> Vec<u8> {
+        let mut out = b"II*\0".to_vec();
+        out.extend(8u32.to_le_bytes());
+        // Each entry is (tag, type: 3 SHORT or 4 LONG, value) and holds one value.
+        let entries: [(u16, u16, u32); 9] =
+            [(256, 4, w), (257, 4, h), (258, 3, 8), (259, 3, 1), (262, 3, 1), (273, 4, 8), (277, 3, 1), (278, 4, h), (279, 4, 0)];
+        out.extend((entries.len() as u16).to_le_bytes());
+        for (tag, kind, value) in entries {
+            out.extend(tag.to_le_bytes());
+            out.extend(kind.to_le_bytes());
+            out.extend(1u32.to_le_bytes());
+            out.extend(value.to_le_bytes());
+        }
+        out.extend(0u32.to_le_bytes());
+        out
+    }
+
+    /// A TIFF's sides go up to 2^32 - 1 pixels: a size whose RGBA bytes don't fit in 64 bits is
+    /// refused like any other past the allowance, and an image within the allowance still decodes.
+    #[test]
+    fn a_size_past_64_bits_as_rgba_is_not_decoded() {
+        let huge = tiff_header(1 << 31, 1 << 31);
+        assert!(rgba_within(&huge, MAX_RASTER_ALLOC).is_none());
+        assert!(rgba_within(&huge, u64::MAX).is_none());
+        let gray = image::GrayImage::from_raw(4, 2, vec![7; 8]).unwrap();
+        let mut png = Vec::new();
+        gray.write_to(&mut Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        assert_eq!(rgba_within(&png, 35).map(|i| i.dimensions()), Some((4, 2)), "32 bytes as RGBA, within 35");
+    }
+
     #[test]
     fn samples_a_pixel_or_the_average_around_it() {
         let b = blob(&[[255, 0, 0, 255], [0, 255, 0, 255], [0, 0, 255, 255], [9, 9, 9, 0]], 4, 1);

crates/doc/src/placed_document.rs

@@ -430,7 +430,7 @@ fn art_id() -> crate::NodeId {
 }
 
 /// Visit `n` and every descendant (opacity-mask art included) mutably.
-fn each_mut(n: &mut Node, f: &mut impl FnMut(&mut Node)) {
+pub(crate) fn each_mut(n: &mut Node, f: &mut impl FnMut(&mut Node)) {
     f(n);
     if let Some(m) = n.extras_if_any().and_then(|e| e.mask.as_mut()) {
         each_mut(Arc::make_mut(&mut m.art), f);

crates/doc/src/selection.rs

@@ -43,6 +43,11 @@ pub struct Selection {
     /// guides and objects can be selected together, in either order.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub guides: Vec<usize>,
+    /// A selected ruler guide that is the key object for Align instead of [`Self::key`] (an index
+    /// into [`Document::guides`], one of [`Self::guides`]): the objects line up on it. Never set
+    /// with `key`; [`Self::prune`] clears it when no object is selected to align to it.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub key_guide: Option<usize>,
 }
 
 impl Selection {
@@ -67,6 +72,11 @@ impl Selection {
         self.target = None;
         self.slices.clear();
         self.guides.clear();
+        self.key_guide = None;
+    }
+    /// Is there a key for Align: an object or a guide?
+    pub fn has_key(&self) -> bool {
+        self.key.is_some() || self.key_guide.is_some()
     }
     pub fn set(&mut self, ids: impl IntoIterator<Item = NodeId>) {
         self.clear();
@@ -114,6 +124,9 @@ impl Selection {
     pub fn toggle_guide(&mut self, i: usize) {
         if let Some(k) = self.guides.iter().position(|g| *g == i) {
             self.guides.remove(k);
+            if self.key_guide == Some(i) {
+                self.key_guide = None;
+            }
         } else {
             self.guides.push(i);
         }
@@ -162,13 +175,16 @@ impl Selection {
             refs.retain(|&(si, seg)| path.subpaths.get(si).is_some_and(|sp| seg < sp.segment_count()));
             !refs.is_empty() && self.objects.contains(id) && self.anchors.contains_key(id)
         });
-        // The key object stays while another selected object lies outside it.
+        // Guides on a hidden or locked layer can't stay selected.
+        self.guides.retain(|i| doc.guides.get(*i).is_some_and(|g| doc.guide_editable(g)));
+        // The key object stays while another selected object lies outside it, or while ruler
+        // guides are selected for it to line up (#2143).
         let keep = self.key.and_then(|k| found.get(&k)).and_then(|p| doc.node_at(p)).is_some_and(|n| {
             let mut inside = BTreeSet::new();
             n.walk(&mut |c| {
                 inside.insert(c.id);
             });
-            self.objects.iter().any(|o| !inside.contains(o))
+            self.objects.iter().any(|o| !inside.contains(o)) || (self.objects.contains(&n.id) && !self.guides.is_empty())
         });
         if !keep {
             self.key = None;
@@ -177,8 +193,10 @@ impl Selection {
             self.target = None;
         }
         self.slices.retain(|id| doc.is_slice(*id));
-        // Guides on a hidden or locked layer can't stay selected.
-        self.guides.retain(|i| doc.guides.get(*i).is_some_and(|g| doc.guide_editable(g)));
+        // A key guide needs objects to line up on it, and stays selected.
+        if self.key.is_some() || self.objects.is_empty() || self.key_guide.is_some_and(|k| !self.guides.contains(&k)) {
+            self.key_guide = None;
+        }
     }
     /// Deselect the objects that are hidden or locked, themselves or through a group or layer
     /// around them (and so the key object when it is one): hidden or locked art can't stay

crates/doc/src/setup.rs

@@ -192,6 +192,16 @@ impl Background {
 
 /// Largest bleed on any side, in points (1 inch).
 pub const MAX_BLEED: f64 = 72.0;
+/// Largest superscript or subscript size, and the farthest its baseline moves either way, in
+/// percent of the font size.
+pub const MAX_SCRIPT: f64 = 500.0;
+/// Largest synthesized small capitals size, in percent of the font size.
+pub const MAX_SMALL_CAPS: f64 = 200.0;
+
+/// Returns `bleed` with each side kept to 0–[`MAX_BLEED`] points; a side that isn't finite becomes 0.
+pub fn bleed_in_range(bleed: [f64; 4]) -> [f64; 4] {
+    bleed.map(|b| if b.is_finite() { b.clamp(0.0, MAX_BLEED) } else { 0.0 })
+}
 
 /// File → Document Setup.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -274,6 +284,18 @@ impl DocSetup {
     pub fn flattener(&self) -> &str {
         self.flattener_preset.as_deref().unwrap_or(DEFAULT_FLATTENER)
     }
+    /// Moves the bleed and the type proportions into the ranges Document Setup takes, each to the
+    /// nearer end: the bleed by [`bleed_in_range`], superscript and subscript sizes to
+    /// 1–[`MAX_SCRIPT`] and positions to ±[`MAX_SCRIPT`], the small caps size to
+    /// 1–[`MAX_SMALL_CAPS`].
+    pub fn keep_in_range(&mut self) {
+        self.bleed = bleed_in_range(self.bleed);
+        for m in [&mut self.superscript, &mut self.subscript] {
+            m.size = m.size.clamp(1.0, MAX_SCRIPT);
+            m.position = m.position.clamp(-MAX_SCRIPT, MAX_SCRIPT);
+        }
+        self.small_caps_size = self.small_caps_size.clamp(1.0, MAX_SMALL_CAPS);
+    }
 }
 
 #[cfg(test)]

crates/doc/src/symbol_export_type.rs

@@ -0,0 +1,49 @@
+//! Symbol Options › Export Type: Graphic or Movie Clip
+//! ([helpx Symbol Options](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/create-and-place-symbols.html)).
+//!
+//! For Illustrator-only work the choice has no canvas effect; it is kept for Animate / Flash /
+//! HTML5 handoff. Illustrator's default is Movie Clip. Stored under [`SYMBOL_EXPORT_TYPE`] keyed
+//! by symbol name; the default (Movie Clip) is omitted from the map.
+
+use serde_json::Value;
+
+/// Document unknown key: `{ symbolName: "graphic"|"movieClip" }`.
+pub const SYMBOL_EXPORT_TYPE: &str = "symbolExportType";
+
+/// Symbol Options › Export Type.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum SymbolExportType {
+    /// Static / graphic symbol instance (Animate Graphic).
+    Graphic,
+    /// Default: Movie Clip for Animate / game handoff; instances still place the same on the canvas.
+    #[default]
+    MovieClip,
+}
+
+impl SymbolExportType {
+    pub const IDS: [&'static str; 2] = ["movieClip", "graphic"];
+
+    pub fn id(self) -> &'static str {
+        match self {
+            Self::Graphic => "graphic",
+            Self::MovieClip => "movieClip",
+        }
+    }
+
+    pub fn from_id(s: &str) -> Option<Self> {
+        match s {
+            "graphic" => Some(Self::Graphic),
+            "movieClip" => Some(Self::MovieClip),
+            _ => None,
+        }
+    }
+
+    /// True when this is the document default (nothing stored for the symbol).
+    pub fn is_default(self) -> bool {
+        matches!(self, Self::MovieClip)
+    }
+
+    pub fn from_value(v: &Value) -> Option<Self> {
+        v.as_str().and_then(Self::from_id)
+    }
+}

crates/doc/src/symbol_nine_slice.rs

@@ -0,0 +1,57 @@
+//! Symbol Options › Enable Guides for 9-Slice Scaling: four guides that cut a symbol into a 3 × 3
+//! grid so that, in Animate / Flash handoff, the corners keep their size while the edges and the
+//! centre stretch
+//! ([helpx Symbol Options](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/create-and-place-symbols.html)).
+//!
+//! The guides are stored as fractions (0..1) of the symbol's natural size, measured from the left
+//! and top edges and from the right and bottom edges, so they survive resizing the art. Like
+//! [`crate::SymbolExportType`] this is handoff metadata: instances place the same on the canvas.
+//! Stored under [`SYMBOL_NINE_SLICE`] keyed by symbol name; symbols without 9-slice have no entry.
+
+use serde_json::{Value, json};
+
+/// Document unknown key: `{ symbolName: [left, top, right, bottom] }`.
+pub const SYMBOL_NINE_SLICE: &str = "symbolNineSlice";
+
+/// The four 9-slice guides as fractions of the symbol's natural size.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct SymbolNineSlice {
+    /// Left guide, from the left edge.
+    pub left: f64,
+    /// Top guide, from the top edge.
+    pub top: f64,
+    /// Right guide, from the right edge.
+    pub right: f64,
+    /// Bottom guide, from the bottom edge.
+    pub bottom: f64,
+}
+
+impl Default for SymbolNineSlice {
+    /// The centre third of each axis is the stretchy cell.
+    fn default() -> Self {
+        let t = 1.0 / 3.0;
+        Self { left: t, top: t, right: t, bottom: t }
+    }
+}
+
+impl SymbolNineSlice {
+    /// Guides from `[left, top, right, bottom]`; `None` unless each is finite, within 0..1, and the
+    /// two on each axis leave a gap between them.
+    pub fn new(left: f64, top: f64, right: f64, bottom: f64) -> Option<Self> {
+        let ok = |v: f64| v.is_finite() && (0.0..=1.0).contains(&v);
+        (ok(left) && ok(top) && ok(right) && ok(bottom) && left + right < 1.0 && top + bottom < 1.0).then_some(Self { left, top, right, bottom })
+    }
+
+    pub fn to_value(self) -> Value {
+        json!([self.left, self.top, self.right, self.bottom])
+    }
+
+    pub fn from_value(v: &Value) -> Option<Self> {
+        let a = v.as_array()?;
+        let n = |i: usize| a.get(i).and_then(Value::as_f64);
+        if a.len() != 4 {
+            return None;
+        }
+        Self::new(n(0)?, n(1)?, n(2)?, n(3)?)
+    }
+}

crates/doc/src/tests_units.rs

@@ -98,6 +98,13 @@ fn units_are_named_by_label_key_or_suffix() {
     assert_eq!(Unit::named(""), None);
 }
 
+#[test]
+fn a_shared_suffix_names_the_plain_unit() {
+    assert_eq!(Unit::named(Unit::Feet.suffix()), Some(Unit::Feet));
+    assert_eq!(Unit::named("FT"), Some(Unit::Feet));
+    assert_eq!(Unit::named(Unit::FeetInches.label()), Some(Unit::FeetInches));
+}
+
 #[test]
 fn readouts_show_two_decimals() {
     assert_eq!(Unit::Points.readout(15.0), "15.00 pt");

crates/doc/src/text.rs

@@ -4,7 +4,7 @@ use serde::{Deserialize, Serialize};
 use vectorcraft_color::{Color, Paint};
 use vectorcraft_geom::{Affine, PathData, Point, Rect, Vec2};
 
-use crate::appearance::{Appearance, AppearanceItem, Dash, FillLayer, LineCap, LineJoin, StrokeLayer};
+use crate::appearance::{Appearance, AppearanceItem, Dash, FillLayer, LineCap, LineJoin, StrokeAlign, StrokeLayer};
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum Justify {
@@ -32,6 +32,11 @@ pub struct CharStyle {
     /// wouldn't pick (an imported file's type matched to it); None = the one they pick.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub font_version: Option<String>,
+    /// Variation axis settings of a variable font (Character panel › Variable Font), by axis tag
+    /// (`wght`, `wdth`), in the axis's own units. They replace the named instance's setting of
+    /// each axis they name; the other axes keep the style's settings. Empty: the style as it is.
+    #[serde(default, rename = "fontAxes", skip_serializing_if = "std::collections::BTreeMap::is_empty")]
+    pub font_axes: std::collections::BTreeMap<String, f64>,
     /// Size in points.
     pub size: f64,
     /// Leading in points; None = Auto (120% of size).
@@ -84,6 +89,10 @@ pub struct CharStyle {
     pub stroke_miter_limit: f64,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub stroke_dash: Option<Dash>,
+    /// Align Stroke of the character stroke (Stroke panel, with type selected): centred on the
+    /// glyph outlines, inside or outside them, as for object strokes; the type stays live.
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    pub stroke_align: StrokeAlign,
     /// Superscript or subscript (Character panel).
     #[serde(default, skip_serializing_if = "crate::skip::is_default")]
     pub position: CharPosition,
@@ -170,6 +179,18 @@ pub struct ScriptMetrics {
 
 impl ScriptMetrics {
     pub const DEFAULT: Self = Self { size: 58.3, position: 33.3 };
+    /// Returns these proportions with the size kept to 1 to 500% and the position kept to -500 to
+    /// 500%, the ranges `document.setup` takes for `superscript` and `subscript`. A value outside
+    /// its range becomes the nearer end.
+    pub fn in_range(self) -> Self {
+        Self { size: self.size.clamp(1.0, 500.0), position: self.position.clamp(-500.0, 500.0) }
+    }
+}
+
+/// Returns a small caps size kept to 1 to 200%, the range `document.setup` takes for
+/// `smallCapsSize`. A size outside it becomes the nearer end.
+fn small_caps_in_range(size: f64) -> f64 {
+    size.clamp(1.0, 200.0)
 }
 
 impl Default for ScriptMetrics {
@@ -206,6 +227,14 @@ impl CharPosition {
             CharPosition::Subscript(_) => "subscript",
         }
     }
+    /// Returns this position with its proportions kept by [`ScriptMetrics::in_range`].
+    pub fn in_range(self) -> Self {
+        match self {
+            CharPosition::Normal => CharPosition::Normal,
+            CharPosition::Superscript(m) => CharPosition::Superscript(m.in_range()),
+            CharPosition::Subscript(m) => CharPosition::Subscript(m.in_range()),
+        }
+    }
 }
 
 fn ten() -> f64 {
@@ -227,6 +256,7 @@ impl Default for CharStyle {
             font_family: "Source Sans 3".into(),
             font_style: "Regular".into(),
             font_version: None,
+            font_axes: std::collections::BTreeMap::new(),
             size: 12.0,
             leading: None,
             tracking: 0.0,
@@ -249,6 +279,7 @@ impl Default for CharStyle {
             stroke_join: LineJoin::Miter,
             stroke_miter_limit: 10.0,
             stroke_dash: None,
+            stroke_align: StrokeAlign::Center,
             position: CharPosition::Normal,
             char_align: CharAlign::RomanBaseline,
             proportional_metrics: false,
@@ -262,12 +293,27 @@ impl CharStyle {
     pub fn effective_leading(&self) -> f64 {
         self.leading.unwrap_or(self.size * 1.2)
     }
+    /// Keeps the size, leading, baseline shift and horizontal and vertical scales in range: a size
+    /// or scale of 0 or less becomes the default new type takes (12 pt, 100%), a negative leading
+    /// becomes Auto, and a value past [`crate::MAX_COORD`] (a baseline shift past it either way)
+    /// becomes the nearer end. A leading of 0, which legacy `.ai` import stores, stays, and a
+    /// baseline shift that is not a number becomes 0.
+    pub fn keep_dimensions_in_range(&mut self) {
+        let default = Self::default();
+        let within = |v: f64, or: f64| if v > 0.0 { v.min(crate::MAX_COORD) } else { or };
+        self.size = within(self.size, default.size);
+        self.h_scale = within(self.h_scale, default.h_scale);
+        self.v_scale = within(self.v_scale, default.v_scale);
+        self.leading = self.leading.filter(|l| *l >= 0.0).map(|l| l.min(crate::MAX_COORD));
+        self.baseline_shift = if self.baseline_shift.is_nan() { 0.0 } else { self.baseline_shift.clamp(-crate::MAX_COORD, crate::MAX_COORD) };
+    }
     /// Do the characters draw a stroke (a paint and a positive weight)?
     pub fn has_stroke(&self) -> bool {
         !self.stroke.is_none() && self.stroke_width > 0.0
     }
-    /// The character stroke as a stroke layer (paint, weight, cap, join, miter limit, dashes and
-    /// overprint), so type strokes share the object strokes' geometry, rendering and export.
+    /// The character stroke as a stroke layer (paint, weight, cap, join, miter limit, dashes,
+    /// alignment and overprint), so type strokes share the object strokes' geometry, rendering
+    /// and export.
     pub fn stroke_layer(&self) -> StrokeLayer {
         StrokeLayer {
             overprint: self.overprint_stroke,
@@ -275,11 +321,13 @@ impl CharStyle {
             join: self.stroke_join,
             miter_limit: self.stroke_miter_limit,
             dash: self.stroke_dash.clone(),
+            align: self.stroke_align,
             ..StrokeLayer::new(self.stroke.clone(), self.stroke_width)
         }
     }
-    /// Take the paint, weight, cap, join, miter limit and dashes of `st` as the character stroke
-    /// (the options characters have no use for, such as alignment and arrowheads, are dropped).
+    /// Take the paint, weight, cap, join, miter limit, dashes and alignment of `st` as the
+    /// character stroke (the options characters have no use for, such as arrowheads and width
+    /// profiles, are dropped).
     pub fn set_stroke_layer(&mut self, st: &StrokeLayer) {
         self.stroke = st.paint.clone();
         self.stroke_width = st.width;
@@ -287,6 +335,19 @@ impl CharStyle {
         self.stroke_join = st.join;
         self.stroke_miter_limit = st.miter_limit;
         self.stroke_dash = st.dash.clone();
+        self.stroke_align = st.align;
+    }
+    /// How far the character stroke paints past the glyph outlines (text space): half the weight
+    /// centred, the whole weight outside, nothing inside (miter spikes aside).
+    pub fn stroke_outset(&self) -> f64 {
+        if !self.has_stroke() {
+            return 0.0;
+        }
+        match self.stroke_align {
+            StrokeAlign::Center => self.stroke_width / 2.0,
+            StrokeAlign::Outside => self.stroke_width,
+            StrokeAlign::Inside => 0.0,
+        }
     }
     /// The character fill as a fill layer, overprinting as the characters do.
     fn fill_layer(&self) -> FillLayer {
@@ -306,6 +367,60 @@ impl CharStyle {
     pub fn basic_appearance(&self) -> Appearance {
         Appearance { items: vec![AppearanceItem::Fill(self.fill_layer()), AppearanceItem::Stroke(self.stroke_layer())], ..Default::default() }
     }
+    /// Keeps the superscript or subscript proportions in range with [`CharPosition::in_range`] and
+    /// keeps the small caps size to 1 to 200%, the range `document.setup` takes for `smallCapsSize`.
+    pub fn keep_scripts_in_range(&mut self) {
+        self.position = self.position.in_range();
+        self.small_caps = self.small_caps.map(small_caps_in_range);
+    }
+}
+
+impl crate::Document {
+    /// Keeps the superscript, subscript and small caps proportions to the ranges `document.setup`
+    /// takes ([`CharStyle::keep_scripts_in_range`]) in the type of the layers, symbols, graph
+    /// designs, pattern swatches and the pattern definition that pattern editing's Cancel puts
+    /// back (opacity-mask art included), in graphs' label styles and in the character styles. It
+    /// recurses through the art: call it on a document no deeper than [`crate::depth::MAX_DEPTH`].
+    pub fn keep_scripts_in_range(&mut self) {
+        let mut fix = |n: &mut crate::Node| {
+            if let crate::NodeKind::Text(t) = &mut n.kind {
+                for r in &mut t.runs {
+                    r.style.keep_scripts_in_range();
+                }
+            }
+            if let Some(g) = n.extras_if_any().and_then(|e| e.graph.as_deref_mut()) {
+                let l = &mut g.label_styles;
+                for st in [&mut l.values, &mut l.categories, &mut l.legend].into_iter().flatten() {
+                    st.keep_scripts_in_range();
+                }
+            }
+        };
+        let roots = self
+            .layers
+            .iter_mut()
+            .chain(self.symbols.iter_mut().map(|s| &mut s.art))
+            .chain(self.graph_designs.iter_mut().map(|g| &mut g.art))
+            .chain(self.patterns.iter_mut().flat_map(|p| p.art.iter_mut()))
+            .chain(self.pattern_edit.iter_mut().filter_map(|pe| pe.original.as_mut()).flat_map(|p| p.art.iter_mut()));
+        for root in roots {
+            crate::placed_document::each_mut(std::sync::Arc::make_mut(root), &mut fix);
+        }
+        // Character styles store the attributes they set by their serialized names.
+        for def in self.char_styles.iter_mut() {
+            if let Some(v) = def.attrs.get_mut("position")
+                && let Ok(p) = serde_json::from_value::<CharPosition>(v.clone())
+                && p.in_range() != p
+            {
+                *v = serde_json::to_value(p.in_range()).unwrap_or(serde_json::Value::Null);
+            }
+            if let Some(v) = def.attrs.get_mut("small_caps")
+                && let Some(size) = v.as_f64()
+                && small_caps_in_range(size) != size
+            {
+                *v = small_caps_in_range(size).into();
+            }
+        }
+    }
 }
 
 /// Tab stop alignment (Tabs panel).
@@ -360,6 +475,129 @@ impl Composer {
     }
 }
 
+/// A paragraph's hyphenation options (Paragraph panel menu › Hyphenation…): which words automatic
+/// hyphenation may break, where, and on how many lines in a row. Saved only when they differ from
+/// the defaults: words longer than 5 letters, 3 letters on each side of the hyphen, no hyphen
+/// limit, no hyphenation zone, and capitalized words hyphenated.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct HyphenationOptions {
+    /// Words Longer Than: only words with more letters than this are hyphenated.
+    pub words_longer_than: u32,
+    /// After First: the fewest letters a word keeps before the hyphen.
+    pub after_first: u32,
+    /// Before Last: the fewest letters a word keeps after the hyphen.
+    pub before_last: u32,
+    /// Hyphen Limit: the most consecutive lines that automatic hyphenation may end with a hyphen;
+    /// 0 sets no limit.
+    pub hyphen_limit: u32,
+    /// Hyphenation Zone (pt): with the Single-line Composer, a line whose text before the next
+    /// word already ends within this distance of its right edge breaks before that word instead
+    /// of hyphenating it. 0 allows every hyphenation.
+    pub zone: f64,
+    /// Hyphenate Capitalized Words: when it is off, words that start with a capital letter are not
+    /// hyphenated. Words in capitals only are never hyphenated.
+    pub capitalized: bool,
+}
+
+impl Default for HyphenationOptions {
+    fn default() -> Self {
+        Self { words_longer_than: 5, after_first: 3, before_last: 3, hyphen_limit: 0, zone: 0.0, capitalized: true }
+    }
+}
+
+/// How a justified line holding a single word is set ([`JustificationOptions::single_word`]).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum SingleWordJustify {
+    /// Spread across the line, between its letters.
+    #[default]
+    FullJustify,
+    AlignLeft,
+    AlignCenter,
+    AlignRight,
+}
+
+/// A paragraph's justification options (Paragraph panel menu › Justification…), in percent.
+///
+/// Each spacing has a Minimum, a Desired and a Maximum value (`[min, desired, max]`). Desired
+/// applies to every line of the paragraph, justified or not: word spaces are that share of the
+/// font's word space, each letter is followed by that share of a word space, and glyphs are that
+/// wide. Justified lines may vary them between Minimum and Maximum to fill the measure. Saved only
+/// when they differ from the defaults: word spacing 80/100/133, letter spacing 0/0/0, glyph
+/// scaling 100/100/100, Auto Leading 120 and Full Justify.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct JustificationOptions {
+    /// Word Spacing, percent of the font's word space (0..1000).
+    pub word_spacing: [f64; 3],
+    /// Letter Spacing, percent of the font's word space added after each letter (-100..500).
+    pub letter_spacing: [f64; 3],
+    /// Glyph Scaling, percent of the glyphs' width (50..200).
+    pub glyph_scaling: [f64; 3],
+    /// Auto Leading: the leading of characters whose leading is Auto, in percent of their size
+    /// (0..500).
+    pub auto_leading: f64,
+    /// Single Word Justification: how a justified line holding one word is set.
+    pub single_word: SingleWordJustify,
+}
+
+impl JustificationOptions {
+    /// Word Spacing's range (percent).
+    pub const WORD_SPACING: (f64, f64) = (0.0, 1000.0);
+    /// Letter Spacing's range (percent).
+    pub const LETTER_SPACING: (f64, f64) = (-100.0, 500.0);
+    /// Glyph Scaling's range (percent).
+    pub const GLYPH_SCALING: (f64, f64) = (50.0, 200.0);
+    /// Auto Leading's range (percent).
+    pub const AUTO_LEADING: (f64, f64) = (0.0, 500.0);
+
+    /// Are Desired word spacing, letter spacing and glyph scaling the defaults (nothing to change
+    /// in a line's natural widths)?
+    pub fn desired_is_default(&self) -> bool {
+        let d = Self::default();
+        self.word_spacing[1] == d.word_spacing[1] && self.letter_spacing[1] == d.letter_spacing[1] && self.glyph_scaling[1] == d.glyph_scaling[1]
+    }
+
+    /// Keeps options read from a file to what `text.setFormat` can set: a value that is not a
+    /// finite number becomes its default, every value is clamped to its range, and a Minimum,
+    /// Desired and Maximum out of order go back to their defaults together.
+    pub fn keep_in_range(&mut self) {
+        let d = Self::default();
+        for (v, dv, (lo, hi)) in [
+            (&mut self.word_spacing, d.word_spacing, Self::WORD_SPACING),
+            (&mut self.letter_spacing, d.letter_spacing, Self::LETTER_SPACING),
+            (&mut self.glyph_scaling, d.glyph_scaling, Self::GLYPH_SCALING),
+        ] {
+            for (x, dx) in v.iter_mut().zip(dv) {
+                *x = if x.is_finite() { x.clamp(lo, hi) } else { dx };
+            }
+            if !(v[0] <= v[1] && v[1] <= v[2]) {
+                *v = dv;
+            }
+        }
+        let (lo, hi) = Self::AUTO_LEADING;
+        self.auto_leading = if self.auto_leading.is_finite() { self.auto_leading.clamp(lo, hi) } else { d.auto_leading };
+    }
+
+    /// A paragraph's leading for characters of `size` whose leading is Auto.
+    pub fn auto_leading_for(&self, size: f64) -> f64 {
+        size * self.auto_leading / 100.0
+    }
+}
+
+impl Default for JustificationOptions {
+    fn default() -> Self {
+        Self {
+            word_spacing: [80.0, 100.0, 133.0],
+            letter_spacing: [0.0, 0.0, 0.0],
+            glyph_scaling: [100.0, 100.0, 100.0],
+            auto_leading: 120.0,
+            single_word: SingleWordJustify::FullJustify,
+        }
+    }
+}
+
 /// Paragraph attributes (the Paragraph panel).
 ///
 /// Saved through [`ParaStyleFile`], which keeps files with text openable by builds from before
@@ -374,6 +612,11 @@ pub struct ParaStyle {
     pub space_before: f64,
     pub space_after: f64,
     pub hyphenate: bool,
+    /// The limits automatic hyphenation keeps to (Paragraph panel menu › Hyphenation…).
+    pub hyphenation: HyphenationOptions,
+    /// Word and letter spacing, glyph scaling, Auto Leading and Single Word Justification
+    /// (Paragraph panel menu › Justification…).
+    pub justification: JustificationOptions,
     /// Line breaking: Single-line or Every-line Composer.
     pub composer: Composer,
     /// Tab stops (Tabs panel), sorted by position.
@@ -398,6 +641,26 @@ pub struct ParaStyle {
     /// Kinsoku (Paragraph panel › Kinsoku Set): which Japanese characters may not start or end a
     /// line.
     pub kinsoku: Kinsoku,
+    /// Roman Hanging Punctuation (Paragraph panel menu): quotation marks, hyphens, full stops and
+    /// commas starting or ending a line hang outside the margin, and asterisks, tildes, ellipses,
+    /// dashes, colons and semicolons hang by half. East Asian punctuation hangs by burasagari.
+    pub roman_hanging: bool,
+}
+
+impl ParaStyle {
+    /// Keeps the indents and the space before and after to -[`crate::MAX_COORD`] to
+    /// [`crate::MAX_COORD`], and the tab stop positions to 0 to 100,000 pt, the range
+    /// `text.tabs.set` takes. A value outside its range becomes the nearer end, and one that is
+    /// not a number becomes 0.
+    pub fn keep_spacing_in_range(&mut self) {
+        let within = |v: f64, lo: f64, hi: f64| if v.is_nan() { 0.0 } else { v.clamp(lo, hi) };
+        for v in [&mut self.left_indent, &mut self.right_indent, &mut self.first_line_indent, &mut self.space_before, &mut self.space_after] {
+            *v = within(*v, -crate::MAX_COORD, crate::MAX_COORD);
+        }
+        for t in &mut self.tabs {
+            t.position = within(t.position, 0.0, 100_000.0);
+        }
+    }
 }
 
 /// [`ParaStyle`] as saved. [`Justify::Auto`] is written as the alignment it has in the paragraph
@@ -421,6 +684,10 @@ struct ParaStyleFile {
     space_after: f64,
     #[serde(default)]
     hyphenate: bool,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    hyphenation: HyphenationOptions,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    justification: JustificationOptions,
     #[serde(default, skip_serializing_if = "Composer::is_default")]
     composer: Composer,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
@@ -437,6 +704,8 @@ struct ParaStyleFile {
     burasagari: Burasagari,
     #[serde(default, skip_serializing_if = "crate::skip::is_default")]
     kinsoku: Kinsoku,
+    #[serde(default, skip_serializing_if = "crate::skip::is_default")]
+    roman_hanging: bool,
 }
 
 impl From<ParaStyle> for ParaStyleFile {
@@ -454,6 +723,8 @@ impl From<ParaStyle> for ParaStyleFile {
             space_before,
             space_after,
             hyphenate,
+            hyphenation,
+            justification,
             composer,
             tabs,
             style_name,
@@ -462,6 +733,7 @@ impl From<ParaStyle> for ParaStyleFile {
             leading_model,
             burasagari,
             kinsoku,
+            roman_hanging,
             ..
         } = p;
         Self {
@@ -473,6 +745,8 @@ impl From<ParaStyle> for ParaStyleFile {
             space_before,
             space_after,
             hyphenate,
+            hyphenation,
+            justification,
             composer,
             tabs,
             style_name,
@@ -481,6 +755,7 @@ impl From<ParaStyle> for ParaStyleFile {
             leading_model,
             burasagari,
             kinsoku,
+            roman_hanging,
         }
     }
 }
@@ -488,6 +763,8 @@ impl From<ParaStyle> for ParaStyleFile {
 impl From<ParaStyleFile> for ParaStyle {
     fn from(f: ParaStyleFile) -> Self {
         let justify = if f.justify_auto { Justify::Auto } else { f.justify };
+        let mut justification = f.justification;
+        justification.keep_in_range();
         let ParaStyleFile {
             left_indent,
             right_indent,
@@ -495,6 +772,7 @@ impl From<ParaStyleFile> for ParaStyle {
             space_before,
             space_after,
             hyphenate,
+            hyphenation,
             composer,
             tabs,
             style_name,
@@ -503,6 +781,7 @@ impl From<ParaStyleFile> for ParaStyle {
             leading_model,
             burasagari,
             kinsoku,
+            roman_hanging,
             ..
         } = f;
         Self {
@@ -513,6 +792,8 @@ impl From<ParaStyleFile> for ParaStyle {
             space_before,
             space_after,
             hyphenate,
+            hyphenation,
+            justification,
             composer,
             tabs,
             style_name,
@@ -521,6 +802,7 @@ impl From<ParaStyleFile> for ParaStyle {
             leading_model,
             burasagari,
             kinsoku,
+            roman_hanging,
         }
     }
 }
@@ -1007,6 +1289,12 @@ pub struct TextObject {
     /// Wrap objects above this area type, resolved by the engine after each edit (text space).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub wrap: Vec<WrapShape>,
+    /// Type › Optical Margin Alignment: in every paragraph, Latin punctuation and the slanted
+    /// sides of letters such as A and W at a line's start or end hang outside the margin there
+    /// (point and area type of left-to-right paragraphs; see the layout's `optical_hangs`). Off
+    /// for new type and for documents from before it, and saved only when on.
+    #[serde(default, rename = "opticalMarginAlignment", skip_serializing_if = "crate::skip::is_default")]
+    pub optical_margin: bool,
     /// Cached layout bounds in text space, filled in by the layout engine (not serialized).
     #[serde(skip)]
     pub cached_bounds: Option<Rect>,
@@ -1072,6 +1360,7 @@ impl TextObject {
             path_align: PathAlign::default(),
             path_spacing: 0.0,
             wrap: Vec::new(),
+            optical_margin: false,
             cached_bounds: None,
             cached_baselines: Vec::new(),
         }
@@ -1288,6 +1577,87 @@ impl TextObject {
         });
         self.cached_baselines.iter().copied().chain(first)
     }
+    /// Keeps every run's size, leading, baseline shift and scales in range
+    /// ([`CharStyle::keep_dimensions_in_range`]) and every paragraph's indents, spacing and tab
+    /// stops ([`ParaStyle::keep_spacing_in_range`]).
+    pub fn keep_type_values_in_range(&mut self) {
+        for r in &mut self.runs {
+            r.style.keep_dimensions_in_range();
+        }
+        for p in self.para_styles_mut() {
+            p.keep_spacing_in_range();
+        }
+    }
+}
+
+impl crate::Document {
+    /// Keeps the character dimensions, indents, paragraph spacing and tab stops in range
+    /// ([`TextObject::keep_type_values_in_range`]) in the type of the layers, symbols, graph
+    /// designs, pattern swatches and the pattern definition that pattern editing's Cancel puts
+    /// back (opacity-mask art included), and the same attributes of the character and paragraph
+    /// styles. It recurses through the art: call it on a document no deeper than
+    /// [`crate::depth::MAX_DEPTH`].
+    pub fn keep_type_values_in_range(&mut self) {
+        let mut fix = |n: &mut crate::Node| {
+            if let crate::NodeKind::Text(t) = &mut n.kind {
+                t.keep_type_values_in_range();
+            }
+        };
+        let roots = self
+            .layers
+            .iter_mut()
+            .chain(self.symbols.iter_mut().map(|s| &mut s.art))
+            .chain(self.graph_designs.iter_mut().map(|g| &mut g.art))
+            .chain(self.patterns.iter_mut().flat_map(|p| p.art.iter_mut()))
+            .chain(self.pattern_edit.iter_mut().filter_map(|pe| pe.original.as_mut()).flat_map(|p| p.art.iter_mut()));
+        for root in roots {
+            crate::placed_document::each_mut(std::sync::Arc::make_mut(root), &mut fix);
+        }
+        // Styles store the attributes they set by their serialized names (a number, or null for
+        // Auto leading); a number is rewritten only when it changes.
+        for def in self.char_styles.iter_mut() {
+            let num = |k: &str| def.attrs.get(k).and_then(serde_json::Value::as_f64);
+            let mut st = CharStyle { leading: num("leading"), ..CharStyle::default() };
+            st.size = num("size").unwrap_or(st.size);
+            st.h_scale = num("h_scale").unwrap_or(st.h_scale);
+            st.v_scale = num("v_scale").unwrap_or(st.v_scale);
+            st.baseline_shift = num("baseline_shift").unwrap_or(st.baseline_shift);
+            st.keep_dimensions_in_range();
+            let kept = [
+                ("size", Some(st.size)),
+                ("h_scale", Some(st.h_scale)),
+                ("v_scale", Some(st.v_scale)),
+                ("baseline_shift", Some(st.baseline_shift)),
+                ("leading", st.leading),
+            ];
+            for (k, v) in kept {
+                if let Some(old) = def.attrs.get_mut(k)
+                    && old.is_number()
+                    && old.as_f64() != v
+                {
+                    *old = v.into();
+                }
+            }
+        }
+        for def in self.para_styles.iter_mut() {
+            for k in ["left_indent", "right_indent", "first_line_indent", "space_before", "space_after"] {
+                if let Some(v) = def.attrs.get_mut(k)
+                    && let Some(x) = v.as_f64()
+                    && x.abs() > crate::MAX_COORD
+                {
+                    *v = x.clamp(-crate::MAX_COORD, crate::MAX_COORD).into();
+                }
+            }
+            for t in def.attrs.get_mut("tabs").and_then(serde_json::Value::as_array_mut).into_iter().flatten() {
+                if let Some(v) = t.get_mut("position")
+                    && let Some(x) = v.as_f64()
+                    && !(0.0..=100_000.0).contains(&x)
+                {
+                    *v = x.clamp(0.0, 100_000.0).into();
+                }
+            }
+        }
+    }
 }
 
 #[cfg(test)]
@@ -1317,6 +1687,37 @@ mod tests {
         assert_eq!(serde_json::from_value::<CharStyle>(serde_json::to_value(&farsi).unwrap()).unwrap(), farsi);
     }
 
+    /// A file can't feed layout justification values `text.setFormat` would refuse: each is
+    /// clamped to its range, one that isn't finite takes its default, and a Minimum, Desired and
+    /// Maximum out of order go back to their defaults.
+    #[test]
+    fn justification_options_read_from_a_file_stay_in_range() {
+        let d = JustificationOptions::default();
+        let read: ParaStyle = serde_json::from_value(serde_json::json!({
+            "justification": {
+                "word_spacing": [-5.0, 1e300, 1e308], "letter_spacing": [10.0, 5.0, 20.0],
+                "glyph_scaling": [1.0, 100.0, 9e9], "auto_leading": -1e12
+            }
+        }))
+        .unwrap();
+        let j = read.justification;
+        assert_eq!(j.word_spacing, [0.0, 1000.0, 1000.0]);
+        assert_eq!(j.letter_spacing, d.letter_spacing, "out of order");
+        assert_eq!(j.glyph_scaling, [50.0, 100.0, 200.0]);
+        assert_eq!(j.auto_leading, 0.0);
+        let mut j = JustificationOptions {
+            word_spacing: [f64::NAN, 100.0, f64::INFINITY],
+            letter_spacing: [-1.0, 0.0, f64::NEG_INFINITY],
+            auto_leading: f64::NAN,
+            ..d.clone()
+        };
+        j.keep_in_range();
+        assert_eq!((j.word_spacing, j.letter_spacing, j.auto_leading), (d.word_spacing, [-1.0, 0.0, 0.0], d.auto_leading));
+        let mut same = d.clone();
+        same.keep_in_range();
+        assert_eq!(same, d);
+    }
+
     #[test]
     fn character_controls_reject_collapsed_and_nonfinite_transforms() {
         let mut t = TextObject::point(Point::ZERO, "Text", CharStyle::default());

crates/doc/src/variables.rs

@@ -116,6 +116,10 @@ pub struct Variables {
     pub bindings: BTreeMap<NodeId, BTreeSet<String>>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub active_dataset: Option<String>,
+    /// Lock Variables: while set, variables can't be defined, deleted or renamed. Objects can
+    /// still be bound to them and unbound, and datasets still change and apply.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub locked: bool,
 }
 
 impl Variables {
@@ -184,20 +188,26 @@ impl Document {
         self.variables.bindings = bindings;
     }
 
-    /// Whether a variable may read and rewrite the object `id`: it is in the document, neither
-    /// it nor anything above it is locked, and nothing above it is hidden. Its own visibility
-    /// doesn't count, as that is what a visibility variable drives: a row that hid it must be
-    /// able to show it again, and a capture must record it hidden.
+    /// Whether a variable may be bound to the object `id`: it is in the document, neither it nor
+    /// anything above it is locked, and nothing above it is hidden. Its own visibility doesn't
+    /// count, as that is what a visibility variable drives.
     pub fn variable_target(&self, id: NodeId) -> bool {
         self.ancestry(id).is_some_and(|a| a.iter().all(|i| self.node(*i).is_some_and(|n| !n.locked && (n.visible || *i == id))))
     }
 
+    /// Whether a data set reads and rewrites the bound object `id`: it is in the document and
+    /// neither it nor anything above it is locked. Hidden objects count, and so do objects in a
+    /// hidden layer or group.
+    pub fn dataset_target(&self, id: NodeId) -> bool {
+        self.ancestry(id).is_some_and(|a| a.iter().all(|i| self.node(*i).is_some_and(|n| !n.locked)))
+    }
+
     /// What the object `id` holds for the variable of `kind`: its characters, whether it shows,
     /// or a linked image's path. `None` when the object is gone, is not of that kind, has no
-    /// link path yet (an embedded image), or is locked or on a hidden or locked layer (the
+    /// link path yet (an embedded image), or is locked or in a locked layer or group (the
     /// document's value is whatever it was left at).
     pub fn variable_value(&self, id: NodeId, kind: VariableKind) -> Option<DataValue> {
-        if !self.variable_target(id) {
+        if !self.dataset_target(id) {
             return None;
         }
         let node = self.node(id)?;

crates/doc/src/xml_id.rs

@@ -27,7 +27,8 @@ pub fn to_object_name(id: &str) -> String {
     out
 }
 
-/// The XML id for an object name (the inverse of [`to_object_name`]).
+/// The XML id for an object name (the inverse of [`to_object_name`]). The empty name stays empty,
+/// since a bare `_` would read back as a space.
 pub fn from_object_name(name: &str) -> String {
     let mut out = String::with_capacity(name.len().saturating_mul(2));
     for (i, c) in name.chars().enumerate() {
@@ -35,17 +36,14 @@ pub fn from_object_name(name: &str) -> String {
             out.push('_');
         } else if c == '_' {
             out.push_str("_x5F_");
-        } else if i == 0 && c.is_ascii_digit() {
+        } else if (i == 0 && !(c.is_alphabetic() || c == ':')) || !(c.is_alphanumeric() || c == '.' || c == '-' || c == ':') {
+            // A first character that cannot start an XML name is escaped, never given a bare `_`
+            // prefix (that would read back as a space).
             out.push_str(&format!("_x{:X}_", u32::from(c)));
-        } else if c.is_alphanumeric() || c == '.' || c == '-' || c == ':' {
-            out.push(c);
         } else {
-            out.push_str(&format!("_x{:X}_", u32::from(c)));
+            out.push(c);
         }
     }
-    if out.is_empty() || !starts_name(&out) {
-        out.insert(0, '_');
-    }
     out
 }
 
@@ -66,10 +64,6 @@ pub fn is_valid(id: &str) -> bool {
     chars.all(|c| c.is_alphanumeric() || matches!(c, '_' | '.' | '-' | ':'))
 }
 
-fn starts_name(id: &str) -> bool {
-    id.starts_with(|c: char| c.is_alphabetic() || c == '_' || c == ':')
-}
-
 /// `_xHHHH_` at the start of `s`: the character and the escape's length.
 fn escaped(s: &str) -> Option<(char, usize)> {
     let body = s.strip_prefix("_x")?;
@@ -114,4 +108,15 @@ mod tests {
         assert!(is_valid("Layer_1") && is_valid("_x31_abc") && is_valid(":root"));
         assert!(!is_valid("My Rect") && !is_valid("1abc") && !is_valid(""));
     }
+
+    #[test]
+    fn round_trip_names_that_cannot_start_an_xml_name() {
+        for name in ["-abc", ".5 mm", "²x", "Ⅷ", "", "1abc", "Layer 1", " lead", "_a", ":a", "#"] {
+            let id = from_object_name(name);
+            assert_eq!(to_object_name(&id), name, "name {name:?} -> id {id:?}");
+        }
+        assert_eq!(from_object_name("-abc"), "_x2D_abc");
+        assert_eq!(from_object_name(".5 mm"), "_x2E_5_mm");
+        assert_eq!(from_object_name("²x"), "_xB2_x");
+    }
 }

crates/effects/src/adjust.rs

@@ -48,15 +48,29 @@ enum Channel {
 
 impl Channel {
     fn of(p: &Value) -> Self {
-        match text(p, "channel", "rgb").to_ascii_lowercase().as_str() {
-            "red" | "r" => Channel::One(0),
-            "green" | "g" => Channel::One(1),
-            "blue" | "b" => Channel::One(2),
-            _ => Channel::All,
+        Self::parse(text(p, "channel", "rgb")).unwrap_or(Channel::All)
+    }
+
+    fn parse(s: &str) -> Option<Self> {
+        match s.to_ascii_lowercase().as_str() {
+            "rgb" => Some(Channel::All),
+            "red" | "r" => Some(Channel::One(0)),
+            "green" | "g" => Some(Channel::One(1)),
+            "blue" | "b" => Some(Channel::One(2)),
+            _ => None,
         }
     }
 }
 
