address review: count pending point candidates in the perpendicular cap

.github/workflows/nix.yml

@@ -23,5 +23,39 @@ jobs:
     uses: storytold/craft-common-actions/.github/workflows/nix.yml@main
 
   git-sources:
-    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
-    uses: storytold/craft-common-actions/.github/workflows/git-sources.yml@main
+    name: Git dependencies come from storytold
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Git dependencies come from storytold
+        run: |
+          set -euo pipefail
+          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
+          # Source replacement, patches and path overrides in cargo config never show up
+          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
+          # Cargo still reads the legacy .cargo/config.
+          python3 - <<'PY'
+          import os, sys, tomllib
+          for path in (".cargo/config", ".cargo/config.toml"):
+              if not os.path.exists(path):
+                  continue
+              config = tomllib.load(open(path, "rb"))
+              replaced = [name for name, source in config.get("source", {}).items()
+                          if isinstance(source, dict) and "replace-with" in source]
+              if replaced or "patch" in config or "paths" in config:
+                  print(f"{path} replaces, patches or overrides a source")
+                  sys.exit(1)
+          PY
+          # Fails when Cargo.lock is out of date with the manifests.
+          cargo metadata --locked --format-version 1 > /dev/null
+          python3 - <<'PY'
+          import sys, tomllib
+          lock = tomllib.load(open("Cargo.lock", "rb"))
+          bad = sorted({p["source"] for p in lock.get("package", [])
+                        if p.get("source", "").startswith("git+")
+                        and not p["source"].startswith("git+https://github.com/storytold/")})
+          if bad:
+              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
+              sys.exit(1)
+          PY

.github/workflows/packaging-lint.yml

@@ -27,10 +27,6 @@ jobs:
     name: Windows installation policy (no app build)
     runs-on: windows-latest
     steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false

.github/workflows/release.yml

@@ -24,9 +24,47 @@ jobs:
       contents: read
       pull-requests: read
     uses: storytold/craft-common-actions/.github/workflows/refresh-contributors.yml@main
+  git-sources:
+    name: Git dependencies come from storytold
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Git dependencies come from storytold
+        run: |
+          set -euo pipefail
+          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
+          # Source replacement, patches and path overrides in cargo config never show up
+          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
+          # Cargo still reads the legacy .cargo/config.
+          python3 - <<'PY'
+          import os, sys, tomllib
+          for path in (".cargo/config", ".cargo/config.toml"):
+              if not os.path.exists(path):
+                  continue
+              config = tomllib.load(open(path, "rb"))
+              replaced = [name for name, source in config.get("source", {}).items()
+                          if isinstance(source, dict) and "replace-with" in source]
+              if replaced or "patch" in config or "paths" in config:
+                  print(f"{path} replaces, patches or overrides a source")
+                  sys.exit(1)
+          PY
+          # Fails when Cargo.lock is out of date with the manifests.
+          cargo metadata --locked --format-version 1 > /dev/null
+          python3 - <<'PY'
+          import sys, tomllib
+          lock = tomllib.load(open("Cargo.lock", "rb"))
+          bad = sorted({p["source"] for p in lock.get("package", [])
+                        if p.get("source", "").startswith("git+")
+                        and not p["source"].startswith("git+https://github.com/storytold/")})
+          if bad:
+              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
+              sys.exit(1)
+          PY
 
   release:
-    needs: credits
+    needs: [git-sources, credits]
     permissions:
       # The reusable release workflow tags and uploads the draft release.
       contents: write