+/// The channels Curves and Levels apply to (`channel`), as their parameters list them.
+pub const CHANNELS: [&str; 4] = ["rgb", "red", "green", "blue"];
+
+/// Do Curves and Levels read `s` as their `channel`: one of [`CHANNELS`], or r, g or b, in any
+/// case? They draw any other value on all three channels, as RGB.
+pub fn is_channel(s: &str) -> bool {
+    Channel::parse(s).is_some()
+}
+
 /// Entries of a sampled tone curve.
 const LUT: usize = 256;
 
@@ -490,4 +504,20 @@ mod tests {
         assert_eq!(out.appearance.items[0].paint(), p.appearance.items[0].paint());
         assert!(out.appearance.items[1].effects().is_empty());
     }
+
+    #[test]
+    fn adjust_recolours_the_points_of_a_freeform_gradient() {
+        use vectorcraft_doc::color::{Freeform, FreeformPoint, Gradient, GradientKind, GradientPaint};
+        let mut gp = GradientPaint::new(Gradient { kind: GradientKind::Freeform, ..Gradient::default() });
+        let pt = |x, c| FreeformPoint::new(kurbo::Point::new(x, 5.0), c);
+        gp.set_freeform(Freeform { points: vec![pt(2.0, Color::rgb(1.0, 0.0, 0.0)), pt(8.0, Color::rgb(0.0, 0.0, 1.0))], ..Default::default() });
+        let fill = Appearance::basic(Paint::Gradient(Box::new(gp)), Paint::None, 0.0);
+        let mut p = Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), fill);
+        p.appearance.effects.push(Effect { id: "adjust.hueSaturation".into(), params: json!({"hue": 120}), visible: true });
+        let out = adjust(&p, None, &mut |_, _| None).unwrap();
+        let Paint::Gradient(g) = out.appearance.fill_paint() else { panic!("a gradient fill") };
+        // The points are what a freeform gradient draws from, not its stops.
+        let hexes: Vec<String> = g.freeform.as_ref().unwrap().points.iter().map(|p| p.color.to_hex()).collect();
+        assert_eq!(hexes, ["#00ff00", "#ff0000"]);
+    }
 }

crates/effects/src/bake.rs

@@ -28,7 +28,7 @@ use crate::group::{has_own_paint, paints};
 use crate::reshape::{as_art, geometry_effects, glyph_outlines, outline_nested_text, reshape_leaves};
 use crate::{
     GeomContext, adjust_in_document, apply_geometry_with, crop_marks_art, evaluate_container, has_adjustment, has_crop_marks, has_geometry,
-    has_pathfinder, is_geometry, is_pathfinder, merged_params, needs_outline, outline_text, reshape,
+    has_item_geometry, has_pathfinder, is_geometry, is_pathfinder, merged_params, needs_outline, outline_text, reshape,
 };
 
 fn item_effects(item: &AppearanceItem) -> &[vectorcraft_doc::Effect] {
@@ -89,7 +89,8 @@ fn path_kind(d: &mut Document, path: PathData, rule: FillRule) -> NodeKind {
 
 /// `n` with its geometry effects evaluated (`None` = unchanged).
 fn bake_node(d: &mut Document, n: &Node) -> Option<Node> {
-    if !needs_bake(n) {
+    // A cancelled export leaves the rest of the document as it is: the caller drops the result.
+    if !needs_bake(n) || vectorcraft_doc::cancel::is_cancelled() {
         return None;
     }
     // Colour adjustments: the object recoloured (inside it too), then baked as it is.
@@ -106,9 +107,11 @@ fn bake_node(d: &mut Document, n: &Node) -> Option<Node> {
         let m = evaluate_container(&m).unwrap_or(m);
         return Some(bake_pieces(d, m));
     }
-    // Type, images, symbol instances and live objects: reshaped through their outlines. Type that
-    // Transform effects only move and copy stays type, moved to each place.
-    if needs_outline(n) && (has_geometry(&n.appearance.effects) || n.projection().is_some()) {
+    // Type, images, symbol instances and live objects: reshaped through their outlines, and so are
+    // type whose own fills or strokes have geometry effects and images whose own fills or strokes
+    // paint a shape ([`has_item_geometry`]). Type that Transform effects only move and copy stays
+    // type, moved to each place.
+    if needs_outline(n) && (has_geometry(&n.appearance.effects) || n.projection().is_some() || has_item_geometry(n)) {
         if let Some(m) = moved_type_group(n) {
             return Some(bake_pieces(d, m));
         }
@@ -119,6 +122,13 @@ fn bake_node(d: &mut Document, n: &Node) -> Option<Node> {
         let m = reshape(n, symbol.as_deref())?;
         return Some(bake_node(d, &m).unwrap_or(m));
     }
+    // A path whose Transform effect copies it with a gradient: each copy an object of its own, so
+    // its gradient fits it rather than spanning every copy.
+    if crate::has_gradient_copies(n)
+        && let Some(m) = reshape(n, None)
+    {
+        return Some(bake_pieces(d, m));
+    }
     // Groups and layers: Pathfinder, geometry effects and their own fills and strokes (type that
     // Transform effects only move stays type). The new pieces (results, outlines, copies, the
     // fills' and strokes' art) get ids of their own.
@@ -504,7 +514,8 @@ pub fn expand_art(d: &mut Document, n: &mut Node, stroke_art: StrokeArt) {
 /// Envelope Options → Distort Appearance: path or compound path `n` as plain filled art that an
 /// envelope bends as a whole: its geometry effects applied, every visible fill a copy of the path
 /// painted by that fill and every visible stroke without a brush its filled outline in the
-/// stroke's paint, opacity and blend mode (a brushed stroke stays a stroke), in paint order, as
+/// stroke's paint, opacity, blend mode and raster effects (a gradient along or across the stroke:
+/// its gradient meshes clipped to the outline; a brushed stroke stays a stroke), in paint order, as
 /// the members of a group keeping `n`'s id, transparency, opacity mask and raster effects. `None`
 /// when it has neither a stroke to outline nor a geometry effect, so bending first changes nothing.
 pub fn bake_appearance(n: &Node) -> Option<Node> {
@@ -534,8 +545,28 @@ pub fn bake_appearance(n: &Node) -> Option<Node> {
         clear_item_effects(&mut it);
         pieces.push(match &it {
             AppearanceItem::Stroke(st) if st.brush.is_none() => {
-                let fill = FillLayer { opacity: st.opacity, blend: st.blend, ..FillLayer::new(st.paint.clone()) };
-                piece(crate::stroke::outline_region(&ig, rule, st), FillRule::NonZero, AppearanceItem::Fill(fill))
+                let outline = crate::stroke::outline_region(&ig, rule, st);
+                match st.path_gradient() {
+                    // A gradient along or across the stroke: its gradient meshes clipped to the outline.
+                    Some(g) => {
+                        let mut clip = Node::path(n.id, outline, Appearance::default());
+                        if let NodeKind::Path { clipping, .. } = &mut clip.kind {
+                            *clipping = true;
+                        }
+                        let meshes = crate::stroke::gradient_meshes(&ig.to_bezpath(), rule, st, &g.gradient);
+                        let meshes = meshes.into_iter().map(|m| Node::new(n.id, NodeKind::Mesh(m)));
+                        let children = std::iter::once(clip).chain(meshes).map(Arc::new).collect();
+                        let mut group = Node::new(n.id, NodeKind::Group { children, clip: true });
+                        (group.opacity, group.blend) = (st.opacity, st.blend);
+                        group.appearance.effects = st.effects.clone();
+                        Arc::new(group)
+                    }
+                    None => {
+                        let effects = st.effects.clone();
+                        let fill = FillLayer { opacity: st.opacity, blend: st.blend, effects, ..FillLayer::new(st.paint.clone()) };
+                        piece(outline, FillRule::NonZero, AppearanceItem::Fill(fill))
+                    }
+                }
             }
             _ => piece(ig, rule, it),
         });
@@ -571,6 +602,15 @@ mod tests {
     use vectorcraft_doc::{CharStyle, Effect, NodeId, TextObject};
     use vectorcraft_geom::{Point, Rect, shapes};
 
+    /// Type tests need glyph outlines, which only the optional craft-fonts build input provides.
+    fn skip_without_craft_fonts() -> bool {
+        let skip = vectorcraft_text::CRAFT_FONTS.is_empty();
+        if skip {
+            eprintln!("skipped: built without craft-fonts (set CRAFT_FONTS_DIR to a craft-fonts checkout to run it)");
+        }
+        skip
+    }
+
     fn fx(id: &str, params: serde_json::Value) -> Effect {
         Effect { id: id.into(), params, visible: true }
     }
@@ -618,6 +658,36 @@ mod tests {
         assert!(ch[0].id != ch[1].id && ch[0].id != NodeId(50));
     }
 
+    #[test]
+    fn a_baked_stroke_keeps_its_raster_effects() {
+        let mut n = Node::path(NodeId(50), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default_art());
+        if let AppearanceItem::Stroke(s) = &mut n.appearance.items[1] {
+            s.effects.push(fx("path.offsetPath", json!({"offset": 5.0})));
+            s.effects.push(fx("stylize.dropShadow", json!({})));
+        }
+        let m = bake_appearance(&n).unwrap();
+        let ch = m.children().unwrap();
+        let Some(AppearanceItem::Fill(f)) = ch[1].appearance.items.first() else { panic!("the outline is filled") };
+        assert_eq!(f.effects.iter().map(|e| e.id.as_str()).collect::<Vec<_>>(), ["stylize.dropShadow"]);
+    }
+
+    #[test]
+    fn a_baked_stroke_with_a_gradient_along_it_becomes_meshes_clipped_to_its_outline() {
+        let mut n = Node::path(NodeId(50), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default_art());
+        if let AppearanceItem::Stroke(s) = &mut n.appearance.items[1] {
+            s.width = 10.0;
+            s.paint = Paint::Gradient(Box::new(vectorcraft_color::GradientPaint::new(Default::default())));
+            s.gradient_mode = vectorcraft_doc::StrokeGradientMode::Along;
+            s.opacity = 0.5;
+        }
+        let m = bake_appearance(&n).unwrap();
+        let ch = m.children().unwrap();
+        let NodeKind::Group { children, clip: true } = &ch[1].kind else { panic!("a clip group: {:?}", ch[1].kind) };
+        assert!(matches!(children[0].kind, NodeKind::Path { clipping: true, .. }));
+        assert!(children.len() > 1 && children[1..].iter().all(|c| matches!(c.kind, NodeKind::Mesh(_))), "gradient meshes");
+        assert_eq!(ch[1].opacity, 0.5);
+    }
+
     /// Black 24 pt "Type" with its baseline at (20, 60).
     fn type_node(id: u64) -> Node {
         let style = CharStyle { size: 24.0, fill: Paint::solid(Color::BLACK), ..Default::default() };
@@ -646,6 +716,9 @@ mod tests {
 
     #[test]
     fn type_moved_or_copied_by_a_groups_transform_effect_stays_type() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         for (params, origins, square) in [
             (json!({"moveH": 30}), vec![(50.0, 60.0)], Rect::new(30.0, 0.0, 40.0, 10.0)),
             (json!({"moveH": 200, "copies": 1}), vec![(20.0, 60.0), (220.0, 60.0)], Rect::new(0.0, 0.0, 210.0, 10.0)),
@@ -677,6 +750,9 @@ mod tests {
 
     #[test]
     fn hidden_type_in_a_group_that_keeps_its_type_stays_hidden() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut g = type_group(vec![fx("distort.transform", json!({"moveH": 200, "copies": 1}))]);
         let mut hidden = type_node(55);
         hidden.visible = false;
@@ -688,6 +764,9 @@ mod tests {
 
     #[test]
     fn type_outlined_next_to_type_that_stays_type_keeps_its_look() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut g = type_group(vec![fx("distort.transform", json!({"moveH": 200, "copies": 1}))]);
         let mut shadowed = type_node(55);
         shadowed.opacity = 0.5;
@@ -710,6 +789,9 @@ mod tests {
 
     #[test]
     fn type_in_a_clipping_group_with_a_fill_of_its_own_is_outlined_plain() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut g = type_group(vec![fx("distort.transform", json!({"moveH": 200, "copies": 1}))]);
         // The clipping path is a group with a fill of its own, holding type with an effect of its own.
         let mut moved = type_node(60);
@@ -728,6 +810,9 @@ mod tests {
 
     #[test]
     fn type_with_its_own_transform_effect_copies_stays_type() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut n = type_node(50);
         n.opacity = 0.5;
         n.appearance.effects = vec![fx("distort.transform", json!({"moveV": 50, "copies": 2})), fx("stylize.dropShadow", json!({}))];
@@ -774,6 +859,9 @@ mod tests {
 
     #[test]
     fn type_whose_copies_paint_over_each_other_is_still_outlined() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let moves = vec![fx("distort.transform", json!({"moveV": 40, "copies": 1}))];
         assert_eq!(type_origins(&bake_document(&doc_with(type_group(moves.clone()))).unwrap()).len(), 2);
         // A 20 pt stroke on the characters reaches the copy below.
@@ -789,6 +877,9 @@ mod tests {
 
     #[test]
     fn type_with_a_look_of_its_own_in_a_moved_group_is_still_outlined() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let moves = vec![fx("distort.transform", json!({"moveV": 40, "copies": 1}))];
         let mut translucent = type_node(50);
         translucent.opacity = 0.5;
@@ -861,6 +952,9 @@ mod tests {
 
     #[test]
     fn type_whose_copies_hold_too_much_is_still_outlined() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let spaced = |spaces: usize| {
             let mut n = type_node(50);
             if let NodeKind::Text(t) = &mut n.kind {
@@ -898,6 +992,9 @@ mod tests {
 
     #[test]
     fn type_in_a_pathfinder_group_inside_a_moved_group_is_still_outlined() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut inner = type_group(vec![fx("pathfinder.add", json!({}))]);
         inner.id = NodeId(53);
         let mut outer = Node::group(NodeId(54), vec![Arc::new(inner)]);
@@ -931,4 +1028,36 @@ mod tests {
         // An effect that also scales.
         assert!(transform_offsets(&[json!({"moveH": 10, "scaleH": 50})], &square).is_none());
     }
+    /// A 10 pt square painted with a red to blue gradient and a Transform effect with 2 copies.
+    fn gradient_copies(id: u64) -> Node {
+        use vectorcraft_color::{Gradient, GradientKind, GradientPaint, GradientStop};
+        let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+        let paint = Paint::Gradient(Box::new(GradientPaint::new(Gradient { kind: GradientKind::Linear, stops })));
+        let mut n = Node::path(NodeId(id), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::basic(paint, Paint::None, 0.0));
+        n.appearance.effects.push(fx("distort.transform", json!({"moveH": 30, "copies": 2})));
+        n
+    }
+
+    /// The paths under `n` that paint a gradient fitted to their own 10 pt box, left to right.
+    fn gradient_pieces(n: &Node) -> Vec<f64> {
+        let mut out = vec![];
+        let mut walk = vec![n];
+        while let Some(n) = walk.pop() {
+            match n.children() {
+                Some(ch) if !matches!(n.kind, NodeKind::Compound { .. }) => walk.extend(ch.iter().map(|c| &**c)),
+                _ => {
+                    assert!(matches!(n.appearance.fill_paint(), Paint::Gradient(_)), "{n:?}");
+                    out.extend(n.geometric_bounds().map(|b| b.width()));
+                }
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn exporting_a_path_with_a_transform_gives_each_copy_its_own_gradient() {
+        let d = bake_document(&doc_with(gradient_copies(50))).unwrap();
+        // Three squares of their own, not one path spanning all three.
+        assert_eq!(gradient_pieces(d.node(NodeId(50)).unwrap()), vec![10.0; 3]);
+    }
 }

crates/effects/src/distort.rs

@@ -267,8 +267,20 @@ pub fn twist(path: &PathData, b: Rect, angle: f64) -> PathData {
 
 const ZIGZAG_ARCLEN_ACCURACY: f64 = 1e-4;
 
+/// A Zig Zag ridge: where it sits, the path's unit direction there, and the length along the
+/// path to the ridges before and after it (zero at an open path's ends).
+struct Ridge {
+    p: Point,
+    dir: Vec2,
+    gap_in: f64,
+    gap_out: f64,
+}
+
 /// Zig Zag: `ridges` extra points per segment, evenly spaced along its length and alternately
-/// displaced along the normal.
+/// displaced along the normal. Corner points join them with straight lines. Smooth points make a
+/// wave: every peak and valley is a smooth point whose handles run along the path, a third of the
+/// way to the next ridge, so each span between them follows a half cosine (an S through the path)
+/// whatever the size of the ridges (#2343).
 pub fn zig_zag(path: &PathData, b: Rect, p: &Value) -> PathData {
     let size = num(p, "size", 10.0).clamp(-1e4, 1e4);
     let amp = if flag(p, "relative", false) { size / 100.0 * mean_size(b) } else { size };
@@ -277,29 +289,33 @@ pub fn zig_zag(path: &PathData, b: Rect, p: &Value) -> PathData {
     let mut subs = vec![];
     for sp in &path.subpaths {
         let segs = sp.segment_count();
-        let mut pts = vec![];
+        let gap = |i: usize| sp.segment(i).arclen(ZIGZAG_ARCLEN_ACCURACY) / (ridges + 1) as f64;
+        let mut pts: Vec<Ridge> = vec![];
         let mut k = 0usize;
         for i in 0..segs {
             let c = sp.segment(i);
             // Ridges are spaced by length, not by `t`: a line's retracted handles bunch `t` up
             // near the anchors, and so does any uneven curve.
             let len = c.arclen(ZIGZAG_ARCLEN_ACCURACY);
+            let step = len / (ridges + 1) as f64;
             for j in 0..=ridges {
                 let s = j as f64 / (ridges + 1) as f64;
                 let t = if j > 0 && len > 1e-9 { c.inv_arclen(s * len, ZIGZAG_ARCLEN_ACCURACY).clamp(0.0, 1.0) } else { s };
+                let mut gap_in = step;
                 let nrm = if j == 0 {
                     // Average the normals of the segments meeting at the anchor.
                     let prev = if i > 0 {
-                        Some(sp.segment(i - 1))
+                        Some(i - 1)
                     } else if sp.closed {
-                        Some(sp.segment(segs - 1))
+                        Some(segs - 1)
                     } else {
                         None
                     };
+                    gap_in = prev.map_or(0.0, gap);
                     let n1 = normal_at(&c, 0.0);
                     match prev {
-                        Some(pc) => {
-                            let s = n1 + normal_at(&pc, 1.0);
+                        Some(pi) => {
+                            let s = n1 + normal_at(&sp.segment(pi), 1.0);
                             if s.hypot() > 1e-9 { s / s.hypot() } else { n1 }
                         }
                         None => n1,
@@ -308,7 +324,7 @@ pub fn zig_zag(path: &PathData, b: Rect, p: &Value) -> PathData {
                     normal_at(&c, t)
                 };
                 let sign = if k.is_multiple_of(2) { 1.0 } else { -1.0 };
-                pts.push(c.eval(t) + nrm * (amp * sign));
+                pts.push(Ridge { p: c.eval(t) + nrm * (amp * sign), dir: Vec2::new(-nrm.y, nrm.x), gap_in, gap_out: step });
                 k += 1;
             }
         }
@@ -316,12 +332,18 @@ pub fn zig_zag(path: &PathData, b: Rect, p: &Value) -> PathData {
             if segs > 0 {
                 let c = sp.segment(segs - 1);
                 let sign = if k.is_multiple_of(2) { 1.0 } else { -1.0 };
-                pts.push(c.p3 + normal_at(&c, 1.0) * (amp * sign));
+                let nrm = normal_at(&c, 1.0);
+                pts.push(Ridge { p: c.p3 + nrm * (amp * sign), dir: Vec2::new(-nrm.y, nrm.x), gap_in: gap(segs - 1), gap_out: 0.0 });
             } else {
-                pts.extend(sp.anchors.iter().map(|a| a.p));
+                pts.extend(sp.anchors.iter().map(|a| Ridge { p: a.p, dir: Vec2::ZERO, gap_in: 0.0, gap_out: 0.0 }));
             }
         }
-        subs.push(if smooth { catmull_rom(&pts, sp.closed, 1.0) } else { SubPath::polyline(&pts, sp.closed) });
+        subs.push(if smooth {
+            let anchors = pts.iter().map(|r| Anchor::with_handles(r.p, r.p - r.dir * (r.gap_in / 3.0), r.p + r.dir * (r.gap_out / 3.0))).collect();
+            SubPath::new(anchors, sp.closed)
+        } else {
+            SubPath::polyline(&pts.iter().map(|r| r.p).collect::<Vec<_>>(), sp.closed)
+        });
     }
     PathData::new(subs)
 }

crates/effects/src/group.rs

@@ -293,6 +293,15 @@ mod tests {
     use vectorcraft_doc::{CharStyle, Effect, NodeId, TextObject};
     use vectorcraft_geom::{Point, Rect, shapes};
 
+    /// Type tests need glyph outlines, which only the optional craft-fonts build input provides.
+    fn skip_without_craft_fonts() -> bool {
+        let skip = vectorcraft_text::CRAFT_FONTS.is_empty();
+        if skip {
+            eprintln!("skipped: built without craft-fonts (set CRAFT_FONTS_DIR to a craft-fonts checkout to run it)");
+        }
+        skip
+    }
+
     fn sq(id: u64, x: f64, color: Color) -> Arc<Node> {
         Arc::new(Node::path(
             NodeId(id),
@@ -350,6 +359,9 @@ mod tests {
 
     #[test]
     fn type_changes_the_result_of_every_pathfinder_effect() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let glyphs = crate::outline_text(&type_h()).unwrap();
         let b = glyphs.geometric_bounds().unwrap();
         assert!(b.x0 < 100.0 && b.x1 > 100.0 && b.y0 > 0.0 && b.y1 < 100.0, "{b:?}");
@@ -377,6 +389,9 @@ mod tests {
 
     #[test]
     fn pieces_of_type_keep_its_paint_opacity_and_blend_mode() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         let mut t = type_h();
         (t.opacity, t.blend) = (0.5, BlendMode::Multiply);
         let look = |p: &Arc<Node>| (p.appearance.fill_paint(), p.opacity, p.blend);
@@ -418,6 +433,9 @@ mod tests {
 
     #[test]
     fn type_in_a_group_keeps_its_look_when_the_groups_geometry_effects_outline_it() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         use vectorcraft_color::BlendMode;
         let art = type_in_group(|t| (t.opacity, t.blend) = (0.5, BlendMode::Multiply));
         assert!(art.id == NodeId(3) && !matches!(art.kind, NodeKind::Text(_)), "{art:?}");
@@ -447,6 +465,9 @@ mod tests {
 
     #[test]
     fn a_transform_on_a_group_moves_the_gradients_of_its_type_and_not_those_placed_on_its_paths() {
+        if skip_without_craft_fonts() {
+            return;
+        }
         use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
         let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
         let ramp = GradientPaint::new(Gradient { kind: GradientKind::Linear, stops });
@@ -470,4 +491,32 @@ mod tests {
         assert!((after - before - 30.0).abs() < 1e-6, "the type's gradient starts at {before}, then {after}");
         assert_eq!(start(&members[0]), 0.0, "the square's gradient stays where it was placed");
     }
+
+    #[test]
+    fn a_transform_on_a_group_paints_each_copy_with_its_own_gradient() {
+        use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+        let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+        let ramp = GradientPaint::new(Gradient { kind: GradientKind::Linear, stops });
+        let geom = GradientGeom { start: (0.0, 5.0).into(), end: (10.0, 5.0).into(), aspect: 1.0, focal: None };
+        let paints = [Paint::Gradient(Box::new(ramp.clone())), Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }))];
+        for (k, paint) in paints.into_iter().enumerate() {
+            let square =
+                Arc::new(Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::basic(paint, Paint::None, 0.0)));
+            let mut g = Node::group(NodeId(10), vec![square]);
+            let params = serde_json::json!({"moveH": 30, "copies": 2});
+            g.appearance.effects.push(Effect { id: "distort.transform".into(), params, visible: true });
+            let art = evaluate_container(&g).unwrap();
+            let copies = art.children().unwrap()[0].children().expect("the object and its copies are objects of their own");
+            assert_eq!(copies.len(), 3);
+            for (i, c) in copies.iter().enumerate() {
+                // Each copy's own box: an unplaced gradient fits it, a placed one moved with it.
+                assert!((c.geometric_bounds().unwrap().x0 - 30.0 * i as f64).abs() < 1e-6);
+                match c.appearance.fill_paint() {
+                    Paint::Gradient(g) if k == 0 => assert!(g.geom.is_none(), "copy {i} fits its own box"),
+                    Paint::Gradient(g) => assert!((g.geom.unwrap().start.x - 30.0 * i as f64).abs() < 1e-6, "copy {i}"),
+                    p => panic!("a gradient: {p:?}"),
+                }
+            }
+        }
+    }
 }

crates/effects/src/lib.rs

@@ -5,8 +5,8 @@
 //!
 //! - **Geometry effects** (Distort & Transform, Path, Convert to Shape, Round Corners, Scribble,
 //!   Warp) rewrite a path: [`apply_geometry`] evaluates them in stack order.
-//! - **Raster effects** (Drop Shadow, Inner/Outer Glow, Feather, Gaussian Blur, and the
-//!   Photoshop-style filters of [`pixel`]: Radial Blur, Smart Blur, Color Halftone, Crystallize, Mezzotint, Pointillize,
+//! - **Raster effects** (Drop Shadow, Inner/Outer Glow, Feather, Gaussian Blur, Rasterize, and the
+//!   Photoshop-style filters of [`pixel`]: Radial Blur, Smart Blur, Color Halftone, Crystallize, Mezzotint, Pointillize, Halftone Pattern,
 //!   Unsharp Mask and Glowing Edges) are described by
 //!   [`raster_effects`] and painted by the renderer; [`outset`] says how far they reach beyond
 //!   the geometry.
@@ -37,6 +37,7 @@ mod bake;
 mod clip;
 mod distort;
 mod group;
+mod lighting;
 mod live;
 mod marks;
 pub mod pixel;
@@ -55,10 +56,13 @@ mod tests;
 mod tests_scale;
 
 use serde_json::{Map, Value, json};
-use vectorcraft_doc::{AppearanceItem, Effect, Node, NodeKind, StrokeLayer};
+use vectorcraft_doc::{Appearance, AppearanceItem, Effect, Node, NodeKind, StrokeLayer};
 use vectorcraft_geom::{BezPath, FillRule, PathData, Rect};
 
-pub use adjust::{ADJUSTMENTS, ColorMap, ImageHook, adjust, adjust_in_document, color_map, curve_at, curve_points, has_adjustment, is_adjustment};
+pub use adjust::{
+    ADJUSTMENTS, CHANNELS, ColorMap, ImageHook, adjust, adjust_in_document, color_map, curve_at, curve_points, has_adjustment, is_adjustment,
+    is_channel,
+};
 pub use bake::{StrokeArt, bake_appearance, bake_document, expand_art, expand_leaf, fresh_ids, needs_bake};
 pub use clip::clip_outline;
 pub use group::{
@@ -68,8 +72,8 @@ pub use group::{
 pub use live::{expand_live, expand_live_deep, expanded_live_group, text_outliner};
 pub use marks::{CROP_MARKS, crop_marks_art, has_crop_marks};
 pub use pixel::{PIXEL_EFFECTS, PixelFx, PixelSpace};
-pub use raster::{RasterFx, outset, raster_effects};
-pub use reshape::{expand_outlined, needs_outline, outline_art, outline_text, reshape};
+pub use raster::{RASTERIZE, RasterFx, Rasterize, outset, raster_effects};
+pub use reshape::{expand_outlined, has_gradient_copies, has_item_geometry, image_paint, needs_outline, outline_art, outline_text, reshape};
 pub use revolve::{REVOLVE, has_revolve, revolve_art, revolve_options, validate_revolve};
 pub use solids::{
     EXTRUDE, INFLATE, ROTATE, ROTATION_PRESETS, SOLIDS, extrude_options, has_solid, inflate_options, is_three_d, solid_art, validate_solid,
@@ -149,6 +153,10 @@ fn lengths_of(id: &str) -> Lengths {
         "texture.mosaicTiles" => always(&["tileSize"]),
         "texture.patchwork" => always(&["squareSize"]),
         "texture.stainedGlass" => always(&["cellSize"]),
+        "sketch.graphicPen" => always(&["strokeLength"]),
+        "sketch.halftonePattern" => always(&["size"]),
+        "sketch.notePaper" => always(&["relief"]),
+        RASTERIZE => always(&["addAround"]),
         _ => Lengths::default(),
     }
 }
@@ -165,6 +173,7 @@ const ARTISTIC: &[&str] = &["Effect", "Artistic"];
 const BRUSH_STROKES: &[&str] = &["Effect", "Brush Strokes"];
 const DISTORT: &[&str] = &["Effect", "Distort"];
 const SHARPEN: &[&str] = &["Effect", "Sharpen"];
+const SKETCH: &[&str] = &["Effect", "Sketch"];
 const PIXELATE: &[&str] = &["Effect", "Pixelate"];
 const TEXTURE: &[&str] = &["Effect", "Texture"];
 const VIDEO: &[&str] = &["Effect", "Video"];
@@ -200,29 +209,29 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             REVOLVE,
             "Revolve…",
             &["Effect", "3D and Materials"],
-            "{angle: degrees (0..360, 360), offset: pt (0..100000, 0), edge: left|right, rotationX: degrees (0), rotationY: degrees (0), rotationZ: degrees (0), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), segments: integer (8..128, 64), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth), cap: bool (true, close circular ends of open profiles; partial-sweep cut sides stay open), expandVisibleOnly: bool (true, trim covered opaque solid surfaces only on Expand Appearance)}. Shaded surfaces use smooth vector gradients automatically; intersecting profiles use approximate painter visibility.",
-            json!({"angle":360.0,"offset":0.0,"edge":"left","rotationX":0.0,"rotationY":0.0,"rotationZ":0.0,"perspectiveAngle":0.0,"segments":64,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0,"cap":true,"expandVisibleOnly":true}),
+            "{angle: degrees (0..360, 360), offset: pt (0..100000, 0), edge: left|right, rotationX: degrees (0), rotationY: degrees (0), rotationZ: degrees (0), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), segments: integer (8..128, 64), shade: bool (true), lightColor: #rrggbb (white, #ffffff; legacy directional light color), lights: null or array of 1..10 objects (color: #rrggbb, intensity: % 0..100, rotation: degrees -180..180, height: degrees 0..90, softness: % 0..100, behind: bool; overrides the single-light fields; ambient is shared), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth), cap: bool (true, close circular ends of open profiles; partial-sweep cut sides stay open), expandVisibleOnly: bool (true, trim covered opaque solid surfaces only on Expand Appearance)}. Shaded surfaces use smooth vector gradients automatically; intersecting profiles use approximate painter visibility.",
+            json!({"angle":360.0,"offset":0.0,"edge":"left","rotationX":0.0,"rotationY":0.0,"rotationZ":0.0,"perspectiveAngle":0.0,"segments":64,"shade":true,"lightColor":"#ffffff","lights":null,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0,"cap":true,"expandVisibleOnly":true}),
         ),
         g(
             EXTRUDE,
             "Extrude & Bevel…",
             &["Effect", "3D and Materials"],
-            "{depth: pt (0..2000, 50), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: hollow), bevel: none|classic|rounded|cove|step|ogee (none), bevelWidth: pt (0..1000, 4), bevelHeight: pt (0..1000, 4), bevelRepeat: integer (1..32, 1), bevelSpace: % (0..90, 0; flat between repeats), bevelInside: bool (false: added around the shape; true: carved into it), bevelBothSides: bool (false), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. The front face is the art, extruded backwards about the centre of its bounds; painted with the top fill (else the top stroke).",
-            json!({"depth":50.0,"twist":0.0,"taper":100.0,"cap":true,"bevel":"none","bevelWidth":4.0,"bevelHeight":4.0,"bevelRepeat":1,"bevelSpace":0.0,"bevelInside":false,"bevelBothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
+            "{depth: pt (0..2000, 50), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: hollow), bevel: none|classic|rounded|cove|step|ogee (none), bevelWidth: pt (0..1000, 4), bevelHeight: pt (0..1000, 4), bevelRepeat: integer (1..32, 1), bevelSpace: % (0..90, 0; flat between repeats), bevelInside: bool (false: added around the shape; true: carved into it), bevelBothSides: bool (false), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightColor: #rrggbb (white, #ffffff; legacy directional light color), lights: null or array of 1..10 objects (color: #rrggbb, intensity: % 0..100, rotation: degrees -180..180, height: degrees 0..90, softness: % 0..100, behind: bool; overrides the single-light fields; ambient is shared), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. The front face is the art, extruded backwards about the centre of its bounds; painted with the top fill (else the top stroke).",
+            json!({"depth":50.0,"twist":0.0,"taper":100.0,"cap":true,"bevel":"none","bevelWidth":4.0,"bevelHeight":4.0,"bevelRepeat":1,"bevelSpace":0.0,"bevelInside":false,"bevelBothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightColor":"#ffffff","lights":null,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
         ),
         g(
             INFLATE,
             "Inflate…",
             &["Effect", "3D and Materials"],
-            "{depth: pt (0..2000, 0; flat depth between front and back), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: no back, a shell open behind), volume: % (0..100, 50; 50 rounds the edge like a half sphere), bothSides: bool (false: flat back), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Painted with the top fill (else the top stroke).",
-            json!({"depth":0.0,"twist":0.0,"taper":100.0,"cap":true,"volume":50.0,"bothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
+            "{depth: pt (0..2000, 0; flat depth between front and back), twist: degrees (0..360, 0; the back turned against the front), taper: % (1..100, 100; the back's size), cap: bool (true: solid; false: no back, a shell open behind), volume: % (0..100, 50; 50 rounds the edge like a half sphere), bothSides: bool (false: flat back), rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightColor: #rrggbb (white, #ffffff; legacy directional light color), lights: null or array of 1..10 objects (color: #rrggbb, intensity: % 0..100, rotation: degrees -180..180, height: degrees 0..90, softness: % 0..100, behind: bool; overrides the single-light fields; ambient is shared), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Painted with the top fill (else the top stroke).",
+            json!({"depth":0.0,"twist":0.0,"taper":100.0,"cap":true,"volume":50.0,"bothSides":false,"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightColor":"#ffffff","lights":null,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
         ),
         g(
             ROTATE,
             "Rotate…",
             &["Effect", "3D and Materials"],
-            "{rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Turns the flat art in 3D about the centre of its bounds; every fill and stroke keeps its paint, shaded as one plane.",
-            json!({"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
+            "{rotationX: degrees (-180..180, -21.88), rotationY: degrees (-180..180, -23.4), rotationZ: degrees (-180..180, 9.06; the defaults are the Off-Axis Front position), perspectiveAngle: degrees (0..160, 0; 0 is none, wider brings the eye nearer), perspective: % (0..100; the earlier form, read as the perspectiveAngle that shows the same view), shade: bool (true), lightColor: #rrggbb (white, #ffffff; legacy directional light color), lights: null or array of 1..10 objects (color: #rrggbb, intensity: % 0..100, rotation: degrees -180..180, height: degrees 0..90, softness: % 0..100, behind: bool; overrides the single-light fields; ambient is shared), lightRotation: degrees (-180..180, 125.26; round the object on the page, 0 on its right, counterclockwise), lightHeight: degrees (0..90, 30; 0 beside the object, 90 straight in front), lightBehind: bool (false; true lights it from behind), lightIntensity: % (0..100, 80), lightSoftness: % (0..100, 0; how far round the object the light reaches), ambient: % (0..200, 25; Ambient Light), lightAzimuth: degrees (the earlier form: with lightElevation, read as the lightRotation, lightHeight and lightBehind of the same light), lightElevation: degrees (the earlier form, with lightAzimuth)}. Turns the flat art in 3D about the centre of its bounds; every fill and stroke keeps its paint, shaded as one plane.",
+            json!({"rotationX":-21.88,"rotationY":-23.4,"rotationZ":9.06,"perspectiveAngle":0.0,"shade":true,"lightColor":"#ffffff","lights":null,"lightRotation":125.26438968275465,"lightHeight":30.0,"lightBehind":false,"lightIntensity":80.0,"lightSoftness":0.0,"ambient":25.0}),
         ),
         g(
             "convertToShape.rectangle",
@@ -289,6 +298,13 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             "{offset: pt (10; negative insets), joins: \"miter\"|\"round\"|\"bevel\", miterLimit: (4)}",
             json!({"offset": 10.0, "joins": "miter", "miterLimit": 4.0}),
         ),
+        g(
+            "path.outlineObject",
+            "Outline Object",
+            PATH,
+            "{} type is drawn, exported and expanded as its glyph outlines and stays editable, and the effects after it reshape those outlines; paths and images do not change",
+            json!({}),
+        ),
         g(
             "path.outlineStroke",
             "Outline Stroke",
@@ -327,6 +343,13 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
         ),
         r("stylize.feather", "Feather…", STYLIZE, "{radius: pt (5)}", json!({"radius": 5.0})),
         r("blur.gaussian", "Gaussian Blur…", BLUR, "{radius: pt (5)}", json!({"radius": 5.0})),
+        r(
+            "artistic.cutout",
+            "Cutout…",
+            ARTISTIC,
+            "{levels: 2..8 (4; steps per colour channel: more levels, more flat colours), edgeSimplicity: 0..10 (4; simpler, smoother edges), edgeFidelity: 1..3 (2; keeps more of the edges' detail)} redraws the object as flat pieces of coloured paper, each piece painted in the average colour that falls into it, keeping its coverage. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"levels": 4.0, "edgeSimplicity": 4.0, "edgeFidelity": 2.0}),
+        ),
         r(
             "artistic.filmGrain",
             "Film Grain…",
@@ -334,6 +357,48 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             "{grain: 0..20 (4; monochrome noise in shadows and midtones), highlightArea: 0..20 (0; widens the bright highlight area), intensity: 0..10 (10; highlight strength and quieter highlight grain)}. Smooth document-space grain follows translations; minification uses approximate footprint filtering. Coverage and pure white are preserved; black takes light speckles, and saturated colour channels may clip. Grain 0 with either highlightArea 0 or intensity 0 leaves the art unchanged. Original visual approximation; chosen VectorCraft defaults.",
             json!({"grain": 4.0, "highlightArea": 0.0, "intensity": 10.0}),
         ),
+        r(
+            "artistic.neonGlow",
+            "Neon Glow…",
+            ARTISTIC,
+            "{glowSize: -24..24 (5; above 0 the light areas glow, below 0 the dark ones; farther from 0 spreads the glow wider), glowBrightness: 0..50 (15; a stronger glow over dimmer greys), color: \"#rrggbb\" (\"#4da6ff\"; the glow's colour)} redraws the object in greys lit by a coloured glow, keeping its coverage. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"glowSize": 5.0, "glowBrightness": 15.0, "color": "#4da6ff"}),
+        ),
+        r(
+            "artistic.plasticWrap",
+            "Plastic Wrap…",
+            ARTISTIC,
+            "{highlightStrength: 0..20 (20; brighter specular highlights), detail: 0..15 (12; finer wrinkles in document space), smoothness: 1..15 (15; softer folds)} coats the object in shiny plastic, keeping its coverage. highlightStrength 0 leaves the art unchanged. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"highlightStrength": 20.0, "detail": 12.0, "smoothness": 15.0}),
+        ),
+        r(
+            "artistic.posterEdges",
+            "Poster Edges…",
+            ARTISTIC,
+            "{edgeThickness: 0..10 (2; wider lines), edgeIntensity: 0..10 (1; darker lines, on fainter edges too), posterization: 0..6 (2; posterization + 2 levels per colour channel)} reduces the object's colours and draws black lines on its edges, keeping its coverage. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"edgeThickness": 2.0, "edgeIntensity": 1.0, "posterization": 2.0}),
+        ),
+        r(
+            "artistic.smudgeStick",
+            "Smudge Stick…",
+            ARTISTIC,
+            "{strokeLength: 0..10 (2; length of the short diagonal strokes), highlightArea: 0..20 (12; widens the area counted as light), intensity: 0..10 (10; how far the light areas are lightened)} smudges the dark areas along short diagonal strokes; the lighter areas become brighter and lose detail. Coverage is kept. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"strokeLength": 2.0, "highlightArea": 12.0, "intensity": 10.0}),
+        ),
+        r(
+            "artistic.sponge",
+            "Sponge…",
+            ARTISTIC,
+            "{brushSize: 0..10 (2; size of the sponge's pores), definition: 0..25 (12; how strongly lighter and darker blobs contrast), smoothness: 1..15 (5; softer blob edges)} paints the object as if dabbed with a sponge, in highly textured areas of contrasting colour. Coverage is kept. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"brushSize": 2.0, "definition": 12.0, "smoothness": 5.0}),
+        ),
+        r(
+            "artistic.watercolor",
+            "Watercolor…",
+            ARTISTIC,
+            "{brushDetail: 1..14 (9; the larger, the more detail stays), shadowIntensity: 0..10 (1; deepens the shadows), texture: 1..3 (1; paper grain, whole numbers)} paints the object in a watercolor style: detail simplified, colour saturated and darker where tones change at edges. Coverage is kept. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"brushDetail": 9.0, "shadowIntensity": 1.0, "texture": 1.0}),
+        ),
         r(
             "blur.radial",
             "Radial Blur…",
@@ -345,7 +410,7 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             "blur.smart",
             "Smart Blur…",
             BLUR,
-            "{radius: pt 0.1..100 (3), threshold: levels 0.1..100 (25; only colours closer than this blur together, so edges stay sharp), quality: \"low\"|\"medium\"|\"high\" (\"medium\"; 5, 7 or 9 samples across), blurMode: \"normal\"|\"edgeOnly\"|\"overlayEdge\" (\"normal\"; edgeOnly: the edges in white on black, overlayEdge: the edges in white over the blur)}. A pixel is on an edge when one of its four nearest pixels differs from it by more than the threshold in a channel and its channels (alpha included) add up to at least that pixel's; the white and the black keep each pixel's coverage, and the radius changes only the blur",
+            "{radius: pt 0.1..100 (3), threshold: levels 0.1..100 (25; only colours closer than this blur together, so edges stay sharp), quality: \"low\"|\"medium\"|\"high\" (\"medium\"; 5, 7 or 9 samples across), blurMode: \"normal\"|\"edgeOnly\"|\"overlayEdge\" (\"normal\"; edgeOnly: the edges in white on black, overlayEdge: the edges in white over the blur)}. A pixel is on an edge when one of the pixels the search reads within the radius (all of them for a small radius, a grid of samples for a wide one) or one of its four nearest pixels differs from it by more than the threshold in a channel and its channels (alpha included) add up to at least that pixel's, so a step gives a line about as wide as the radius, and at least one pixel wide, on the side with the larger sum; the white and the black keep each pixel's coverage",
             json!({"radius": 3.0, "threshold": 25.0, "quality": "medium", "blurMode": "normal"}),
         ),
         r(
@@ -432,6 +497,83 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             "{amount: % 1..500 (50), radius: pt 0.1..250 (1; σ of the blur edges are found against), threshold: levels 0..255 (0; smaller differences are left alone)}",
             json!({"amount": 50.0, "radius": 1.0, "threshold": 0.0}),
         ),
+        r(
+            "sketch.basRelief",
+            "Bas Relief…",
+            SKETCH,
+            "{detail: 1..15 (13; the larger, the finer the features that stay), smoothness: 1..15 (3; rounds the carving), lightDirection: \"bottom\"|\"bottomLeft\"|\"left\"|\"topLeft\"|\"top\"|\"topRight\"|\"right\"|\"bottomRight\" (\"bottom\"; where the light comes from)} carves the object in low relief in black and white: surfaces facing the light turn white, those turned away black, flat areas grey. Coverage is kept. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"detail": 13.0, "smoothness": 3.0, "lightDirection": "bottom"}),
+        ),
+        r(
+            "sketch.chalkCharcoal",
+            "Chalk & Charcoal…",
+            SKETCH,
+            "{chalkArea: 0..20 (6; chalk in light areas), charcoalArea: 0..20 (6; charcoal in dark areas), strokePressure: 0..5 (2)} redraws the object with chalk highlights and charcoal strokes on white paper, keeping its coverage. Original visual approximation from public documentation; slider ranges and defaults are VectorCraft choices, not verified proprietary values.",
+            json!({"chalkArea": 6.0, "charcoalArea": 6.0, "strokePressure": 2.0}),
+        ),
+        r(
+            "sketch.charcoal",
+            "Charcoal…",
+            SKETCH,
+            "{thickness: 1..7 (1; width of the bold edges and of the strokes' spacing), detail: 0..5 (1; the larger, the finer the edges), lightDarkBalance: 0..100 (50; how far into the lights the charcoal reaches)} redraws the object in black charcoal on white paper: bold edges and diagonal strokes over the midtones. Coverage is kept. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"thickness": 1.0, "detail": 1.0, "lightDarkBalance": 50.0}),
+        ),
+        r(
+            "sketch.chrome",
+            "Chrome…",
+            SKETCH,
+            "{detail: 0..10 (4; finer surface texture), smoothness: 0..10 (4; softer relief before the highlights and shadows)} treats the object as polished chrome lit from the top left: bright highlights on high points and dark shadows in low ones, keeping its coverage. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"detail": 4.0, "smoothness": 4.0}),
+        ),
+        r(
+            "sketch.graphicPen",
+            "Graphic Pen…",
+            SKETCH,
+            "{strokeLength: pt 1..15 (5; the longest ink stroke), lightDarkBalance: 0..100 (50; more black when higher), strokeDirection: \"rightDiagonal\"|\"horizontal\"|\"leftDiagonal\"|\"vertical\" (\"rightDiagonal\")} redraws the object in fine linear black ink on white paper, with strokes denser in darker areas. Control names and ranges follow the public documentation; the defaults are unverified.",
+            json!({"strokeLength": 5.0, "lightDarkBalance": 50.0, "strokeDirection": "rightDiagonal"}),
+        ),
+        r(
+            "sketch.halftonePattern",
+            "Halftone Pattern…",
+            SKETCH,
+            "{size: pt 1..12 (1; how far apart the screen's dots, rings or lines are), contrast: 0..50 (5; 50 draws pure black and white), patternType: \"circle\"|\"dot\"|\"line\" (\"dot\"; rings round the object's centre, dots on a square grid, horizontal lines)} redraws the object in black ink on white paper through a halftone screen whose ink covers as much as the colour is dark, keeping its coverage. Original visual approximation from the public Sketch effects reference; slider ranges follow the documented control names, numeric defaults are chosen for VectorCraft and are not verified against proprietary defaults (the public help pages give no numbers).",
+            json!({"size": 1.0, "contrast": 5.0, "patternType": "dot"}),
+        ),
+        r(
+            "sketch.notePaper",
+            "Note Paper…",
+            SKETCH,
+            "{imageBalance: 0..50 (25; lower tones darken the emboss, higher lighten it), graininess: 0..10 (0; fibrous paper texture), relief: 0..50 (4; emboss strength in points)} embosses the object's tones on warm paper, keeping its coverage. Original visual approximation from the public Sketch effects reference; slider ranges follow the documented control names, numeric defaults are chosen for VectorCraft and are not verified against proprietary defaults (the public help pages give no numbers).",
+            json!({"imageBalance": 25.0, "graininess": 0.0, "relief": 4.0}),
+        ),
+        r(
+            "sketch.photocopy",
+            "Photocopy…",
+            SKETCH,
+            "{detail: 1..24 (7; the larger, the finer the features that copy), darkness: 1..50 (25; the larger, the more of the dark copies)} copies the object in black on white: large dark areas copy only around their edges and midtones go to black or white. Coverage is kept. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"detail": 7.0, "darkness": 25.0}),
+        ),
+        r(
+            "sketch.plaster",
+            "Plaster…",
+            SKETCH,
+            "{imageBalance: 1..50 (20; higher values sink more of the image), smoothness: 1..15 (8; higher values soften the relief), lightDirection: \"bottom\"|\"bottomLeft\"|\"left\"|\"topLeft\"|\"top\"|\"topRight\"|\"right\"|\"bottomRight\" (\"top\")} molds the object in relief plaster and lights it from that direction; dark areas are raised and light areas recessed, keeping its coverage. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"imageBalance": 20.0, "smoothness": 8.0, "lightDirection": "top"}),
+        ),
+        r(
+            "sketch.reticulation",
+            "Reticulation…",
+            SKETCH,
+            "{density: 0..50 (12; finer grain at higher values), foregroundLevel: 0..50 (6; pulls shadows toward black ink), backgroundLevel: 0..50 (6; pulls highlights toward white paper)} redraws the object in black ink on white paper through a high-contrast film-grain screen, keeping its coverage. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"density": 12.0, "foregroundLevel": 6.0, "backgroundLevel": 6.0}),
+        ),
+        r(
+            "sketch.stamp",
+            "Stamp…",
+            SKETCH,
+            "{lightDarkBalance: 0..50 (25; the larger, the more of the object prints black), smoothness: 1..50 (5; rounds the shapes)} simplifies the object to solid black and white, as a rubber stamp would print it. Coverage is kept. Original visual approximation; chosen VectorCraft defaults.",
+            json!({"lightDarkBalance": 25.0, "smoothness": 5.0}),
+        ),
         r(
             "stylize.glowingEdges",
             "Glowing Edges…",
@@ -598,6 +740,13 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
         "{style?: \"roman\"|\"japanese\" (default: the japaneseCropMarks preference when applied)} trim marks in [Registration] around the object's bounds, following it",
         json!({}),
     ));
+    v.push(r(
+        RASTERIZE,
+        "Rasterize…",
+        &["Effect"],
+        "{colorModel: \"document\" (the document's mode, RGB or CMYK)|\"grayscale\"|\"bitmap\" (\"document\"), useDocumentResolution: bool (true: Document Raster Effects Settings › Resolution), resolution: ppi 1..2400 (72; with useDocumentResolution false), background: \"white\"|\"transparent\" (\"transparent\"), antiAlias: \"none\"|\"art\"|\"type\" (\"art\"; none: hard edges), clippingMask: bool (false; the image clipped to the art's outline), addAround: pt 0..1000 (0; room around the art)} draws the object as an image of square pixels over its bounds and the room around them, leaving its paths, type and other art as they are; when it is the object's only raster effect, Expand Appearance makes the image Object › Rasterize makes",
+        json!({"colorModel": "document", "useDocumentResolution": true, "resolution": 72.0, "background": "transparent", "antiAlias": "art", "clippingMask": false, "addAround": 0.0}),
+    ));
     v
 }
 
@@ -747,7 +896,7 @@ pub fn scale_effect(e: &mut Effect, s: f64) {
 
 /// Is `id` a raster (painted) effect?
 pub fn is_raster(id: &str) -> bool {
-    matches!(id, "stylize.dropShadow" | "stylize.innerGlow" | "stylize.outerGlow" | "stylize.feather" | "blur.gaussian")
+    matches!(id, "stylize.dropShadow" | "stylize.innerGlow" | "stylize.outerGlow" | "stylize.feather" | "blur.gaussian" | RASTERIZE)
         || PIXEL_EFFECTS.contains(&id)
 }
 
@@ -792,6 +941,12 @@ pub struct GeomContext<'a> {
     /// The seed of the Transform effect's Random: the object's id, so each object varies its own
     /// way and keeps its result on every redraw.
     pub seed: u64,
+    /// The object's appearance, which live-effect plug-ins are given read only (their fills and
+    /// strokes).
+    pub appearance: Option<&'a Appearance>,
+    /// The index in `appearance.items` of the fill or stroke whose own effects these are; `None`:
+    /// the object's effects.
+    pub item: Option<usize>,
 }
 
 impl<'a> GeomContext<'a> {
@@ -801,15 +956,17 @@ impl<'a> GeomContext<'a> {
             NodeKind::Path { rule, .. } | NodeKind::Compound { rule, .. } => *rule,
             _ => FillRule::NonZero,
         };
-        Self { stroke: n.appearance.stroke().filter(|s| !s.paint.is_none() && s.width > 0.0), rule, seed: n.id.0 }
+        let stroke = n.appearance.stroke().filter(|s| !s.paint.is_none() && s.width > 0.0);
+        Self { stroke, rule, seed: n.id.0, appearance: Some(&n.appearance), item: None }
     }
 
     /// The context of the effects on `item`, one of the same object's appearance items: a
-    /// stroke's own effects outline that stroke.
+    /// stroke's own effects outline that stroke, and a plug-in is told which item it is on.
     pub fn item(self, item: &'a AppearanceItem) -> Self {
+        let at = self.appearance.and_then(|a| a.items.iter().position(|i| std::ptr::eq(i, item)));
         match item {
-            AppearanceItem::Stroke(s) => Self { stroke: Some(s), ..self },
-            AppearanceItem::Fill(_) => self,
+            AppearanceItem::Stroke(s) => Self { stroke: Some(s), item: at, ..self },
+            AppearanceItem::Fill(_) => Self { item: at, ..self },
         }
     }
 }
@@ -848,7 +1005,8 @@ pub fn apply_geometry_bez(effects: &[Effect], path: &BezPath, bounds: Rect, ctx:
 pub(crate) fn apply_one(id: &str, p: &Value, path: &PathData, b: Rect, ctx: &GeomContext) -> PathData {
     use util::*;
     if let Some(plugin) = vectorcraft_plugins::effect::plugin_id(id) {
-        return vectorcraft_plugins::effect::apply(plugin, p, path, b, ctx.rule).unwrap_or_else(|| path.clone());
+        let paints = vectorcraft_plugins::effect::Paints { appearance: ctx.appearance, item: ctx.item };
+        return vectorcraft_plugins::effect::apply(plugin, p, path, b, ctx.rule, paints).unwrap_or_else(|| path.clone());
     }
     match id {
         "distort.freeDistort" => distort::free_distort(path, b, p),
@@ -865,6 +1023,9 @@ pub(crate) fn apply_one(id: &str, p: &Value, path: &PathData, b: Rect, ctx: &Geo
             }
             vectorcraft_pathops::offset_path(path, off, join(p, "joins"), num(p, "miterLimit", 4.0).clamp(1.0, 500.0))
         }
+        // Outline Object returns the geometry unchanged. Type reaches every geometry effect as its
+        // glyph outlines (`reshape::reshape`), so type that carries it is drawn as those outlines.
+        "path.outlineObject" => path.clone(),
         "path.outlineStroke" => {
             let fallback;
             let base = match ctx.stroke {

crates/effects/src/lighting.rs

@@ -0,0 +1,373 @@
+//! Shared conversion and vector paint shading for the 3D effects' directional lights.
+use serde_json::Value;
+use vectorcraft_doc::color::{Color, Paint};
+use vectorcraft_doc::{AppearanceItem, FillLayer};
+
+fn parse(v: &Value) -> Option<Color> {
+    let s = v.as_str()?;
+    // Match the command's opaque RGB contract, before any parsing or allocation.
+    (s.len() == 7 && s.starts_with('#') && s.as_bytes().iter().skip(1).all(u8::is_ascii_hexdigit)).then(|| Color::from_hex(s)).flatten()
+}
+
+pub(crate) fn light_color(p: &Value) -> [f64; 3] {
+    p.get("lightColor").and_then(parse).unwrap_or(Color::WHITE).to_rgb_uncalibrated().map(f64::from)
+}
+
+pub(crate) fn validate(p: &Value) -> Result<(), String> {
+    if p.get("lightColor").is_some_and(|v| parse(v).is_none()) {
+        return Err("lightColor must be an opaque RGB color in #rrggbb form".into());
+    }
+    if let Some(list) = p.get("lights").filter(|v| !v.is_null()) {
+        parse_lights(list)?;
+    }
+    Ok(())
+}
+
+pub(crate) fn lights(p: &Value) -> Option<vectorcraft_three_d::Lights> {
+    p.get("lights").filter(|v| !v.is_null()).and_then(|v| parse_lights(v).ok())
+}
+
+fn parse_lights(v: &Value) -> Result<vectorcraft_three_d::Lights, String> {
+    use vectorcraft_three_d::{Light, Lights, MAX_LIGHTS};
+    let list = v.as_array().filter(|v| !v.is_empty() && v.len() <= MAX_LIGHTS).ok_or("lights must contain one to ten lights")?;
+    let mut out = Vec::with_capacity(list.len());
+    for item in list {
+        let item = item.as_object().ok_or("each light must be an object")?;
+        if item.keys().any(|key| !["color", "intensity", "rotation", "height", "softness", "behind"].contains(&key.as_str())) {
+            return Err("unknown light setting: use color, intensity, rotation, height, softness or behind".into());
+        }
+        let defaults = Light::default();
+        let number = |key: &str, default: f64, min: f64, max: f64| -> Result<f64, String> {
+            match item.get(key) {
+                None => Ok(default),
+                Some(v) => v
+                    .as_f64()
+                    .filter(|n| n.is_finite() && *n >= min && *n <= max)
+                    .ok_or_else(|| format!("light {key} must be a number from {min} to {max}")),
+            }
+        };
+        let color = match item.get("color") {
+            None => [1.0; 3],
+            Some(v) => parse(v).ok_or("light color must use opaque #rrggbb")?.to_rgb_uncalibrated().map(f64::from),
+        };
+        let behind = item.get("behind").map_or(Ok(false), |v| v.as_bool().ok_or("light behind must be true or false"))?;
+        out.push(Light {
+            color,
+            behind,
+            intensity: number("intensity", defaults.intensity * 100.0, 0.0, 100.0)? / 100.0,
+            rotation: number("rotation", defaults.rotation, -180.0, 180.0)?,
+            height: number("height", defaults.height, 0.0, 90.0)?,
+            softness: number("softness", defaults.softness * 100.0, 0.0, 100.0)? / 100.0,
+        });
+    }
+    Lights::new(&out)
+}
+
+pub(crate) fn shade(c: Color, rgb: [f64; 3]) -> Color {
+    let [r, g, b] = c.to_rgb();
+    Color::rgb(r * rgb[0] as f32, g * rgb[1] as f32, b * rgb[2] as f32)
+}
+
+pub(crate) fn smooth_paint(g: vectorcraft_three_d::LightGradient, color: Color) -> Paint {
+    use vectorcraft_doc::color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = g.stops().into_iter().map(|(at, rgb)| GradientStop::new(at, shade(color, rgb))).collect();
+    let mut p = GradientPaint::new(Gradient { kind: GradientKind::Linear, stops });
+    p.geom = Some(GradientGeom { start: g.diffuse.start, end: g.diffuse.end, aspect: 1.0, focal: None });
+    Paint::Gradient(Box::new(p))
+}
+
+/// Multiply two independently placed vector gradients before applying the face's coverage
+/// once. Separately antialiasing the source and light along each triangle edge leaves seams.
+pub(crate) fn gradient_art(
+    id: vectorcraft_doc::NodeId,
+    path: &vectorcraft_geom::PathData,
+    paint: &Paint,
+    light: vectorcraft_three_d::LightGradient,
+) -> vectorcraft_doc::Node {
+    composed_art(id, path, paint, Ramp::Single(light), 0.75)
+}
+
+pub(crate) fn rgb_gradient_art(
+    id: vectorcraft_doc::NodeId,
+    path: &vectorcraft_geom::PathData,
+    paint: &Paint,
+    light: vectorcraft_three_d::RgbGradient,
+) -> vectorcraft_doc::Node {
+    composed_art(id, path, paint, Ramp::Rgb(light), 0.75)
+}
+
+/// Smooth Inflate triangles keep the seam within their narrow projected footprint.
+pub(crate) fn facet_art(
+    id: vectorcraft_doc::NodeId,
+    path: &vectorcraft_geom::PathData,
+    paint: &Paint,
+    light: vectorcraft_three_d::RgbGradient,
+    seam: f64,
+) -> vectorcraft_doc::Node {
+    let [r, g, b] = light.channels;
+    if r == g && g == b {
+        let light = vectorcraft_three_d::LightGradient { diffuse: r, ambient: 0.0, color: [1.0; 3] };
+        if let Some(color) = paint.color() {
+            let paint = smooth_paint(light, color);
+            let mut edge = vectorcraft_doc::StrokeLayer::new(paint.clone(), seam);
+            edge.join = vectorcraft_doc::LineJoin::Round;
+            return vectorcraft_doc::Node::path(
+                id,
+                path.clone(),
+                vectorcraft_doc::Appearance {
+                    items: vec![AppearanceItem::Fill(FillLayer::new(paint)), AppearanceItem::Stroke(edge)],
+                    ..Default::default()
+                },
+            );
+        }
+        return composed_art(id, path, paint, Ramp::Single(light), seam);
+    }
+    composed_art(id, path, paint, Ramp::Rgb(light), seam)
+}
+
+/// Composite smooth solid-fill facets with one clip and three channel groups per surface.
+/// Black channel backdrops keep shared edges opaque before the final coverage is applied.
+pub(crate) fn solid_surface(id: vectorcraft_doc::NodeId, facets: &[vectorcraft_three_d::Facet], paint: &Paint) -> vectorcraft_doc::Node {
+    use kurbo::Shape;
+    use std::sync::Arc;
+    use vectorcraft_doc::color::BlendMode;
+    use vectorcraft_doc::{Appearance, Node, NodeKind, StrokeLayer};
+    use vectorcraft_geom::{BezPath, PathData, Rect, shapes};
+
+    let mut boundary = BezPath::new();
+    let mut bounds = None;
+    for face in facets {
+        let path = face.path();
+        if let Some(b) = path.bounds() {
+            bounds = Some(bounds.map_or(b, |r: Rect| r.union(b)));
+        }
+        let mut contour = path.to_bezpath();
+        if contour.area() < 0.0 {
+            contour = contour.reverse_subpaths();
+        }
+        boundary.extend(contour.iter());
+    }
+    let clip = Node::path(id, PathData::from_bezpath(&boundary), Appearance::default());
+    let bounds = bounds.unwrap_or(Rect::ZERO).inflate(1.0, 1.0);
+    let cover = |paint| Node::path(id, shapes::rectangle(bounds), Appearance::basic(paint, Paint::None, 0.0));
+    let channels = (0..3)
+        .map(|channel| {
+            let mut color = [0.0; 3];
+            if let Some(value) = color.get_mut(channel) {
+                *value = 1.0;
+            }
+            let mut children = vec![Arc::new(cover(Paint::solid(Color::BLACK)))];
+            children.extend(facets.iter().map(|face| {
+                let paint = if let Some(ramp) = face.rgb_gradient {
+                    smooth_paint(vectorcraft_three_d::LightGradient { diffuse: ramp.channels[channel], ambient: 0.0, color }, Color::WHITE)
+                } else {
+                    Paint::solid(shade(Color::WHITE, color.map(|c| c * face.illumination[channel])))
+                };
+                let mut edge = StrokeLayer::new(paint.clone(), (face.thickness() / 2.0).clamp(0.05, 0.75));
+                edge.join = vectorcraft_doc::LineJoin::Round;
+                Arc::new(Node::path(
+                    id,
+                    face.path(),
+                    Appearance { items: vec![AppearanceItem::Fill(FillLayer::new(paint)), AppearanceItem::Stroke(edge)], ..Default::default() },
+                ))
+            }));
+            let mut group = Node::group(id, children);
+            group.isolate = true;
+            group.blend = BlendMode::Screen;
+            Arc::new(group)
+        })
+        .collect();
+    let mut light = Node::group(id, channels);
+    light.isolate = true;
+    light.blend = BlendMode::Multiply;
+    let mut colors = Node::group(id, vec![Arc::new(cover(paint.clone())), Arc::new(light)]);
+    colors.isolate = true;
+    Node::new(id, NodeKind::Group { children: vec![Arc::new(clip), Arc::new(colors)], clip: true })
+}
+
+enum Ramp {
+    Single(vectorcraft_three_d::LightGradient),
+    Rgb(vectorcraft_three_d::RgbGradient),
+}
+
+/// Separate a gradient's color and coverage so a tessellated surface can apply its opacity
+/// once, instead of building opacity at the overlapping seam strokes of adjacent faces.
+pub(crate) fn opaque_paint(paint: &Paint) -> (Paint, Option<Paint>) {
+    let mut base = paint.clone();
+    let mut mask = paint.clone();
+    let mut transparent = false;
+    if let (Paint::Gradient(b), Paint::Gradient(m)) = (&mut base, &mut mask) {
+        b.swatch = None;
+        m.swatch = None;
+        for (b, m) in b.gradient.stops.iter_mut().zip(&mut m.gradient.stops) {
+            transparent |= b.opacity != 1.0;
+            b.opacity = 1.0;
+            m.color = Color::WHITE;
+            m.swatch = None;
+            m.tint = 1.0;
+        }
+        if let (Some(b), Some(m)) = (&mut b.freeform, &mut m.freeform) {
+            for (b, m) in b.points.iter_mut().zip(&mut m.points) {
+                transparent |= b.opacity != 1.0;
+                b.opacity = 1.0;
+                m.color = Color::WHITE;
+            }
+        }
+    }
+    (base, transparent.then_some(mask))
+}
+
+fn composed_art(id: vectorcraft_doc::NodeId, path: &vectorcraft_geom::PathData, paint: &Paint, light: Ramp, seam: f64) -> vectorcraft_doc::Node {
+    use kurbo::Shape;
+    use std::sync::Arc;
+    use vectorcraft_doc::color::BlendMode;
+    use vectorcraft_doc::{Appearance, Node, NodeKind, OpacityMask};
+    use vectorcraft_geom::{Rect, shapes};
+    let (base, mask) = opaque_paint(paint);
+    // Clip once to the union of this single-contour face and its round seam stroke.
+    // Align their winding so the nonzero fill adds coverage instead of cancelling it.
+    let mut boundary = path.to_bezpath();
+    let mut footprint = kurbo::stroke(boundary.iter(), &kurbo::Stroke::new(seam).with_join(kurbo::Join::Round), &kurbo::StrokeOpts::default(), 0.05);
+    if boundary.area() * footprint.area() < 0.0 {
+        boundary = boundary.reverse_subpaths();
+    }
+    footprint.extend(boundary.iter());
+    let clip = Node::path(id, vectorcraft_geom::PathData::from_bezpath(&footprint), Appearance::default());
+    // Opaque rectangles cover the complete seam stroke, without separately antialiasing
+    // either ramp. Opaque sources need only vector clipping, not full-frame opacity masks.
+    let bounds = path.bounds().unwrap_or(Rect::ZERO).inflate(1.0, 1.0);
+    let cover = |paint| Node::path(id, shapes::rectangle(bounds), Appearance::basic(paint, Paint::None, 0.0));
+    let mut illumination = match light {
+        Ramp::Single(light) => cover(smooth_paint(light, Color::WHITE)),
+        Ramp::Rgb(light) => {
+            let channels = light
+                .channels
+                .iter()
+                .enumerate()
+                .map(|(channel, gradient)| {
+                    let mut color = [0.0; 3];
+                    if let Some(value) = color.get_mut(channel) {
+                        *value = 1.0;
+                    }
+                    let mut layer = cover(smooth_paint(vectorcraft_three_d::LightGradient { diffuse: *gradient, ambient: 0.0, color }, Color::WHITE));
+                    // Screen adds disjoint R, G and B channels exactly; no light is clamped
+                    // separately. Each ramp already holds the sum of all directional lights.
+                    layer.blend = BlendMode::Screen;
+                    Arc::new(layer)
+                })
+                .collect();
+            let mut group = Node::group(id, channels);
+            group.isolate = true;
+            group
+        }
+    };
+    illumination.blend = BlendMode::Multiply;
+    let mut colors = Node::group(id, vec![Arc::new(cover(base)), Arc::new(illumination)]);
+    colors.isolate = true;
+    // Keep isolation inside the clip: the clip then applies to the finished colors,
+    // rather than separately antialiasing each of the two gradient drawings.
+    let mut face = Node::new(id, NodeKind::Group { children: vec![Arc::new(clip), Arc::new(colors)], clip: true });
+    if let Some(mask) = mask {
+        face.extras_mut().mask = Some(Box::new(OpacityMask::new(cover(mask), true)));
+    }
+    face
+}
+
+pub(crate) fn fills(paint: &Paint, rgb: [f64; 3], brightness: f64, colored: bool) -> Vec<AppearanceItem> {
+    let shade = |c: Color| shade(c, rgb);
+    if let Some(c) = paint.color() {
+        return vec![AppearanceItem::Fill(FillLayer::new(Paint::solid(shade(c))))];
+    }
+    // Keep the white-light gradient treatment identical to existing documents. Colored light
+    // shades the ramp itself, keeping placement, stops, midpoint and opacity as vector data.
+    if matches!(paint, Paint::Gradient(_)) && colored {
+        let mut shaded = paint.clone();
+        vectorcraft_doc::recolor::map_paint(&mut shaded, &shade);
+        if let Paint::Gradient(g) = &mut shaded {
+            g.swatch = None;
+        }
+        return vec![AppearanceItem::Fill(FillLayer::new(shaded))];
+    }
+    // Pattern tiles remain referenced artwork. Retain their existing neutral shadow
+    // approximation; tinting arbitrary pattern contents needs document-level evaluation.
+    let mut shadow = FillLayer::new(Paint::solid(Color::BLACK));
+    shadow.opacity = (1.0 - brightness) as f32;
+    vec![AppearanceItem::Fill(FillLayer::new(paint.clone())), AppearanceItem::Fill(shadow)]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    use vectorcraft_doc::color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    use vectorcraft_geom::Point;
+
+    #[test]
+    fn command_contract_is_strict_and_loaded_invalid_colors_fall_back_to_white() {
+        assert_eq!(light_color(&json!({})), [1.0; 3]);
+        assert_eq!(light_color(&json!({"lightColor":"#FF0000"})), [1.0, 0.0, 0.0]);
+        for v in [json!("#ff0"), json!("#ffffff80"), json!("blue"), json!("#gg0000"), json!(null), json!([1, 0, 0])] {
+            let p = json!({"lightColor":v});
+            assert!(validate(&p).is_err(), "{p}");
+            assert_eq!(light_color(&p), [1.0; 3]);
+        }
+    }
+
+    #[test]
+    fn malformed_loaded_lists_keep_the_legacy_light_and_valid_lists_override_it() {
+        for value in [json!([]), json!(vec![json!({}); 11]), json!([false]), json!([{"height": 91}]), json!([{"color":"#ff0"}])] {
+            let p = json!({"lights": value, "lightColor":"#ff0000"});
+            assert!(lights(&p).is_none());
+            assert_eq!(light_color(&p), [1.0, 0.0, 0.0]);
+            assert!(validate(&p).is_err());
+        }
+        let p = json!({"lights":[{}, {"color":"#0000ff","intensity":40}], "lightColor":"#ff0000"});
+        let list = lights(&p).unwrap();
+        assert_eq!(list.iter().count(), 2);
+        assert_eq!(*list.iter().next().unwrap(), vectorcraft_three_d::Light::default());
+        assert_eq!(list.iter().nth(1).unwrap().color, [0.0, 0.0, 1.0]);
+    }
+
+    #[test]
+    fn colored_gradient_keeps_placement_alpha_and_midpoints() {
+        let mut stop = GradientStop::new(0.0, Color::WHITE);
+        stop.opacity = 0.4;
+        stop.midpoint = 0.3;
+        let g = GradientPaint {
+            gradient: Gradient { kind: GradientKind::Linear, stops: vec![stop, GradientStop::new(1.0, Color::BLACK)] },
+            geom: Some(GradientGeom { start: Point::new(20.0, 30.0), end: Point::new(100.0, 30.0), aspect: 1.0, focal: None }),
+            angle: 0.0,
+            swatch: None,
+            freeform: None,
+        };
+        let paint = Paint::Gradient(Box::new(g.clone()));
+        let items = fills(&paint, [1.0, 0.25, 0.25], 1.0, true);
+        let Paint::Gradient(shaded) = items[0].paint() else { panic!("vector gradient") };
+        assert_eq!(shaded.geom, g.geom);
+        assert_eq!(shaded.gradient.stops[0].color.to_rgb(), [1.0, 0.25, 0.25]);
+        assert_eq!(shaded.gradient.stops[0].opacity, 0.4);
+        assert_eq!(shaded.gradient.stops[0].midpoint, 0.3);
+        assert_eq!(shaded.gradient.stops[1].color, Color::BLACK);
+        assert_eq!(paint, Paint::Gradient(Box::new(g)));
+        let white = fills(&paint, [0.4; 3], 0.4, false);
+        assert_eq!(white[0].paint(), &paint, "white retains the previous gradient treatment");
+        assert_eq!(white.len(), 2);
+        let unlit = fills(&paint, [0.25; 3], 0.25, true);
+        assert_eq!(unlit.len(), 1, "neutral ambient under colored light still tints once");
+        let mut freeform = if let Paint::Gradient(g) = paint { g } else { panic!("gradient") };
+        freeform.gradient.kind = GradientKind::Freeform;
+        freeform.gradient.stops = vec![GradientStop::new(0.0, Color::BLACK)];
+        freeform.swatch = Some("Original ramp".into());
+        freeform.freeform = Some(vectorcraft_doc::color::Freeform {
+            points: vec![vectorcraft_doc::color::FreeformPoint::new(Point::new(12.0, 18.0), Color::WHITE)],
+            ..Default::default()
+        });
+        let original = Paint::Gradient(freeform);
+        let items = fills(&original, [1.0, 0.25, 0.25], 1.0, true);
+        let Paint::Gradient(shaded) = items[0].paint() else { panic!("freeform gradient") };
+        let point = shaded.freeform.as_ref().unwrap().points[0];
+        assert_eq!(point.at, Point::new(12.0, 18.0));
+        assert_eq!(point.color.to_rgb(), [1.0, 0.25, 0.25]);
+        assert_eq!(shaded.swatch, None, "a changed freeform point detaches the gradient swatch");
+    }
+}

crates/effects/src/pixel/artistic.rs

@@ -1,11 +1,15 @@
-//! Effect › Artistic. Original filters built from public behaviour documentation:
+//! Effect › Artistic (Cutout, Film Grain, Neon Glow, Plastic Wrap, Poster Edges). Original filters built from
+//! public behaviour documentation:
 //! <https://helpx.adobe.com/illustrator/using/summary-effects.html> and
 //! <https://helpx.adobe.com/photoshop-elements/using/artistic-filters.html>.
 //! These are visual approximations, not reproductions of a proprietary algorithm.
 
-use super::PixelSpace;
+use super::edges::sobel;
 use super::pixelate::{Place, cell, rand};
+
+const SALT_PLASTIC: u64 = 512;
 use super::texture::{luma, premultiply, straight};
+use super::{PixelSpace, blur_plane};
 use vectorcraft_geom::Point;
 
 const SALT_FILM: u64 = 256;
@@ -134,3 +138,208 @@ pub(super) fn film_grain(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSp
         *p = premultiply(c, f32::from(p[3]) / 255.0);
     });
 }
+
+/// The coverage-weighted Gaussian softening of the planes `planes` (premultiplied by `alpha`) by
+/// `sigma` pixels: each divided by the softened coverage, so transparency doesn't darken edges.
+fn soften(planes: &mut [Vec<f32>], alpha: &[f32], w: usize, h: usize, sigma: f64) {
+    let mut a = alpha.to_vec();
+    blur_plane(&mut a, w, h, sigma);
+    for plane in planes {
+        for (v, c) in plane.iter_mut().zip(alpha) {
+            *v *= c;
+        }
+        blur_plane(plane, w, h, sigma);
+        for (v, c) in plane.iter_mut().zip(&a) {
+            *v = if *c > 1e-4 { (*v / c).clamp(0.0, 1.0) } else { 0.0 };
+        }
+    }
+}
+
+/// The pixels' straight colour channels and their coverage (0..1), as planes.
+fn planes(px: &[[u8; 4]]) -> ([Vec<f32>; 3], Vec<f32>) {
+    let colours = px.iter().map(|p| straight(*p)).collect::<Vec<_>>();
+    (std::array::from_fn(|k| colours.iter().map(|c| c[k]).collect()), px.iter().map(|p| f32::from(p[3]) / 255.0).collect())
+}
+
+/// Cutout: the object as flat pieces of coloured paper. Its colours, softened as `simplicity`
+/// (0..10) asks and less as `fidelity` (1..3) keeps detail, fall into `levels` (2..8) steps per
+/// colour channel; each step's piece is painted in the average colour of what falls into it, so
+/// colours keep their hue. Slivers (the blends along softened edges) take the nearest large
+/// piece's colour, so the pieces meet with crisp edges. Coverage is kept.
+pub(super) fn cutout(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, levels: f64, simplicity: f64, fidelity: f64) {
+    if !([levels, simplicity, fidelity].iter().all(|v| v.is_finite()) && space.px.is_finite() && space.px > 0.0) {
+        return;
+    }
+    let levels = levels.round().clamp(2.0, 8.0) as usize;
+    // Simpler edges come from softer colours; more fidelity softens them less.
+    let sigma = 0.6 * simplicity.clamp(0.0, 10.0) * (4.0 - fidelity.clamp(1.0, 3.0)) / 3.0 / space.px;
+    let (mut colour, alpha) = planes(px);
+    soften(&mut colour, &alpha, w, h, sigma);
+    let at = |k: usize| [0, 1, 2].map(|i| colour[i].get(k).copied().unwrap_or(0.0));
+    let piece = |c: [f32; 3]| c.iter().fold(0, |n, v| n * levels + ((v * levels as f32) as usize).min(levels - 1));
+    // Each piece's colour: the coverage-weighted mean of the softened colours in it.
+    let mut sums = vec![[0.0f64; 4]; levels * levels * levels];
+    for (k, a) in alpha.iter().enumerate() {
+        let c = at(k);
+        let Some(sum) = sums.get_mut(piece(c)) else { continue };
+        for (s, v) in sum.iter_mut().zip(c) {
+            *s += f64::from(v * a);
+        }
+        sum[3] += f64::from(*a);
+    }
+    let mean = |sum: &[f64; 4]| [0, 1, 2].map(|i| (sum[i] / sum[3]) as f32);
+    let total: f64 = sums.iter().map(|s| s[3]).sum();
+    let heaviest = sums.iter().map(|s| s[3]).fold(0.0, f64::max);
+    // Pieces of at least 1% of the object (and always the largest one) are kept.
+    let large: Vec<[f32; 3]> = sums.iter().filter(|s| s[3] > 0.0 && (s[3] >= 0.01 * total || s[3] >= heaviest)).map(mean).collect();
+    let paint: Vec<Option<[f32; 3]>> = sums
+        .iter()
+        .map(|s| {
+            let c = (s[3] > 0.0).then(|| mean(s))?;
+            let far = |o: &[f32; 3]| o.iter().zip(c).map(|(a, b)| (a - b) * (a - b)).sum::<f32>();
+            large.iter().min_by(|a, b| far(a).total_cmp(&far(b))).copied()
+        })
+        .collect();
+    for (k, p) in px.iter_mut().enumerate() {
+        if p[3] == 0 {
+            continue;
+        }
+        if let Some(Some(c)) = paint.get(piece(at(k))) {
+            *p = premultiply(*c, f32::from(p[3]) / 255.0);
+        }
+    }
+}
+
+/// Poster Edges: the object's colours posterized to `posterization` + 2 (2..8) levels per
+/// channel, with black lines drawn on the edges of any of its colour channels and of its outline. `thickness` (0..10) widens the lines and
+/// `intensity` (0..10) darkens them and lets fainter edges take a line. Coverage is kept.
+pub(super) fn poster_edges(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, thickness: f64, intensity: f64, posterization: f64) {
+    if !([thickness, intensity, posterization].iter().all(|v| v.is_finite()) && space.px.is_finite() && space.px > 0.0) {
+        return;
+    }
+    let steps = (posterization.round().clamp(0.0, 6.0) + 1.0) as f32;
+    // The edges of each premultiplied channel (so the object's outline too), a step of 1 reading 1.
+    let mut edges = vec![0.0f32; px.len()];
+    for k in 0..4 {
+        let plane: Vec<f32> = px.iter().map(|p| f32::from(p[k]) / 255.0).collect();
+        for (e, s) in edges.iter_mut().zip(sobel(&plane, w, h)) {
+            *e = e.max(s / 4.0);
+        }
+    }
+    // Wider lines spread the edges; scale them back up so a spread line stays as dark.
+    let sigma = (0.3 + 0.25 * thickness.clamp(0.0, 10.0)) / space.px;
+    blur_plane(&mut edges, w, h, sigma);
+    let gain = ((0.3 + 0.25 * intensity.clamp(0.0, 10.0)) * (1.0 + 1.5 * sigma.max(0.0))) as f32;
+    for (p, e) in px.iter_mut().zip(edges) {
+        if p[3] == 0 {
+            continue;
+        }
+        let t = ((e * gain - 0.25) / 0.5).clamp(0.0, 1.0);
+        let ink = t * t * (3.0 - 2.0 * t);
+        let c = straight(*p).map(|v| (v * steps).round() / steps * (1.0 - ink));
+        *p = premultiply(c, f32::from(p[3]) / 255.0);
+    }
+}
+
+/// How far (document units) Plastic Wrap's softened relief is sampled at `smoothness` (1..15).
+pub(super) fn plastic_reach(smoothness: f64) -> f64 {
+    3.0 * (0.15 + 0.35 * smoothness.clamp(1.0, 15.0))
+}
+
+/// Plastic Wrap: the object under shiny plastic. Its tones form a relief; `detail` (0..15) adds
+/// finer wrinkles in document space; `smoothness` (1..15) softens the relief; specular highlights
+/// as strong as `highlight` (0..20) are screened over it. Coverage is kept.
+pub(super) fn plastic_wrap(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, highlight: f64, detail: f64, smoothness: f64) {
+    if ![highlight, detail, smoothness].iter().all(|v| v.is_finite()) || !space.px.is_finite() || space.px <= 0.0 {
+        return;
+    }
+    let strength = (highlight / 20.0).clamp(0.0, 1.0) as f32;
+    if strength == 0.0 {
+        return;
+    }
+    let detail_amt = (detail / 15.0).clamp(0.0, 1.0) as f32;
+    let sigma = (0.15 + 0.35 * smoothness.clamp(1.0, 15.0)) / space.px;
+    let Some(place) = Place::new(space, w, h) else { return };
+    let len = px.len();
+    let mut height = vec![0.0f32; len];
+    let alpha: Vec<f32> = px.iter().map(|p| f32::from(p[3]) / 255.0).collect();
+    let cell_scale = 8.0 + 24.0 * (1.0 - detail_amt as f64);
+    let mut noise = CellNoise::default();
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let i = y * w + x;
+        let l = luma(straight(*p));
+        let q = place.at(x, y);
+        let nq = Point::new(q.x / cell_scale, q.y / cell_scale);
+        height[i] = l + detail_amt * 0.35 * noise.at(SALT_PLASTIC, nq) as f32;
+    });
+    for (h, a) in height.iter_mut().zip(&alpha) {
+        *h *= *a;
+    }
+    blur_plane(&mut height, w, h, sigma);
+    let mut cov = alpha.clone();
+    blur_plane(&mut cov, w, h, sigma);
+    for (h, c) in height.iter_mut().zip(&cov) {
+        *h = if *c > 1e-4 { *h / *c } else { 0.0 };
+    }
+    const LIGHT: [f32; 3] = [0.35, -0.25, 0.9];
+    let inv = (LIGHT[0] * LIGHT[0] + LIGHT[1] * LIGHT[1] + LIGHT[2] * LIGHT[2]).sqrt().max(1e-6);
+    let light = LIGHT.map(|v| v / inv);
+    let scale = (8.0 * space.px).max(1e-6) as f32;
+    let sample = |x: isize, y: isize| -> f32 {
+        if x < 0 || y < 0 || x >= w as isize || y >= h as isize {
+            return 0.0;
+        }
+        height[y as usize * w + x as usize]
+    };
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let gx = sample(x as isize + 1, y as isize) - sample(x as isize - 1, y as isize);
+        let gy = sample(x as isize, y as isize + 1) - sample(x as isize, y as isize - 1);
+        let nx = -gx / scale;
+        let ny = -gy / scale;
+        let nz = 1.0;
+        let nlen = (nx * nx + ny * ny + nz * nz).sqrt().max(1e-6);
+        let ndotl = (nx / nlen * light[0] + ny / nlen * light[1] + nz / nlen * light[2]).max(0.0);
+        let spec = ndotl.powi(12) * strength;
+        if spec <= 1e-5 {
+            return;
+        }
+        let c = straight(*p).map(|v| 1.0 - (1.0 - v) * (1.0 - spec));
+        *p = premultiply(c, f32::from(p[3]) / 255.0);
+    });
+}
+
+/// How far (document units) Neon Glow's glow spreads at `size` (-24..24).
+pub(super) fn glow_spread(size: f64) -> f64 {
+    0.25 * size.abs().min(24.0)
+}
+
+/// Neon Glow: the object in dimmed greys, lit by `colour` glowing from its light areas (`size`
+/// above 0) or from its dark areas (below 0), spread as far as |`size`| (0..24) says and as
+/// strong as `brightness` (0..50). Coverage is kept.
+pub(super) fn neon_glow(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, size: f64, brightness: f64, colour: [f32; 3]) {
+    if !([size, brightness].iter().all(|v| v.is_finite()) && space.px.is_finite() && space.px > 0.0) {
+        return;
+    }
+    let strength = (brightness / 50.0).clamp(0.0, 1.0) as f32;
+    let tones: Vec<f32> = px.iter().map(|p| luma(straight(*p))).collect();
+    let alpha: Vec<f32> = px.iter().map(|p| f32::from(p[3]) / 255.0).collect();
+    let mut glow = [tones.iter().map(|l| if size < 0.0 { 1.0 - l } else { *l }).collect::<Vec<_>>()];
+    soften(&mut glow, &alpha, w, h, glow_spread(size) / space.px);
+    let [glow] = glow;
+    for ((p, tone), g) in px.iter_mut().zip(tones).zip(glow) {
+        if p[3] == 0 {
+            continue;
+        }
+        // The greys dim as the glow brightens, and the glow is screened over them.
+        let base = tone * (1.0 - 0.6 * strength);
+        let lit = (3.0 * g * strength).clamp(0.0, 1.0);
+        let c = colour.map(|v| 1.0 - (1.0 - base) * (1.0 - v.clamp(0.0, 1.0) * lit));
+        *p = premultiply(c, f32::from(p[3]) / 255.0);
+    }
+}

crates/effects/src/pixel/blur.rs

@@ -102,6 +102,40 @@ fn close(a: &Px16, b: &Px16, t: i32) -> bool {
     a.iter().zip(b).all(|(a, b)| (*a as i32 - *b as i32).abs() <= t)
 }
 
+/// The offsets Smart Blur looks at around a pixel out to about `r` pixels (up to round(`r`)),
+/// with the radius of the box blur of the copy they are read from (0: the pixels themselves):
+/// every pixel of the square of side 2 · round(`r`) + 1, or `samples` × `samples` points spread
+/// over the square once it is wider than `samples` pixels, read from a copy box-blurred over the
+/// gaps between them. The callers keep the offsets inside their disc.
+fn smart_grid(r: f64, samples: u32) -> (Vec<Vec2>, usize) {
+    let n = samples.clamp(3, 15) as f64;
+    let k = r.round();
+    if 2.0 * k < n {
+        let k = k as i32;
+        ((-k..=k).flat_map(|dy| (-k..=k).map(move |dx| Vec2::new(dx as f64, dy as f64))).collect(), 0)
+    } else {
+        let gap = 2.0 * r / (n - 1.0);
+        let grid = (0..n as i32).map(|i| -r + gap * i as f64);
+        (grid.clone().flat_map(|dy| grid.clone().map(move |dx| Vec2::new(dx.round(), dy.round()))).collect(), (gap / 2.0).floor() as usize)
+    }
+}
+
+/// How far from a pixel Smart Blur's edge modes ([`smart_edges`]) read, in the units of `radius`:
+/// `radius`, and the box blur of the copy that a wide radius's offsets are read from.
+pub(super) fn edge_reach(radius: f64, samples: u32) -> f64 {
+    radius + radius / (samples.clamp(3, 15) as f64 - 1.0)
+}
+
+/// `src` (rows of `w` pixels) box-blurred with radius `prefilter`, the copy that the offsets of
+/// [`smart_grid`] are read from; `None` when they are read from `src` itself.
+fn smart_near(src: &[Px16], w: usize, prefilter: usize) -> Option<Vec<Px16>> {
+    (prefilter > 0).then(|| {
+        let mut b = src.to_vec();
+        box_blur(&mut b, w, prefilter);
+        b
+    })
+}
+
 /// Smart Blur (Normal mode): each pixel averaged with itself and the neighbours within `radius`
 /// pixels whose premultiplied channels all lie within `threshold` levels of its own. Wide radii
 /// look at `samples` × `samples` neighbours spread over the disc, read from a copy box-blurred
@@ -113,28 +147,12 @@ pub(super) fn smart(px: &mut [[u8; 4]], w: usize, h: usize, radius: f64, thresho
         return;
     }
     let r = radius.min(MAX_SMART);
-    let n = samples.clamp(3, 15) as f64;
-    let k = r.round();
-    let (offsets, prefilter): (Vec<Vec2>, usize) = if 2.0 * k < n {
-        let k = k as i32;
-        ((-k..=k).flat_map(|dy| (-k..=k).map(move |dx| Vec2::new(dx as f64, dy as f64))).collect(), 0)
-    } else {
-        let gap = 2.0 * r / (n - 1.0);
-        let grid = (0..n as i32).map(|i| -r + gap * i as f64);
-        (grid.clone().flat_map(|dy| grid.clone().map(move |dx| Vec2::new(dx.round(), dy.round()))).collect(), (gap / 2.0).floor() as usize)
-    };
+    let (offsets, prefilter) = smart_grid(r, samples);
     let offsets: Vec<(isize, isize)> =
         offsets.into_iter().filter(|o| o.hypot() <= r + 0.5 && *o != Vec2::ZERO).map(|o| (o.x as isize, o.y as isize)).collect();
     let src = to16(px);
-    let blurred;
-    let near: &[Px16] = if prefilter > 0 {
-        let mut b = src.clone();
-        box_blur(&mut b, w, prefilter);
-        blurred = b;
-        &blurred
-    } else {
-        &src
-    };
+    let blurred = smart_near(&src, w, prefilter);
+    let near = blurred.as_deref().unwrap_or(&src);
     let t = levels(threshold);
     for (y, (row, out)) in src.chunks_exact(w).zip(px.chunks_exact_mut(w)).enumerate().take(h) {
         for (x, (c, o)) in row.iter().zip(out.iter_mut()).enumerate() {
@@ -162,33 +180,41 @@ pub(super) fn smart(px: &mut [[u8; 4]], w: usize, h: usize, radius: f64, thresho
 
 /// Smart Blur's Edge Only (`overlay` false) and Overlay Edge (`overlay` true) modes: the pixels on
 /// an edge drawn white, over black or over the Normal mode's result ([`smart`]). A pixel is on an
-/// edge when one of its four nearest neighbors (transparent beyond the raster) has a premultiplied
-/// channel more than `threshold` levels from its own and its channels add up to at least the
-/// neighbor's, so a step between two colors gives a line one pixel wide on the side whose channels
-/// add up to more, and two pixels wide when the sums are equal. The white and the black keep the
-/// pixel's coverage.
+/// edge when one of the pixels the search reads within `radius` pixels of it (transparent beyond
+/// the raster) has a premultiplied channel more than `threshold` levels from its own and its
+/// channels add up to at least that pixel's. The search reads the Normal mode's offsets ([`smart_grid`]) for the whole
+/// pixels of `radius`, kept within `radius`, from the pixels and, for a wide radius, from the
+/// box-blurred copy, and always the four nearest pixels. A straight step between two colors gives
+/// a line on the side whose channels add up to more, about `radius` wide (the whole pixels of
+/// `radius` while every pixel within it is read, and at least one pixel), and lines on both sides
+/// when the sums are equal. The white and the black keep the pixel's coverage.
 pub(super) fn smart_edges(px: &mut [[u8; 4]], w: usize, h: usize, radius: f64, threshold: f64, samples: u32, overlay: bool) {
     let src = to16(px);
     let t = levels(threshold);
     let sum = |p: &Px16| p.iter().map(|v| u32::from(*v)).sum::<u32>();
-    let at = |x: usize, y: usize, dx: isize, dy: isize| -> Px16 {
-        let (Some(x), Some(y)) = (x.checked_add_signed(dx), y.checked_add_signed(dy)) else { return [0; 4] };
-        if x >= w || y >= h {
-            return [0; 4];
+    let r = if radius.is_nan() { 0.0 } else { radius.min(MAX_SMART) };
+    // Spread over whole pixels, so that the outermost offsets lie within `r` and are kept.
+    let (offsets, prefilter) = smart_grid(r.floor(), samples);
+    let wide: Vec<(isize, isize)> = offsets.into_iter().filter(|o| o.hypot() > 1.0 && o.hypot() <= r).map(|o| (o.x as isize, o.y as isize)).collect();
+    let nearest = [(1, 0), (-1, 0), (0, 1), (0, -1)];
+    let blurred = smart_near(&src, w, prefilter);
+    let mut edge = vec![false; src.len()];
+    for (y, (row, out)) in src.chunks_exact(w).zip(edge.chunks_exact_mut(w)).enumerate().take(h) {
+        for (x, (c, e)) in row.iter().zip(out.iter_mut()).enumerate() {
+            let own = sum(c);
+            let differs = |n: &Px16| !close(n, c, t) && own >= sum(n);
+            // The pixel at the offset and, with `copy`, its blurred copy; transparent beyond the raster.
+            let found = |(dx, dy): &(isize, isize), copy: bool| {
+                let (sx, sy) = (x as isize + dx, y as isize + dy);
+                if sx < 0 || sy < 0 || sx as usize >= w || sy as usize >= h {
+                    return differs(&[0; 4]);
+                }
+                let i = sy as usize * w + sx as usize;
+                src.get(i).is_some_and(differs) || (copy && blurred.as_deref().and_then(|b| b.get(i)).is_some_and(differs))
+            };
+            *e = nearest.iter().any(|o| found(o, false)) || wide.iter().any(|o| found(o, true));
         }
-        src.get(y * w + x).copied().unwrap_or([0; 4])
-    };
-    let edge: Vec<bool> = src
-        .iter()
-        .enumerate()
-        .map(|(i, c)| {
-            let (x, y) = (i % w.max(1), i / w.max(1));
-            [(1, 0), (-1, 0), (0, 1), (0, -1)].iter().any(|(dx, dy)| {
-                let n = at(x, y, *dx, *dy);
-                !close(&n, c, t) && sum(c) >= sum(&n)
-            })
-        })
-        .collect();
+    }
     if overlay {
         smart(px, w, h, radius, threshold, samples);
     }

crates/effects/src/pixel/brushstrokes.rs

@@ -64,9 +64,9 @@ impl StrokeDirection {
 }
 
 /// Along a right diagonal stroke, rising to the right (y down).
-const RIGHT: Vec2 = Vec2::new(FRAC_1_SQRT_2, -FRAC_1_SQRT_2);
+pub(super) const RIGHT: Vec2 = Vec2::new(FRAC_1_SQRT_2, -FRAC_1_SQRT_2);
 /// Along a left diagonal stroke, falling to the right.
-const LEFT: Vec2 = Vec2::new(FRAC_1_SQRT_2, FRAC_1_SQRT_2);
+pub(super) const LEFT: Vec2 = Vec2::new(FRAC_1_SQRT_2, FRAC_1_SQRT_2);
 
 /// The most samples a stroke averages, whatever its length.
 const MAX_SAMPLES: usize = 16;
@@ -75,7 +75,7 @@ const MAX_SAMPLES: usize = 16;
 const JITTER: f64 = 0.25;
 
 /// How soft (points, the σ) the tones are that decide which strokes a pixel gets.
-const TONE_SOFTNESS: f64 = 1.0;
+pub(super) const TONE_SOFTNESS: f64 = 1.0;
 
 /// Dark Strokes' short dark strokes and long light ones (points).
 pub(super) const DARK_LENGTH: f64 = 3.0;
@@ -86,7 +86,7 @@ const INK_SOFTNESS: f64 = 0.6;
 
 /// A pixel at 72 ppi (points): how far the neighbours of the Sobel operator and of sampling
 /// between pixels add to a filter's reach.
-const MARGIN: f64 = 1.0;
+pub(super) const MARGIN: f64 = 1.0;
 
 /// How far (document units) strokes `len` long reach: half their length, their random shift, the
 /// softening between their samples and the pixels a sample is taken between.
@@ -137,18 +137,18 @@ pub(super) fn spray_shift(radius: f64) -> f64 {
 
 /// The object's colours averaged along strokes `len` long: [`MAX_SAMPLES`] at most, the object
 /// softened first when they lie more than a pixel apart.
-struct Smear<'a> {
+pub(super) struct Smear<'a> {
     /// Premultiplied colours (0..1).
     src: Vec<[f32; 4]>,
     w: usize,
     h: usize,
     place: &'a Place,
-    len: f64,
+    pub(super) len: f64,
     n: usize,
 }
 
 impl<'a> Smear<'a> {
-    fn new(px: &[[u8; 4]], w: usize, h: usize, place: &'a Place, len: f64) -> Self {
+    pub(super) fn new(px: &[[u8; 4]], w: usize, h: usize, place: &'a Place, len: f64) -> Self {
         let len = if len.is_finite() { len.max(0.0) } else { 0.0 };
         let span = len / place.px;
         let n = if span.is_finite() { (span.ceil() as usize).saturating_add(1).clamp(1, MAX_SAMPLES) } else { MAX_SAMPLES };
@@ -218,7 +218,7 @@ impl<'a> Smear<'a> {
     }
 
     /// The stroke of pattern `salt` through `q` along `dir`, its rows `width` apart.
-    fn stroke(&self, salt: u64, q: Point, dir: Vec2, width: f64) -> [f32; 4] {
+    pub(super) fn stroke(&self, salt: u64, q: Point, dir: Vec2, width: f64) -> [f32; 4] {
         self.at(q + dir * stroke_shift(salt, q, dir, self.len, width), dir)
     }
 }
@@ -242,37 +242,37 @@ fn stroke_shift(salt: u64, q: Point, dir: Vec2, len: f64, width: f64) -> f64 {
 }
 
 /// Smooth noise in [-1, 1) streaked along `dir`: blobs `along` long and `across` wide.
-fn streak(salt: u64, q: Point, dir: Vec2, along: f64, across: f64) -> f64 {
+pub(super) fn streak(salt: u64, q: Point, dir: Vec2, along: f64, across: f64) -> f64 {
     let (u, v) = frame(q, dir);
     2.0 * value_noise(salt, u / along.max(1e-3), v / across.max(1e-3)) - 1.0
 }
 
 /// The straight colour and coverage of premultiplied `pm` (0..1).
-fn unpremultiply(pm: [f32; 4]) -> ([f32; 3], f32) {
+pub(super) fn unpremultiply(pm: [f32; 4]) -> ([f32; 3], f32) {
     let a = pm[3].clamp(0.0, 1.0);
     if a > 1e-6 { ([pm[0], pm[1], pm[2]].map(|v| (v / a).clamp(0.0, 1.0)), a) } else { ([0.0; 3], 0.0) }
 }
 
 /// `a` + (`b` − `a`) × `t`, channel by channel.
-fn mix<const N: usize>(a: [f32; N], b: [f32; N], t: f32) -> [f32; N] {
+pub(super) fn mix<const N: usize>(a: [f32; N], b: [f32; N], t: f32) -> [f32; N] {
     std::array::from_fn(|k| a[k] + (b[k] - a[k]) * t)
 }
 
 /// A smooth step from 0 at `t` ≤ 0 to 1 at `t` ≥ 1.
-fn ramp(t: f64) -> f64 {
+pub(super) fn ramp(t: f64) -> f64 {
     let t = if t.is_finite() { t.clamp(0.0, 1.0) } else { 0.0 };
     t * t * (3.0 - 2.0 * t)
 }
 
 /// Pixel `p` (premultiplied 0..255) as premultiplied 0..1.
-fn unit(p: [u8; 4]) -> [f32; 4] {
+pub(super) fn unit(p: [u8; 4]) -> [f32; 4] {
     p.map(|v| f32::from(v) / 255.0)
 }
 
 /// The object's edges after softening it by `sigma` (document units): about 1 across a step from
 /// black to white or from clear to opaque, the same at any resolution. Empty when the sizes don't
 /// match.
-fn edges(px: &[[u8; 4]], w: usize, h: usize, place: &Place, sigma: f64) -> Vec<f32> {
+pub(super) fn edges(px: &[[u8; 4]], w: usize, h: usize, place: &Place, sigma: f64) -> Vec<f32> {
     let mut tone: Vec<f32> = px.iter().map(|p| luma(straight(*p)) * f32::from(p[3]) / 255.0).collect();
     let mut cover: Vec<f32> = px.iter().map(|p| f32::from(p[3]) / 255.0).collect();
     let s = sigma / place.px;
@@ -516,3 +516,40 @@ pub(super) fn sumi_e(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace,
         *p = premultiply(out, f32::from(p[3]) / 255.0);
     });
 }
+
+const SALT_GRAPHIC: u64 = 200;
+
+/// Graphic Pen: the object redrawn in fine linear ink strokes along `dir`, each `len` (1..15)
+/// points long on white paper; `balance` (0..100) sets the tone threshold (higher draws more
+/// black ink).
+pub(super) fn graphic_pen(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, len: f64, balance: f64, dir: StrokeDirection) {
+    let Some(place) = Place::new(space, w, h) else { return };
+    let len = if len.is_finite() { len.clamp(1.0, 15.0) } else { 1.0 };
+    let smear = Smear::new(px, w, h, &place, len);
+    let tones = Tones::new(px, w, h, TONE_SOFTNESS / place.px);
+    let threshold = 1.0 - balance.clamp(0.0, 100.0) / 100.0;
+    let row = (0.2 * len).max(0.75);
+    let along = dir.along();
+    place.each(px, |x, y, p| {
+        let a = f32::from(p[3]) / 255.0;
+        if a <= 0.0 {
+            return;
+        }
+        let q = place.at(x, y);
+        let (c, stroke_a) = unpremultiply(smear.stroke(SALT_GRAPHIC, q, along, row));
+        let dark = (1.0 - tones.get(x, y)).max(f64::from(1.0 - luma(c)) * f64::from(stroke_a));
+        if dark <= threshold {
+            *p = premultiply([1.0, 1.0, 1.0], a);
+            return;
+        }
+        let weight = ramp((dark - threshold) / (1.0 - threshold).max(1e-3));
+        let u = frame(q, along).0;
+        let on_stroke = {
+            let t = (u / len).rem_euclid(1.0);
+            if t < 0.65 { 1.0 } else { 0.0 }
+        };
+        let grain = 0.08 * streak(SALT_GRAPHIC + 1, q, along, 0.35 * len, 0.5);
+        let ink = (weight * on_stroke + grain).clamp(0.0, 1.0);
+        *p = premultiply([(1.0 - ink) as f32; 3], a);
+    });
+}

crates/effects/src/pixel/mod.rs

@@ -1,7 +1,10 @@
-//! Photoshop-style raster effects (Effect › Artistic › Film Grain, Blur › Radial Blur and Smart Blur, Brush Strokes ›
-//! Accented Edges, Angled Strokes, Crosshatch, Dark Strokes, Ink Outlines, Spatter, Sprayed Strokes
-//! and Sumi-e, Distort › Diffuse Glow, Glass and Ocean Ripple, Pixelate › Color Halftone,
-//! Crystallize, Mezzotint and Pointillize, Sharpen › Unsharp Mask, Stylize › Glowing Edges, Texture
+//! Photoshop-style raster effects (Effect › Artistic › Cutout, Film Grain, Neon Glow, Plastic Wrap and
+//! Poster Edges, Smudge Stick, Sponge and Watercolor, Blur › Radial Blur and Smart Blur, Brush Strokes › Accented Edges, Angled Strokes,
+//! Crosshatch, Dark Strokes, Ink Outlines, Spatter, Sprayed Strokes and Sumi-e, Distort › Diffuse
+//! Glow, Glass and Ocean Ripple, Pixelate › Color Halftone, Crystallize, Mezzotint and Pointillize,
+//! Sharpen › Unsharp Mask, Sketch › Chalk & Charcoal, Graphic Pen, Halftone Pattern, Note Paper, Plaster and
+//! Reticulation, Stylize ›
+//! Glowing Edges, Texture
 //! › Craquelure, Grain, Mosaic Tiles, Patchwork, Stained Glass and Texturizer, and Video ›
 //! De-Interlace and NTSC Colors): filters over premultiplied RGBA8 pixels.
 //!
@@ -18,8 +21,11 @@ mod brushstrokes;
 mod distort;
 mod edges;
 mod loaded;
+mod paint;
 mod pixelate;
 mod sharpen;
+mod sketch;
+mod sketch_ink;
 mod texture;
 mod video;
 
@@ -33,11 +39,19 @@ pub use brushstrokes::{STROKE_DIRECTIONS, StrokeDirection};
 pub use distort::{GLASS_TEXTURES, GLASS_TEXTURES_LOADED, GlassTexture};
 pub use loaded::{LOADED, LoadedTexture, TEXTURE_IMAGE, texture};
 pub use pixelate::{MEZZOTINT_TYPES, Mezzotint};
+pub use sketch::{HALFTONE_TYPES, HalftonePattern};
 pub use texture::{GRAIN_TYPES, Grain, LIGHT_DIRECTIONS, Light, TEXTURES, Texture};
 
 /// The Photoshop-style effect ids (all raster effects, see [`crate::is_raster`]).
-pub const PIXEL_EFFECTS: [&str; 28] = [
+pub const PIXEL_EFFECTS: [&str; 46] = [
+    "artistic.cutout",
     "artistic.filmGrain",
+    "artistic.neonGlow",
+    "artistic.plasticWrap",
+    "artistic.posterEdges",
+    "artistic.smudgeStick",
+    "artistic.sponge",
+    "artistic.watercolor",
     "blur.radial",
     "blur.smart",
     "brushStrokes.accentedEdges",
@@ -56,6 +70,17 @@ pub const PIXEL_EFFECTS: [&str; 28] = [
     "pixelate.mezzotint",
     "pixelate.pointillize",
     "sharpen.unsharpMask",
+    "sketch.basRelief",
+    "sketch.chalkCharcoal",
+    "sketch.charcoal",
+    "sketch.chrome",
+    "sketch.graphicPen",
+    "sketch.halftonePattern",
+    "sketch.notePaper",
+    "sketch.photocopy",
+    "sketch.plaster",
+    "sketch.reticulation",
+    "sketch.stamp",
     "stylize.glowingEdges",
     "texture.craquelure",
     "texture.grain",
@@ -71,18 +96,40 @@ pub const PIXEL_EFFECTS: [&str; 28] = [
 /// are in document units.
 #[derive(Clone, Debug, PartialEq)]
 pub enum PixelFx {
+    /// Artistic › Cutout: flat pieces of colour in `levels` (2..8) steps per channel, their
+    /// edges as simple as `simplicity` (0..10) and as faithful as `fidelity` (1..3) say.
+    Cutout { levels: f64, simplicity: f64, fidelity: f64 },
     /// Artistic › Film Grain: monochrome grain in shadows and midtones, a wider bright
     /// highlight area (0..20), and tonal intensity (0..10), preserving coverage.
     FilmGrain { grain: f64, highlight: f64, intensity: f64 },
+    /// Artistic › Smudge Stick: the dark areas smudged along short diagonal strokes `stroke`
+    /// (0..10) long, the light areas (widened by `highlight`, 0..20) smudged longer and lightened
+    /// by up to `intensity` (0..10).
+    SmudgeStick { stroke: f64, highlight: f64, intensity: f64 },
+    /// Artistic › Sponge: soft blobs of lighter and darker colour about `brush` (0..10) large,
+    /// contrasting as `definition` (0..25) says, their edges as soft as `smoothness` (1..15).
+    Sponge { brush: f64, definition: f64, smoothness: f64 },
+    /// Artistic › Watercolor: detail simplified by a brush of `detail` (1..14), edges saturated,
+    /// shadows deepened by `shadow` (0..10), `texture` (1..3) grains of paper showing.
+    Watercolor { detail: f64, shadow: f64, texture: u32 },
+    /// Artistic › Neon Glow: dimmed greys lit by `colour` (straight RGB, 0..1) glowing from the
+    /// light areas (`size` above 0) or the dark ones (below 0), spread by |`size`| (-24..24), as
+    /// strong as `brightness` (0..50).
+    NeonGlow { size: f64, brightness: f64, colour: [f32; 3] },
+    /// Artistic › Plastic Wrap: specular highlights as strong as `highlight` (0..20) on a relief
+    /// wrinkled by `detail` (0..15) and softened by `smoothness` (1..15).
+    PlasticWrap { highlight: f64, detail: f64, smoothness: f64 },
+    /// Artistic › Poster Edges: colours posterized to `posterization` + 2 levels (0..6) with black
+    /// lines on the edges, as thick as `thickness` (0..10) and as dark as `intensity` (0..10).
+    PosterEdges { thickness: f64, intensity: f64, posterization: f64 },
     /// Blur › Radial Blur around the object's centre: along arcs (spin, an arc of `amount`°) or
     /// along rays (zoom, the content scaled by up to about ±`amount`/2 %), averaging 2^`passes` samples.
     RadialBlur { amount: f64, zoom: bool, passes: u32 },
     /// Blur › Smart Blur (Normal mode): each pixel averaged with the neighbours within `radius`
     /// whose colour differs from its own by no more than `threshold` levels, over a grid of
     /// `samples` × `samples` neighbours at most.
-    /// The Edge Only `mode` draws the edges where neighboring pixels differ by more than
-    /// `threshold` levels in white on black, and Overlay Edge draws them in white over the Normal
-    /// result.
+    /// The Edge Only `mode` draws the edges that `threshold` and `radius` find (`blur::smart_edges`)
+    /// in white on black, and Overlay Edge draws them in white over the Normal result.
     SmartBlur { radius: f64, threshold: f64, samples: u32, mode: SmartBlurMode },
     /// Brush Strokes › Accented Edges: the edges, about `width` (1..14) wide, accented towards
     /// white chalk or black ink as `brightness` (0..50) says; `smoothness` (1..15) softens them.
@@ -123,6 +170,38 @@ pub enum PixelFx {
     /// Sharpen › Unsharp Mask: colours pushed away from a Gaussian blur of σ = `radius` by `amount`
     /// (1 = 100 %), where they differ from it by at least `threshold` levels.
     UnsharpMask { amount: f64, radius: f64, threshold: f64 },
+    /// Sketch › Chalk & Charcoal: chalk highlights in light areas and charcoal in dark ones;
+    /// `chalk` and `charcoal` (0..20) set how much, `pressure` (0..5) the stroke weight.
+    ChalkCharcoal { chalk: f64, charcoal: f64, pressure: f64 },
+    /// Sketch › Chrome: polished chrome relief with `detail` (0..10) and `smoothness` (0..10).
+    Chrome { detail: f64, smoothness: f64 },
+    /// Sketch › Graphic Pen: fine linear ink strokes along `dir`, each `length` (1..15) points long
+    /// on white paper; `balance` (0..100) sets how much of the tone range becomes black ink.
+    GraphicPen { length: f64, balance: f64, direction: StrokeDirection },
+    /// Sketch › Halftone Pattern: black ink on white paper through a `kind` screen of cells `size`
+    /// (1..12) apart, its edges as hard as `contrast` (0..50) says.
+    HalftonePattern { size: f64, contrast: f64, kind: HalftonePattern },
+    /// Sketch › Note Paper: embossed tones on fibrous paper (`balance`, `graininess`, `relief`).
+    NotePaper { balance: f64, graininess: f64, relief: f64 },
+    /// Sketch › Bas Relief: low relief lit from `light`, keeping the finer features as `detail`
+    /// (1..15) says and rounded by `smoothness` (1..15).
+    BasRelief { detail: f64, smoothness: f64, light: Light },
+    /// Sketch › Charcoal: bold edges `thickness` (1..7) wide, as fine as `detail` (0..5) says, and
+    /// diagonal strokes over the midtones; `balance` (0..100) sets how far into the lights it reaches.
+    Charcoal { thickness: f64, detail: f64, balance: f64 },
+    /// Sketch › Photocopy: black only where a pixel is darker than its surroundings, as fine as
+    /// `detail` (1..24) says, and as readily as `darkness` (1..50) says.
+    Photocopy { detail: f64, darkness: f64 },
+    /// Sketch › Stamp: solid black and white, printing black as much as `balance` (0..50) says,
+    /// its shapes rounded by `smoothness` (1..50).
+    Stamp { balance: f64, smoothness: f64 },
+    /// Sketch › Plaster: relief plaster lit from `light`; dark areas raised, light recessed;
+    /// `imageBalance` (1..50) shifts more of the image lower at higher values; `smoothness` (1..15)
+    /// softens the relief.
+    Plaster { image_balance: f64, smoothness: f64, light: Light },
+    /// Sketch › Reticulation: black ink on white paper through a high-contrast film-grain screen;
+    /// `density` (0..50), `foreground` and `background` (0..50) pull tones before the grain.
+    Reticulation { density: f64, foreground: f64, background: f64 },
     /// Stylize › Glowing Edges: bright coloured Sobel outlines on black.
     GlowingEdges { width: f64, brightness: f64, smoothness: f64 },
     /// Pixelate › Color Halftone: each colour channel screened at its angle (`angles`° of channels
@@ -203,11 +282,46 @@ pub(crate) fn parse(id: &str, p: &Value) -> Option<PixelFx> {
         levels.iter().find(|(name, _)| name.eq_ignore_ascii_case(q)).map_or(default, |(_, v)| *v)
     };
     Some(match id {
+        "artistic.cutout" => PixelFx::Cutout {
+            levels: num(p, "levels", 4.0).round().clamp(2.0, 8.0),
+            simplicity: num(p, "edgeSimplicity", 4.0).clamp(0.0, 10.0),
+            fidelity: num(p, "edgeFidelity", 2.0).round().clamp(1.0, 3.0),
+        },
+        "artistic.neonGlow" => PixelFx::NeonGlow {
+            size: num(p, "glowSize", 5.0).clamp(-24.0, 24.0),
+            brightness: num(p, "glowBrightness", 15.0).clamp(0.0, 50.0),
+            colour: crate::raster::color_param(p, vectorcraft_doc::color::Color::rgb(0.3, 0.65, 1.0)).to_rgb(),
+        },
+        "artistic.posterEdges" => PixelFx::PosterEdges {
+            thickness: num(p, "edgeThickness", 2.0).clamp(0.0, 10.0),
+            intensity: num(p, "edgeIntensity", 1.0).clamp(0.0, 10.0),
+            posterization: num(p, "posterization", 2.0).round().clamp(0.0, 6.0),
+        },
         "artistic.filmGrain" => PixelFx::FilmGrain {
             grain: num(p, "grain", 4.0).clamp(0.0, 20.0),
             highlight: num(p, "highlightArea", 0.0).clamp(0.0, 20.0),
             intensity: num(p, "intensity", 10.0).clamp(0.0, 10.0),
         },
+        "artistic.smudgeStick" => PixelFx::SmudgeStick {
+            stroke: num(p, "strokeLength", 2.0).clamp(0.0, 10.0),
+            highlight: num(p, "highlightArea", 12.0).clamp(0.0, 20.0),
+            intensity: num(p, "intensity", 10.0).clamp(0.0, 10.0),
+        },
+        "artistic.sponge" => PixelFx::Sponge {
+            brush: num(p, "brushSize", 2.0).clamp(0.0, 10.0),
+            definition: num(p, "definition", 12.0).clamp(0.0, 25.0),
+            smoothness: num(p, "smoothness", 5.0).clamp(1.0, 15.0),
+        },
+        "artistic.watercolor" => PixelFx::Watercolor {
+            detail: num(p, "brushDetail", 9.0).clamp(1.0, 14.0),
+            shadow: num(p, "shadowIntensity", 1.0).clamp(0.0, 10.0),
+            texture: num(p, "texture", 1.0).clamp(1.0, 3.0).round() as u32,
+        },
+        "artistic.plasticWrap" => PixelFx::PlasticWrap {
+            highlight: num(p, "highlightStrength", 20.0).clamp(0.0, 20.0),
+            detail: num(p, "detail", 12.0).clamp(0.0, 15.0),
+            smoothness: num(p, "smoothness", 15.0).clamp(1.0, 15.0),
+        },
         "blur.radial" => PixelFx::RadialBlur {
             amount: num(p, "amount", 10.0).clamp(1.0, 100.0),
             zoom: text(p, "method", "spin").eq_ignore_ascii_case("zoom"),
@@ -277,6 +391,53 @@ pub(crate) fn parse(id: &str, p: &Value) -> Option<PixelFx> {
             radius: num(p, "radius", 1.0).clamp(0.1, 250.0),
             threshold: num(p, "threshold", 0.0).clamp(0.0, 255.0),
         },
+        "sketch.chalkCharcoal" => PixelFx::ChalkCharcoal {
+            chalk: num(p, "chalkArea", 6.0).clamp(0.0, 20.0),
+            charcoal: num(p, "charcoalArea", 6.0).clamp(0.0, 20.0),
+            pressure: num(p, "strokePressure", 2.0).clamp(0.0, 5.0),
+        },
+        "sketch.chrome" => PixelFx::Chrome { detail: num(p, "detail", 4.0).clamp(0.0, 10.0), smoothness: num(p, "smoothness", 4.0).clamp(0.0, 10.0) },
+        "sketch.graphicPen" => PixelFx::GraphicPen {
+            length: num(p, "strokeLength", 5.0).clamp(1.0, 15.0),
+            balance: num(p, "lightDarkBalance", 50.0).clamp(0.0, 100.0),
+            direction: StrokeDirection::parse(text(p, "strokeDirection", "rightDiagonal")),
+        },
+        "sketch.halftonePattern" => PixelFx::HalftonePattern {
+            size: num(p, "size", 1.0).clamp(1.0, 12.0),
+            contrast: num(p, "contrast", 5.0).clamp(0.0, 50.0),
+            kind: HalftonePattern::parse(text(p, "patternType", "dot")),
+        },
+        "sketch.notePaper" => PixelFx::NotePaper {
+            balance: num(p, "imageBalance", 25.0).clamp(0.0, 50.0),
+            graininess: num(p, "graininess", 0.0).clamp(0.0, 10.0),
+            relief: num(p, "relief", 4.0).clamp(0.0, 50.0),
+        },
+        "sketch.basRelief" => PixelFx::BasRelief {
+            detail: num(p, "detail", 13.0).clamp(1.0, 15.0),
+            smoothness: num(p, "smoothness", 3.0).clamp(1.0, 15.0),
+            light: Light::parse(text(p, "lightDirection", "bottom")),
+        },
+        "sketch.charcoal" => PixelFx::Charcoal {
+            thickness: num(p, "thickness", 1.0).clamp(1.0, 7.0),
+            detail: num(p, "detail", 1.0).clamp(0.0, 5.0),
+            balance: num(p, "lightDarkBalance", 50.0).clamp(0.0, 100.0),
+        },
+        "sketch.photocopy" => {
+            PixelFx::Photocopy { detail: num(p, "detail", 7.0).clamp(1.0, 24.0), darkness: num(p, "darkness", 25.0).clamp(1.0, 50.0) }
+        }
+        "sketch.stamp" => {
+            PixelFx::Stamp { balance: num(p, "lightDarkBalance", 25.0).clamp(0.0, 50.0), smoothness: num(p, "smoothness", 5.0).clamp(1.0, 50.0) }
+        }
+        "sketch.plaster" => PixelFx::Plaster {
+            image_balance: num(p, "imageBalance", 20.0).clamp(1.0, 50.0),
+            smoothness: num(p, "smoothness", 8.0).clamp(1.0, 15.0),
+            light: Light::parse(text(p, "lightDirection", "top")),
+        },
+        "sketch.reticulation" => PixelFx::Reticulation {
+            density: num(p, "density", 12.0).clamp(0.0, 50.0),
+            foreground: num(p, "foregroundLevel", 6.0).clamp(0.0, 50.0),
+            background: num(p, "backgroundLevel", 6.0).clamp(0.0, 50.0),
+        },
         "stylize.glowingEdges" => PixelFx::GlowingEdges {
             width: num(p, "edgeWidth", 2.0).clamp(1.0, 14.0),
             brightness: num(p, "edgeBrightness", 6.0).clamp(0.0, 20.0),
@@ -342,7 +503,9 @@ impl PixelFx {
             PixelFx::SmartBlur { radius, .. } => radius,
             PixelFx::AccentedEdges { .. } => 0.0,
             // Strokes reach out of the object as far as they reach into it.
-            PixelFx::AngledStrokes { length, .. } | PixelFx::InkOutlines { length, .. } => brushstrokes::stroke_reach(length),
+            PixelFx::AngledStrokes { length, .. } | PixelFx::GraphicPen { length, .. } | PixelFx::InkOutlines { length, .. } => {
+                brushstrokes::stroke_reach(length)
+            }
             PixelFx::Crosshatch { length, .. } => brushstrokes::stroke_reach(length) + brushstrokes::rough(length),
             PixelFx::DarkStrokes { .. } => brushstrokes::stroke_reach(brushstrokes::LIGHT_LENGTH),
             PixelFx::Spatter { radius, .. } => brushstrokes::spatter_shift(radius),
@@ -353,9 +516,22 @@ impl PixelFx {
             // Content shifted outwards reaches past the bounds by as much as the shift.
             PixelFx::Glass { distortion, .. } => distort::glass_shift(distortion),
             PixelFx::OceanRipple { size, magnitude } => distort::ripple_shift(size, magnitude),
-            PixelFx::UnsharpMask { .. } => 0.0,
+            PixelFx::UnsharpMask { .. }
+            | PixelFx::ChalkCharcoal { .. }
+            | PixelFx::Chrome { .. }
+            | PixelFx::HalftonePattern { .. }
+            | PixelFx::NotePaper { .. }
+            | PixelFx::Plaster { .. }
+            | PixelFx::Reticulation { .. } => 0.0,
+            PixelFx::BasRelief { .. } | PixelFx::Charcoal { .. } | PixelFx::Photocopy { .. } | PixelFx::Stamp { .. } => 0.0,
             PixelFx::GlowingEdges { width, smoothness, .. } => width.max(smoothness * 3.0),
+            // These three keep the object's coverage.
+            PixelFx::SmudgeStick { .. } | PixelFx::Sponge { .. } | PixelFx::Watercolor { .. } => 0.0,
             PixelFx::FilmGrain { .. }
+            | PixelFx::Cutout { .. }
+            | PixelFx::NeonGlow { .. }
+            | PixelFx::PlasticWrap { .. }
+            | PixelFx::PosterEdges { .. }
             | PixelFx::ColorHalftone { .. }
             | PixelFx::Mezzotint { .. }
             | PixelFx::Craquelure { .. }
@@ -376,10 +552,16 @@ impl PixelFx {
     pub fn reach(&self) -> Option<f64> {
         match *self {
             PixelFx::RadialBlur { .. } => None,
-            PixelFx::SmartBlur { radius, .. } => Some(radius),
+            PixelFx::SmartBlur { radius, mode: SmartBlurMode::Normal, .. } => Some(radius),
+            PixelFx::SmartBlur { radius, samples, .. } => Some(blur::edge_reach(radius, samples)),
+            PixelFx::SmudgeStick { stroke, .. } => Some(paint::smudge_reach(stroke)),
+            PixelFx::Sponge { brush, smoothness, .. } => Some(paint::sponge_reach(brush, smoothness)),
+            PixelFx::Watercolor { detail, .. } => Some(paint::watercolor_reach(detail)),
             PixelFx::AccentedEdges { width, smoothness, .. } => Some(brushstrokes::accent_reach(width, smoothness)),
             // The strokes, and the softened tones that choose them.
-            PixelFx::AngledStrokes { length, .. } => Some(brushstrokes::stroke_reach(length).max(brushstrokes::TONE_REACH)),
+            PixelFx::AngledStrokes { length, .. } | PixelFx::GraphicPen { length, .. } => {
+                Some(brushstrokes::stroke_reach(length).max(brushstrokes::TONE_REACH))
+            }
             PixelFx::Crosshatch { length, .. } => {
                 Some((brushstrokes::stroke_reach(length) + brushstrokes::rough(length)).max(brushstrokes::TONE_REACH))
             }
@@ -392,11 +574,29 @@ impl PixelFx {
             PixelFx::Glass { distortion, .. } => Some(distort::glass_shift(distortion)),
             PixelFx::OceanRipple { size, magnitude } => Some(distort::ripple_shift(size, magnitude)),
             PixelFx::UnsharpMask { radius, .. } => Some(3.0 * radius),
+            PixelFx::BasRelief { detail, smoothness, .. } => Some(sketch_ink::relief_reach(detail, smoothness)),
+            PixelFx::Charcoal { thickness, detail, .. } => Some(sketch_ink::charcoal_reach(thickness, detail)),
+            PixelFx::Photocopy { detail, .. } => Some(sketch_ink::copy_reach(detail)),
+            PixelFx::Stamp { smoothness, .. } => Some(sketch_ink::stamp_reach(smoothness)),
             PixelFx::GlowingEdges { width, smoothness, .. } => Some(width.max(smoothness * 3.0)),
             // The cells around the pixel's, and the cells around theirs.
             PixelFx::ColorHalftone { max_radius, .. } => Some(3.0 * std::f64::consts::SQRT_2 * max_radius),
             PixelFx::Crystallize { cell } => Some(1.5 * cell),
-            PixelFx::FilmGrain { .. } | PixelFx::Mezzotint { .. } => Some(0.0),
+            PixelFx::ChalkCharcoal { .. } => Some(sketch::CHALK_CHARCOAL_REACH),
+            PixelFx::Chrome { smoothness, .. } => Some(sketch::chrome_reach(smoothness)),
+            PixelFx::FilmGrain { .. }
+            | PixelFx::Mezzotint { .. }
+            | PixelFx::HalftonePattern { .. }
+            | PixelFx::NotePaper { .. }
+            | PixelFx::Reticulation { .. } => Some(0.0),
+            PixelFx::Plaster { smoothness, .. } => Some(sketch::plaster_reach(smoothness)),
+            // Cutout's palette comes from the whole object.
+            PixelFx::Cutout { .. } => None,
+            // The softened tones around the pixel.
+            PixelFx::NeonGlow { size, .. } => Some(3.0 * artistic::glow_spread(size)),
+            PixelFx::PlasticWrap { smoothness, .. } => Some(artistic::plastic_reach(smoothness)),
+            // The edges' lines, spread round them.
+            PixelFx::PosterEdges { thickness, .. } => Some(3.0 * (0.3 + 0.25 * thickness) + 1.0),
             // The dots' points, and the softened colour around them.
             PixelFx::Pointillize { cell } => Some(2.5 * cell),
             // The softened tones around the pixel.
@@ -417,7 +617,16 @@ impl PixelFx {
         let Some(px) = pixels(data, w, h) else { return };
         let to_px = |len: f64| len / space.px.max(1e-9);
         match *self {
+            PixelFx::Cutout { levels, simplicity, fidelity } => artistic::cutout(px, w, h, space, levels, simplicity, fidelity),
             PixelFx::FilmGrain { grain, highlight, intensity } => artistic::film_grain(px, w, h, space, grain, highlight, intensity),
+            PixelFx::SmudgeStick { stroke, highlight, intensity } => paint::smudge_stick(px, w, h, space, stroke, highlight, intensity),
+            PixelFx::Sponge { brush, definition, smoothness } => paint::sponge(px, w, h, space, brush, definition, smoothness),
+            PixelFx::Watercolor { detail, shadow, texture } => paint::watercolor(px, w, h, space, detail, shadow, texture),
+            PixelFx::PlasticWrap { highlight, detail, smoothness } => artistic::plastic_wrap(px, w, h, space, highlight, detail, smoothness),
+            PixelFx::NeonGlow { size, brightness, colour } => artistic::neon_glow(px, w, h, space, size, brightness, colour),
+            PixelFx::PosterEdges { thickness, intensity, posterization } => {
+                artistic::poster_edges(px, w, h, space, thickness, intensity, posterization)
+            }
             PixelFx::RadialBlur { amount, zoom, passes } => blur::radial(px, w, h, space, amount, zoom, passes),
             PixelFx::SmartBlur { radius, threshold, samples, mode: SmartBlurMode::Normal } => {
                 blur::smart(px, w, h, to_px(radius), threshold, samples)
@@ -439,6 +648,17 @@ impl PixelFx {
             }
             PixelFx::OceanRipple { size, magnitude } => distort::ocean_ripple(px, w, h, space, size, magnitude),
             PixelFx::UnsharpMask { amount, radius, threshold } => sharpen::unsharp(px, w, h, amount, to_px(radius), threshold),
+            PixelFx::ChalkCharcoal { chalk, charcoal, pressure } => sketch::chalk_charcoal(px, w, h, space, chalk, charcoal, pressure),
+            PixelFx::Chrome { detail, smoothness } => sketch::chrome(px, w, h, space, detail, smoothness),
+            PixelFx::GraphicPen { length, balance, direction } => brushstrokes::graphic_pen(px, w, h, space, length, balance, direction),
+            PixelFx::HalftonePattern { size, contrast, kind } => sketch::halftone_pattern(px, w, h, space, size, contrast, kind),
+            PixelFx::NotePaper { balance, graininess, relief } => sketch::note_paper(px, w, h, space, balance, graininess, relief),
+            PixelFx::BasRelief { detail, smoothness, light } => sketch_ink::bas_relief(px, w, h, space, detail, smoothness, light),
+            PixelFx::Charcoal { thickness, detail, balance } => sketch_ink::charcoal(px, w, h, space, thickness, detail, balance),
+            PixelFx::Photocopy { detail, darkness } => sketch_ink::photocopy(px, w, h, space, detail, darkness),
+            PixelFx::Stamp { balance, smoothness } => sketch_ink::stamp(px, w, h, space, balance, smoothness),
+            PixelFx::Plaster { image_balance, smoothness, light } => sketch::plaster(px, w, h, space, image_balance, smoothness, light),
+            PixelFx::Reticulation { density, foreground, background } => sketch::reticulation(px, w, h, space, density, foreground, background),
             PixelFx::GlowingEdges { width, brightness, smoothness } => edges::glow(px, w, h, to_px(width), brightness, to_px(smoothness)),
             PixelFx::ColorHalftone { max_radius, angles } => pixelate::color_halftone(px, w, h, space, max_radius, angles),
             PixelFx::Crystallize { cell } => pixelate::crystallize(px, w, h, space, cell),
@@ -539,6 +759,45 @@ pub fn blur_plane(a: &mut Vec<f32>, w: usize, h: usize, sigma: f64) {
     }
 }
 
+/// Grow a `w` × `h` plane by `radius` pixels each way, the box of SVG's feMorphology: each value
+/// becomes the largest within the radius. A fractional radius blends the two whole radii around
+/// it, so a silhouette grows smoothly as the raster scales. Does nothing for a radius of zero or
+/// less, or when the sizes don't match.
+pub fn dilate_plane(a: &mut Vec<f32>, w: usize, h: usize, radius: f64) {
+    if radius.is_nan() || radius <= 0.0 || w == 0 || h == 0 || w.checked_mul(h) != Some(a.len()) {
+        return;
+    }
+    let radius = radius.min(MAX_BOX as f64);
+    let whole = radius.floor() as usize;
+    let frac = (radius - whole as f64) as f32;
+    let mut tmp = vec![0.0; a.len()];
+    for (len, other) in [(w, h), (h, w)] {
+        max_plane(a, &mut tmp, len, whole, frac);
+        std::mem::swap(a, &mut tmp);
+        transpose(a, &mut tmp, len, other);
+        std::mem::swap(a, &mut tmp);
+    }
+}
+
+/// One horizontal pass of [`dilate_plane`] over the rows of `w` values of a plane: the largest
+/// value within `whole`, blended by `frac` towards the largest within `whole + 1`.
+fn max_plane(src: &[f32], dst: &mut [f32], w: usize, whole: usize, frac: f32) {
+    for (row, out) in src.chunks_exact(w).zip(dst.chunks_exact_mut(w)) {
+        for (x, o) in out.iter_mut().enumerate() {
+            let lo = x.saturating_sub(whole + 1);
+            let hi = (x + whole + 1).min(w - 1);
+            let (mut inner, mut ring) = (row[x], row[x]);
+            for (j, v) in row[lo..=hi].iter().enumerate() {
+                if (lo + j).abs_diff(x) <= whole {
+                    inner = inner.max(*v);
+                }
+                ring = ring.max(*v);
+            }
+            *o = inner + (ring - inner) * frac;
+        }
+    }
+}
+
 /// Premultiplied RGBA at 16 bits (×257): blurs and averages that keep their tones.
 pub(super) type Px16 = [u16; 4];
 
@@ -648,3 +907,7 @@ pub fn gaussian_rgba(data: &mut [u8], w: usize, h: usize, sigma: f64) {
 
 #[cfg(test)]
 mod tests;
+#[cfg(test)]
+mod tests_paint;
+#[cfg(test)]
+mod tests_sketch;

crates/effects/src/pixel/paint.rs

@@ -0,0 +1,173 @@
+//! Effect › Artistic › Smudge Stick, Sponge and Watercolor. Original filters built from public
+//! behaviour documentation: <https://helpx.adobe.com/illustrator/using/summary-effects.html> and
+//! <https://helpx.adobe.com/photoshop-elements/using/artistic-filters.html> (Smudge Stick smudges the
+//! dark areas with short diagonal strokes and brightens the light ones, Sponge paints highly
+//! textured areas of contrasting colour, Watercolor simplifies detail with a medium brush loaded
+//! with water and saturates the colour where tones change at edges). Visual approximations, not
+//! reproductions of a proprietary algorithm; the ranges and defaults are chosen for VectorCraft.
+//!
+//! All three keep the object's coverage, so they paint nothing outside it. Their patterns lie in
+//! document space around the object's centre, as the Brush Strokes' and Texture filters' do.
+
+use super::blur;
+use super::brushstrokes::{MARGIN, RIGHT, Smear, TONE_SOFTNESS, edges, mix, ramp, streak, stroke_reach, unpremultiply};
+use super::pixelate::Place;
+use super::texture::{Tones, luma, premultiply, smooth_noise, straight};
+use super::{PixelSpace, Px16, gaussian, to16};
+
+const SALT_SMUDGE: u64 = 320;
+const SALT_SPONGE: u64 = 328;
+const SALT_WATER: u64 = 336;
+
+/// The length (points) of Smudge Stick's short strokes for Stroke Length `stroke` (0..10); the
+/// light areas are smudged with strokes twice as long.
+fn smudge_length(stroke: f64) -> f64 {
+    1.0 + 1.5 * stroke.clamp(0.0, 10.0)
+}
+
+/// How far (document units) Smudge Stick reaches for Stroke Length `stroke`: its strokes and the
+/// softened tones that choose them.
+pub(super) fn smudge_reach(stroke: f64) -> f64 {
+    stroke_reach(2.0 * smudge_length(stroke)).max(3.0 * TONE_SOFTNESS + MARGIN)
+}
+
+/// The σ (points) Sponge softens the object by, for Brush Size `brush` (0..10) and Smoothness
+/// `smoothness` (1..15).
+fn sponge_softness(brush: f64, smoothness: f64) -> f64 {
+    (0.15 + 0.04 * smoothness.clamp(1.0, 15.0)) * sponge_pore(brush)
+}
+
+/// The size (points) of Sponge's pores for Brush Size `brush` (0..10).
+fn sponge_pore(brush: f64) -> f64 {
+    2.0 + 1.5 * brush.clamp(0.0, 10.0)
+}
+
+/// How far (document units) Sponge reaches: the softened colours around a pixel.
+pub(super) fn sponge_reach(brush: f64, smoothness: f64) -> f64 {
+    3.0 * sponge_softness(brush, smoothness) + MARGIN
+}
+
+/// The radius (points) of the brush that simplifies detail for Brush Detail `detail` (1..14): the
+/// less detail, the wider the brush.
+fn water_brush(detail: f64) -> f64 {
+    0.5 * (15.0 - detail.clamp(1.0, 14.0))
+}
+
+/// The σ (points) of the softening that finds Watercolor's edges.
+const WATER_EDGE: f64 = 0.6;
+
+/// How far (document units) Watercolor reaches for Brush Detail `detail`.
+pub(super) fn watercolor_reach(detail: f64) -> f64 {
+    water_brush(detail) + 3.0 * WATER_EDGE + MARGIN
+}
+
+/// Smudge Stick: the dark areas smudged along short diagonal strokes `stroke` (0..10) long, the
+/// light areas smudged with longer strokes and lightened towards white as strongly as `intensity`
+/// (0..10) says, so they lose their detail; `highlight` (0..20) widens the area counted as light.
+pub(super) fn smudge_stick(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, stroke: f64, highlight: f64, intensity: f64) {
+    if ![stroke, highlight, intensity].iter().all(|v| v.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    let len = smudge_length(stroke);
+    let (short, long) = (Smear::new(px, w, h, &place, len), Smear::new(px, w, h, &place, 2.0 * len));
+    let tones = Tones::new(px, w, h, TONE_SOFTNESS / place.px);
+    // Tones above the threshold count as light; a wider highlight area lowers it.
+    let threshold = 0.9 - 0.5 * (highlight / 20.0).clamp(0.0, 1.0);
+    let lift = (0.7 * intensity / 10.0).clamp(0.0, 0.7) as f32;
+    let row = (0.25 * len).max(1.0);
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let q = place.at(x, y);
+        let own = straight(*p);
+        let paint = |smear: &Smear, salt: u64| {
+            let (c, a) = unpremultiply(smear.stroke(salt, q, RIGHT, row));
+            if a > 0.0 { c } else { own }
+        };
+        // Bristle marks along the dark strokes.
+        let bristle = (1.0 + 0.08 * streak(SALT_SMUDGE + 2, q, RIGHT, len, 0.5)) as f32;
+        let dark = paint(&short, SALT_SMUDGE).map(|v| v * bristle);
+        let light = paint(&long, SALT_SMUDGE + 1);
+        let t = ramp((tones.get(x, y) - threshold) / 0.2 + 0.5) as f32;
+        let bright = light.map(|v| v + (1.0 - v) * lift);
+        *p = premultiply(mix(dark, bright, t), f32::from(p[3]) / 255.0);
+    });
+}
+
+/// Sponge: the object as if dabbed with a sponge, soft blobs of lighter and darker colour about
+/// `brush` (0..10) large; `definition` (0..25) sets how strongly they contrast and `smoothness`
+/// (1..15) how soft their edges are.
+pub(super) fn sponge(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, brush: f64, definition: f64, smoothness: f64) {
+    if ![brush, definition, smoothness].iter().all(|v| v.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    let mut soft: Vec<Px16> = to16(px);
+    gaussian(&mut soft, w, sponge_softness(brush, smoothness) / place.px);
+    let pore = sponge_pore(brush);
+    let edge = 0.12 + 0.03 * smoothness.clamp(1.0, 15.0);
+    let amount = (definition / 25.0).clamp(0.0, 1.0);
+    let gain = 1.0 + 1.2 * amount;
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let alpha = f32::from(p[3]) / 255.0;
+        let own = straight(*p);
+        let (c, a) = unpremultiply(soft.get(y * w + x).map_or([0.0; 4], |s| s.map(|v| f32::from(v) / 65535.0)));
+        let c = if a > 0.0 { c } else { own };
+        let q = place.at(x, y);
+        let n = 0.65 * smooth_noise(SALT_SPONGE, q, pore) + 0.35 * smooth_noise(SALT_SPONGE + 1, q, 0.45 * pore);
+        // -1 inside a dark pore, 1 on a light bridge between pores.
+        let blob = 2.0 * ramp(0.5 + n / (2.0 * edge)) - 1.0;
+        let l = f64::from(luma(c));
+        let target = (0.5 + (l + 0.55 * amount * blob - 0.5) * gain).clamp(0.0, 1.0);
+        // Darker towards black, lighter towards white: the hue stays.
+        let out = if target <= l {
+            let k = if l > 1e-3 { (target / l) as f32 } else { 0.0 };
+            c.map(|v| v * k)
+        } else {
+            let k = ((target - l) / (1.0 - l).max(1e-3)).clamp(0.0, 1.0) as f32;
+            c.map(|v| v + (1.0 - v) * k)
+        };
+        *p = premultiply(out, alpha);
+    });
+}
+
+/// Watercolor: the object's detail simplified by a brush whose size `detail` (1..14) sets (the
+/// larger, the more detail stays), the colour saturated and its pigment pooled where tones change
+/// at edges, the shadows deepened as strongly as `shadow` (0..10) says, and `texture` (1..3)
+/// grains of paper showing through.
+pub(super) fn watercolor(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, detail: f64, shadow: f64, texture: u32) {
+    if ![detail, shadow].iter().all(|v| v.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    let coverage: Vec<u8> = px.iter().map(|p| p[3]).collect();
+    // Simplify: average within areas of similar colour, keeping the bolder edges; a coarser brush
+    // (less detail) also merges colours further apart.
+    blur::smart(px, w, h, water_brush(detail) / place.px, 20.0 + 6.0 * (14.0 - detail.clamp(1.0, 14.0)), 7);
+    let found = edges(px, w, h, &place, WATER_EDGE);
+    let shadow = shadow.clamp(0.0, 10.0);
+    let paper = 0.02 * f64::from(texture.clamp(1, 3));
+    let grain = 1.0 + 0.5 * f64::from(texture.clamp(1, 3));
+    place.each(px, |x, y, p| {
+        let alpha = coverage.get(y * w + x).copied().unwrap_or(0);
+        if alpha == 0 {
+            *p = [0; 4];
+            return;
+        }
+        let c = straight(*p);
+        let e = (2.0 * f64::from(found.get(y * w + x).copied().unwrap_or(0.0))).clamp(0.0, 1.0) as f32;
+        let l = luma(c);
+        // Saturated colour and darker pigment where the tones change.
+        let c = c.map(|v| (l + (v - l) * (1.0 + 0.9 * e)) * (1.0 - 0.12 * e));
+        let deep = ((1.0 - l / 0.5).clamp(0.0, 1.0) * 0.07 * shadow as f32).min(0.8);
+        let q = place.at(x, y);
+        let n = 0.6 * smooth_noise(SALT_WATER, q, grain) + 0.4 * smooth_noise(SALT_WATER + 1, q, 0.5 * grain);
+        let n = (paper * n) as f32;
+        *p = premultiply(c.map(|v| v * (1.0 - deep) + n), f32::from(alpha) / 255.0);
+    });
+}

crates/effects/src/pixel/sketch.rs

@@ -0,0 +1,359 @@
+//! Effect › Sketch (Chalk & Charcoal, Chrome, Halftone Pattern, Note Paper, Plaster and Reticulation; Graphic Pen lives in
+//! [`super::brushstrokes`]). Original filters built from public behaviour documentation:
+//! <https://helpx.adobe.com/illustrator/using/summary-effects.html> (Sketch effects redraw in
+//! black and white) and the public Photoshop Elements Artistic filters guide. Visual
+//! approximations, not proprietary reproductions.
+
+use std::f64::consts::{FRAC_1_SQRT_2, TAU};
+
+use vectorcraft_geom::Vec2;
+
+use super::edges::sobel;
+use super::pixelate::{Place, cell, rand, value_noise};
+use super::texture::{Light, Tones, luma, premultiply, smooth_noise, straight};
+use super::{PixelSpace, blur_plane, pick};
+
+const SALT_CHALK: u64 = 216;
+const SALT_CHROME: u64 = 0xC40_4D45;
+const EDGE_SOFT: f64 = 0.8;
+const TONE_SOFT: f64 = 1.0;
+/// Light from the top left (document axes, y down), as on polished relief surfaces.
+const CHROME_LIGHT: Vec2 = Vec2::new(-FRAC_1_SQRT_2, -FRAC_1_SQRT_2);
+
+/// How far (document units) Chalk & Charcoal samples softened tones and edges.
+pub(super) const CHALK_CHARCOAL_REACH: f64 = 3.0 * TONE_SOFT + 1.0 + 3.0 * EDGE_SOFT;
+
+fn ramp(t: f64) -> f64 {
+    t.clamp(0.0, 1.0)
+}
+
+fn tone_edges(px: &[[u8; 4]], w: usize, h: usize, place: &Place, sigma: f64) -> Vec<f32> {
+    let mut tone: Vec<f32> = px.iter().map(|p| luma(straight(*p)) * f32::from(p[3]) / 255.0).collect();
+    let mut cover: Vec<f32> = px.iter().map(|p| f32::from(p[3]) / 255.0).collect();
+    let s = sigma / place.px;
+    blur_plane(&mut tone, w, h, s);
+    blur_plane(&mut cover, w, h, s);
+    let norm = (s.max(0.8) * TAU.sqrt() / 8.0) as f32;
+    let norm = if norm.is_finite() { norm } else { 0.0 };
+    sobel(&tone, w, h).iter().zip(sobel(&cover, w, h)).map(|(t, c)| t.max(c) * norm).collect()
+}
+
+/// Halftone Pattern's screens, in its Pattern Type menu's order: (label, parameter value).
+pub const HALFTONE_TYPES: [(&str, &str); 3] = [("Circle", "circle"), ("Dot", "dot"), ("Line", "line")];
+
+/// A Halftone Pattern screen ([`HALFTONE_TYPES`]).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum HalftonePattern {
+    /// Rings round the object's centre.
+    Circle,
+    /// Dots on a square grid.
+    Dot,
+    /// Horizontal lines.
+    Line,
+}
+
+impl HalftonePattern {
+    const ALL: [HalftonePattern; 3] = [HalftonePattern::Circle, HalftonePattern::Dot, HalftonePattern::Line];
+
+    /// The screen of Pattern Type `value` (a [`HALFTONE_TYPES`] value, any case); Dot otherwise.
+    pub fn parse(value: &str) -> Self {
+        pick(&HALFTONE_TYPES, &Self::ALL, value, HalftonePattern::Dot)
+    }
+}
+
+/// Halftone Pattern: the object redrawn in black ink on white paper through a `kind` screen whose
+/// cells are `size` points apart, anchored at the object's centre. The ink covers as much of a
+/// cell as the colour is dark; `contrast` (0..50) hardens the screen's soft edges, to pure black
+/// and white at 50. Coverage is kept.
+pub(super) fn halftone_pattern(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, size: f64, contrast: f64, kind: HalftonePattern) {
+    if !(size.is_finite() && size > 0.0 && contrast.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    // The width of the screen's soft edge, in tones: 0 is a hard threshold.
+    let soft = (0.5 * (1.0 - contrast / 50.0)).clamp(0.0, 0.5);
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let q = place.at(x, y);
+        let band = |v: f64| (2.0 * ((v / size).rem_euclid(1.0) - 0.5)).abs();
+        // Where in its cell the pixel lies, 0 where the ink starts to 1 where it ends.
+        let screen = match kind {
+            HalftonePattern::Line => band(q.y),
+            HalftonePattern::Circle => band(q.x.hypot(q.y)),
+            HalftonePattern::Dot => 0.5 * (band(q.x).powi(2) + band(q.y).powi(2)),
+        };
+        let dark = f64::from(1.0 - luma(straight(*p))).clamp(0.0, 1.0);
+        let ink = if dark >= 1.0 {
+            1.0
+        } else if soft > 0.0 {
+            // The threshold kept inside [soft / 2, 1 - soft / 2], so white stays white and black black.
+            let threshold = 0.5 * soft + screen * (1.0 - soft);
+            ((dark - threshold) / soft + 0.5).clamp(0.0, 1.0)
+        } else if dark > screen {
+            1.0
+        } else {
+            0.0
+        };
+        *p = premultiply([(1.0 - ink) as f32; 3], f32::from(p[3]) / 255.0);
+    });
+}
+
+/// Note Paper: the object embossed on fibrous paper. `balance` (0..50) shifts tones toward
+/// highlights or shadows around the middle; `graininess` (0..10) adds paper fibre; `relief`
+/// (0..50, points) is how strongly the tones stand out in the light. Coverage is kept.
+pub(super) fn note_paper(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, balance: f64, graininess: f64, relief: f64) {
+    if !(balance.is_finite() && graininess.is_finite() && relief.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    let height: Vec<f32> = px
+        .iter()
+        .map(|p| {
+            if p[3] == 0 {
+                0.0
+            } else {
+                let mut l = f64::from(luma(straight(*p)));
+                l += (balance - 25.0) / 125.0;
+                l.clamp(0.0, 1.0) as f32
+            }
+        })
+        .collect();
+    let sample = |x: i32, y: i32| -> f32 {
+        if x < 0 || y < 0 || x >= w as i32 || y >= h as i32 {
+            return 0.0;
+        }
+        height.get(y as usize * w + x as usize).copied().unwrap_or(0.0)
+    };
+    let emboss = relief / 50.0;
+    let grain = graininess / 10.0;
+    let light = (-0.6_f64, -0.6, 0.8);
+    let ln = (light.0 * light.0 + light.1 * light.1 + light.2 * light.2).sqrt().max(1e-9);
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let xi = x as i32;
+        let yi = y as i32;
+        let h0 = height.get(y * w + x).copied().unwrap_or(0.0);
+        let dx = (sample(xi + 1, yi) - sample(xi - 1, yi)) as f64;
+        let dy = (sample(xi, yi + 1) - sample(xi, yi - 1)) as f64;
+        let dz = emboss * 0.12;
+        let nx = -dx;
+        let ny = -dy;
+        let nz = dz;
+        let nn = (nx * nx + ny * ny + nz * nz).sqrt().max(1e-9);
+        let shade = ((nx * light.0 + ny * light.1 + nz * light.2) / (nn * ln) * 0.5 + 0.5).clamp(0.0, 1.0);
+        let tone = (0.35 + 0.65 * f64::from(h0)) * shade;
+        let q = place.at(x, y);
+        let fibre = if grain > 0.0 { value_noise(0x4e4f_5450, q.x * 0.35, q.y * 0.35) * grain * 0.18 } else { 0.0 };
+        let v = (tone + fibre).clamp(0.0, 1.0) as f32;
+        *p = premultiply([v; 3], f32::from(p[3]) / 255.0);
+    });
+}
+
+/// Chalk & Charcoal: light areas get chalky highlights and dark areas charcoal strokes and grain;
+/// `chalk` and `charcoal` (0..20) set how strongly, `pressure` (0..5) the stroke weight. Black
+/// chalk and charcoal on white paper, coverage kept.
+pub(super) fn chalk_charcoal(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, chalk: f64, charcoal: f64, pressure: f64) {
+    if !(chalk.is_finite() && charcoal.is_finite() && pressure.is_finite()) {
+        return;
+    }
+    let scale = (pressure.clamp(0.0, 5.0) / 5.0).clamp(0.0, 1.0);
+    let chalk_amt = (0.05 * chalk.clamp(0.0, 20.0) * scale).clamp(0.0, 1.0);
+    let charcoal_amt = (0.05 * charcoal.clamp(0.0, 20.0) * scale).clamp(0.0, 1.0);
+    if chalk_amt <= 0.0 && charcoal_amt <= 0.0 {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    let tones = Tones::new(px, w, h, TONE_SOFT / place.px);
+    let edges = tone_edges(px, w, h, &place, EDGE_SOFT);
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let q = place.at(x, y);
+        let tone = tones.get(x, y);
+        let dark = (1.0 - tone).clamp(0.0, 1.0);
+        let light = tone.clamp(0.0, 1.0);
+        let edge = f64::from(edges.get(y * w + x).copied().unwrap_or(0.0));
+        let charcoal_stroke = value_noise(SALT_CHALK + 1, q.x * 1.1, q.y * 0.12);
+        let charcoal_grain = value_noise(SALT_CHALK, q.x * 0.35, q.y * 0.35);
+        let charcoal_mask = ramp((dark - 0.3) / 0.22)
+            * charcoal_amt
+            * (0.35 + 0.65 * edge)
+            * (0.45 + 0.55 * ramp(charcoal_stroke * 2.2 - 0.55))
+            * (0.6 + 0.4 * charcoal_grain);
+        let chalk_grain = value_noise(SALT_CHALK + 2, q.x * 0.45 + 7.0, q.y * 0.45);
+        let chalk_mask = ramp((light - 0.5) / 0.22) * chalk_amt * (0.55 + 0.45 * chalk_grain);
+        let down = (0.9 * charcoal_mask).clamp(0.0, 1.0) as f32;
+        let up = (0.8 * chalk_mask).clamp(0.0, 1.0) as f32;
+        let mut grey = luma(straight(*p));
+        grey *= 1.0 - down;
+        grey += (1.0 - grey) * up;
+        *p = premultiply([grey, grey, grey], f32::from(p[3]) / 255.0);
+    });
+}
+
+/// How far (document units) Chrome reaches for `smoothness` (0..10): 3 σ of the height-field blur
+/// plus the Sobel neighbours.
+pub(super) fn chrome_reach(smoothness: f64) -> f64 {
+    let smoothness = smoothness.clamp(0.0, 10.0);
+    3.0 * (0.4 + 0.55 * smoothness) + 1.0
+}
+
+/// Chrome: the object as a polished chrome surface lit from the top left. `detail` (0..10) adds
+/// finer relief; `smoothness` (0..10) softens the height field before the highlights and shadows
+/// are drawn. Coverage is kept.
+pub(super) fn chrome(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, detail: f64, smoothness: f64) {
+    if w == 0 || h == 0 {
+        return;
+    }
+    let detail = detail.clamp(0.0, 10.0);
+    let smoothness = smoothness.clamp(0.0, 10.0);
+    let Some(place) = Place::new(space, w, h) else { return };
+    let sigma = (0.4 + smoothness * 0.55) / place.px.max(1e-9);
+    let cell = (14.0 - detail * 1.2).max(1.5);
+    let bump = (detail / 10.0) * 0.4;
+    let strength = 2.5 + detail * 0.35;
+    let mut height: Vec<f32> = Vec::with_capacity(w * h);
+    let mut alpha: Vec<f32> = Vec::with_capacity(w * h);
+    for y in 0..h {
+        for x in 0..w {
+            let p = px[y * w + x];
+            let a = f32::from(p[3]) / 255.0;
+            alpha.push(a);
+            if a <= 0.0 {
+                height.push(0.0);
+                continue;
+            }
+            let q = place.at(x, y);
+            let base = f64::from(luma(straight(p)));
+            let n = if bump > 0.0 { bump * smooth_noise(SALT_CHROME, q, cell) } else { 0.0 };
+            height.push((base + n).clamp(0.0, 1.0) as f32);
+        }
+    }
+    blur_plane(&mut height, w, h, sigma);
+    blur_plane(&mut alpha, w, h, sigma);
+    let tone: Vec<f64> = height.iter().zip(&alpha).map(|(h, a)| if *a > 1e-4 { f64::from(*h / *a).clamp(0.0, 1.0) } else { 0.0 }).collect();
+    let px_unit = place.px.max(1e-9);
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let at = |dx: isize, dy: isize| {
+            let (xx, yy) = ((x as isize + dx).clamp(0, w as isize - 1) as usize, (y as isize + dy).clamp(0, h as isize - 1) as usize);
+            tone[yy * w + xx]
+        };
+        let h0 = tone[y * w + x];
+        let gx = 0.5 * (at(1, 0) - at(-1, 0)) / px_unit;
+        let gy = 0.5 * (at(0, 1) - at(0, -1)) / px_unit;
+        let face = -(gx * CHROME_LIGHT.x + gy * CHROME_LIGHT.y);
+        let spec = (face * strength + (h0 - 0.5) * 1.5).tanh();
+        let grey = (0.5 + 0.5 * spec).clamp(0.0, 1.0);
+        *p = premultiply([grey as f32; 3], f32::from(p[3]) / 255.0);
+    });
+}
+
+/// Colour `c` lit by `s`: darkened towards black below 0, lightened towards white above.
+fn lit(c: [f32; 3], s: f64) -> [f32; 3] {
+    let s = if s.is_finite() { s.clamp(-1.0, 1.0) as f32 } else { 0.0 };
+    c.map(|v| if s < 0.0 { v * (1.0 + s) } else { v + (1.0 - v) * s })
+}
+
+/// How a surface whose height rises along `slope` faces a light from `toward`.
+fn facing(slope: Vec2, toward: Vec2) -> f64 {
+    -slope.dot(toward)
+}
+
+/// The σ (document units) of Plaster's height blur at `smoothness` (1..15).
+fn plaster_sigma_pt(smoothness: f64) -> f64 {
+    let smoothness = smoothness.clamp(1.0, 15.0);
+    0.15 + 0.85 * (smoothness - 1.0) / 14.0
+}
+
+/// How far (document units) Plaster's softened relief reaches at `smoothness` (1..15).
+pub(super) fn plaster_reach(smoothness: f64) -> f64 {
+    if !smoothness.is_finite() {
+        return 3.0 * plaster_sigma_pt(8.0) + 0.5;
+    }
+    3.0 * plaster_sigma_pt(smoothness) + 0.5
+}
+
+/// Plaster: the object molded in relief plaster and lit from `light`. Dark areas are raised and
+/// light areas recessed; `imageBalance` (1..50) shifts more of the image lower at higher values;
+/// `smoothness` (1..15) softens the relief. Coverage is kept.
+pub(super) fn plaster(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, image_balance: f64, smoothness: f64, light: Light) {
+    if !(image_balance.is_finite() && smoothness.is_finite() && space.px.is_finite() && space.px > 0.0)
+        || w == 0
+        || h == 0
+        || w.checked_mul(h) != Some(px.len())
+    {
+        return;
+    }
+    let image_balance = image_balance.clamp(1.0, 50.0);
+    let smoothness = smoothness.clamp(1.0, 15.0);
+    let bias = (image_balance - 1.0) / 49.0;
+    let mut height: Vec<f32> = px
+        .iter()
+        .map(|p| {
+            let a = f32::from(p[3]) / 255.0;
+            let dark = (1.0 - luma(straight(*p))) * a;
+            (dark - bias as f32 * 0.65).clamp(0.0, 1.0)
+        })
+        .collect();
+    blur_plane(&mut height, w, h, plaster_sigma_pt(smoothness) / space.px);
+    let Some(place) = Place::new(space, w, h) else { return };
+    let step = (0.35f64).max(0.5 * place.px);
+    let strength = 0.55;
+    let toward = light.toward();
+    let at = |x: usize, y: usize, dx: i32, dy: i32| {
+        let (xx, yy) = ((x as i32 + dx).clamp(0, w as i32 - 1) as usize, (y as i32 + dy).clamp(0, h as i32 - 1) as usize);
+        height[yy * w + xx]
+    };
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let h = height[y * w + x];
+        let (left, right, up, down) = (at(x, y, -1, 0), at(x, y, 1, 0), at(x, y, 0, -1), at(x, y, 0, 1));
+        let slope = Vec2::new(f64::from(right - left), f64::from(down - up)) / (2.0 * step);
+        let ridge = f64::from(h - 0.25 * (left + right + up + down)) / step;
+        let shade = strength * (facing(slope, toward) + ridge);
+        *p = premultiply(lit(straight(*p), shade), f32::from(p[3]) / 255.0);
+    });
+}
+
+/// Reticulation: the object redrawn in black ink on white paper through a high-contrast film-grain
+/// screen. `density` (0..50) sets how fine the grain is; `foreground` and `background` (0..50 each)
+/// pull shadows toward black and highlights toward white before the grain decides ink. Coverage is
+/// kept.
+pub(super) fn reticulation(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, density: f64, foreground: f64, background: f64) {
+    if !(density.is_finite() && foreground.is_finite() && background.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    // Finer grain at higher density: cells from about 11 pt down to 1 pt.
+    let cell_size = 1.0 + (50.0 - density.clamp(0.0, 50.0)) * 0.2;
+    let fg = foreground.clamp(0.0, 50.0) / 50.0;
+    let bg = background.clamp(0.0, 50.0) / 50.0;
+    let spread = 0.12 + 0.38 * (density.clamp(0.0, 50.0) / 50.0);
+    const SALT: u64 = 0x5245_7469;
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let q = place.at(x, y);
+        let dark = f64::from(1.0 - luma(straight(*p))).clamp(0.0, 1.0);
+        let tone = (dark + fg * (1.0 - dark) * 0.65 - bg * dark * 0.65).clamp(0.0, 1.0);
+        let coarse = value_noise(SALT, q.x / cell_size, q.y / cell_size);
+        let fine = match (cell(q.x), cell(q.y)) {
+            (Some(i), Some(j)) => rand(SALT + 1, i, j, 2),
+            _ => 0.5,
+        };
+        let grain = 0.55 * coarse + 0.45 * fine;
+        let ink = if tone + (grain - 0.5) * spread > 0.5 { 1.0 } else { 0.0 };
+        *p = premultiply([(1.0 - ink) as f32; 3], f32::from(p[3]) / 255.0);
+    });
+}

crates/effects/src/pixel/sketch_ink.rs

@@ -0,0 +1,209 @@
+//! Effect › Sketch › Bas Relief, Charcoal, Photocopy and Stamp. Original filters built from public
+//! behaviour documentation: <https://helpx.adobe.com/illustrator/using/summary-effects.html> and
+//! <https://helpx.adobe.com/photoshop-elements/using/sketch-filters.html> (the Sketch effects
+//! redraw the object in the foreground and background colours, black on white here; Bas Relief
+//! carves low relief lit from a direction, Charcoal draws bold edges and sketches the midtones in
+//! diagonal strokes, Photocopy copies only the edges of large dark areas and takes the midtones to
+//! black or white, Stamp simplifies the image to solid black and white as a rubber stamp would).
+//! Visual approximations, not reproductions of a proprietary algorithm; the ranges and defaults
+//! are chosen for VectorCraft.
+//!
+//! All four keep the object's coverage, so they paint nothing outside it. Their sizes are in
+//! document points, whatever the raster's resolution.
+
+use std::f64::consts::FRAC_1_SQRT_2;
+
+use super::pixelate::{Place, cell, value_noise};
+use super::texture::{Light, Tones, premultiply};
+use super::{PixelSpace, blur_plane};
+
+const SALT_STROKES: u64 = 440;
+
+/// A pixel's size (points) at 72 ppi: how far the neighbours of a gradient add to a filter's reach.
+const MARGIN: f64 = 1.0;
+
+/// Redraw `p` as ink `ink` (0..1) of black on white paper, keeping its coverage.
+fn paint(p: &mut [u8; 4], ink: f64) {
+    let v = if ink.is_finite() { (1.0 - ink).clamp(0.0, 1.0) as f32 } else { 1.0 };
+    *p = premultiply([v; 3], f32::from(p[3]) / 255.0);
+}
+
+/// A smooth step from 0 at `t` ≤ 0 to 1 at `t` ≥ 1 (0 when `t` is not a number).
+fn ramp(t: f64) -> f64 {
+    let t = if t.is_finite() { t.clamp(0.0, 1.0) } else { 0.0 };
+    t * t * (3.0 - 2.0 * t)
+}
+
+/// The tone at (`x`, `y`) and its gradient per pixel, from central differences.
+fn gradient(tones: &Tones, x: usize, y: usize) -> (f64, f64, f64) {
+    let gx = 0.5 * (tones.get(x + 1, y) - tones.get(x.saturating_sub(1), y));
+    let gy = 0.5 * (tones.get(x, y + 1) - tones.get(x, y.saturating_sub(1)));
+    (tones.get(x, y), gx, gy)
+}
+
+/// The σ (points) Bas Relief softens the object by, for Detail `detail` (1..15) and Smoothness
+/// `smoothness` (1..15).
+fn relief_softness(detail: f64, smoothness: f64) -> f64 {
+    0.2 + 0.15 * smoothness.clamp(1.0, 15.0) + 0.1 * (15.0 - detail.clamp(1.0, 15.0))
+}
+
+/// How far (document units) Bas Relief reaches: the softened tones and their neighbours.
+pub(super) fn relief_reach(detail: f64, smoothness: f64) -> f64 {
+    3.0 * relief_softness(detail, smoothness) + MARGIN
+}
+
+/// Bas Relief: the object carved in low relief and lit from `light`. Surfaces facing the light turn
+/// white, those turned away black, flat areas grey with a hint of the object's own tones; `detail`
+/// (1..15) keeps finer features and `smoothness` (1..15) rounds the carving.
+pub(super) fn bas_relief(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, detail: f64, smoothness: f64, light: Light) {
+    if !(detail.is_finite() && smoothness.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    let sigma = relief_softness(detail, smoothness);
+    let tones = Tones::new(px, w, h, sigma / place.px);
+    let toward = light.toward();
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let (tone, slope) = tones.slope(x, y, &place);
+        // A step from black to white, softened by σ, rises 0.4 per σ at its steepest.
+        let lit = -slope.dot(toward) * sigma;
+        paint(p, 1.0 - (0.5 + 0.2 * (tone - 0.5) + 2.5 * lit));
+    });
+}
+
+/// The σ (points) Charcoal softens the object by to find its edges, for Detail `detail` (0..5).
+fn charcoal_softness(detail: f64) -> f64 {
+    0.25 + 0.25 * (5.0 - detail.clamp(0.0, 5.0)) + 0.25
+}
+
+/// The σ (points) that thickens Charcoal's edges, for Thickness `thickness` (1..7).
+fn charcoal_thickening(thickness: f64) -> f64 {
+    0.35 * thickness.clamp(1.0, 7.0)
+}
+
+/// The distance (points) between the strokes sketching Charcoal's midtones.
+fn charcoal_spacing(thickness: f64) -> f64 {
+    1.5 + 0.5 * thickness.clamp(1.0, 7.0)
+}
+
+/// How far (document units) Charcoal reaches: the edges, their thickening and the strokes' tones.
+pub(super) fn charcoal_reach(thickness: f64, detail: f64) -> f64 {
+    (3.0 * (charcoal_softness(detail) + charcoal_thickening(thickness)) + 2.0 * MARGIN).max(2.0 * charcoal_spacing(thickness) + MARGIN)
+}
+
+/// Charcoal: bold, `thickness` (1..7) wide edges, as fine as `detail` (0..5) says, and the
+/// midtones sketched in diagonal strokes; `balance` (0..100) sets how far into the lights the
+/// charcoal reaches (50 is even).
+pub(super) fn charcoal(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, thickness: f64, detail: f64, balance: f64) {
+    if !(thickness.is_finite() && detail.is_finite() && balance.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    let sigma = charcoal_softness(detail);
+    let spacing = charcoal_spacing(thickness);
+    let bias = (balance.clamp(0.0, 100.0) - 50.0) / 100.0 * 0.8;
+    // The edges: how much the softened tones change across σ, 1 for a step from black to white.
+    let edge_tones = Tones::new(px, w, h, sigma / place.px);
+    let mut edge: Vec<f32> = (0..w * h)
+        .map(|k| {
+            let (_, gx, gy) = gradient(&edge_tones, k % w, k / w);
+            let contrast = gx.hypot(gy) / place.px * sigma / 0.4;
+            let weakest = 0.35 - 0.2 * bias / 0.4;
+            ramp((contrast - weakest) / 0.3) as f32
+        })
+        .collect();
+    blur_plane(&mut edge, w, h, charcoal_thickening(thickness) / place.px);
+    // The strokes' tones are softer than the edges', so the strokes don't follow every speck.
+    let tones = Tones::new(px, w, h, 0.5 * spacing / place.px);
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let bold = edge.get(y * w + x).map_or(0.0, |e| ((f64::from(*e) - 0.3) / 0.3).clamp(0.0, 1.0));
+        let dark = 1.0 - tones.get(x, y);
+        let share = ((dark + bias - 0.2) / 0.6).clamp(0.0, 1.0);
+        let q = place.at(x, y);
+        // Across the strokes, which run rising to the right, and along them.
+        let (across, along) = ((q.x + q.y) * FRAC_1_SQRT_2 / spacing, (q.x - q.y) * FRAC_1_SQRT_2 / spacing);
+        let stroke = match (share > 0.0, cell(across)) {
+            (true, Some(line)) => {
+                let f = across - line as f64;
+                // Each stroke breaks and swells along its length.
+                let swell = (0.6 + 0.8 * value_noise(SALT_STROKES, along / 6.0, line as f64)).clamp(0.0, 1.2);
+                let reach = (share * swell).min(1.0);
+                let soft = 2.0 * place.px / spacing;
+                (((reach - (2.0 * f - 1.0).abs()) / soft + 0.5).clamp(0.0, 1.0)) * f64::from(reach > 0.0)
+            }
+            _ => 0.0,
+        };
+        paint(p, bold.max(stroke));
+    });
+}
+
+/// The σ (points) of Photocopy's narrow softening for Detail `detail` (1..24): the less detail,
+/// the wider.
+fn copy_softness(detail: f64) -> f64 {
+    0.15 * (25.0 - detail.clamp(1.0, 24.0))
+}
+
+/// How much wider Photocopy's second softening is than its first.
+const COPY_WIDER: f64 = 3.0;
+
+/// How far (document units) Photocopy reaches: the wide softening.
+pub(super) fn copy_reach(detail: f64) -> f64 {
+    3.0 * COPY_WIDER * copy_softness(detail) + MARGIN
+}
+
+/// Photocopy: black where a pixel is darker than its surroundings, white elsewhere. Large dark
+/// areas copy only around their edges and midtones go to black or white. `detail` (1..24) keeps
+/// finer features and `darkness` (1..50) copies more of the dark.
+pub(super) fn photocopy(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, detail: f64, darkness: f64) {
+    if !(detail.is_finite() && darkness.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    let sigma = copy_softness(detail) / place.px;
+    let narrow = Tones::new(px, w, h, sigma);
+    let wide = Tones::new(px, w, h, COPY_WIDER * sigma);
+    // How much darker than its surroundings a pixel must be to print.
+    let threshold = 0.02 + 0.10 * (1.0 - (darkness.clamp(1.0, 50.0) - 1.0) / 49.0);
+    let soft = 0.02;
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        paint(p, ((wide.get(x, y) - narrow.get(x, y) - threshold) / soft + 0.5).clamp(0.0, 1.0));
+    });
+}
+
+/// The σ (points) Stamp softens the object by for Smoothness `smoothness` (1..50).
+fn stamp_softness(smoothness: f64) -> f64 {
+    0.1 * smoothness.clamp(1.0, 50.0)
+}
+
+/// How far (document units) Stamp reaches: the softened tones and their neighbours.
+pub(super) fn stamp_reach(smoothness: f64) -> f64 {
+    3.0 * stamp_softness(smoothness) + MARGIN
+}
+
+/// Stamp: the object as solid black and white, like a rubber stamp. `balance` (0..50) sets how much
+/// of the object prints black and `smoothness` (1..50) rounds the shapes.
+pub(super) fn stamp(px: &mut [[u8; 4]], w: usize, h: usize, space: &PixelSpace, balance: f64, smoothness: f64) {
+    if !(balance.is_finite() && smoothness.is_finite()) {
+        return;
+    }
+    let Some(place) = Place::new(space, w, h) else { return };
+    let tones = Tones::new(px, w, h, stamp_softness(smoothness) / place.px);
+    let threshold = 0.2 + 0.6 * balance.clamp(0.0, 50.0) / 50.0;
+    place.each(px, |x, y, p| {
+        if p[3] == 0 {
+            return;
+        }
+        let (tone, gx, gy) = gradient(&tones, x, y);
+        // A one pixel wide edge, whatever the softening.
+        paint(p, ((threshold - tone) / gx.hypot(gy).max(0.01) + 0.5).clamp(0.0, 1.0));
+    });
+}

crates/effects/src/pixel/tests.rs

@@ -41,6 +41,26 @@ fn fx(id: &str, p: serde_json::Value) -> PixelFx {
     }
 }
 
+#[test]
+fn dilate_plane_grows_by_its_radius_and_blends_a_fraction() {
+    // GUARDS: an Outer Glow grows its silhouette by a quarter raster pixel before the blur; a step in
+    // that growth as the raster scales would show as the glow's width jumping with the zoom.
+    let mut dot = vec![0.0f32; 7 * 7];
+    dot[3 * 7 + 3] = 255.0;
+    let mut grown = dot.clone();
+    dilate_plane(&mut grown, 7, 7, 1.0);
+    assert_eq!(grown[2 * 7 + 2], 255.0);
+    assert_eq!(grown[7 + 3], 0.0);
+    let mut half = dot.clone();
+    dilate_plane(&mut half, 7, 7, 1.5);
+    assert_eq!(half[3 * 7 + 4], 255.0);
+    assert_eq!(half[3 * 7 + 5], 127.5);
+    assert_eq!(half[3 * 7 + 6], 0.0);
+    let mut same = dot.clone();
+    dilate_plane(&mut same, 7, 7, 0.0);
+    assert_eq!(same, dot);
+}
+
 fn grey(v: u8) -> [u8; 4] {
     [v, v, v, 255]
 }
@@ -500,6 +520,9 @@ fn outsets_follow_the_object() {
     assert!((spin.outset(b) - (far - 25.0)).abs() < 1e-9);
     assert!(fx("blur.radial", json!({"method": "zoom", "amount": 100})).outset(b) > 0.4 * far);
     assert_eq!(fx("blur.smart", json!({"radius": 4})).outset(b), 4.0);
+    assert_eq!(fx("blur.smart", json!({"radius": 4})).reach(), Some(4.0));
+    // The edge modes also read the copy blurred over a wide radius's samples.
+    assert_eq!(fx("blur.smart", json!({"radius": 4, "quality": "low", "blurMode": "edgeOnly"})).reach(), Some(5.0));
     assert_eq!(fx("sharpen.unsharpMask", json!({})).outset(b), 0.0);
     assert_eq!(spin.reach(), None);
     assert_eq!(fx("sharpen.unsharpMask", json!({"radius": 2})).reach(), Some(6.0));
@@ -656,8 +679,8 @@ fn smart_blur_normal_mode_keeps_its_pixels() {
 
 /// Smart Blur's test image: grays 56 and 64 in a checkerboard for x < 3 and 66 and 74 for x in 3..6
 /// (steps of 2 or 18 levels at x = 3, under the threshold), gray 200 from x = 6 on (steps of 126 or
-/// 134 levels). Its edges at threshold 25 are the pixels on the raster's border (transparency is
-/// beyond it) and column 6, the step's lighter side.
+/// 134 levels). Its edges at threshold 25 and radius 1 are the pixels on the raster's border
+/// (transparency is beyond it) and column 6, the step's lighter side.
 fn smart_blur_steps() -> (usize, usize, Vec<u8>, impl Fn(usize, usize) -> bool) {
     let (w, h) = (12, 8);
     let src = image(w, h, |x, y| match x {
@@ -672,16 +695,16 @@ fn smart_blur_steps() -> (usize, usize, Vec<u8>, impl Fn(usize, usize) -> bool)
 fn smart_blur_edge_only_draws_the_edges_white_on_black() {
     let (w, h, src, edge) = smart_blur_steps();
     let mut d = src.clone();
-    fx("blur.smart", json!({"blurMode": "edgeOnly"})).apply(&mut d, w, h, &space(w, h));
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 1})).apply(&mut d, w, h, &space(w, h));
     let want = image(w, h, |x, y| if edge(x, y) { [255; 4] } else { [0, 0, 0, 255] });
     assert_eq!(d, want);
-    // The radius changes only the blur.
-    let mut wide = src.clone();
-    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 40})).apply(&mut wide, w, h, &space(w, h));
-    assert_eq!(wide, want);
+    // Under one pixel the search still takes the four nearest pixels.
+    let mut narrow = src.clone();
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 0.1})).apply(&mut narrow, w, h, &space(w, h));
+    assert_eq!(narrow, want);
     // A threshold under the checkerboard's 8 levels makes its lighter squares edges too.
     let mut low = src.clone();
-    fx("blur.smart", json!({"blurMode": "edgeOnly", "threshold": 5})).apply(&mut low, w, h, &space(w, h));
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 1, "threshold": 5})).apply(&mut low, w, h, &space(w, h));
     for y in 1..h - 1 {
         for x in 1..6 {
             let lighter = matches!(at(&src, w, x, y)[0], 64 | 74);
@@ -692,7 +715,7 @@ fn smart_blur_edge_only_draws_the_edges_white_on_black() {
     let (w, h) = (8, 8);
     let shape = image(w, h, |x, y| if (2..6).contains(&x) && (2..6).contains(&y) { [64, 0, 0, 128] } else { [0; 4] });
     let mut s = shape.clone();
-    fx("blur.smart", json!({"blurMode": "edgeOnly"})).apply(&mut s, w, h, &space(w, h));
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 1})).apply(&mut s, w, h, &space(w, h));
     let ring = |x: usize, y: usize| (2..6).contains(&x) && (2..6).contains(&y) && !((3..5).contains(&x) && (3..5).contains(&y));
     let inside = |x: usize, y: usize| (3..5).contains(&x) && (3..5).contains(&y);
     let want = image(w, h, |x, y| match (ring(x, y), inside(x, y)) {
@@ -707,10 +730,10 @@ fn smart_blur_edge_only_draws_the_edges_white_on_black() {
 fn smart_blur_overlay_edge_draws_the_edges_white_over_the_blur() {
     let (w, h, src, edge) = smart_blur_steps();
     let mut normal = src.clone();
-    fx("blur.smart", json!({})).apply(&mut normal, w, h, &space(w, h));
+    fx("blur.smart", json!({"radius": 1})).apply(&mut normal, w, h, &space(w, h));
     assert_ne!(normal, src, "the checkerboard is blurred");
     let mut d = src.clone();
-    fx("blur.smart", json!({"blurMode": "overlayEdge"})).apply(&mut d, w, h, &space(w, h));
+    fx("blur.smart", json!({"blurMode": "overlayEdge", "radius": 1})).apply(&mut d, w, h, &space(w, h));
     for y in 0..h {
         for x in 0..w {
             let want = if edge(x, y) { [255; 4] } else { at(&normal, w, x, y) };
@@ -726,6 +749,87 @@ fn smart_blur_overlay_edge_draws_the_edges_white_over_the_blur() {
     }
 }
 
+/// The edges #2154 drew at any radius: a pixel is on an edge when one of its four nearest pixels
+/// (transparent beyond the raster) differs from it by more than `t` levels in a channel and its
+/// channels add up to at least that pixel's.
+fn four_neighbor_edges(src: &[u8], w: usize, h: usize, t: u8) -> Vec<bool> {
+    let px = |x: isize, y: isize| if x < 0 || y < 0 || x as usize >= w || y as usize >= h { [0; 4] } else { at(src, w, x as usize, y as usize) };
+    let sum = |p: [u8; 4]| p.iter().map(|v| u32::from(*v)).sum::<u32>();
+    let mut edges = Vec::new();
+    for y in 0..h as isize {
+        for x in 0..w as isize {
+            let c = px(x, y);
+            edges.push([(1, 0), (-1, 0), (0, 1), (0, -1)].iter().any(|(dx, dy)| {
+                let n = px(x + dx, y + dy);
+                c.iter().zip(&n).any(|(a, b)| a.abs_diff(*b) > t) && sum(c) >= sum(n)
+            }));
+        }
+    }
+    edges
+}
+
+#[test]
+fn smart_blur_edges_at_radius_one_are_the_four_neighbor_edges() {
+    let (w, h) = (48, 40);
+    let src = image(w, h, |x, y| {
+        let a = if x > 4 && y < 36 { 255 } else { 128 };
+        [((x * 5 + y) as u8).min(a), ((y * 6) as u8).min(a), (((x * y) % 97) as u8).min(a), a]
+    });
+    for t in [5, 10, 25, 60] {
+        let edges = four_neighbor_edges(&src, w, h, t);
+        assert!(edges.contains(&true) && edges.contains(&false), "threshold {t}");
+        let want: Vec<u8> = src.as_chunks::<4>().0.iter().zip(&edges).flat_map(|(p, e)| if *e { [p[3]; 4] } else { [0, 0, 0, p[3]] }).collect();
+        for radius in [0.1, 0.5, 1.0] {
+            let mut d = src.clone();
+            fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": radius, "threshold": t})).apply(&mut d, w, h, &space(w, h));
+            assert_eq!(d, want, "threshold {t}, radius {radius}");
+        }
+    }
+}
+
+#[test]
+fn smart_blur_radius_widens_the_edge_search() {
+    // Gray 60 left of x = 15 and gray 200 from it on: a step of 140 levels.
+    let (w, h) = (30, 16);
+    let src = image(w, h, |x, _| grey(if x < 15 { 60 } else { 200 }));
+    for radius in [1.0, 1.5, 2.0, 2.5, 3.0, 3.5, 4.0, 4.5] {
+        let mut d = src.clone();
+        fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": radius})).apply(&mut d, w, h, &space(w, h));
+        // The pixels within `radius` of a darker one: the step's first `r` columns on its lighter
+        // side, and a band `r` wide along the raster's border (transparency is beyond it). Up to
+        // radius 4.5 the search reads no blurred copy: at 4 and 4.5 the medium quality's 7 samples
+        // across are 4/3 pixels apart, under the 2 pixels a box blur of radius 1 needs.
+        let r = radius as usize;
+        let want =
+            image(w, h, |x, y| if x < r || y < r || x >= w - r || y >= h - r || (15..15 + r).contains(&x) { [255; 4] } else { [0, 0, 0, 255] });
+        assert_eq!(d, want, "radius {radius}");
+    }
+    // Overlay Edge draws the same edges over the blur.
+    let mut normal = src.clone();
+    fx("blur.smart", json!({"radius": 3})).apply(&mut normal, w, h, &space(w, h));
+    let mut over = src.clone();
+    fx("blur.smart", json!({"blurMode": "overlayEdge", "radius": 3})).apply(&mut over, w, h, &space(w, h));
+    assert_eq!(at(&over, w, 17, 8), [255; 4]);
+    assert_eq!(at(&over, w, 18, 8), at(&normal, w, 18, 8));
+    // A wide radius reads a grid of samples, also through a blurred copy, and finds the step from
+    // the radius away, on its lighter side only.
+    let (w, h) = (260, 100);
+    let src = image(w, h, |x, _| grey(if x < 100 { 60 } else { 200 }));
+    let mut d = src.clone();
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 40})).apply(&mut d, w, h, &space(w, h));
+    for (x, edge) in [(100, true), (130, true), (139, true), (170, false), (99, false), (70, false)] {
+        assert_eq!(at(&d, w, x, 50)[0] == 255, edge, "({x}, 50)");
+    }
+    // A dark band narrower than the gaps between the samples is found through the blurred copy:
+    // at x = 120 the samples fall on x = 107, 93 and 80, all light.
+    let src = image(w, h, |x, _| grey(if (100..104).contains(&x) { 60 } else { 200 }));
+    let mut d = src.clone();
+    fx("blur.smart", json!({"blurMode": "edgeOnly", "radius": 40})).apply(&mut d, w, h, &space(w, h));
+    for (x, edge) in [(104, true), (120, true), (102, false)] {
+        assert_eq!(at(&d, w, x, 50)[0] == 255, edge, "band ({x}, 50)");
+    }
+}
+
 #[test]
 fn unsharp_mask_overshoots_at_edges() {
     let (w, h) = (40, 10);
@@ -1893,3 +1997,570 @@ fn brush_strokes_follow_the_object_at_any_resolution() {
         assert_eq!(shifted, one, "{id}");
     }
 }
+
+/// Chalk & Charcoal of `p` over `w` × `h` pixels of `src`, laid out by `s`.
+fn chalk_charcoal(p: serde_json::Value, src: &[u8], w: usize, h: usize, s: &PixelSpace) -> Vec<u8> {
+    let mut out = src.to_vec();
+    fx("sketch.chalkCharcoal", p).apply(&mut out, w, h, s);
+    out
+}
+
+#[test]
+fn chalk_charcoal_params_take_defaults_and_stay_in_range() {
+    assert_eq!(fx("sketch.chalkCharcoal", json!({})), PixelFx::ChalkCharcoal { chalk: 6.0, charcoal: 6.0, pressure: 2.0 });
+    assert_eq!(
+        fx("sketch.chalkCharcoal", json!({"chalkArea": 1e9, "charcoalArea": -2, "strokePressure": 99})),
+        PixelFx::ChalkCharcoal { chalk: 20.0, charcoal: 0.0, pressure: 5.0 }
+    );
+    let doc = crate::effect_info("sketch.chalkCharcoal").unwrap().params;
+    assert!(doc.contains("chalkArea") && doc.contains("charcoalArea") && doc.contains("strokePressure"), "{doc}");
+    let f = fx("sketch.chalkCharcoal", json!({"strokePressure": 5}));
+    assert_eq!(f.outset(Rect::new(0.0, 0.0, 100.0, 50.0)), 0.0);
+    assert!(f.reach().unwrap() > 0.0);
+}
+
+#[test]
+fn chalk_charcoal_draws_in_black_and_white_only() {
+    let (w, h) = (48, 48);
+    let src = image(w, h, |x, y| {
+        let c = [[230u8, 20, 20], [20, 200, 40], [30, 60, 220], [240, 220, 30]][(x / 12) % 4];
+        let a: u16 = if y < 24 { 255 } else { 128 };
+        [c[0], c[1], c[2]].map(|v| (u16::from(v) * a / 255) as u8).into_iter().chain([a as u8]).collect::<Vec<_>>().try_into().unwrap()
+    });
+    let out = chalk_charcoal(json!({"chalkArea": 12, "charcoalArea": 12, "strokePressure": 4}), &src, w, h, &space(w, h));
+    for (p, q) in out.as_chunks::<4>().0.iter().zip(src.as_chunks::<4>().0) {
+        assert_eq!(p[3], q[3], "coverage kept");
+        if p[3] == 0 {
+            continue;
+        }
+        assert_eq!(p[0], p[1]);
+        assert_eq!(p[1], p[2]);
+    }
+    assert_ne!(out, src);
+}
+
+/// Halftone Pattern of `p` over `w` × `h` pixels of `src`, laid out by `s`.
+fn halftone(p: serde_json::Value, src: &[u8], w: usize, h: usize, s: &PixelSpace) -> Vec<u8> {
+    let mut out = src.to_vec();
+    fx("sketch.halftonePattern", p).apply(&mut out, w, h, s);
+    out
+}
+
+/// The smallest period of `values` (their length when they don't repeat).
+fn period(values: &[u8]) -> usize {
+    (1..values.len()).find(|p| values.iter().zip(&values[*p..]).all(|(a, b)| a == b)).unwrap_or(values.len())
+}
+
+#[test]
+fn graphic_pen_params_take_defaults_and_stay_in_range() {
+    use super::STROKE_DIRECTIONS;
+    assert_eq!(fx("sketch.graphicPen", json!({})), PixelFx::GraphicPen { length: 5.0, balance: 50.0, direction: StrokeDirection::RightDiagonal });
+    assert_eq!(
+        fx("sketch.graphicPen", json!({"strokeLength": 0, "lightDarkBalance": 200, "strokeDirection": "VERTICAL"})),
+        PixelFx::GraphicPen { length: 1.0, balance: 100.0, direction: StrokeDirection::Vertical }
+    );
+    let doc = crate::effect_info("sketch.graphicPen").unwrap().params;
+    assert!(STROKE_DIRECTIONS.iter().all(|(_, v)| doc.contains(&format!("\"{v}\""))), "{doc}");
+    let f = fx("sketch.graphicPen", json!({"strokeLength": 15}));
+    assert_eq!(f.outset(Rect::new(0.0, 0.0, 100.0, 50.0)), brushstrokes::stroke_reach(15.0));
+    assert_eq!(f.reach(), Some(brushstrokes::stroke_reach(15.0).max(brushstrokes::TONE_REACH)));
+    assert_eq!(
+        fx("sketch.graphicPen", json!({"strokeLength": 99})),
+        PixelFx::GraphicPen { length: 15.0, balance: 50.0, direction: StrokeDirection::RightDiagonal }
+    );
+}
+
+/// Graphic Pen on a mid-grey field draws both black ink and white paper.
+#[test]
+fn graphic_pen_draws_ink_and_paper_on_grey() {
+    let (w, h) = (48, 48);
+    let src = image(w, h, |_, _| grey(32));
+    let mut out = src.clone();
+    fx("sketch.graphicPen", json!({"strokeLength": 4, "lightDarkBalance": 50})).apply(&mut out, w, h, &space(w, h));
+    let lumas: Vec<u8> = out.as_chunks::<4>().0.iter().map(|p| p[0]).collect();
+    let (min, max) = lumas.iter().fold((255u8, 0u8), |(lo, hi), l| (lo.min(*l), hi.max(*l)));
+    assert!(min < 80 && max > 200, "min {min} max {max}");
+    assert_ne!(out, src, "the filter should change the raster");
+}
+
+#[test]
+fn halftone_pattern_params_take_defaults_and_stay_in_range() {
+    assert_eq!(fx("sketch.halftonePattern", json!({})), PixelFx::HalftonePattern { size: 1.0, contrast: 5.0, kind: HalftonePattern::Dot });
+    assert_eq!(
+        fx("sketch.halftonePattern", json!({"size": 1e9, "contrast": -3, "patternType": "LINE"})),
+        PixelFx::HalftonePattern { size: 12.0, contrast: 0.0, kind: HalftonePattern::Line }
+    );
+    assert_eq!(
+        fx("sketch.halftonePattern", json!({"size": 0, "contrast": 1e9, "patternType": "circle"})),
+        PixelFx::HalftonePattern { size: 1.0, contrast: 50.0, kind: HalftonePattern::Circle }
+    );
+    for junk in [json!({"patternType": 2}), json!({"patternType": "nonsense"})] {
+        assert_eq!(fx("sketch.halftonePattern", junk), fx("sketch.halftonePattern", json!({})));
+    }
+    let doc = crate::effect_info("sketch.halftonePattern").unwrap().params;
+    let kinds: Vec<HalftonePattern> = HALFTONE_TYPES.iter().map(|(_, v)| HalftonePattern::parse(v)).collect();
+    assert_eq!(kinds, [HalftonePattern::Circle, HalftonePattern::Dot, HalftonePattern::Line]);
+    assert!(HALFTONE_TYPES.iter().all(|(_, v)| doc.contains(&format!("\"{v}\""))), "{doc}");
+    let f = fx("sketch.halftonePattern", json!({"size": 12}));
+    assert_eq!(f.outset(Rect::new(0.0, 0.0, 100.0, 50.0)), 0.0);
+    assert_eq!(f.reach(), Some(0.0));
+}
+
+#[test]
+fn note_paper_params_take_defaults_and_stay_in_range() {
+    assert_eq!(fx("sketch.notePaper", json!({})), PixelFx::NotePaper { balance: 25.0, graininess: 0.0, relief: 4.0 });
+    assert_eq!(
+        fx("sketch.notePaper", json!({"imageBalance": -1, "graininess": 20, "relief": 100})),
+        PixelFx::NotePaper { balance: 0.0, graininess: 10.0, relief: 50.0 }
+    );
+    let doc = crate::effect_info("sketch.notePaper").unwrap().params;
+    assert!(doc.contains("imageBalance") && doc.contains("graininess") && doc.contains("relief"), "{doc}");
+    let f = fx("sketch.notePaper", json!({"relief": 12}));
+    assert_eq!(f.outset(Rect::new(0.0, 0.0, 100.0, 50.0)), 0.0);
+    assert_eq!(f.reach(), Some(0.0));
+}
+
+/// Note Paper embosses a horizontal gradient and graininess adds fibre.
+#[test]
+fn note_paper_embosses_a_gradient_and_grain_changes_pixels() {
+    let (w, h) = (32, 32);
+    let src = image(w, h, |x, _| grey((x * 255 / (w - 1)) as u8));
+    let flat = {
+        let mut out = src.clone();
+        fx("sketch.notePaper", json!({"relief": 0, "graininess": 0})).apply(&mut out, w, h, &space(w, h));
+        out
+    };
+    let embossed = {
+        let mut out = src.clone();
+        fx("sketch.notePaper", json!({"relief": 50, "graininess": 0})).apply(&mut out, w, h, &space(w, h));
+        out
+    };
+    assert_ne!(flat, embossed, "relief changes the emboss");
+    let grainy = {
+        let mut out = src.clone();
+        fx("sketch.notePaper", json!({"relief": 0, "graininess": 10})).apply(&mut out, w, h, &space(w, h));
+        out
+    };
+    assert_ne!(flat, grainy, "graininess adds fibre");
+}
+
+/// Line's rows repeat every Size points: Size pixels at 72 ppi, twice as many at 144 ppi.
+#[test]
+fn halftone_line_period_is_the_size_at_any_resolution() {
+    let p = json!({"size": 4, "contrast": 50, "patternType": "line"});
+    let (w, h) = (48, 48);
+    let out = halftone(p.clone(), &image(w, h, |_, _| grey(128)), w, h, &space(w, h));
+    let column: Vec<u8> = (0..h).map(|y| at(&out, w, 0, y)[0]).collect();
+    assert!(column.contains(&0) && column.contains(&255), "{column:?}");
+    assert_eq!(period(&column), 4, "{column:?}");
+    let fine = PixelSpace { to_doc: Affine::scale(0.5), px: 0.5, ..space(w, h) };
+    let out = halftone(p, &image(2 * w, 2 * h, |_, _| grey(128)), 2 * w, 2 * h, &fine);
+    let column: Vec<u8> = (0..2 * h).map(|y| at(&out, 2 * w, 0, y)[0]).collect();
+    assert_eq!(period(&column), 8, "{column:?}");
+}
+
+/// Circle draws rings round the object's centre, Line rows that don't change along them, and
+/// Dot neither.
+#[test]
+fn halftone_pattern_type_changes_the_pattern() {
+    let (w, h) = (64, 64);
+    let src = image(w, h, |_, _| grey(100));
+    // The centre on a pixel's centre: pixel (32 + dx, 32 + dy) lies at (dx, dy) from it.
+    let s = PixelSpace { center: Point::new(32.5, 32.5), ..space(w, h) };
+    let draw = |kind: &str| halftone(json!({"size": 8, "contrast": 50, "patternType": kind}), &src, w, h, &s);
+    let (circle, dot, line) = (draw("circle"), draw("dot"), draw("line"));
+    assert!(circle != dot && dot != line && line != circle);
+    // Pixels at the same distance from the centre in different directions.
+    let same_radius: [&[(i64, i64)]; 6] = [
+        &[(5, 0), (3, 4), (-4, 3), (0, -5), (-3, -4)],
+        &[(10, 0), (6, 8), (-8, -6), (0, 10)],
+        &[(13, 0), (5, 12), (-12, 5), (0, -13)],
+        &[(15, 0), (9, 12), (-12, 9)],
+        &[(17, 0), (8, 15), (-15, -8)],
+        &[(25, 0), (7, 24), (-15, 20), (-20, -15), (24, -7)],
+    ];
+    let value = |d: &[u8], (dx, dy): (i64, i64)| at(d, w, (32 + dx) as usize, (32 + dy) as usize)[0];
+    let radial = |d: &[u8]| same_radius.iter().all(|ring| ring.iter().all(|q| value(d, *q) == value(d, ring[0])));
+    assert!(radial(&circle), "Circle is the same all round");
+    assert!(!radial(&dot) && !radial(&line));
+    for y in 0..h {
+        assert!((0..w).all(|x| at(&line, w, x, y) == at(&line, w, 0, y)), "row {y} of Line is uniform");
+    }
+}
+
+/// Plaster of `p` over `w` × `h` pixels of `src`, laid out by `s`.
+fn plaster(p: serde_json::Value, src: &[u8], w: usize, h: usize, s: &PixelSpace) -> Vec<u8> {
+    let mut out = src.to_vec();
+    fx("sketch.plaster", p).apply(&mut out, w, h, s);
+    out
+}
+
+#[test]
+fn plaster_params_take_defaults_and_stay_in_range() {
+    use super::texture::Light;
+    assert_eq!(fx("sketch.plaster", json!({})), PixelFx::Plaster { image_balance: 20.0, smoothness: 8.0, light: Light::Top });
+    assert_eq!(
+        fx("sketch.plaster", json!({"imageBalance": 0, "smoothness": 1e9, "lightDirection": "bottomRight"})),
+        PixelFx::Plaster { image_balance: 1.0, smoothness: 15.0, light: Light::BottomRight }
+    );
+    assert_eq!(fx("sketch.plaster", json!({"lightDirection": "nonsense"})), fx("sketch.plaster", json!({})));
+    let doc = crate::effect_info("sketch.plaster").unwrap().params;
+    assert!(doc.contains("\"bottomRight\""), "{doc}");
+    let f = fx("sketch.plaster", json!({"smoothness": 24}));
+    assert_eq!(f.reach(), Some(super::sketch::plaster_reach(15.0)));
+}
+
+/// Plaster changes the image and different light directions give different results.
+#[test]
+fn plaster_light_direction_shifts_shading() {
+    let (w, h) = (48, 32);
+    let src = image(w, h, |x, y| grey((16 + (x + y) % 200) as u8));
+    let s = space(w, h);
+    let base = plaster(json!({"imageBalance": 20, "smoothness": 6, "lightDirection": "top"}), &src, w, h, &s);
+    assert_ne!(base, src, "plaster changes opaque pixels");
+    let left = plaster(json!({"lightDirection": "left"}), &src, w, h, &s);
+    let right = plaster(json!({"lightDirection": "right"}), &src, w, h, &s);
+    assert_ne!(left, right, "light direction changes the relief shading");
+}
+
+#[test]
+fn halftone_contrast_sharpens_the_screen() {
+    let (w, h) = (64, 32);
+    let src = image(w, h, |x, _| grey((x * 4) as u8));
+    let mid = |d: &[u8]| share(d, |p| p[0] != 0 && p[0] != 255);
+    let soft = halftone(json!({"size": 6, "contrast": 0}), &src, w, h, &space(w, h));
+    let hard = halftone(json!({"size": 6, "contrast": 50}), &src, w, h, &space(w, h));
+    assert!(mid(&soft) > 0.3, "{}", mid(&soft));
+    assert_eq!(mid(&hard), 0.0);
+}
+
+/// Halftone Pattern redraws in black ink on white paper, whatever the object's colours, and
+/// keeps its coverage.
+#[test]
+fn halftone_draws_in_black_and_white_only() {
+    let (w, h) = (48, 48);
+    let src = image(w, h, |x, y| {
+        let c = [[230u8, 20, 20], [20, 200, 40], [30, 60, 220], [240, 220, 30]][(x / 12) % 4];
+        let a: u16 = if y < 24 { 255 } else { 128 };
+        [c[0], c[1], c[2]].map(|v| (u16::from(v) * a / 255) as u8).into_iter().chain([a as u8]).collect::<Vec<_>>().try_into().unwrap()
+    });
+    for kind in ["circle", "dot", "line"] {
+        let out = halftone(json!({"size": 6, "contrast": 50, "patternType": kind}), &src, w, h, &space(w, h));
+        for (p, q) in out.as_chunks::<4>().0.iter().zip(src.as_chunks::<4>().0) {
+            assert_eq!(p[3], q[3], "{kind}: coverage kept");
+            assert!(p[0] == p[1] && p[1] == p[2] && (p[0] == 0 || p[0] == p[3]), "{kind}: {p:?} from {q:?}");
+        }
+        assert!(share(&out, |p| p[0] == 0) > 0.1 && share(&out, |p| p[0] == p[3]) > 0.1, "{kind}: ink and paper");
+        let soft = halftone(json!({"size": 6, "contrast": 0, "patternType": kind}), &src, w, h, &space(w, h));
+        assert!(soft.as_chunks::<4>().0.iter().all(|p| p[0] == p[1] && p[1] == p[2]), "{kind}: greys only");
+        for (tone, expect) in [(0, 0), (255, 255)] {
+            let out = halftone(json!({"size": 6, "contrast": 0, "patternType": kind}), &image(w, h, |_, _| grey(tone)), w, h, &space(w, h));
+            assert!(out.as_chunks::<4>().0.iter().all(|p| p[0] == expect), "{kind}: {tone} stays {expect}");
+        }
+    }
+}
+
+fn chrome(p: serde_json::Value, src: &[u8], w: usize, h: usize, s: &PixelSpace) -> Vec<u8> {
+    let mut out = src.to_vec();
+    fx("sketch.chrome", p).apply(&mut out, w, h, s);
+    out
+}
+
+/// Reticulation of `p` over `w` × `h` pixels of `src`, laid out by `s`.
+fn reticulation(p: serde_json::Value, src: &[u8], w: usize, h: usize, s: &PixelSpace) -> Vec<u8> {
+    let mut out = src.to_vec();
+    fx("sketch.reticulation", p).apply(&mut out, w, h, s);
+    out
+}
+
+#[test]
+fn chrome_params_take_defaults_and_stay_in_range() {
+    assert_eq!(fx("sketch.chrome", json!({})), PixelFx::Chrome { detail: 4.0, smoothness: 4.0 });
+    assert_eq!(fx("sketch.chrome", json!({"detail": -1, "smoothness": 99})), PixelFx::Chrome { detail: 0.0, smoothness: 10.0 });
+    assert_eq!(fx("sketch.chrome", json!({"detail": "x"})), fx("sketch.chrome", json!({})));
+    let doc = crate::effect_info("sketch.chrome").unwrap().params;
+    assert!(doc.contains("detail") && doc.contains("smoothness"), "{doc}");
+    let f = fx("sketch.chrome", json!({}));
+    assert_eq!(f.outset(Rect::new(0.0, 0.0, 100.0, 50.0)), 0.0);
+    assert_eq!(f.reach(), Some(sketch::chrome_reach(4.0)));
+    assert_eq!(fx("sketch.chrome", json!({"smoothness": 10})).reach(), Some(sketch::chrome_reach(10.0)));
+}
+
+/// Chrome redraws in greyscale, keeps coverage, and more detail changes the pattern.
+#[test]
+fn chrome_draws_polished_greyscale_relief() {
+    let (w, h) = (64, 64);
+    let src = image(w, h, |x, y| {
+        let t = ((x + y) * 4) as u8;
+        [t, t / 2, 255 - t, 255]
+    });
+    let soft = chrome(json!({"detail": 0, "smoothness": 8}), &src, w, h, &space(w, h));
+    let sharp = chrome(json!({"detail": 10, "smoothness": 0}), &src, w, h, &space(w, h));
+    assert_ne!(soft, sharp);
+    for out in [&soft, &sharp] {
+        for (p, q) in out.as_chunks::<4>().0.iter().zip(src.as_chunks::<4>().0) {
+            assert_eq!(p[3], q[3], "coverage kept");
+            assert!(p[0] == p[1] && p[1] == p[2], "greyscale {p:?}");
+        }
+        assert!(share(out, |p| p[0] > 10 && p[0] < 245) > 0.05, "midtones");
+    }
+}
+
+#[test]
+fn reticulation_params_take_defaults_and_stay_in_range() {
+    assert_eq!(fx("sketch.reticulation", json!({})), PixelFx::Reticulation { density: 12.0, foreground: 6.0, background: 6.0 });
+    assert_eq!(
+        fx("sketch.reticulation", json!({"density": -5, "foregroundLevel": 99, "backgroundLevel": -1})),
+        PixelFx::Reticulation { density: 0.0, foreground: 50.0, background: 0.0 }
+    );
+    let f = fx("sketch.reticulation", json!({}));
+    assert_eq!(f.outset(Rect::new(0.0, 0.0, 100.0, 50.0)), 0.0);
+    assert_eq!(f.reach(), Some(0.0));
+}
+
+#[test]
+fn reticulation_draws_in_black_and_white_only() {
+    let (w, h) = (48, 48);
+    let src = image(w, h, |x, y| {
+        let c = [[230u8, 20, 20], [20, 200, 40], [30, 60, 220], [240, 220, 30]][(x / 12) % 4];
+        let a: u16 = if y < 24 { 255 } else { 128 };
+        [c[0], c[1], c[2]].map(|v| (u16::from(v) * a / 255) as u8).into_iter().chain([a as u8]).collect::<Vec<_>>().try_into().unwrap()
+    });
+    let out = reticulation(json!({}), &src, w, h, &space(w, h));
+    for (p, q) in out.as_chunks::<4>().0.iter().zip(src.as_chunks::<4>().0) {
+        assert_eq!(p[3], q[3], "coverage kept");
+        assert!(p[0] == p[1] && p[1] == p[2] && (p[0] == 0 || p[0] == p[3]), "{p:?} from {q:?}");
+    }
+    assert!(share(&out, |p| p[0] == 0) > 0.05 && share(&out, |p| p[0] == p[3]) > 0.05, "ink and paper");
+}
+
+#[test]
+fn reticulation_density_changes_the_grain() {
+    let (w, h) = (64, 64);
+    let src = image(w, h, |_, _| grey(128));
+    let low = reticulation(json!({"density": 5}), &src, w, h, &space(w, h));
+    let high = reticulation(json!({"density": 45}), &src, w, h, &space(w, h));
+    assert_ne!(low, high);
+}
+
+/// The distinct colours of the covered pixels.
+fn colours(d: &[u8]) -> std::collections::BTreeSet<[u8; 4]> {
+    d.as_chunks::<4>().0.iter().filter(|p| p[3] > 0).copied().collect()
+}
+
+/// A left-to-right rainbow ramp, half covered at its bottom rows.
+fn ramp(w: usize, h: usize) -> Vec<u8> {
+    image(w, h, |x, y| {
+        let t = x * 255 / (w - 1);
+        let a = if y + 4 >= h { 128 } else { 255 };
+        let c = [t, 255 - t, (t * 3) % 256].map(|v| (v * a / 255) as u8);
+        [c[0], c[1], c[2], a as u8]
+    })
+}
+
+#[test]
+fn artistic_params_take_defaults_and_stay_in_range() {
+    assert_eq!(fx("artistic.cutout", json!({})), PixelFx::Cutout { levels: 4.0, simplicity: 4.0, fidelity: 2.0 });
+    assert_eq!(
+        fx("artistic.cutout", json!({"levels": 1e308, "edgeSimplicity": -5, "edgeFidelity": "NaN"})),
+        PixelFx::Cutout { levels: 8.0, simplicity: 0.0, fidelity: 2.0 }
+    );
+    assert_eq!(fx("artistic.posterEdges", json!({})), PixelFx::PosterEdges { thickness: 2.0, intensity: 1.0, posterization: 2.0 });
+    assert_eq!(
+        fx("artistic.posterEdges", json!({"edgeThickness": 99, "edgeIntensity": -1, "posterization": 6.4})),
+        PixelFx::PosterEdges { thickness: 10.0, intensity: 0.0, posterization: 6.0 }
+    );
+    let PixelFx::NeonGlow { size, brightness, colour } = fx("artistic.neonGlow", json!({})) else { panic!() };
+    assert_eq!((size, brightness), (5.0, 15.0));
+    assert!((colour[0] - 0.3).abs() < 0.01 && (colour[1] - 0.65).abs() < 0.01 && colour[2] == 1.0, "{colour:?}");
+    assert_eq!(
+        fx("artistic.neonGlow", json!({"glowSize": -1e308, "glowBrightness": 80, "color": "#ff0000"})),
+        PixelFx::NeonGlow { size: -24.0, brightness: 50.0, colour: [1.0, 0.0, 0.0] }
+    );
+    assert_eq!(fx("artistic.plasticWrap", json!({})), PixelFx::PlasticWrap { highlight: 20.0, detail: 12.0, smoothness: 15.0 });
+    assert_eq!(
+        fx("artistic.plasticWrap", json!({"highlightStrength": -1, "detail": 99, "smoothness": 0})),
+        PixelFx::PlasticWrap { highlight: 0.0, detail: 15.0, smoothness: 1.0 }
+    );
+    for id in ["artistic.cutout", "artistic.neonGlow", "artistic.plasticWrap", "artistic.posterEdges"] {
+        assert_eq!(fx(id, json!({})).outset(Rect::new(0.0, 0.0, 40.0, 30.0)), 0.0, "{id} keeps the object's shape");
+    }
+}
+
+#[test]
+fn artistic_filters_leave_invalid_coordinate_spaces_alone() {
+    let (w, h) = (16, 12);
+    let src = ramp(w, h);
+    let run = |f: &PixelFx, s: &PixelSpace| {
+        let mut out = src.clone();
+        f.apply(&mut out, w, h, s);
+        out
+    };
+    let colour = [0.3, 0.65, 1.0];
+    let filters = [
+        PixelFx::Cutout { levels: 4.0, simplicity: 4.0, fidelity: 2.0 },
+        PixelFx::NeonGlow { size: 5.0, brightness: 15.0, colour },
+        PixelFx::PlasticWrap { highlight: 20.0, detail: 12.0, smoothness: 15.0 },
+        PixelFx::PosterEdges { thickness: 2.0, intensity: 1.0, posterization: 2.0 },
+    ];
+    for f in &filters {
+        assert_ne!(run(f, &space(w, h)), src, "{f:?} changes the art in a valid space");
+    }
+    let mut changed = Vec::new();
+    for f in &filters {
+        for px in [0.0, -1.0, f64::NAN, f64::INFINITY] {
+            if run(f, &PixelSpace { px, ..space(w, h) }) != src {
+                changed.push(format!("{f:?} at px {px}"));
+            }
+        }
+    }
+    for f in [
+        PixelFx::Cutout { levels: f64::NAN, simplicity: 4.0, fidelity: 2.0 },
+        PixelFx::Cutout { levels: 4.0, simplicity: f64::INFINITY, fidelity: 2.0 },
+        PixelFx::Cutout { levels: 4.0, simplicity: 4.0, fidelity: f64::NEG_INFINITY },
+        PixelFx::NeonGlow { size: f64::NAN, brightness: 15.0, colour },
+        PixelFx::NeonGlow { size: 5.0, brightness: f64::INFINITY, colour },
+        PixelFx::PosterEdges { thickness: f64::NAN, intensity: 1.0, posterization: 2.0 },
+        PixelFx::PosterEdges { thickness: 2.0, intensity: f64::INFINITY, posterization: 2.0 },
+        PixelFx::PosterEdges { thickness: 2.0, intensity: 1.0, posterization: f64::NEG_INFINITY },
+    ] {
+        if run(&f, &space(w, h)) != src {
+            changed.push(format!("{f:?}"));
+        }
+    }
+    assert!(changed.is_empty(), "directly constructed non-finite parameters and invalid spaces are harmless: {changed:?}");
+}
+
+#[test]
+fn plastic_wrap_adds_specular_highlights_and_keeps_coverage() {
+    let (w, h) = (48, 32);
+    let src = image(w, h, |x, y| grey((((x + y) * 5) % 200 + 30) as u8));
+    let mut none = src.clone();
+    fx("artistic.plasticWrap", json!({"highlightStrength": 0})).apply(&mut none, w, h, &space(w, h));
+    assert_eq!(none, src);
+    let mut out = src.clone();
+    fx("artistic.plasticWrap", json!({})).apply(&mut out, w, h, &space(w, h));
+    assert!(out != src, "defaults brighten some pixels");
+    assert!(out.as_chunks::<4>().0.iter().zip(src.as_chunks::<4>().0).all(|(o, s)| o[3] == s[3]));
+    let mut weak = src.clone();
+    let mut strong = src.clone();
+    fx("artistic.plasticWrap", json!({"highlightStrength": 4})).apply(&mut weak, w, h, &space(w, h));
+    fx("artistic.plasticWrap", json!({"highlightStrength": 20})).apply(&mut strong, w, h, &space(w, h));
+    let lift =
+        |a: &[u8], b: &[u8]| a.as_chunks::<4>().0.iter().zip(b.as_chunks::<4>().0).map(|(o, s)| i32::from(o[0]) - i32::from(s[0])).sum::<i32>();
+    assert!(lift(&strong, &src) > lift(&weak, &src), "stronger highlights lift more");
+}
+
+#[test]
+fn cutout_paints_a_few_flat_colours_and_keeps_coverage() {
+    let (w, h) = (64, 24);
+    let src = ramp(w, h);
+    for levels in [2, 3, 5, 8] {
+        let mut out = src.clone();
+        fx("artistic.cutout", json!({"levels": levels})).apply(&mut out, w, h, &space(w, h));
+        let opaque: std::collections::BTreeSet<_> = colours(&out).into_iter().filter(|p| p[3] == 255).collect();
+        assert!(opaque.len() <= levels * levels * levels && opaque.len() >= 2, "{levels} levels: {} colours", opaque.len());
+        assert!(opaque.len() < 64, "flat pieces, not a ramp: {levels} levels, {} colours", opaque.len());
+        assert!(out.as_chunks::<4>().0.iter().zip(src.as_chunks::<4>().0).all(|(o, s)| o[3] == s[3]));
+    }
+}
+
+#[test]
+fn cutout_simplicity_smooths_the_pieces_edges() {
+    // A noisy grey: simpler edges join the speckles into fewer changes between neighbours.
+    let (w, h) = (48, 48);
+    let src = image(w, h, |x, y| grey(if (x * 7 + y * 13) % 5 < 2 { 60 } else { 190 }));
+    let changes = |simplicity: f64| {
+        let mut out = src.clone();
+        fx("artistic.cutout", json!({"levels": 2, "edgeSimplicity": simplicity, "edgeFidelity": 1})).apply(&mut out, w, h, &space(w, h));
+        out.as_chunks::<4>().0.windows(2).filter(|p| p[0] != p[1]).count()
+    };
+    assert!(changes(10.0) * 4 < changes(0.0), "{} vs {}", changes(10.0), changes(0.0));
+}
+
+#[test]
+fn poster_edges_draw_black_lines_on_edges_and_posterize_the_rest() {
+    let (w, h) = (40, 20);
+    // Two flat halves: a line where they meet, posterized colour away from it.
+    let src = image(w, h, |x, _| if x < w / 2 { [200, 90, 30, 255] } else { [30, 120, 210, 255] });
+    let mut out = src.clone();
+    fx("artistic.posterEdges", json!({"edgeThickness": 2, "edgeIntensity": 10, "posterization": 0})).apply(&mut out, w, h, &space(w, h));
+    let line = at(&out, w, w / 2, h / 2);
+    assert!(line[0] < 40 && line[1] < 40 && line[2] < 40, "a dark line on the edge: {line:?}");
+    // 2 levels per channel: every far pixel is 0 or 255 in each channel.
+    for x in [3, w - 4] {
+        let p = at(&out, w, x, h / 2);
+        assert!(p[..3].iter().all(|v| *v == 0 || *v == 255), "{x}: {p:?}");
+    }
+    // Inside a flat colour, away from the object's outline, there are no lines: it only posterizes.
+    let mut flat = image(w, h, |_, _| [200, 90, 30, 255]);
+    fx("artistic.posterEdges", json!({"edgeIntensity": 10, "posterization": 6})).apply(&mut flat, w, h, &space(w, h));
+    let inside: std::collections::BTreeSet<_> = (6..h - 6).flat_map(|y| (6..w - 6).map(move |x| (x, y))).map(|(x, y)| at(&flat, w, x, y)).collect();
+    assert_eq!(inside.len(), 1, "{inside:?}");
+    assert!(at(&flat, w, 0, h / 2)[0] < 60, "the outline takes a line");
+}
+
+#[test]
+fn poster_edges_thickness_widens_the_lines() {
+    let (w, h) = (60, 10);
+    let src = image(w, h, |x, _| grey(if x < w / 2 { 30 } else { 230 }));
+    let dark = |thickness: f64| {
+        let mut out = src.clone();
+        fx("artistic.posterEdges", json!({"edgeThickness": thickness, "edgeIntensity": 10, "posterization": 6})).apply(&mut out, w, h, &space(w, h));
+        (0..w).filter(|x| at(&out, w, *x, h / 2)[0] < 20 && (*x >= w / 2 || at(&src, w, *x, h / 2)[0] > 20)).count()
+    };
+    assert!(dark(10.0) > dark(0.0), "{} vs {}", dark(10.0), dark(0.0));
+}
+
+#[test]
+fn neon_glow_lights_the_bright_or_the_dark_areas_in_its_colour() {
+    let (w, h) = (40, 20);
+    let src = image(w, h, |x, _| grey(if x < w / 2 { 20 } else { 235 }));
+    let run = |size: f64| {
+        let mut out = src.clone();
+        fx("artistic.neonGlow", json!({"glowSize": size, "glowBrightness": 40, "color": "#ff0000"})).apply(&mut out, w, h, &space(w, h));
+        (at(&out, w, 3, h / 2), at(&out, w, w - 4, h / 2))
+    };
+    // Red glow: the red channel rises above green and blue where it glows.
+    let red = |p: [u8; 4]| i32::from(p[0]) - i32::from(p[1]);
+    let (dark, light) = run(8.0);
+    assert!(red(light) > 60 && red(light) > red(dark) + 40, "light areas glow: {dark:?} {light:?}");
+    let (dark, light) = run(-8.0);
+    assert!(red(dark) > 60 && red(dark) > red(light) + 40, "dark areas glow: {dark:?} {light:?}");
+    // No brightness: dimmed greys only.
+    let mut out = src.clone();
+    fx("artistic.neonGlow", json!({"glowBrightness": 0})).apply(&mut out, w, h, &space(w, h));
+    assert!(out.as_chunks::<4>().0.iter().all(|p| p[0] == p[1] && p[1] == p[2] && p[3] == 255));
+}
+
+#[test]
+fn artistic_filters_look_the_same_at_any_resolution() {
+    // The same art at 1 and at 2 pixels per point: the filter at the coarse resolution matches
+    // the fine result sampled at the same points.
+    let (w, h) = (48, 32);
+    let art = |x: f64, y: f64| grey(if (x - 24.0).hypot(y - 16.0) < 10.0 { 230 } else { 40 });
+    let coarse = image(w, h, |x, y| art(x as f64 + 0.5, y as f64 + 0.5));
+    let fine = image(2 * w, 2 * h, |x, y| art((x as f64 + 0.5) / 2.0, (y as f64 + 0.5) / 2.0));
+    let mut half = space(2 * w, 2 * h);
+    half.to_doc = Affine::scale(0.5);
+    half.px = 0.5;
+    half.center = Point::new(w as f64 / 2.0, h as f64 / 2.0);
+    for (id, p) in [
+        ("artistic.cutout", json!({"edgeSimplicity": 6})),
+        ("artistic.neonGlow", json!({"glowSize": 12, "glowBrightness": 30})),
+        ("artistic.posterEdges", json!({"edgeThickness": 6, "edgeIntensity": 6})),
+    ] {
+        let (mut a, mut b) = (coarse.clone(), fine.clone());
+        fx(id, p.clone()).apply(&mut a, w, h, &space(w, h));
+        fx(id, p).apply(&mut b, 2 * w, 2 * h, &half);
+        let diff: f64 = (0..h)
+            .flat_map(|y| (0..w).map(move |x| (x, y)))
+            .map(|(x, y)| {
+                let (p, q) = (at(&a, w, x, y), at(&b, 2 * w, 2 * x, 2 * y));
+                (0..3).map(|k| f64::from(p[k].abs_diff(q[k]))).sum::<f64>() / 3.0
+            })
+            .sum::<f64>()
+            / (w * h) as f64;
+        assert!(diff < 12.0, "{id}: mean difference {diff}");
+    }
+}

crates/effects/src/pixel/tests_paint.rs

@@ -0,0 +1,189 @@
+//! Artistic › Smudge Stick, Sponge and Watercolor.
+
+use serde_json::json;
+use vectorcraft_doc::Effect;
+use vectorcraft_geom::{Affine, Point};
+
+use super::*;
+use crate::{RasterFx, raster_effects};
+
+/// A `w` × `h` raster whose pixels are document points (origin top-left), of an object that fills it.
+fn space(w: usize, h: usize) -> PixelSpace {
+    let (w, h) = (w as f64, h as f64);
+    PixelSpace {
+        to_doc: Affine::IDENTITY,
+        px: 1.0,
+        center: Point::new(w / 2.0, h / 2.0),
+        channels: Channels::Rgb,
+        line: 1.0,
+        extent: 0.5 * w.hypot(h),
+    }
+}
+
+fn image(w: usize, h: usize, f: impl Fn(usize, usize) -> [u8; 4]) -> Vec<u8> {
+    (0..h).flat_map(|y| (0..w).map(move |x| (x, y))).flat_map(|(x, y)| f(x, y)).collect()
+}
+
+fn fx(id: &str, p: serde_json::Value) -> PixelFx {
+    let e = Effect { id: id.into(), params: p, visible: true };
+    match raster_effects(&[e]).first() {
+        Some(RasterFx::Pixel(p)) => p.clone(),
+        other => panic!("{id}: {other:?}"),
+    }
+}
+
+fn run(id: &str, p: serde_json::Value, src: &[u8], w: usize, h: usize) -> Vec<u8> {
+    let mut out = src.to_vec();
+    fx(id, p).apply(&mut out, w, h, &space(w, h));
+    out
+}
+
+fn grey(v: u8) -> [u8; 4] {
+    [v, v, v, 255]
+}
+
+/// The mean of channel 0 over the columns `x0..x1`.
+fn mean(d: &[u8], w: usize, x0: usize, x1: usize) -> f64 {
+    let rows = d.len() / 4 / w;
+    let sum: f64 = (0..rows).flat_map(|y| (x0..x1).map(move |x| (x, y))).map(|(x, y)| f64::from(d[(y * w + x) * 4])).sum();
+    sum / (rows * (x1 - x0)) as f64
+}
+
+/// The summed difference between horizontal neighbours of channel 0 over columns `x0..x1`.
+fn roughness(d: &[u8], w: usize, x0: usize, x1: usize) -> f64 {
+    let rows = d.len() / 4 / w;
+    (0..rows)
+        .flat_map(|y| (x0..x1 - 1).map(move |x| (x, y)))
+        .map(|(x, y)| (f64::from(d[(y * w + x) * 4]) - f64::from(d[(y * w + x + 1) * 4])).abs())
+        .sum()
+}
+
+fn spread(d: &[u8]) -> f64 {
+    let v: Vec<f64> = d.as_chunks::<4>().0.iter().map(|p| f64::from(p[0])).collect();
+    let m = v.iter().sum::<f64>() / v.len() as f64;
+    (v.iter().map(|x| (x - m).powi(2)).sum::<f64>() / v.len() as f64).sqrt()
+}
+
+/// No panic and the coverage kept on tiny, huge and non-finite spaces and parameters.
+fn survives(id: &str, params: &[serde_json::Value]) {
+    let (w, h) = (9, 7);
+    let src = image(w, h, |x, y| [(x * 25) as u8, (y * 30) as u8, 90, if x == 0 { 0 } else { 255 }]);
+    let tiny = PixelSpace { px: 1e-9, ..space(w, h) };
+    let huge = PixelSpace { px: 1e9, center: Point::new(f64::MAX, -1e300), ..space(w, h) };
+    let nan = PixelSpace { px: f64::NAN, ..space(w, h) };
+    for p in params {
+        for s in [tiny, huge, nan, space(w, h)] {
+            let mut out = src.clone();
+            fx(id, p.clone()).apply(&mut out, w, h, &s);
+            assert_eq!(out.len(), src.len());
+        }
+    }
+    // A size that doesn't match, and an empty raster, do nothing.
+    let mut odd = vec![1u8; 10];
+    fx(id, json!({})).apply(&mut odd, 3, 3, &space(3, 3));
+    assert_eq!(odd, vec![1u8; 10]);
+    fx(id, json!({})).apply(&mut [], 0, 0, &space(1, 1));
+}
+
+#[test]
+fn smudge_stick_smudges_the_dark_and_lightens_the_light() {
+    assert_eq!(fx("artistic.smudgeStick", json!({})), PixelFx::SmudgeStick { stroke: 2.0, highlight: 12.0, intensity: 10.0 });
+    assert_eq!(
+        fx("artistic.smudgeStick", json!({"strokeLength": 1e308, "highlightArea": -5, "intensity": "x"})),
+        PixelFx::SmudgeStick { stroke: 10.0, highlight: 0.0, intensity: 10.0 }
+    );
+    // A fine checkerboard of dark tones on the left, of light tones on the right, and a half
+    // transparent bottom.
+    let (w, h) = (64, 48);
+    let src = image(w, h, |x, y| {
+        let on = (x + y) % 2 == 0;
+        let v = match (x < 32, on) {
+            (true, true) => 20,
+            (true, false) => 70,
+            (false, true) => 190,
+            (false, false) => 240,
+        };
+        if y < 40 { grey(v) } else { [v / 2, v / 2, v / 2, 128] }
+    });
+    let out = run("artistic.smudgeStick", json!({}), &src, w, h);
+    assert_eq!(out, run("artistic.smudgeStick", json!({}), &src, w, h), "draws the same twice");
+    assert!(out.as_chunks::<4>().0.iter().zip(src.as_chunks::<4>().0).all(|(o, s)| o[3] == s[3]), "coverage kept");
+    // The dark detail is smudged away, the light areas brighter.
+    assert!(roughness(&out, w, 4, 28) < 0.5 * roughness(&src, w, 4, 28));
+    assert!(mean(&out, w, 36, 60) > mean(&src, w, 36, 60) + 10.0);
+    // Intensity 0 leaves the light areas unlightened.
+    let flat = run("artistic.smudgeStick", json!({"intensity": 0}), &src, w, h);
+    assert!(mean(&flat, w, 36, 60) < mean(&out, w, 36, 60) - 5.0);
+    survives(
+        "artistic.smudgeStick",
+        &[json!({}), json!({"strokeLength": 1e308, "highlightArea": 1e308, "intensity": 1e308}), json!({"strokeLength": "NaN"})],
+    );
+}
+
+#[test]
+fn sponge_dabs_contrasting_blobs_and_keeps_the_hue() {
+    assert_eq!(fx("artistic.sponge", json!({})), PixelFx::Sponge { brush: 2.0, definition: 12.0, smoothness: 5.0 });
+    assert_eq!(
+        fx("artistic.sponge", json!({"brushSize": -1, "definition": 1e308, "smoothness": 0})),
+        PixelFx::Sponge { brush: 0.0, definition: 25.0, smoothness: 1.0 }
+    );
+    let (w, h) = (80, 60);
+    let flat = image(w, h, |_, y| if y < 50 { [200, 90, 60, 255] } else { [100, 45, 30, 128] });
+    let out = run("artistic.sponge", json!({"definition": 25}), &flat, w, h);
+    assert_eq!(out, run("artistic.sponge", json!({"definition": 25}), &flat, w, h), "draws the same twice");
+    assert!(out.as_chunks::<4>().0.iter().zip(flat.as_chunks::<4>().0).all(|(o, s)| o[3] == s[3]), "coverage kept");
+    // A flat colour breaks up into lighter and darker blobs of the same hue.
+    let top = &out[..w * 50 * 4];
+    assert!(spread(top) > 15.0, "{}", spread(top));
+    assert!(top.as_chunks::<4>().0.iter().all(|p| p[0] >= p[1] && p[1] >= p[2]), "red stays the strongest channel");
+    // Definition 0 leaves a flat colour as it is; more definition, more contrast.
+    let none = run("artistic.sponge", json!({"definition": 0}), &flat, w, h);
+    assert!(spread(&none[..w * 50 * 4]) < 1.0);
+    let some = run("artistic.sponge", json!({"definition": 8}), &flat, w, h);
+    assert!(spread(&some[..w * 50 * 4]) < spread(top));
+    survives("artistic.sponge", &[json!({}), json!({"brushSize": 1e308, "definition": 1e308, "smoothness": 1e308}), json!({"brushSize": "NaN"})]);
+}
+
+#[test]
+fn watercolor_simplifies_detail_and_saturates_edges() {
+    assert_eq!(fx("artistic.watercolor", json!({})), PixelFx::Watercolor { detail: 9.0, shadow: 1.0, texture: 1 });
+    assert_eq!(
+        fx("artistic.watercolor", json!({"brushDetail": 99, "shadowIntensity": -1, "texture": 2.6})),
+        PixelFx::Watercolor { detail: 14.0, shadow: 0.0, texture: 3 }
+    );
+    // Noisy grey on the left, a step from light red to dark blue on the right, a transparent row.
+    let (w, h) = (64, 48);
+    let src = image(w, h, |x, y| {
+        if y >= 44 {
+            return [0; 4];
+        }
+        if x < 32 {
+            grey(if (x * 7 + y * 13) % 5 < 2 { 90 } else { 150 })
+        } else if x < 48 {
+            [200, 120, 120, 255]
+        } else {
+            [60, 70, 110, 255]
+        }
+    });
+    let few = run("artistic.watercolor", json!({"brushDetail": 1}), &src, w, h);
+    let many = run("artistic.watercolor", json!({"brushDetail": 14}), &src, w, h);
+    assert_eq!(few, run("artistic.watercolor", json!({"brushDetail": 1}), &src, w, h), "draws the same twice");
+    assert!(few.as_chunks::<4>().0.iter().zip(src.as_chunks::<4>().0).all(|(o, s)| o[3] == s[3]), "coverage kept, nothing painted outside");
+    assert!(roughness(&few, w, 4, 28) < 0.5 * roughness(&src, w, 4, 28), "less detail, simpler");
+    assert!(roughness(&few, w, 4, 28) < roughness(&many, w, 4, 28));
+    // Colour is saturated where the tones change, and shadows deepen with Shadow Intensity.
+    let chroma = |d: &[u8], x: usize, y: usize| {
+        let i = (y * w + x) * 4;
+        f64::from(d[i].max(d[i + 1]).max(d[i + 2])) - f64::from(d[i].min(d[i + 1]).min(d[i + 2]))
+    };
+    assert!(chroma(&few, 47, 20) > chroma(&src, 47, 20) || chroma(&few, 48, 20) > chroma(&src, 48, 20));
+    assert!(mean(&run("artistic.watercolor", json!({"shadowIntensity": 10}), &src, w, h), w, 4, 28) < mean(&few, w, 4, 28));
+    // Texture adds paper grain to a flat colour.
+    let flat = image(w, h, |_, _| grey(128));
+    let (t1, t3) = (run("artistic.watercolor", json!({"texture": 1}), &flat, w, h), run("artistic.watercolor", json!({"texture": 3}), &flat, w, h));
+    assert!(spread(&t3) > spread(&t1) && spread(&t1) > 0.2);
+    survives(
+        "artistic.watercolor",
+        &[json!({}), json!({"brushDetail": -1e308, "shadowIntensity": 1e308, "texture": 1e308}), json!({"brushDetail": "NaN"})],
+    );
+}

crates/effects/src/pixel/tests_sketch.rs

@@ -0,0 +1,181 @@
+//! Sketch › Bas Relief, Charcoal, Photocopy and Stamp.
+
+use serde_json::json;
+use vectorcraft_doc::Effect;
+use vectorcraft_geom::{Affine, Point, Rect};
+
+use super::*;
+use crate::{RasterFx, raster_effects};
+
+/// A `w` × `h` raster whose pixels are document points (origin top-left), of an object that fills it.
+fn space(w: usize, h: usize) -> PixelSpace {
+    let (w, h) = (w as f64, h as f64);
+    PixelSpace {
+        to_doc: Affine::IDENTITY,
+        px: 1.0,
+        center: Point::new(w / 2.0, h / 2.0),
+        channels: Channels::Rgb,
+        line: 1.0,
+        extent: 0.5 * w.hypot(h),
+    }
+}
+
+fn image(w: usize, h: usize, f: impl Fn(usize, usize) -> [u8; 4]) -> Vec<u8> {
+    (0..h).flat_map(|y| (0..w).map(move |x| (x, y))).flat_map(|(x, y)| f(x, y)).collect()
+}
+
+fn fx(id: &str, p: serde_json::Value) -> PixelFx {
+    let e = Effect { id: id.into(), params: p, visible: true };
+    match raster_effects(&[e]).first() {
+        Some(RasterFx::Pixel(p)) => p.clone(),
+        other => panic!("{id}: {other:?}"),
+    }
+}
+
+fn run(id: &str, p: serde_json::Value, src: &[u8], w: usize, h: usize) -> Vec<u8> {
+    let mut out = src.to_vec();
+    fx(id, p).apply(&mut out, w, h, &space(w, h));
+    out
+}
+
+fn grey(v: u8) -> [u8; 4] {
+    [v, v, v, 255]
+}
+
+/// Channel 0 of pixel (`x`, `y`).
+fn at(d: &[u8], w: usize, x: usize, y: usize) -> u8 {
+    d[(y * w + x) * 4]
+}
+
+/// How many pixels of channel 0 are darker than 128.
+fn black(d: &[u8]) -> usize {
+    d.as_chunks::<4>().0.iter().filter(|p| p[0] < 128).count()
+}
+
+/// No panic and the coverage kept on tiny, huge and non-finite spaces and parameters.
+fn survives(id: &str, params: &[serde_json::Value]) {
+    let (w, h) = (9, 7);
+    let src = image(w, h, |x, y| [(x * 25) as u8, (y * 30) as u8, 90, if x == 0 { 0 } else { 255 }]);
+    let tiny = PixelSpace { px: 1e-9, ..space(w, h) };
+    let huge = PixelSpace { px: 1e9, center: Point::new(f64::MAX, -1e300), ..space(w, h) };
+    let nan = PixelSpace { px: f64::NAN, ..space(w, h) };
+    for p in params {
+        for s in [tiny, huge, nan, space(w, h)] {
+            let mut out = src.clone();
+            fx(id, p.clone()).apply(&mut out, w, h, &s);
+            assert_eq!(out.len(), src.len());
+            let alphas = |d: &[u8]| d.as_chunks::<4>().0.iter().map(|p| p[3]).collect::<Vec<_>>();
+            if s.px == 1.0 {
+                assert_eq!(alphas(&out), alphas(&src), "{id}: coverage kept");
+            }
+        }
+    }
+    // A size that doesn't match, and an empty raster, do nothing.
+    let mut odd = vec![1u8; 10];
+    fx(id, json!({})).apply(&mut odd, 3, 3, &space(3, 3));
+    assert_eq!(odd, vec![1u8; 10]);
+    fx(id, json!({})).apply(&mut [], 0, 0, &space(1, 1));
+}
+
+#[test]
+fn photocopy_copies_the_edges_of_dark_areas() {
+    assert_eq!(fx("sketch.photocopy", json!({})), PixelFx::Photocopy { detail: 7.0, darkness: 25.0 });
+    assert_eq!(fx("sketch.photocopy", json!({"detail": 1e308, "darkness": -5})), PixelFx::Photocopy { detail: 24.0, darkness: 1.0 });
+    let (w, h) = (64, 16);
+    let src = image(w, h, |x, _| grey(if x < 32 { 30 } else { 230 }));
+    let out = run("sketch.photocopy", json!({"detail": 20}), &src, w, h);
+    // Black just on the dark side of the edge; white in the dark area's middle and in the light.
+    assert!(at(&out, w, 30, 8) < 64, "edge {}", at(&out, w, 30, 8));
+    assert!(at(&out, w, 6, 8) > 192, "dark area {}", at(&out, w, 6, 8));
+    assert!(at(&out, w, 50, 8) > 192, "light area {}", at(&out, w, 50, 8));
+    assert_eq!(out, run("sketch.photocopy", json!({"detail": 20}), &src, w, h), "deterministic");
+    // A higher Darkness copies more.
+    let more = run("sketch.photocopy", json!({"detail": 20, "darkness": 50}), &src, w, h);
+    let less = run("sketch.photocopy", json!({"detail": 20, "darkness": 1}), &src, w, h);
+    assert!(black(&more) >= black(&less));
+    survives("sketch.photocopy", &[json!({}), json!({"detail": 1e308, "darkness": "NaN"}), json!({"detail": -1e308, "darkness": [1]})]);
+}
+
+#[test]
+fn stamp_prints_solid_black_and_white() {
+    assert_eq!(fx("sketch.stamp", json!({})), PixelFx::Stamp { balance: 25.0, smoothness: 5.0 });
+    assert_eq!(fx("sketch.stamp", json!({"lightDarkBalance": 1e308, "smoothness": -1})), PixelFx::Stamp { balance: 50.0, smoothness: 1.0 });
+    let (w, h) = (64, 8);
+    let src = image(w, h, |x, _| grey((x * 4) as u8));
+    let few = run("sketch.stamp", json!({"lightDarkBalance": 0}), &src, w, h);
+    let many = run("sketch.stamp", json!({"lightDarkBalance": 50}), &src, w, h);
+    assert!(black(&many) > black(&few), "{} vs {}", black(&many), black(&few));
+    // Pure black and white, but for the one pixel wide edges.
+    let mixed = many.as_chunks::<4>().0.iter().filter(|p| p[0] != 0 && p[0] != 255).count();
+    assert!(mixed * 10 < many.len() / 4, "{mixed} grey pixels");
+    assert_eq!(at(&many, w, 0, 4), 0);
+    assert_eq!(at(&many, w, 63, 4), 255);
+    survives(
+        "sketch.stamp",
+        &[json!({}), json!({"lightDarkBalance": "NaN", "smoothness": 1e308}), json!({"lightDarkBalance": -1e308, "smoothness": null})],
+    );
+}
+
+#[test]
+fn charcoal_draws_bold_edges_and_sketches_the_midtones() {
+    assert_eq!(fx("sketch.charcoal", json!({})), PixelFx::Charcoal { thickness: 1.0, detail: 1.0, balance: 50.0 });
+    assert_eq!(
+        fx("sketch.charcoal", json!({"thickness": 1e308, "detail": -5, "lightDarkBalance": "x"})),
+        PixelFx::Charcoal { thickness: 7.0, detail: 0.0, balance: 50.0 }
+    );
+    let (w, h) = (64, 48);
+    // Black on the left, white on the right: a bold line at the edge, nothing in the white.
+    let step = image(w, h, |x, _| grey(if x < 32 { 0 } else { 255 }));
+    let out = run("sketch.charcoal", json!({}), &step, w, h);
+    assert!((28..36).any(|x| at(&out, w, x, 24) < 64), "edge");
+    assert!((48..64).all(|x| at(&out, w, x, 24) == 255), "white stays white");
+    // A midtone is sketched in strokes, more of it the more the balance reaches into the lights.
+    let mid = image(w, h, |_, _| grey(128));
+    let sketched = run("sketch.charcoal", json!({}), &mid, w, h);
+    let (n, total) = (black(&sketched), w * h);
+    assert!(n > total / 50 && n < total * 9 / 10, "{n} of {total}");
+    let darker = run("sketch.charcoal", json!({"lightDarkBalance": 100}), &mid, w, h);
+    let lighter = run("sketch.charcoal", json!({"lightDarkBalance": 0}), &mid, w, h);
+    assert!(black(&darker) > black(&lighter));
+    assert_eq!(sketched, run("sketch.charcoal", json!({}), &mid, w, h), "deterministic");
+    let white = image(w, h, |_, _| grey(255));
+    assert_eq!(black(&run("sketch.charcoal", json!({"lightDarkBalance": 0}), &white, w, h)), 0);
+    survives(
+        "sketch.charcoal",
+        &[json!({}), json!({"thickness": 1e308, "detail": "NaN", "lightDarkBalance": [1]}), json!({"thickness": -1e308, "detail": 1e308})],
+    );
+}
+
+#[test]
+fn bas_relief_lights_the_surfaces_facing_the_light() {
+    assert_eq!(fx("sketch.basRelief", json!({})), PixelFx::BasRelief { detail: 13.0, smoothness: 3.0, light: Light::Bottom });
+    assert_eq!(
+        fx("sketch.basRelief", json!({"detail": 0, "smoothness": 1e308, "lightDirection": "Top"})),
+        PixelFx::BasRelief { detail: 1.0, smoothness: 15.0, light: Light::Top }
+    );
+    // Dark above, light below: the edge is lit from one side and shaded from the other.
+    let (w, h) = (16, 48);
+    let src = image(w, h, |_, y| grey(if y < 24 { 20 } else { 235 }));
+    let below = run("sketch.basRelief", json!({"lightDirection": "bottom"}), &src, w, h);
+    let above = run("sketch.basRelief", json!({"lightDirection": "top"}), &src, w, h);
+    let edge = (0..h).map(|y| (y, i32::from(at(&below, w, 8, y)) - i32::from(at(&above, w, 8, y)))).max_by_key(|(_, d)| d.abs());
+    assert!(edge.is_some_and(|(_, d)| d.abs() > 100), "{edge:?}");
+    // Flat areas are grey.
+    for y in [2, 45] {
+        let v = at(&below, w, 8, y);
+        assert!((90..190).contains(&v), "flat {v}");
+    }
+    survives(
+        "sketch.basRelief",
+        &[json!({}), json!({"detail": "NaN", "smoothness": 1e308, "lightDirection": 3}), json!({"detail": -1e308, "smoothness": null})],
+    );
+}
+
+#[test]
+fn sketch_filters_reach_beyond_nothing_they_do_not_paint() {
+    for id in ["sketch.basRelief", "sketch.charcoal", "sketch.photocopy", "sketch.stamp"] {
+        let f = fx(id, json!({}));
+        assert_eq!(f.outset(Rect::new(0.0, 0.0, 50.0, 50.0)), 0.0, "{id} keeps the object's coverage");
+        assert!(f.reach().is_some_and(|r| r.is_finite() && r > 0.0), "{id} reach");
+    }
+}

crates/effects/src/pixel/texture.rs

@@ -128,7 +128,7 @@ impl Light {
     }
 
     /// The unit vector towards the light (document axes, y down).
-    fn toward(self) -> Vec2 {
+    pub(super) fn toward(self) -> Vec2 {
         let d = FRAC_1_SQRT_2;
         match self {
             Light::Bottom => Vec2::new(0.0, 1.0),
@@ -269,7 +269,7 @@ impl Tones {
     }
 
     /// The tone at pixel (`x`, `y`) and its slope per document unit along the document's axes.
-    fn slope(&self, x: usize, y: usize, place: &Place) -> (f64, Vec2) {
+    pub(super) fn slope(&self, x: usize, y: usize, place: &Place) -> (f64, Vec2) {
         let gx = 0.5 * (self.get(x + 1, y) - self.get(x.saturating_sub(1), y));
         let gy = 0.5 * (self.get(x, y + 1) - self.get(x, y.saturating_sub(1)));
         // Per pixel → per document unit: through the transpose of the document → pixel map.

crates/effects/src/raster.rs

@@ -1,15 +1,19 @@
 //! Raster (painted) effects: descriptions for the renderer.
 
 use serde_json::Value;
-use vectorcraft_doc::Effect;
 use vectorcraft_doc::color::{BlendMode, Color};
+use vectorcraft_doc::rastersettings::MAX_ADD_AROUND;
+use vectorcraft_doc::{Effect, RasterColorModel, RasterEffectsSettings};
 
-use vectorcraft_geom::Rect;
+use vectorcraft_geom::{Point, Rect};
 
 use crate::merged_params;
-use crate::pixel::{self, PixelFx};
+use crate::pixel::{self, PixelFx, PixelSpace};
 use crate::util::*;
 
+/// Effect › Rasterize's id.
+pub const RASTERIZE: &str = "rasterize";
+
 /// A painted effect, in document units. `blur` is Illustrator's blur distance; the renderer uses
 /// a Gaussian with σ = blur / 2 (so the visible spread is about 1.5 × blur).
 #[derive(Clone, Debug, PartialEq)]
@@ -25,6 +29,8 @@ pub enum RasterFx {
         /// instead of `color`; `None` when it is `color`.
         darkness: Option<f32>,
     },
+    /// Blurs the art's solid silhouette grown by a quarter of a pixel of the document's raster grid,
+    /// as the glows AI files export measure.
     OuterGlow {
         mode: BlendMode,
         opacity: f32,
@@ -48,6 +54,8 @@ pub enum RasterFx {
     },
     /// A Photoshop-style filter over the object's pixels (Radial Blur, Unsharp Mask…).
     Pixel(PixelFx),
+    /// Effect › Rasterize: the object drawn as an image of square pixels.
+    Rasterize(Rasterize),
 }
 
 impl RasterFx {
@@ -71,6 +79,282 @@ impl RasterFx {
             RasterFx::InnerGlow { .. } | RasterFx::Feather { .. } => 0.0,
             RasterFx::GaussianBlur { radius } => 1.5 * radius,
             RasterFx::Pixel(p) => p.outset(bounds),
+            RasterFx::Rasterize(r) => r.outset(),
+        }
+    }
+    /// This effect with a Rasterize that takes the document's resolution at `ppi` ([`Rasterize::at_document_ppi`]).
+    pub fn at_document_ppi(&self, ppi: f64) -> RasterFx {
+        match self {
+            RasterFx::Rasterize(r) => RasterFx::Rasterize(r.at_document_ppi(ppi)),
+            fx => fx.clone(),
+        }
+    }
+    /// What this effect paints over when what it paints around covers `bounds`: Rasterize's image
+    /// ([`Rasterize::image`], `line` the document's raster grid), `bounds` grown by
+    /// [`Self::outset`] for the others.
+    pub fn spread(&self, bounds: Rect, line: f64) -> Rect {
+        match self {
+            RasterFx::Rasterize(r) => r.image(bounds, line),
+            RasterFx::OuterGlow { .. } => {
+                let o = self.outset(bounds) + 0.25 * line;
+                bounds.inflate(o, o)
+            }
+            fx => {
+                let o = fx.outset(bounds);
+                bounds.inflate(o, o)
+            }
+        }
+    }
+}
+
+/// Effect › Rasterize's options, read from its parameters. The image covers the object's bounds
+/// (as far as the effects before it spread the object) and `add_around` points around them, in
+/// pixels `72 / ppi` points wide whose first one starts at that area's top-left corner, as Object
+/// › Rasterize makes its image.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Rasterize {
+    /// Pixels per inch (1 to 2400); `None` takes Document Raster Effects Settings › Resolution.
+    pub ppi: Option<f64>,
+    /// The image's color model.
+    pub color_model: RasterColorModel,
+    /// A white background: the image is opaque. Otherwise it keeps its transparency.
+    pub white: bool,
+    /// Smooth edges (Art Optimized or Type Optimized). Off, each pixel takes the art at its center.
+    pub anti_alias: bool,
+    /// Type Optimized: smooth edges with type fitted to the pixels.
+    pub hinted: bool,
+    /// The image is clipped to the art's outline.
+    pub clipping_mask: bool,
+    /// Room around the art, in points (0 to [`MAX_ADD_AROUND`]).
+    pub add_around: f64,
+}
+
+impl Rasterize {
+    /// The options in the effect's parameters `p` (defaults merged in).
+    fn parse(p: &Value) -> Self {
+        let ppi = (!flag(p, "useDocumentResolution", true)).then(|| num(p, "resolution", 72.0).clamp(1.0, 2400.0));
+        let color_model = match text(p, "colorModel", "document").to_ascii_lowercase().as_str() {
+            "grayscale" | "gray" => RasterColorModel::Grayscale,
+            "bitmap" => RasterColorModel::Bitmap,
+            _ => RasterColorModel::Document,
+        };
+        Self {
+            ppi,
+            color_model,
+            white: text(p, "background", "transparent").eq_ignore_ascii_case("white"),
+            anti_alias: !text(p, "antiAlias", "art").eq_ignore_ascii_case("none"),
+            hinted: text(p, "antiAlias", "art").eq_ignore_ascii_case("type"),
+            clipping_mask: flag(p, "clippingMask", false),
+            add_around: num(p, "addAround", 0.0).clamp(0.0, MAX_ADD_AROUND),
+        }
+    }
+
+    /// The width of a pixel of the image in document units: 72 / `ppi`, or `line` (72 / the
+    /// document's raster effects resolution) when it takes the document's.
+    pub fn cell(&self, line: f64) -> f64 {
+        self.ppi.map_or(line, |ppi| 72.0 / ppi)
+    }
+
+    /// These options at `ppi` when they take the document's resolution.
+    pub fn at_document_ppi(self, ppi: f64) -> Self {
+        Self { ppi: self.ppi.or(Some(ppi)), ..self }
+    }
+
+    /// How far beyond the object's bounds the image reaches: the room around it and, at a known
+    /// resolution, one pixel more for the last column and row, which are whole pixels.
+    pub fn outset(&self) -> f64 {
+        self.add_around + self.ppi.map_or(0.0, |ppi| 72.0 / ppi)
+    }
+
+    /// How far (document units) from a pixel the content that decides it lies: across its pixel
+    /// of the image (72 points when the resolution is the document's, not known here).
+    pub fn reach(&self) -> f64 {
+        self.cell(72.0) * std::f64::consts::SQRT_2
+    }
+
+    /// The image of art over `bounds`: `bounds` and the room around them, in whole pixels
+    /// ([`Self::cell`] of `line`) from that area's top-left corner.
+    pub fn image(&self, bounds: Rect, line: f64) -> Rect {
+        let cell = self.cell(line);
+        let area = bounds.inflate(self.add_around, self.add_around);
+        let (cols, rows) = ((area.width() / cell).ceil().max(1.0), (area.height() / cell).ceil().max(1.0));
+        Rect::new(area.x0, area.y0, area.x0 + cols * cell, area.y0 + rows * cell)
+    }
+
+    /// Give `pixels` (premultiplied RGBA8), the art drawn on the image's own grid, the background
+    /// and then the color model, as Object › Rasterize does.
+    pub fn finish(&self, pixels: &mut [u8]) {
+        for p in pixels.as_chunks_mut::<4>().0 {
+            if self.white {
+                let under = 255 - p[3];
+                *p = p.map(|c| c.saturating_add(under));
+            }
+        }
+        RasterEffectsSettings { color_model: self.color_model, ..Default::default() }.finish_pixels(pixels);
+    }
+
+    /// Draw `image` into `data`, `w` × `h` premultiplied RGBA8 pixels lying in the document as
+    /// `space` says: `image` is `cols` × `rows` premultiplied RGBA8 pixels covering `rect` in the
+    /// document. In a view that isn't turned, each pixel of `data` takes the mean of the image over
+    /// its area (transparent outside the image); otherwise the mean of the image at up to 8 × 8
+    /// points across it. Does nothing when the sizes don't match.
+    #[allow(clippy::too_many_arguments)]
+    pub fn compose(&self, data: &mut [u8], w: usize, h: usize, space: &PixelSpace, image: &[u8], cols: usize, rows: usize, rect: Rect) {
+        let (px, rest) = data.as_chunks_mut::<4>();
+        let (src, src_rest) = image.as_chunks::<4>();
+        let fits = |n: usize, w: usize, h: usize, rest: usize| w > 0 && h > 0 && rest == 0 && w.checked_mul(h) == Some(n);
+        if !(fits(px.len(), w, h, rest.len()) && fits(src.len(), cols, rows, src_rest.len()) && rect.width() > 0.0 && rect.height() > 0.0) {
+            return;
+        }
+        let (sx, sy) = (cols as f64 / rect.width(), rows as f64 / rect.height());
+        // Document → image pixels.
+        let to_image = |p: Point| ((p.x - rect.x0) * sx, (p.y - rect.y0) * sy);
+        let at = |i: f64, j: f64| {
+            (i >= 0.0 && j >= 0.0 && i < cols as f64 && j < rows as f64).then(|| src.get(j as usize * cols + i as usize).copied()).flatten()
+        };
+        let straight = matches!(space.to_doc.as_coeffs(), [_, b, c, _, _, _] if b == 0.0 && c == 0.0);
+        // Points across a raster pixel in a turned view: about one an image pixel.
+        let n = (space.px * sx.max(sy)).ceil().clamp(1.0, 8.0) as usize;
+        for (k, p) in px.iter_mut().enumerate() {
+            let (x, y) = ((k % w) as f64, (k / w) as f64);
+            let mut acc = [0.0f64; 4];
+            let weight = if straight {
+                let (a, b) = (to_image(space.to_doc * Point::new(x, y)), to_image(space.to_doc * Point::new(x + 1.0, y + 1.0)));
+                let (u0, u1, v0, v1) = (a.0.min(b.0), a.0.max(b.0), a.1.min(b.1), a.1.max(b.1));
+                let (i0, i1) = (u0.floor().max(0.0), u1.ceil().min(cols as f64));
+                let (j0, j1) = (v0.floor().max(0.0), v1.ceil().min(rows as f64));
+                let mut j = j0;
+                while j < j1 {
+                    let mut i = i0;
+                    while i < i1 {
+                        let share = (u1.min(i + 1.0) - u0.max(i)).max(0.0) * (v1.min(j + 1.0) - v0.max(j)).max(0.0);
+                        if let Some(q) = at(i, j) {
+                            for (s, v) in acc.iter_mut().zip(q) {
+                                *s += share * f64::from(v);
+                            }
+                        }
+                        i += 1.0;
+                    }
+                    j += 1.0;
+                }
+                (u1 - u0) * (v1 - v0)
+            } else {
+                for t in 0..n * n {
+                    let (fx, fy) = (((t % n) as f64 + 0.5) / n as f64, ((t / n) as f64 + 0.5) / n as f64);
+                    let (i, j) = to_image(space.to_doc * Point::new(x + fx, y + fy));
+                    if let Some(q) = at(i.floor(), j.floor()) {
+                        for (s, v) in acc.iter_mut().zip(q) {
+                            *s += f64::from(v);
+                        }
+                    }
+                }
+                (n * n) as f64
+            };
+            *p = if weight > 0.0 { acc.map(|s| (s / weight).round().clamp(0.0, 255.0) as u8) } else { [0; 4] };
+        }
+    }
+
+    /// Turn `data`, `w` × `h` premultiplied RGBA8 pixels of the object lying in the document as
+    /// `space` says, into its image over `bounds` (what the object covers after the effects before
+    /// this one), when the image is too large to draw on its own grid. Each pixel of the image more
+    /// than a raster pixel wide takes the mean of the raster pixels whose centers lie in it
+    /// (anti-aliased) or the raster pixel at its center (not anti-aliased). Smaller pixels are left
+    /// as drawn. Then the background and the color model apply as Object › Rasterize applies them.
+    /// What lies outside the image becomes transparent, and in a view that isn't turned the raster
+    /// pixels along its edges keep the share of them it covers. Does nothing when the sizes don't
+    /// match. The renderer draws the content with hard edges when it goes into Rasterize with
+    /// anti-aliasing off and image pixels at least a raster pixel wide.
+    pub fn apply(&self, data: &mut [u8], w: usize, h: usize, space: &PixelSpace, bounds: Rect) {
+        let cell = self.cell(space.line);
+        let (px, rest) = data.as_chunks_mut::<4>();
+        if w == 0 || h == 0 || !rest.is_empty() || w.checked_mul(h) != Some(px.len()) || !(cell.is_finite() && cell > 0.0 && space.px > 0.0) {
+            return;
+        }
+        let area = self.image(bounds, space.line);
+        let (cols, rows) = ((area.width() / cell).round().max(1.0), (area.height() / cell).round().max(1.0));
+        // The pixel of the image (column, row) that a raster pixel's center lies in.
+        let pixel_at = |x: usize, y: usize| {
+            let p = space.to_doc * Point::new(x as f64 + 0.5, y as f64 + 0.5);
+            let (c, r) = (((p.x - area.x0) / cell).floor(), ((p.y - area.y0) / cell).floor());
+            (c >= 0.0 && r >= 0.0 && c < cols && r < rows).then_some((c, r))
+        };
+        let wide = cell / space.px;
+        // The image's pixels the raster covers: columns c0..c1, rows r0..r1.
+        let seen = space.to_doc.transform_rect_bbox(Rect::new(0.0, 0.0, w as f64, h as f64));
+        let (c0, c1) = (((seen.x0 - area.x0) / cell).floor().clamp(0.0, cols), ((seen.x1 - area.x0) / cell).ceil().clamp(0.0, cols));
+        let (r0, r1) = (((seen.y0 - area.y0) / cell).floor().clamp(0.0, rows), ((seen.y1 - area.y0) / cell).ceil().clamp(0.0, rows));
+        let span = (c1 - c0) as usize;
+        let slot = |(c, r): (f64, f64)| ((r - r0) as usize).saturating_mul(span).saturating_add((c - c0) as usize);
+        // Anti-aliased: the sums of each pixel's raster pixels (premultiplied) and their count,
+        // which saturate past 16 million raster pixels to an image pixel. They are kept for the
+        // whole grid when it has no more pixels than the raster, else for the pixels the raster
+        // reaches (a turned view of a narrow raster).
+        let grid = span.saturating_mul((r1 - r0) as usize);
+        let whole = grid <= px.len();
+        let mut dense: Vec<[u32; 5]> = vec![];
+        let mut sparse: std::collections::HashMap<usize, [u32; 5]> = std::collections::HashMap::new();
+        if self.anti_alias && wide > 1.0 {
+            if whole {
+                dense = vec![[0; 5]; grid];
+            }
+            for (i, p) in px.iter().enumerate() {
+                let Some(k) = pixel_at(i % w, i / w).map(slot) else { continue };
+                let s = if whole { dense.get_mut(k) } else { Some(sparse.entry(k).or_default()) };
+                if let Some(s) = s {
+                    for (acc, v) in s.iter_mut().zip(p) {
+                        *acc = acc.saturating_add(u32::from(*v));
+                    }
+                    s[4] = s[4].saturating_add(1);
+                }
+            }
+        }
+        let sum = |k: usize| if whole { dense.get(k) } else { sparse.get(&k) };
+        // Not anti-aliased: the raster as drawn, to read each pixel's center from.
+        let drawn = (!self.anti_alias && wide > 1.0).then(|| px.to_vec());
+        let to_raster = space.to_doc.inverse();
+        let model = RasterEffectsSettings { color_model: self.color_model, ..Default::default() };
+        // In a view that isn't turned, the raster pixels along the image's edges take the share of
+        // them it covers; otherwise those whose center lies in it are in it.
+        let straight = matches!(space.to_doc.as_coeffs(), [_, b, c, _, _, _] if b == 0.0 && c == 0.0);
+        let image = to_raster.transform_rect_bbox(area);
+        let cover =
+            |x: f64, y: f64| (image.x1.min(x + 1.0) - image.x0.max(x)).clamp(0.0, 1.0) * (image.y1.min(y + 1.0) - image.y0.max(y)).clamp(0.0, 1.0);
+        for (i, p) in px.iter_mut().enumerate() {
+            let (x, y) = (i % w, i / w);
+            let (at, share) = if straight {
+                // The image pixel nearest the raster pixel's center.
+                let q = space.to_doc * Point::new(x as f64 + 0.5, y as f64 + 0.5);
+                let at = (((q.x - area.x0) / cell).floor().clamp(0.0, cols - 1.0), ((q.y - area.y0) / cell).floor().clamp(0.0, rows - 1.0));
+                (Some(at), cover(x as f64, y as f64))
+            } else {
+                (pixel_at(x, y), 1.0)
+            };
+            let Some(at) = at.filter(|_| share > 0.0) else {
+                *p = [0; 4];
+                continue;
+            };
+            // An image pixel's color, over the share of the raster pixel the image covers. (A raster
+            // pixel left as drawn holds art the image covers whole.)
+            let made = if let Some(s) = sum(slot(at)).filter(|s| s[4] > 0) {
+                Some([0, 1, 2, 3].map(|k| ((u64::from(s[k]) + u64::from(s[4] / 2)) / u64::from(s[4])).min(255) as u8))
+            } else {
+                drawn.as_ref().map(|drawn| {
+                    let center = to_raster * Point::new(area.x0 + (at.0 + 0.5) * cell, area.y0 + (at.1 + 0.5) * cell);
+                    let (x, y) = (center.x.floor(), center.y.floor());
+                    let inside = x >= 0.0 && y >= 0.0 && x < w as f64 && y < h as f64;
+                    if inside { drawn.get(y as usize * w + x as usize).copied().unwrap_or_default() } else { [0; 4] }
+                })
+            };
+            if let Some(v) = made {
+                *p = if share < 1.0 { v.map(|c| (f64::from(c) * share).round() as u8) } else { v };
+            }
+            // White goes under the art first, over the image's share of the pixel, then the color
+            // model applies, as in Object › Rasterize.
+            if self.white {
+                let under = ((255.0 * share).round() as u8).saturating_sub(p[3]);
+                *p = p.map(|c| c.saturating_add(under));
+            }
+            model.finish_pixels(p);
         }
     }
 }
@@ -133,6 +417,7 @@ pub fn raster_effects(effects: &[Effect]) -> Vec<RasterFx> {
                 },
                 "stylize.feather" => RasterFx::Feather { radius: num(&p, "radius", 5.0).clamp(0.0, 1000.0) },
                 "blur.gaussian" => RasterFx::GaussianBlur { radius: num(&p, "radius", 5.0).clamp(0.0, 1000.0) },
+                RASTERIZE => RasterFx::Rasterize(Rasterize::parse(&p)),
                 id => RasterFx::Pixel(pixel::parse(id, &p)?),
             })
         })

crates/effects/src/reshape.rs

@@ -5,12 +5,16 @@
 //! (glyph outlines, the evaluated live object, the symbol's art) and [`reshape`] runs each effect
 //! over all of them as one piece, with the whole art's bounds as the effect's reference box, so a
 //! warp bends a line of type as a whole. An image is clipped by its reshaped frame. Raster effects
-//! (shadows, glows, blur, feather) stay on the result for the renderer and exporters.
+//! (shadows, glows, blur, feather) stay on the result for the renderer and exporters. Type without
+//! inline graphics whose own fills or strokes have geometry effects is outlined too: each of those
+//! effects reshapes the whole outline that its fill or stroke paints. An image's own fills and
+//! strokes paint only the shape that a Convert to Shape or Outline Object effect on them gives
+//! them ([`image_rows`]).
 
 use std::sync::Arc;
 
 use vectorcraft_doc::{Appearance, AppearanceItem, Effect, Node, NodeKind};
-use vectorcraft_geom::{Affine, FillRule, PathData, Rect, shapes};
+use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Rect, Shape, shapes};
 
 use crate::{GeomContext, apply_one, is_geometry, merged_params};
 
@@ -30,6 +34,89 @@ pub fn needs_outline(n: &Node) -> bool {
     )
 }
 
+/// Is `n` a path or compound path with a visible Transform effect that makes copies and a gradient
+/// in a fill or stroke? Such an object is drawn through its art ([`outline_art`]) so that each copy
+/// paints its gradient by itself ([`copy_with_gradients`]), as a group's copies do.
+pub fn has_gradient_copies(n: &Node) -> bool {
+    matches!(n.kind, NodeKind::Path { guide: false, clipping: false, .. } | NodeKind::Compound { .. })
+        && (n.appearance.has_unplaced_gradient() || n.appearance.has_placed_gradient())
+        && geometry_effects(n)
+            .iter()
+            .any(|e| e.id == "distort.transform" && crate::distort::transform_map(Rect::ZERO, &merged_params(&e.id, &e.params), 0).1 > 0)
+}
+
+/// Is `n` type without inline graphics that has a fill or stroke of its own that paints and has a
+/// visible geometry effect, or an image with a fill or stroke of its own that paints a shape
+/// ([`image_rows`])? On type, such an effect reshapes the whole outline that its fill or stroke
+/// paints ([`outline_text`], which leaves inline graphics out).
+pub fn has_item_geometry(n: &Node) -> bool {
+    match &n.kind {
+        NodeKind::Text(t) => {
+            t.runs.iter().all(|r| r.inline.is_none()) && n.appearance.items.iter().any(|i| crate::paints(i) && crate::has_geometry(i.effects()))
+        }
+        NodeKind::Image(_) => n.appearance.items.iter().any(shapes_image),
+        _ => false,
+    }
+}
+
+/// Does effect `e` give an image's fill or stroke a shape to paint (a visible Convert to Shape or
+/// Outline Object)?
+fn gives_shape(e: &Effect) -> bool {
+    e.visible
+        && matches!(e.id.as_str(), "convertToShape.rectangle" | "convertToShape.roundedRectangle" | "convertToShape.ellipse" | "path.outlineObject")
+}
+
+/// Does `item`, a fill or stroke of an image, paint something: does it paint and carry an effect
+/// that gives it a shape ([`gives_shape`])?
+fn shapes_image(item: &AppearanceItem) -> bool {
+    crate::paints(item) && item.effects().iter().any(gives_shape)
+}
+
+/// The fills and strokes of `items` (an image's own) that paint something ([`shapes_image`]), each
+/// without the effects before its first Convert to Shape or Outline Object. Convert to Shape sizes
+/// its shape from the image's box, and Outline Object gives the image's frame. The others paint
+/// nothing.
+fn image_rows(items: &[AppearanceItem]) -> Vec<AppearanceItem> {
+    items
+        .iter()
+        .filter(|i| shapes_image(i))
+        .map(|i| {
+            let mut i = i.clone();
+            let fx = i.effects_mut();
+            let first = fx.iter().position(gives_shape).unwrap_or(0);
+            fx.drain(..first);
+            i
+        })
+        .collect()
+}
+
+/// The shapes that the image `n`'s own fills and strokes paint ([`image_rows`]), each with its fill
+/// rule and the fill or stroke that paints it: the paths (or compound paths) along its frame that
+/// [`reshape`] makes, with each fill's or stroke's geometry effects applied as the renderer applies
+/// them. Empty for anything but an image with such fills or strokes.
+pub fn image_paint(n: &Node) -> Vec<(BezPath, FillRule, AppearanceItem)> {
+    if !matches!(n.kind, NodeKind::Image(_)) || !has_item_geometry(n) {
+        return vec![];
+    }
+    let Some(art) = reshape(n, None) else { return vec![] };
+    let mut out = vec![];
+    art.walk(&mut |c| {
+        let (NodeKind::Path { rule, .. } | NodeKind::Compound { rule, .. }) = &c.kind else { return };
+        let Some(g) = c.stroke_path() else { return };
+        let ctx = GeomContext::of(c);
+        for item in c.appearance.items.iter().filter(|i| crate::paints(i)) {
+            let fx = item.effects();
+            let shape = if crate::has_geometry(fx) && !g.elements().is_empty() {
+                crate::apply_geometry_bez(fx, &g, g.bounding_box(), &ctx.item(item))
+            } else {
+                g.clone()
+            };
+            out.push((shape, *rule, item.clone()));
+        }
+    });
+    out
+}
+
 /// The glyph outlines of type `t` in text space with its underline and strikethrough bars: one
 /// path per run, and all of them as one.
 pub(crate) fn glyph_outlines(t: &vectorcraft_doc::TextObject) -> (Vec<kurbo::BezPath>, kurbo::BezPath) {
@@ -117,6 +204,16 @@ pub fn outline_art(n: &Node, symbol_art: Option<&Node>) -> Option<Node> {
             a.transform(*xf, false);
             Node::group(n.id, vec![Arc::new(a)])
         }
+        // The object as the one piece the copies of its Transform effect are made from.
+        _ if has_gradient_copies(n) => {
+            let mut one = n.clone();
+            one.opacity = 1.0;
+            one.blend = Default::default();
+            one.isolate = false;
+            one.extras_mut().mask = None;
+            one.appearance.effects.clear();
+            Node::group(n.id, vec![Arc::new(one)])
+        }
         _ if vectorcraft_doc::live::is_live(n) => vectorcraft_doc::live::expand_deep(n, Some(hook)),
         _ => return None,
     };
@@ -155,21 +252,33 @@ pub(crate) fn outline_nested_text(n: &mut Node, clipping: bool) {
 
 /// `n` (see [`needs_outline`]) with its object-level geometry effects and its perspective applied:
 /// its [`outline_art`] reshaped as one piece, or for an image the image clipped by its reshaped
-/// frame. The result is a group with `n`'s id, name, visibility, transparency, opacity mask and
-/// remaining (raster) effects; `None` when `n` has neither a visible geometry effect nor a
-/// perspective, or has no art (a symbol instance without `symbol_art`).
+/// frame. Type's own fills and strokes keep their effects on its whole outline. An image's own
+/// fills and strokes that paint a shape ([`image_rows`]) become paths along its frame below and
+/// above it, reshaped with it, and keep their effects from their first Convert to Shape or Outline
+/// Object on. The result is a group with `n`'s id, name, visibility, transparency, opacity mask
+/// and remaining (raster) effects; `None` when `n` has no visible geometry effect, no perspective
+/// and is not type or an image with a fill or stroke of its own that [`has_item_geometry`] counts,
+/// or has no art (a symbol instance without `symbol_art`).
 pub fn reshape(n: &Node, symbol_art: Option<&Node>) -> Option<Node> {
-    if (geometry_effects(n).is_empty() && n.projection().is_none()) || !needs_outline(n) {
+    if (geometry_effects(n).is_empty() && n.projection().is_none() && !has_item_geometry(n)) || !(needs_outline(n) || has_gradient_copies(n)) {
         return None;
     }
     as_art(n, symbol_art)
 }
 
-/// `n` (see [`needs_outline`]) as plain art for Expand Appearance: [`reshape`]d when it has
-/// geometry effects, else type with fills or strokes of its own outlined, in the same form. `None`
-/// when it has neither.
+/// `n` (see [`needs_outline`], or a path with [`has_gradient_copies`]) as plain art for Expand
+/// Appearance: [`reshape`]d when it has
+/// geometry effects, else type with fills or strokes of its own outlined, or an image with fills
+/// or strokes of its own that paint a shape, in the same form. `None` when it has none of these.
 pub fn expand_outlined(n: &Node, symbol_art: Option<&Node>) -> Option<Node> {
-    let own_paint = matches!(n.kind, NodeKind::Text(_)) && !n.appearance.items.is_empty();
+    // A path whose Transform effect copies it with a gradient: each copy an object of its own.
+    if has_gradient_copies(n) {
+        return as_art(n, symbol_art);
+    }
+    let own_paint = match n.kind {
+        NodeKind::Text(_) => !n.appearance.items.is_empty(),
+        _ => has_item_geometry(n),
+    };
     if !needs_outline(n) || (geometry_effects(n).is_empty() && !own_paint) {
         return None;
     }
@@ -182,12 +291,28 @@ pub(crate) fn as_art(n: &Node, symbol_art: Option<&Node>) -> Option<Node> {
     let mut art = match &n.kind {
         NodeKind::Image(im) => {
             let frame = shapes::rectangle(Rect::new(0.0, 0.0, im.width as f64, im.height as f64)).transformed(im.xf);
-            let mut clip = Node::path(n.id, frame, Appearance::default());
-            if let NodeKind::Path { clipping, .. } = &mut clip.kind {
-                *clipping = true;
-            }
             let image = Node::new(n.id, n.kind.clone());
-            Node::new(n.id, NodeKind::Group { children: vec![Arc::new(clip), Arc::new(image)], clip: true })
+            let clipped = || {
+                let mut clip = Node::path(n.id, frame.clone(), Appearance::default());
+                if let NodeKind::Path { clipping, .. } = &mut clip.kind {
+                    *clipping = true;
+                }
+                Node::new(n.id, NodeKind::Group { children: vec![Arc::new(clip), Arc::new(image.clone())], clip: true })
+            };
+            // The fills and strokes that paint a shape, as paths along the frame below and above
+            // the image.
+            let (below, above) = n.appearance.split_contents();
+            let (below, above) = (image_rows(below), image_rows(above));
+            if below.is_empty() && above.is_empty() {
+                clipped()
+            } else {
+                let rows = |items: Vec<AppearanceItem>| {
+                    (!items.is_empty()).then(|| Arc::new(Node::path(n.id, frame.clone(), Appearance { items, ..Default::default() })))
+                };
+                // Without geometry effects, the image is not clipped.
+                let image = if fx.is_empty() { image.clone() } else { clipped() };
+                Node::group(n.id, rows(below).into_iter().chain([Arc::new(image)]).chain(rows(above)).collect())
+            }
         }
         _ => outline_art(n, symbol_art)?,
     };
@@ -196,7 +321,8 @@ pub(crate) fn as_art(n: &Node, symbol_art: Option<&Node>) -> Option<Node> {
     if let Some(h) = n.projection() {
         project_leaves(&mut art, &h);
     }
-    // The art is a group with `n`'s id (a clip group for an image).
+    // The art is a group with `n`'s id (for an image without fills or strokes that paint, a clip
+    // group).
     let mut out = art;
     out.name = n.name.clone();
     out.visible = n.visible;
@@ -256,13 +382,21 @@ pub(crate) fn reshape_leaves(art: &mut Node, fx: &[&Effect]) {
     for e in fx {
         let Some(bounds) = art.geometric_bounds() else { break };
         let params = merged_params(&e.id, &e.params);
+        let transform = (e.id == "distort.transform").then(|| crate::distort::transform_map(bounds, &params, seed));
         for_each_leaf(art, &mut |leaf| {
             let Some((path, rule)) = leaf_geometry(leaf) else { return };
+            // A gradient paints each copy by itself, not the one piece the copies make together.
+            if let Some((m, copies)) = transform
+                && copies > 0
+                && (leaf.appearance.has_unplaced_gradient() || leaf.appearance.has_placed_gradient())
+            {
+                copy_with_gradients(leaf, &path, m, copies);
+                return;
+            }
             let out = apply_one(&e.id, &params, &path, bounds, &GeomContext { seed, ..GeomContext::of(leaf) });
             set_geometry(leaf, out, rule);
         });
-        if e.id == "distort.transform" {
-            let (m, copies) = crate::distort::transform_map(bounds, &params, seed);
+        if let Some((m, copies)) = transform {
             transform_placed(art, m, copies);
         }
     }
@@ -271,6 +405,34 @@ pub(crate) fn reshape_leaves(art: &mut Node, fx: &[&Effect]) {
     }
 }
 
+/// Replace `leaf` (a path or compound path with geometry `path`) by a group of it and `copies`
+/// more, each mapped once more by `m` than the last, as a Transform effect copies an object. Each
+/// copy is an object of its own, so its gradients fit it (a placed gradient moves with it) rather
+/// than spanning every copy. The copies stop where [`crate::distort::transform_within`]'s would.
+fn copy_with_gradients(leaf: &mut Node, path: &PathData, m: Affine, copies: usize) {
+    let each = path.anchor_count();
+    let mut anchors = each;
+    let mut placements: Vec<Arc<Node>> = vec![Arc::new(leaf.clone())];
+    let mut xf = Affine::IDENTITY;
+    for _ in 0..copies {
+        anchors = anchors.saturating_add(each);
+        if anchors > crate::distort::MAX_COPY_ANCHORS {
+            break;
+        }
+        xf *= m;
+        let mut copy = leaf.clone();
+        copy.transform(xf, vectorcraft_doc::Scaling::default());
+        if !copy.geometric_bounds().is_some_and(crate::distort::within_reach) {
+            break;
+        }
+        placements.push(Arc::new(copy));
+    }
+    // The copies become nodes of their own under a group with the object's id and name.
+    let mut g = Node::group(leaf.id, placements);
+    g.name = leaf.name.clone();
+    *leaf = g;
+}
+
 /// The bounds of each group of type's outlines under `n` ([`outline_text`]), `n` included, in
 /// order. A group inside one of them is part of it.
 fn type_outline_bounds(n: &Node, out: &mut Vec<Option<Rect>>) {

crates/effects/src/revolve.rs

@@ -34,6 +34,8 @@ pub fn revolve_options(p: &Value) -> Revolve {
         light_rotation: num(p, "lightRotation", vectorcraft_three_d::DEFAULT_LIGHT.0),
         light_height: num(p, "lightHeight", vectorcraft_three_d::DEFAULT_LIGHT.1),
         light_behind: flag(p, "lightBehind", false),
+        light_color: crate::lighting::light_color(p),
+        lights: crate::lighting::lights(p),
         light_intensity: num(p, "lightIntensity", 80.0) / 100.0,
         light_softness: num(p, "lightSoftness", 0.0) / 100.0,
         ambient: num(p, "ambient", 25.0) / 100.0,
@@ -46,6 +48,7 @@ pub fn revolve_options(p: &Value) -> Revolve {
 /// Validate before a command mutates the document. Loading external files is still bounded
 /// by the evaluator; unsupported source kinds remain unchanged when rendered.
 pub fn validate_revolve(n: &Node, p: &Value) -> Result<(), String> {
+    crate::lighting::validate(p)?;
     let path = profile(n).ok_or("Revolve currently requires a path or compound path. Select a profile drawn with the Pen tool.")?;
     let b = path.bounds().ok_or("Revolve requires a profile with at least two anchors")?;
     if !path.subpaths.iter().any(|sp| sp.anchors.len() >= 2) {
@@ -87,7 +90,9 @@ fn surface(
     let b = path.bounds()?;
     // A loaded file or a profile edited past the limits keeps drawing its source path instead
     // of crashing the frame. Commands validate the same evaluator and report its errors.
-    let faces = vectorcraft_three_d::revolve(path, b, revolve_options(&merged_params(REVOLVE, &fx.params))).ok()?;
+    let options = revolve_options(&merged_params(REVOLVE, &fx.params));
+    let colored = options.light_color != [1.0; 3] || options.lights.is_some();
+    let faces = vectorcraft_three_d::revolve(path, b, options).ok()?;
     // Visibility is an expansion option, never a change to live geometry or export baking.
     // Keep all faces for paints whose coverage we cannot prove opaque. A bounded visibility
     // failure also retains the complete surface rather than losing any of the user's art.
@@ -102,19 +107,42 @@ fn surface(
     let faces = visible.unwrap_or_else(|| {
         faces
             .into_iter()
-            .map(|f| vectorcraft_three_d::VisibleFace { path: f.path(), brightness: f.brightness, depth: f.depth, gradient: f.gradient })
+            .map(|f| vectorcraft_three_d::VisibleFace {
+                path: f.path(),
+                brightness: f.brightness,
+                depth: f.depth,
+                gradient: f.gradient,
+                illumination: f.illumination,
+                light_gradient: f.light_gradient,
+                rgb_gradient: f.rgb_gradient,
+            })
             .collect()
     });
     let children = faces
         .into_iter()
         .map(|face| {
+            if let Some(g) = face.rgb_gradient
+                && (paint.color().is_some() || matches!(paint, Paint::Gradient(_)))
+            {
+                return Arc::new(crate::lighting::rgb_gradient_art(n.id, &face.path, &paint, g));
+            }
+            if let (true, Paint::Gradient(_), Some(g)) = (colored, &paint, face.light_gradient) {
+                return Arc::new(crate::lighting::gradient_art(n.id, &face.path, &paint, g));
+            }
             let mut fill = FillLayer::new(paint.clone());
             let mut items = vec![];
             if let Some(c) = paint.color() {
                 let [r, g, b] = c.to_rgb();
                 let color = |s: f64| Color::rgb(r * s as f32, g * s as f32, b * s as f32);
-                fill.paint = face.gradient.map_or_else(|| Paint::solid(color(face.brightness)), |g| shading_paint(g, color, |_| 1.0));
+                fill.paint = if colored {
+                    face.light_gradient
+                        .map_or_else(|| Paint::solid(crate::lighting::shade(c, face.illumination)), |g| crate::lighting::smooth_paint(g, c))
+                } else {
+                    face.gradient.map_or_else(|| Paint::solid(color(face.brightness)), |g| shading_paint(g, color, |_| 1.0))
+                };
                 items.push(AppearanceItem::Fill(fill));
+            } else if colored && matches!(paint, Paint::Gradient(_)) {
+                items = crate::lighting::fills(&paint, face.illumination, face.brightness, true);
             } else {
                 items.push(AppearanceItem::Fill(fill));
                 let mut shadow = FillLayer::new(Paint::solid(Color::BLACK));

crates/effects/src/solids.rs

@@ -3,11 +3,14 @@
 use std::sync::Arc;
 
 use serde_json::Value;
-use vectorcraft_doc::color::{BlendMode, Color, Paint};
-use vectorcraft_doc::{Appearance, AppearanceItem, Effect, FillLayer, Node, NodeKind, StrokeLayer};
+use vectorcraft_doc::color::{BlendMode, Paint};
+use vectorcraft_doc::{Appearance, AppearanceItem, Effect, Node, NodeKind, StrokeLayer};
 use vectorcraft_geom::{FillRule, PathData, Rect};
 use vectorcraft_three_d::{Bevel, BevelShape, Extrude, Facet, Inflate, View};
 
+#[cfg(test)]
+use vectorcraft_doc::color::Color;
+
 use crate::util::{flag, num, text};
 use crate::{GeomContext, apply_geometry_with, is_geometry};
 
@@ -65,6 +68,8 @@ pub fn view_options(p: &Value) -> View {
         light_rotation: num(p, "lightRotation", vectorcraft_three_d::DEFAULT_LIGHT.0),
         light_height: num(p, "lightHeight", vectorcraft_three_d::DEFAULT_LIGHT.1),
         light_behind: flag(p, "lightBehind", false),
+        light_color: crate::lighting::light_color(p),
+        lights: crate::lighting::lights(p),
         light_intensity: num(p, "lightIntensity", 80.0) / 100.0,
         light_softness: num(p, "lightSoftness", 0.0) / 100.0,
         ambient: num(p, "ambient", 25.0) / 100.0,
@@ -124,6 +129,7 @@ fn facets(id: &str, path: &PathData, rule: FillRule, bounds: Rect, p: &Value) ->
 
 /// Validate before a command changes the document; the evaluator bounds loaded files too.
 pub fn validate_solid(n: &Node, id: &str, p: &Value) -> Result<(), String> {
+    crate::lighting::validate(p)?;
     let label = crate::effect_info(id).map_or("This effect", |e| e.label.trim_end_matches('…'));
     let (path, rule) =
         profile(n).ok_or_else(|| format!("{label} currently requires a path or compound path. Convert type, images and groups to paths first."))?;
@@ -139,32 +145,38 @@ pub fn validate_solid(n: &Node, id: &str, p: &Value) -> Result<(), String> {
 
 /// One surface: each facet a path shaded from `paint`, as a group with the paint's opacity and
 /// blend mode (so overlapping facets don't add up their transparency).
-fn surface(n: &Node, facets: Vec<Facet>, paint: &Paint, opacity: f32, blend: BlendMode) -> Node {
+fn surface(n: &Node, facets: Vec<Facet>, paint: &Paint, opacity: f32, blend: BlendMode, colored: bool) -> Node {
+    if colored && paint.color().is_some() && facets.iter().any(|face| face.rgb_gradient.is_some()) {
+        let mut group = crate::lighting::solid_surface(n.id, &facets, paint);
+        group.opacity = opacity;
+        group.blend = blend;
+        return group;
+    }
+    // Preserve existing white-light paints, alpha composition and seam joins exactly.
+    let (opaque, mask) = if colored { crate::lighting::opaque_paint(paint) } else { (paint.clone(), None) };
+    let paint = &opaque;
     let children = facets
         .into_iter()
         .map(|face| {
-            let mut items = vec![];
-            if let Some(c) = paint.color() {
-                let [r, g, b] = c.to_rgb();
-                let s = face.brightness as f32;
-                items.push(AppearanceItem::Fill(FillLayer::new(Paint::solid(Color::rgb(r * s, g * s, b * s)))));
-            } else {
-                // Gradients and patterns keep their paint, darkened by a black layer.
-                items.push(AppearanceItem::Fill(FillLayer::new(paint.clone())));
-                let mut shadow = FillLayer::new(Paint::solid(Color::BLACK));
-                shadow.opacity = (1.0 - face.brightness) as f32;
-                items.push(AppearanceItem::Fill(shadow));
-            }
             // Adjacent facets, antialiased on their own, would leave hairline seams: a narrow
             // stroke of the same paint closes them. No wider than the facet is thick, though: seen
             // at a grazing angle a facet can be thinner than the stroke, and its stroke would then
             // paint over its neighbours.
             let seam = (face.thickness() / 2.0).clamp(0.05, 0.75);
+            if let Some(g) = face.rgb_gradient
+                && (paint.color().is_some() || matches!(paint, Paint::Gradient(_)))
+            {
+                return Arc::new(crate::lighting::facet_art(n.id, &face.path(), paint, g, seam));
+            }
+            let items = crate::lighting::fills(paint, face.illumination, face.brightness, colored);
             let items = items
                 .into_iter()
                 .flat_map(|item| {
                     let AppearanceItem::Fill(fill) = &item else { return vec![item] };
                     let mut edge = StrokeLayer::new(fill.paint.clone(), seam);
+                    if colored {
+                        edge.join = vectorcraft_doc::LineJoin::Round;
+                    }
                     edge.opacity = fill.opacity;
                     vec![item, AppearanceItem::Stroke(edge)]
                 })
@@ -175,6 +187,11 @@ fn surface(n: &Node, facets: Vec<Facet>, paint: &Paint, opacity: f32, blend: Ble
     let mut group = Node::group(n.id, children);
     group.opacity = opacity;
     group.blend = blend;
+    if let Some(mask) = mask {
+        let bounds = group.visual_bounds().unwrap_or(Rect::ZERO).inflate(1.0, 1.0);
+        let coverage = Node::path(n.id, vectorcraft_geom::shapes::rectangle(bounds), Appearance::basic(mask, Paint::None, 0.0));
+        group.extras_mut().mask = Some(Box::new(vectorcraft_doc::OpacityMask::new(coverage, true)));
+    }
     group
 }
 
@@ -195,11 +212,16 @@ fn region(path: &PathData, rule: FillRule, item: &AppearanceItem) -> (PathData,
 }
 
 /// The 3D art of one effect `fx` on `path` (already through the effects before it).
-/// Extrude & Bevel and Inflate build a solid from the outline, painted with the top visible fill
-/// (or, without one, the top stroke); Rotate turns every fill and stroke, each in its own paint.
+/// Rotate turns every fill and stroke, each in its own paint. Extrude & Bevel and Inflate build a
+/// solid from the path for the top visible fill and one from the outline of each visible stroke,
+/// each in its own paint. When every one is opaque with normal blending and no colored light makes
+/// a surface one composite or masks it, their faces are drawn in one back-to-front order (where
+/// depths tie, as for the caps turned toward the viewer, in the order of the appearance);
+/// otherwise each solid is a surface of its own, in that order.
 fn art_for(n: &Node, fx: &Effect, path: &PathData, rule: FillRule, items: &[&AppearanceItem]) -> Option<Vec<Arc<Node>>> {
     let b = path.bounds()?;
     let p = crate::merged_params(&fx.id, &fx.params);
+    let colored = view_options(&p).has_colored_lights();
     if fx.id == ROTATE {
         // Every part turns about the centre of the object's own bounds, so they stay together.
         let mut out = vec![];
@@ -207,16 +229,76 @@ fn art_for(n: &Node, fx: &Effect, path: &PathData, rule: FillRule, items: &[&App
             let (paint, opacity, blend) = paint_of(item);
             let (area, rule) = region(path, rule, item);
             let f = facets(ROTATE, &area, rule, b, &p).ok()?;
-            out.push(Arc::new(surface(n, f, &paint, opacity, blend)));
+            out.push(Arc::new(surface(n, f, &paint, opacity, blend, colored)));
         }
         return Some(out);
     }
-    let item = items.iter().rev().find(|i| matches!(i, AppearanceItem::Fill(_))).or_else(|| items.last())?;
-    let (paint, opacity, blend) = paint_of(item);
-    // A loaded file or a shape edited past the limits keeps drawing its source path instead of
-    // failing the frame; commands validate the same evaluator and report its errors.
-    let f = facets(&fx.id, path, rule, b, &p).ok()?;
-    Some(vec![Arc::new(surface(n, f, &paint, opacity, blend))])
+    let top_fill = items.iter().rposition(|i| matches!(i, AppearanceItem::Fill(_)));
+    let parts: Vec<(&AppearanceItem, PathData, FillRule)> = items
+        .iter()
+        .enumerate()
+        .filter(|(k, i)| Some(*k) == top_fill || matches!(i, AppearanceItem::Stroke(_)))
+        .map(|(_, i)| {
+            let (area, rule) = region(path, rule, i);
+            (*i, area, rule)
+        })
+        .collect();
+    // The solids share the bounds of all their shapes: one center to turn, twist and taper about,
+    // and Inflate's grid reaches over the strokes' outlines.
+    let bounds = parts.iter().filter_map(|(_, area, _)| area.bounds()).reduce(|a, c| a.union(c)).unwrap_or(b);
+    let built = if fx.id == INFLATE {
+        // One eye for every puff, as far away as the highest needs.
+        let shapes: Vec<(&PathData, FillRule)> = parts.iter().map(|(_, area, rule)| (area, *rule)).collect();
+        vectorcraft_three_d::inflate_together(&shapes, bounds, inflate_options(&p), view_options(&p))
+    } else {
+        parts.iter().map(|(_, area, rule)| facets(&fx.id, area, *rule, bounds, &p)).collect()
+    };
+    let mut solids = vec![];
+    for ((item, _, _), f) in parts.iter().zip(built) {
+        let item: &AppearanceItem = item;
+        match f {
+            Ok(f) => solids.push((item, f)),
+            // A stroke's outline past the limits is left out; the fill's solid still draws.
+            Err(_) if matches!(item, AppearanceItem::Stroke(_)) => {}
+            // A loaded file or a shape edited past the limits keeps drawing its source path
+            // instead of failing the frame; commands validate the same evaluator and report its
+            // errors.
+            Err(_) => return None,
+        }
+    }
+    if solids.is_empty() {
+        return None;
+    }
+    let opaque = solids.iter().all(|(item, _)| {
+        let (_, opacity, blend) = paint_of(item);
+        opacity >= 1.0 && blend == BlendMode::Normal
+    });
+    let surfaces: Vec<(Vec<f64>, Node)> = solids
+        .into_iter()
+        .map(|(item, f)| {
+            let depths: Vec<f64> = f.iter().map(|f| f.depth).collect();
+            let (paint, opacity, blend) = paint_of(item);
+            (depths, surface(n, f, &paint, opacity, blend, colored))
+        })
+        .collect();
+    // One order takes a plain group of faces from each solid, one face for each facet. With
+    // colored lights a surface can instead be one clipped composite of all its facets, or carry an
+    // opacity mask, and then it stays whole.
+    let plain = surfaces.iter().all(|(depths, s)| {
+        s.extras().mask.is_none() && matches!(&s.kind, NodeKind::Group { children, clip: false } if children.len() == depths.len())
+    });
+    if !opaque || !plain {
+        return Some(surfaces.into_iter().map(|(_, s)| Arc::new(s)).collect());
+    }
+    let mut faces = vec![];
+    for (depths, s) in surfaces {
+        if let NodeKind::Group { children, .. } = s.kind {
+            faces.extend(depths.into_iter().zip(children));
+        }
+    }
+    // A stable sort: faces at the same depth keep the order of the appearance.
+    faces.sort_by(|a, b| a.0.total_cmp(&b.0));
+    Some(vec![Arc::new(Node::group(n.id, faces.into_iter().map(|(_, face)| face).collect()))])
 }
 
 fn geometry(path: &PathData, fx: &[Effect], ctx: &GeomContext) -> PathData {

crates/effects/src/tests.rs

@@ -510,6 +510,31 @@ fn zigzag_spaces_ridges_evenly_along_a_straight_line() {
     }
 }
 
+/// #2343: Smooth points make a continuous wave, not a zigzag with rounded tips. Every peak and
+/// valley is a smooth point whose handles run parallel to the line, and the curve between them
+/// follows a cosine, even where the ridges are much taller than they are apart.
+#[test]
+fn zigzag_smooth_is_a_wave() {
+    use vectorcraft_geom::kurbo::ParamCurve;
+    let line = PathData::single(SubPath::polyline(&[Point::new(0.0, 0.0), Point::new(100.0, 0.0)], false));
+    for size in [3.0, 30.0] {
+        let out = run("distort.zigZag", json!({"ridges": 9, "points": "smooth", "size": size}), &line);
+        let sp = &out.subpaths[0];
+        assert_eq!(sp.anchors.len(), 11);
+        for a in &sp.anchors {
+            assert!(close(a.h_in.y, a.p.y, 1e-9) && close(a.h_out.y, a.p.y, 1e-9), "size {size}: handles not level at {a:?}");
+        }
+        for i in 0..sp.segment_count() {
+            let c = sp.segment(i);
+            for k in 0..=20 {
+                let q = c.eval(k as f64 / 20.0);
+                let want = -size * (std::f64::consts::PI * q.x / 10.0).cos();
+                assert!((q.y - want).abs() < 0.03 * size, "size {size}: {q:?} off the wave ({want})");
+            }
+        }
+    }
+}
+
 /// #1554 on curves: a circle's ridges sit at equal angles, at the radius plus and minus the size in
 /// turn all the way round.
 #[test]
@@ -572,6 +597,18 @@ fn outline_stroke_uses_context_stroke() {
     assert!(close(out.bounds().unwrap().width(), 101.0, 0.1));
 }
 
+#[test]
+fn outline_object_is_a_geometry_effect_that_keeps_the_path() {
+    let info = effect_info("path.outlineObject").unwrap();
+    assert_eq!((info.label, info.menu, &info.defaults, info.raster), ("Outline Object", &["Effect", "Path"][..], &json!({}), false));
+    assert!(is_geometry("path.outlineObject"));
+    assert_eq!(run("path.outlineObject", json!({}), &square()), square());
+    // The effects after it reshape the same geometry.
+    let b = square().bounds().unwrap();
+    let offset = fx("path.offsetPath", json!({"offset": 5}));
+    assert_eq!(apply_geometry(&[fx("path.outlineObject", json!({})), offset.clone()], &square(), b), apply_geometry(&[offset], &square(), b));
+}
+
 #[test]
 fn convert_to_shape_sizes() {
     let r = run("convertToShape.rectangle", json!({"extraW": 20, "extraH": 10}), &square()).bounds().unwrap();
@@ -797,6 +834,50 @@ fn drop_shadow_darkness_replaces_its_color_when_chosen() {
     assert_eq!(darkness(json!({})), None);
 }
 
+#[test]
+fn rasterize_compose_leaves_the_raster_alone_when_the_sizes_do_not_fit() {
+    let r = match raster_effects(&[fx(RASTERIZE, json!({}))]).as_slice() {
+        [RasterFx::Rasterize(r)] => *r,
+        other => panic!("{other:?}"),
+    };
+    let space = PixelSpace {
+        to_doc: Affine::IDENTITY,
+        px: 1.0,
+        center: Point::new(1.0, 1.0),
+        channels: pixel::Channels::Rgb,
+        line: 1.0,
+        extent: std::f64::consts::SQRT_2,
+    };
+    let compose = |len: usize, w: usize, h: usize, image: &[u8], cols: usize, rows: usize, rect: Rect| {
+        let mut data = vec![7; len];
+        r.compose(&mut data, w, h, &space, image, cols, rows, rect);
+        data
+    };
+    // A 2 × 2 red image over a 2 × 2 raster of one-point pixels: each pixel takes the image's color.
+    let red = [255, 0, 0, 255].repeat(4);
+    let mut long = red.clone();
+    long.extend([255, 0]);
+    let (img, long, area) = (red.as_slice(), long.as_slice(), Rect::new(0.0, 0.0, 2.0, 2.0));
+    assert_eq!(compose(16, 2, 2, img, 2, 2, area), red);
+    let cases = [
+        ("w × h is not the raster's pixel count", 16, 1, 2, img, 2, 2, area),
+        ("the raster's length is not a multiple of 4", 18, 2, 2, img, 2, 2, area),
+        ("cols × rows is not the image's pixel count", 16, 2, 2, img, 1, 2, area),
+        ("the image's length is not a multiple of 4", 16, 2, 2, long, 2, 2, area),
+        ("the image has no width", 16, 2, 2, img, 2, 2, Rect::new(0.0, 0.0, 0.0, 2.0)),
+        ("the image has no height", 16, 2, 2, img, 2, 2, Rect::new(0.0, 0.0, 2.0, 0.0)),
+        ("the image has a negative width", 16, 2, 2, img, 2, 2, Rect::new(2.0, 0.0, 0.0, 2.0)),
+        ("the image has a NaN width", 16, 2, 2, img, 2, 2, Rect::new(0.0, 0.0, f64::NAN, 2.0)),
+        ("the image has a NaN height", 16, 2, 2, img, 2, 2, Rect::new(0.0, 0.0, 2.0, f64::NAN)),
+    ];
+    let failures: Vec<_> = cases
+        .iter()
+        .filter(|&&(_, len, w, h, image, cols, rows, rect)| compose(len, w, h, image, cols, rows, rect) != vec![7; len])
+        .map(|c| c.0)
+        .collect();
+    assert!(failures.is_empty(), "{failures:?}");
+}
+
 #[test]
 fn blend_mode_names() {
     use vectorcraft_doc::color::BlendMode;

crates/effects/src/tests_scale.rs

@@ -23,6 +23,10 @@ fn scale_effect_scales_distances_only() {
     scale_effect(&mut e, 2.0);
     assert_eq!((&e.params["x"], &e.params["y"], &e.params["blur"]), (&json!(6.0), &json!(8.0), &json!(10.0)));
     assert_eq!(e.params["opacity"], json!(75.0));
+    // Rasterize's Add Around Object is a distance; its resolution isn't.
+    let mut r = new_effect(RASTERIZE, &json!({"addAround": 10, "resolution": 150})).unwrap();
+    scale_effect(&mut r, 2.0);
+    assert_eq!((&r.params["addAround"], &r.params["resolution"]), (&json!(20.0), &json!(150)));
     // Outline Stroke without a weight follows its stroke's: nothing to scale.
     let mut o = Effect { id: "path.outlineStroke".into(), params: json!(null), visible: true };
     scale_effect(&mut o, 2.0);

crates/effects/src/tests_solids.rs

@@ -1,6 +1,6 @@
 use serde_json::json;
 use vectorcraft_doc::{Document, NodeId};
-use vectorcraft_geom::{Affine, BezPath};
+use vectorcraft_geom::{Affine, BezPath, Point, Shape};
 
 use super::*;
 
@@ -27,7 +27,10 @@ fn faces(art: &Node) -> Vec<&Node> {
 
 fn fill_rgb(n: &Node) -> [f32; 3] {
     match &n.appearance.items[0] {
-        AppearanceItem::Fill(f) => f.paint.color().unwrap().to_rgb(),
+        AppearanceItem::Fill(f) => match &f.paint {
+            Paint::Gradient(g) => g.gradient.sample(0.5).0.to_rgb(),
+            p => p.color().unwrap().to_rgb(),
+        },
         _ => panic!("a fill first"),
     }
 }
@@ -41,7 +44,8 @@ fn every_solid_draws_shaded_faces_and_leaves_the_source_editable() {
         let art = solid_art(&n).unwrap_or_else(|| panic!("{id}"));
         assert_eq!(n.path_data(), Some(&source), "{id}");
         assert!(!faces(&art).is_empty(), "{id}");
-        // The faces are the fill's red, shaded: never brighter, never another hue.
+        // The faces are the fill's red or the stroke's black, shaded: never brighter, never another
+        // hue.
         for f in faces(&art) {
             let [r, g, b] = fill_rgb(f);
             assert!(r <= 0.8 + 1e-6 && (g * 4.0 - r).abs() < 1e-4 && (b * 8.0 - r).abs() < 1e-4 || id == ROTATE, "{id}: {r} {g} {b}");
@@ -73,12 +77,229 @@ fn rotate_turns_every_fill_and_stroke_and_the_solids_use_the_top_fill() {
     n.appearance.effects[0].params = json!({"rotationX": 0, "rotationY": 60, "rotationZ": 0});
     let b = solid_art(&n).unwrap().children().unwrap()[1].visual_bounds().unwrap();
     assert!((b.width() - 104.0 * 0.5 - 0.75).abs() < 1e-6, "{b:?}");
-    // Extrude & Bevel paints one surface with the top fill.
+    // Extrude & Bevel draws the fill's solid and the stroke's, both opaque, as one surface.
     let mut n = square_node();
     n.appearance.effects.push(fx(EXTRUDE, json!({})));
     assert_eq!(solid_art(&n).unwrap().children().unwrap().len(), 1);
 }
 
+const BLUE: Color = Color::Rgb { r: 0.1, g: 0.3, b: 0.9 };
+
+/// `b` with a red fill and a 6 pt blue stroke above it, on the path.
+fn stroked(b: &BezPath) -> Node {
+    Node::path(NodeId(1), PathData::from_bezpath(b), Appearance::basic(Paint::solid(RED), Paint::solid(BLUE), 6.0))
+}
+
+/// A `width` × 100 pt rectangle at (100, 100), stroked.
+fn stroked_rect(width: f64) -> Node {
+    let mut b = BezPath::new();
+    b.move_to((100.0, 100.0));
+    b.line_to((100.0 + width, 100.0));
+    b.line_to((100.0 + width, 200.0));
+    b.line_to((100.0, 200.0));
+    b.close_path();
+    stroked(&b)
+}
+
+/// Is `face` in the stroke's blue (rather than the fill's red)?
+fn blue(face: &Node) -> bool {
+    let [r, _, b] = fill_rgb(face);
+    b > r
+}
+
+/// The bounds of the faces' own paths (without their seam strokes).
+fn extent(faces: &[&Node]) -> Rect {
+    faces.iter().filter_map(|f| f.path_data()?.bounds()).reduce(|a, b| a.union(b)).unwrap()
+}
+
+fn assert_rect(r: Rect, x0: f64, y0: f64, x1: f64, y1: f64) {
+    assert!([r.x0 - x0, r.y0 - y0, r.x1 - x1, r.y1 - y1].iter().all(|d| d.abs() < 1e-6), "{r:?}");
+}
+
+/// Extrude & Bevel and Inflate build a solid from each stroke's outline as well as from the path
+/// for the fill: seen straight on, the stroke's faces reach 3 pt (half its width) outside the
+/// fill's, and they are drawn in the stroke's paint.
+#[test]
+fn a_stroke_builds_a_solid_from_its_outline_beside_the_fill() {
+    for id in [EXTRUDE, INFLATE] {
+        let mut n = stroked_rect(100.0);
+        n.appearance.effects.push(fx(id, json!({"rotationX": 0, "rotationY": 0, "rotationZ": 0})));
+        let art = solid_art(&n).unwrap();
+        let (strokes, fills): (Vec<&Node>, Vec<&Node>) = faces(&art).into_iter().partition(|f| blue(f));
+        assert!(!strokes.is_empty(), "{id}: the stroke draws");
+        assert_rect(extent(&fills), 100.0, 100.0, 200.0, 200.0);
+        assert_rect(extent(&strokes), 97.0, 97.0, 203.0, 203.0);
+        // Its own blue, shaded: never brighter, never another hue.
+        for f in &strokes {
+            let [r, g, b] = fill_rgb(f);
+            assert!(b <= 0.9 + 1e-6 && (r * 9.0 - b).abs() < 1e-4 && (g * 3.0 - b).abs() < 1e-4, "{id}: {r} {g} {b}");
+        }
+    }
+}
+
+/// Turned, the extrusion's walls show in both paints, and the front caps, which nothing of either
+/// solid can hide, are drawn last: the fill's, then the stroke's above it, equally lit. Without
+/// depth the two flat shapes are drawn in the same order. A stroke below the fill has its cap
+/// drawn below the fill's.
+#[test]
+fn the_front_caps_are_drawn_last_in_the_order_of_the_appearance() {
+    // A triangle wider than deep, so the near ends of the walls lie nearer than the middle of the
+    // caps; the mean of its outline's points is not the mean of the stroke's.
+    let mut b = BezPath::new();
+    b.move_to((100.0, 100.0));
+    b.line_to((400.0, 100.0));
+    b.line_to((100.0, 200.0));
+    b.close_path();
+    for params in [json!({}), json!({"depth": 120, "bevel": "rounded"}), json!({"depth": 0})] {
+        let mut n = stroked(&b);
+        n.appearance.effects.push(fx(EXTRUDE, params.clone()));
+        n.appearance.items.reverse();
+        let art = solid_art(&n).unwrap();
+        let [.., stroke_cap, fill_cap] = faces(&art)[..] else { panic!("{params}: two caps") };
+        assert!(blue(stroke_cap) && !blue(fill_cap), "{params}: the stroke below");
+        n.appearance.items.reverse();
+        let art = solid_art(&n).unwrap();
+        let faces = faces(&art);
+        let flat = params["depth"] == json!(0);
+        assert!(if flat { faces.len() == 2 } else { faces.len() > 4 }, "{params}: {} faces", faces.len());
+        let [.., fill_cap, stroke_cap] = faces.as_slice() else { panic!("{params}: two caps") };
+        assert!(!blue(fill_cap) && blue(stroke_cap), "{params}");
+        // The stroke's cap is a ring: its outline and the hole the fill shows through.
+        assert_eq!(stroke_cap.path_data().unwrap().subpaths.len(), 2, "{params}");
+        assert_eq!(fill_cap.path_data().unwrap().subpaths.len(), 1, "{params}");
+        let shade = |f: &Node, i: usize, of: f32| fill_rgb(f)[i] / of;
+        assert!((shade(fill_cap, 0, 0.8) - shade(stroke_cap, 2, 0.9)).abs() < 1e-5, "{params}: one plane, one light");
+        if !flat {
+            assert!(faces.iter().filter(|f| blue(f)).count() > 2 && faces.iter().filter(|f| !blue(f)).count() > 1, "{params}: walls of both");
+        }
+    }
+}
+
+/// A stroked open path builds a ribbon, the stroke's outline, not the area the path would enclose
+/// if it were closed: for an L of two 100 pt legs, a 6 pt band with butt ends and a mitered corner.
+#[test]
+fn a_stroked_open_path_builds_a_ribbon() {
+    let mut b = BezPath::new();
+    b.move_to((100.0, 100.0));
+    b.line_to((200.0, 100.0));
+    b.line_to((200.0, 200.0));
+    for id in [EXTRUDE, INFLATE] {
+        let mut n = Node::path(NodeId(1), PathData::from_bezpath(&b), Appearance::basic(Paint::None, Paint::solid(BLUE), 6.0));
+        n.appearance.effects.push(fx(id, json!({"rotationX": 0, "rotationY": 0, "rotationZ": 0, "volume": 0})));
+        let art = solid_art(&n).unwrap();
+        let faces = faces(&art);
+        assert!(faces.iter().all(|f| blue(f)), "{id}");
+        assert_rect(extent(&faces), 100.0, 97.0, 203.0, 200.0);
+        let area: f64 = faces.iter().map(|f| f.path_data().unwrap().to_bezpath().area().abs()).sum();
+        // 6 × 200 less the 3 × 3 the legs share, plus the 3 × 3 miter.
+        assert!((area - 1200.0).abs() < 1e-6, "{id}: {area}");
+    }
+}
+
+/// A stroke whose outline takes more points than a solid takes is left out, and the fill's solid
+/// still draws.
+#[test]
+fn a_stroke_past_the_limits_is_left_out() {
+    // 1,500 corners: within the 2,048 points of the fill's solid, but not the stroke's outline.
+    let points: Vec<Point> = (0..1500)
+        .map(|k| {
+            let (s, c) = (k as f64 * std::f64::consts::TAU / 1500.0).sin_cos();
+            let r = if k % 2 == 0 { 100.0 } else { 96.0 };
+            Point::new(200.0 + r * c, 200.0 + r * s)
+        })
+        .collect();
+    let path = PathData::single(vectorcraft_geom::SubPath::polyline(&points, true));
+    for id in [EXTRUDE, INFLATE] {
+        let mut n = Node::path(NodeId(1), path.clone(), Appearance::basic(Paint::solid(RED), Paint::solid(BLUE), 2.0));
+        n.appearance.effects.push(fx(id, json!({})));
+        let art = solid_art(&n).unwrap_or_else(|| panic!("{id}: the fill's solid draws"));
+        assert!(!faces(&art).is_empty() && faces(&art).iter().all(|f| !blue(f)), "{id}");
+    }
+}
+
+/// At no volume Inflate's front is flat: turned, the fill's cells are all drawn before the stroke's,
+/// whatever their depths, as the extrusion's caps are. When the fill puffs, a stroke too narrow to
+/// puff on the grid stays flat and keeps its depths: the fill's puff is drawn over its far side.
+#[test]
+fn a_flat_inflate_draws_the_strokes_front_above_the_fills() {
+    // On the 100 pt square's grid (cells 101 / 48 pt apart from 99.5) no grid point falls inside a
+    // 1 pt stroke, so the stroke stays flat.
+    for (volume, width, length) in [(0.0, 6.0, 300.0), (50.0, 1.0, 100.0)] {
+        let mut n = stroked_rect(length);
+        if let Some(AppearanceItem::Stroke(s)) = n.appearance.items.iter_mut().find(|i| matches!(i, AppearanceItem::Stroke(_))) {
+            s.width = width;
+        }
+        n.appearance.effects.push(fx(INFLATE, json!({ "volume": volume })));
+        let art = solid_art(&n).unwrap();
+        let faces = faces(&art);
+        let first_blue = faces.iter().position(|f| blue(f)).unwrap();
+        let last_red = faces.iter().rposition(|f| !blue(f)).unwrap();
+        assert_eq!(last_red < first_blue, volume == 0.0, "{volume}: red at {last_red}, blue from {first_blue} of {}", faces.len());
+    }
+}
+
+/// With Perspective one eye sees the fill's puff and the stroke's, however much higher one rises:
+/// seen from behind, the back of a stroke aligned outside meets the fill's back exactly.
+#[test]
+fn inflate_sees_the_fill_and_the_stroke_from_one_eye() {
+    let mut n = stroked_rect(100.0);
+    if let Some(AppearanceItem::Stroke(s)) = n.appearance.items.iter_mut().find(|i| matches!(i, AppearanceItem::Stroke(_))) {
+        s.align = vectorcraft_doc::StrokeAlign::Outside;
+    }
+    let params = json!({"volume": 100, "depth": 100, "perspectiveAngle": 120, "rotationX": 15, "rotationY": 160, "rotationZ": 0});
+    n.appearance.effects.push(fx(INFLATE, params));
+    let art = solid_art(&n).unwrap();
+    let [.., fill_back, stroke_back] = faces(&art)[..] else { panic!("two backs") };
+    assert!(!blue(fill_back) && blue(stroke_back));
+    let fill = fill_back.path_data().unwrap().bounds().unwrap();
+    // The ring's inner contour: the smaller of its two.
+    let rims = stroke_back.path_data().unwrap().subpaths.iter().filter_map(|s| PathData::new(vec![s.clone()]).bounds());
+    let hole = rims.reduce(|a, b| a.intersect(b)).unwrap();
+    assert_rect(hole, fill.x0, fill.y0, fill.x1, fill.y1);
+}
+
+/// A stroke with its own transparency or blending is a surface of its own above the fill's, so its
+/// opacity applies to the stroke as a whole.
+#[test]
+fn a_translucent_stroke_is_a_surface_of_its_own() {
+    for (opacity, blend) in [(0.5, BlendMode::Normal), (1.0, BlendMode::Multiply)] {
+        let mut n = stroked_rect(100.0);
+        if let Some(AppearanceItem::Stroke(s)) = n.appearance.items.iter_mut().find(|i| matches!(i, AppearanceItem::Stroke(_))) {
+            s.opacity = opacity;
+            s.blend = blend;
+        }
+        n.appearance.effects.push(fx(EXTRUDE, json!({})));
+        let art = solid_art(&n).unwrap();
+        let surfaces = art.children().unwrap();
+        assert_eq!(surfaces.len(), 2);
+        assert_eq!((surfaces[0].opacity, surfaces[0].blend), (1.0, BlendMode::Normal));
+        assert_eq!((surfaces[1].opacity, surfaces[1].blend), (opacity, blend));
+        assert!(surfaces[0].children().unwrap().iter().all(|f| !blue(f)) && surfaces[1].children().unwrap().iter().all(|f| blue(f)));
+    }
+}
+
+/// With a light that is not white, a fill in a gradient with transparent stops is drawn with an
+/// opacity mask over its whole surface: the fill's solid and the stroke's stay surfaces of their
+/// own, and the mask stays on the fill's. Under a white light the same object is one surface.
+#[test]
+fn a_masked_surface_under_a_colored_light_stays_whole() {
+    use vectorcraft_doc::color::{Gradient, GradientKind, GradientPaint, GradientStop};
+    let mut half = GradientStop::new(1.0, RED);
+    half.opacity = 0.5;
+    let gradient = GradientPaint::new(Gradient { kind: GradientKind::Linear, stops: vec![GradientStop::new(0.0, RED), half] });
+    for (lights, surfaces) in [(json!({"lights": [{"color": "#ff8080"}]}), 2), (json!({}), 1)] {
+        let mut n = stroked_rect(100.0);
+        if let Some(AppearanceItem::Fill(f)) = n.appearance.items.iter_mut().find(|i| matches!(i, AppearanceItem::Fill(_))) {
+            f.paint = Paint::Gradient(Box::new(gradient.clone()));
+        }
+        n.appearance.effects.push(fx(EXTRUDE, lights.clone()));
+        let art = solid_art(&n).unwrap();
+        let drawn = art.children().unwrap();
+        assert_eq!(drawn.len(), surfaces, "{lights}");
+        assert_eq!(drawn[0].extras().mask.is_some(), surfaces == 2, "{lights}");
+    }
+}
+
 #[test]
 fn transparency_stays_on_the_whole_surface_and_items_take_their_own_effect() {
     let mut n = square_node();
@@ -183,10 +404,12 @@ fn an_earlier_perspective_strength_draws_as_its_angle() {
 #[test]
 fn an_earlier_light_direction_shades_as_its_rotation_and_height() {
     fn colours(n: &Node, out: &mut Vec<[f32; 3]>) {
-        if let Some(AppearanceItem::Fill(f)) = n.appearance.items.first()
-            && let Some(c) = f.paint.color()
-        {
-            out.push(c.to_rgb());
+        if let Some(AppearanceItem::Fill(f)) = n.appearance.items.first() {
+            if let Paint::Gradient(g) = &f.paint {
+                out.extend(g.gradient.stops.iter().map(|s| s.color.to_rgb()));
+            } else if let Some(c) = f.paint.color() {
+                out.push(c.to_rgb());
+            }
         }
         for c in n.children().into_iter().flatten() {
             colours(c, out);
@@ -225,9 +448,9 @@ fn effects_before_it_shape_the_solid_and_effects_after_it_bend_the_result() {
     let mut n = square_node();
     n.appearance.effects.push(fx("path.offsetPath", json!({"offset": 20})));
     n.appearance.effects.push(fx(EXTRUDE, json!({"rotationX": 0, "rotationY": 0, "rotationZ": 0, "perspectiveAngle": 0})));
-    // Straight on, the extrusion shows its front: the offset square.
+    // Straight on, the extrusion shows its front: the offset square and its 4 pt stroke.
     let b = solid_art(&n).unwrap().visual_bounds().unwrap();
-    assert!((b.width() - 140.0 - 0.75).abs() < 1e-6, "{b:?}");
+    assert!((b.width() - 144.0 - 0.75).abs() < 1e-6, "{b:?}");
     n.appearance.effects.push(fx("distort.twist", json!({"angle": 30})));
     let art = solid_art(&n).unwrap();
     assert!(art.appearance.effects.iter().any(|e| e.id == "distort.twist"), "applied to the result as a whole");
@@ -265,3 +488,55 @@ fn inflate_reads_twist_taper_and_cap() {
     assert_eq!((d.twist, d.taper, d.cap), (0.0, 1.0, true));
     assert_eq!(crate::default_params(INFLATE).unwrap()["cap"], json!(true));
 }
+
+#[test]
+fn legacy_white_inflate_keeps_polygon_faces_and_its_seam_range() {
+    let mut n = square_node();
+    n.appearance.effects.push(fx(INFLATE, json!({})));
+    let art = solid_art(&n).unwrap();
+    let original = faces(&art);
+    assert!(original.len() > 1000);
+    assert!(original.iter().any(|f| f.path_data().unwrap().subpaths.iter().any(|p| p.anchors.len() > 3)), "legacy cells remain polygons");
+    for face in original {
+        assert!(matches!(face.kind, NodeKind::Path { .. }));
+        let AppearanceItem::Stroke(stroke) = &face.appearance.items[1] else { panic!("seam") };
+        assert!((0.05..=0.75).contains(&stroke.width));
+        assert_eq!(stroke.join, vectorcraft_doc::LineJoin::Miter);
+    }
+    // A tiny shape exercises the lower bound, which otherwise disappears at grazing angles.
+    n.transform(Affine::scale(0.001), false);
+    let art = solid_art(&n).unwrap();
+    assert!(faces(&art).iter().any(|face| matches!(&face.appearance.items[1], AppearanceItem::Stroke(s) if s.width == 0.05)));
+    // An explicit white light overrides a stale legacy color without switching shading paths.
+    n.appearance.effects[0].params = json!({"lightColor":"#ff0000","lights":[{}]});
+    let art = solid_art(&n).unwrap();
+    assert!(faces(&art).iter().all(|face| matches!(face.kind, NodeKind::Path { .. })));
+}
+
+#[test]
+fn colored_solid_inflate_batches_channels_and_clips_once_per_surface() {
+    let mut n = square_node();
+    n.appearance.effects.push(fx(INFLATE, json!({"lights":[{"color":"#ff0000"},{"color":"#0000ff"}]})));
+    let art = solid_art(&n).unwrap();
+    fn count(n: &Node) -> (usize, usize, usize) {
+        let (mut groups, mut clips, mut paths) = match &n.kind {
+            NodeKind::Group { clip, .. } => (1, usize::from(*clip), 0),
+            NodeKind::Path { .. } => (0, 0, 1),
+            _ => (0, 0, 0),
+        };
+        for child in n.children().into_iter().flatten() {
+            let (g, c, p) = count(child);
+            groups += g;
+            clips += c;
+            paths += p;
+        }
+        (groups, clips, paths)
+    }
+    let (groups, clips, paths) = count(&art);
+    assert!(paths > 1000, "exercise a tessellated surface");
+    // The fill's solid and the stroke's, each one composite with its own clip.
+    let surfaces = art.children().unwrap().len();
+    assert_eq!(surfaces, 2);
+    assert_eq!(clips, surfaces);
+    assert_eq!(groups, 1 + 6 * surfaces, "group count must not grow with triangle count");
+}

crates/engine/Cargo.toml

@@ -15,6 +15,8 @@ default = ["bundled-fonts"]
 bundled-fonts = ["vectorcraft-text/bundled-fonts"]
 
 [dependencies]
+# Which paths stored in documents may be opened.
+craft-docpath = { workspace = true }
 vectorcraft-geom = { workspace = true }
 vectorcraft-color = { workspace = true }
 vectorcraft-doc = { workspace = true }
@@ -35,6 +37,8 @@ vectorcraft-affinity = { workspace = true }
 vectorcraft-scriptcheck = { workspace = true }
 image = { workspace = true }
 flate2 = { workspace = true }
+# The XML parts of Word documents placed as type (place/docx.rs).
+roxmltree = "0.21"
 kurbo = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -46,6 +50,8 @@ vectorcraft-affinity = { workspace = true, features = ["synth"] }
 crc32fast = { workspace = true }
 vectorcraft-testkit = { workspace = true }
 proptest = { workspace = true }
+# A variable font built in code (no font file is committed).
+vectorcraft-text = { workspace = true, features = ["test-fonts"] }
 wat = { workspace = true }
 # Zstandard streams for the Illustrator editing data fuzz tests.
 ruzstd = { workspace = true }

crates/engine/src/cmd/appearance.rs

@@ -15,7 +15,9 @@
 //! layer's own fills and strokes paint its members' geometry and its effects apply to them as one
 //! piece; the Contents row (type: Characters) is the slot that says which of its fills and strokes
 //! paint below the members and which above ([`Appearance::contents_at`], moved by
-//! `appearance.moveItem {from: "contents"}`).
+//! `appearance.moveItem {from: "contents"}`). An image's own fills and strokes paint only the
+//! shape that a Convert to Shape or Outline Object effect on them gives them, below or above the
+//! image as its Contents row says; new ones go right below that row.
 
 use serde_json::{Value, json};
 use vectorcraft_color::{BlendMode, Paint};
@@ -36,7 +38,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add New Fill",
             ["Window", "Appearance"],
             None,
-            "{ids?|id?, target?: \"object\"|\"contents\"} add a fill on top of each selected object's own stack (a copy of its top fill; type without one: its characters' fill; else the default fill)",
+            "{ids?|id?, target?: \"object\"|\"contents\"} add a fill on top of each selected object's own stack, on an image right below its Contents row (a copy of its top fill; type without one: its characters' fill; else the default fill)",
             has_doc,
             |s, p| add_item(s, p, true)
         ),
@@ -45,7 +47,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add New Stroke",
             ["Window", "Appearance"],
             None,
-            "{ids?|id?, target?} add a stroke on top of each selected object's own stack (a copy of its top stroke, else the default stroke)",
+            "{ids?|id?, target?} add a stroke on top of each selected object's own stack, on an image right below its Contents row (a copy of its top stroke, else the default stroke)",
             has_doc,
             |s, p| add_item(s, p, false)
         ),
@@ -408,6 +410,9 @@ fn set_active_item(s: &mut Session, p: &Value) -> Result<Value> {
 fn add_item(s: &mut Session, p: &Value, fill: bool) -> Result<Value> {
     let ids = require_targets(s, p, if fill { "appearance.addFill" } else { "appearance.addStroke" })?;
     let defaults = s.paint.clone();
+    // Where the new item went in on the active item's object, when it is an image.
+    let active = s.active_appearance_item.as_ref().and_then(|a| a.objects.first().copied());
+    let mut inserted = None;
     s.edit(if fill { "Add New Fill" } else { "Add New Stroke" }, |d, _| {
         for id in &ids {
             if let Some(n) = d.node_mut(*id) {
@@ -429,11 +434,23 @@ fn add_item(s: &mut Session, p: &Value, fill: bool) -> Result<Value> {
                 } else {
                     AppearanceItem::Stroke(StrokeLayer::new(paint, n.appearance.stroke_width().max(1.0)))
                 };
-                n.appearance.items.push(item);
+                if matches!(n.kind, NodeKind::Image(_)) {
+                    // On an image it goes right below the Contents row (the image).
+                    let k = n.appearance.contents_at();
+                    n.appearance.items.insert(k, item);
+                    n.appearance.set_contents_at(k + 1);
+                    if active == Some(*id) {
+                        inserted = Some(k);
+                    }
+                } else {
+                    n.appearance.items.push(item);
+                }
             }
         }
         Ok(())
     })?;
+    // The rows above the new item move up by one.
+    s.remap_appearance_item(&ids, |a| Some(a + usize::from(inserted.is_some_and(|k| k <= a))));
     ok()
 }
 
@@ -478,7 +495,7 @@ fn transfer(s: &mut Session, p: &Value) -> Result<Value> {
         if let (Some(f), Some(t)) = (src.geometric_bounds(), to.geometric_bounds()) {
             ap.rebase_gradients(f, t);
         }
-        // Only groups, layers and type have a Contents (Characters) row to keep a slot for.
+        // Only groups, layers, type and images have a Contents (Characters) row to keep a slot for.
         if to.contents_label().is_none() {
             ap.contents_index = None;
         }
@@ -717,7 +734,7 @@ fn move_contents(s: &mut Session, ids: &[NodeId], to: usize) -> Result<Value> {
             n.appearance.set_contents_at(to);
             slot.get_or_insert(n.appearance.contents_at());
         }
-        slot.ok_or_else(|| bad("appearance.moveItem", "only groups, layers and type have a Contents (Characters) row"))?;
+        slot.ok_or_else(|| bad("appearance.moveItem", "only groups, layers, type and images have a Contents (Characters) row"))?;
         Ok(count_changed(d, &before, ids))
     })?;
     Ok(json!({ "contents": slot }))

crates/engine/src/cmd/assets.rs

@@ -80,7 +80,7 @@ fn clean_name(name: &str) -> Option<String> {
 
 /// Ids of art under `id`: the id itself when it is not a layer, else every non-layer under it
 /// (sublayers unfolded). Layers alone have nothing to collect.
-fn art_under(doc: &vectorcraft_doc::Document, id: NodeId, out: &mut Vec<NodeId>) {
+pub(crate) fn art_under(doc: &vectorcraft_doc::Document, id: NodeId, out: &mut Vec<NodeId>) {
     let Some(n) = doc.node(id) else { return };
     if n.is_layer() {
         if let Some(kids) = n.children() {