Cargo.lock

@@ -614,7 +614,7 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cadcraft"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -645,7 +645,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-cli"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -661,14 +661,14 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-color"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-constraints"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-doc",
  "cadcraft-geom",
@@ -678,7 +678,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-doc"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-geom",
@@ -689,7 +689,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-dwg"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "acadrust",
  "log",
@@ -697,7 +697,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-dxf"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "encoding_rs",
  "log",
@@ -706,7 +706,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-engine"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-constraints",
@@ -727,7 +727,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-fonts"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-dxf",
  "cadcraft-geom",
@@ -740,14 +740,14 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-geom"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-io"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "acadrust",
  "cadcraft-color",
@@ -769,14 +769,13 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-mcp"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
  "cadcraft-render",
  "clap",
  "getrandom 0.4.3",
- "libc",
  "log",
  "serde_json",
  "tiny-skia",
@@ -784,7 +783,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-render"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
@@ -798,7 +797,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-ui-egui"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
@@ -825,7 +824,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-web"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-fonts",
@@ -1214,7 +1213,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
 dependencies = [
  "chrono",
  "dunce",
@@ -1224,7 +1223,6 @@ dependencies = [
  "image",
  "log",
  "plist",
- "rustix 1.1.5",
  "semver",
  "serde",
  "serde_json",
@@ -5994,7 +5992,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.20.1"
+version = "0.17.0"
 dependencies = [
  "chrono",
  "serde_json",

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 # default-members
 
 [workspace.package]
-version = "0.20.1"
+version = "0.17.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -71,7 +71,7 @@ egui-wgpu = "0.37"
 # Monotonic time on native and web (performance.now on wasm).
 web-time = "1.1"
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", features = ["egui"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "1b34eba41e62138fc2438d2734523b302840b45d", features = ["egui"] }
 rfd = "0.17"
 arboard = { version = "3.6", default-features = false }
 

apps/cadcraft/src/control_server.rs

@@ -250,18 +250,17 @@ fn parse_line(bytes: &[u8]) -> Line {
         Ok(v) => v,
         Err(e) => return Line::Reject(format!("bad JSON ({e}); expected one JSON request object per line; closing the connection")),
     };
-    let Value::Object(mut obj) = msg else {
+    let Some(obj) = msg.as_object() else {
         return Line::Reject("not a control request (expected a JSON object); closing the connection".into());
     };
-    let Some(Value::String(method)) = obj.remove("method") else {
+    let Some(method) = obj.get("method").and_then(Value::as_str) else {
         return Line::Reject("not a control request (missing string `method`); closing the connection".into());
     };
-    // Moved out of the parsed object, not cloned: `params` can be most of the line.
     Line::Request {
-        id: obj.remove("id").unwrap_or(Value::Null),
-        method,
-        params: obj.remove("params").unwrap_or(json!({})),
-        token: obj.remove("token").and_then(|t| if let Value::String(t) = t { Some(t) } else { None }),
+        id: obj.get("id").cloned().unwrap_or(Value::Null),
+        method: method.to_string(),
+        params: obj.get("params").cloned().unwrap_or(json!({})),
+        token: obj.get("token").and_then(Value::as_str).map(str::to_string),
     }
 }
 

crates/doc/src/array.rs

@@ -204,23 +204,6 @@ impl ArrayParams {
         self.replaced.iter().rev().find(|r| (r.i, r.j, r.level) == (i, j, level)).map_or(self.source.as_str(), |r| r.block.as_str())
     }
 
-    /// [`block_for`](Self::block_for) for many items: the replacements are indexed once (the last
-    /// entry for a place wins, as there), so each lookup is O(1) instead of a scan of `replaced`.
-    pub fn block_lookup<'a>(&'a self) -> impl Fn(u32, u32, u32) -> &'a str + 'a {
-        // Only places `items()` generates are indexed, so stray out-of-range records cost nothing.
-        let (cols, rows) = match &self.kind {
-            ArrayKind::Rect(r) => (r.cols, r.rows),
-            ArrayKind::Polar(p) => (p.items, p.rows),
-        };
-        let index: std::collections::HashMap<(u32, u32, u32), &str> = self
-            .replaced
-            .iter()
-            .filter(|r| r.i < cols && r.j < rows && r.level < self.levels)
-            .map(|r| ((r.i, r.j, r.level), r.block.as_str()))
-            .collect();
-        move |i, j, level| index.get(&(i, j, level)).copied().unwrap_or(self.source.as_str())
-    }
-
     /// The block references that make up the array block: one per item, on layer 0 with ByBlock
     /// properties so they take the array's. Handles are allocated from `d`. `None` when the
     /// parameters are not [valid](Self::is_valid).
@@ -234,10 +217,9 @@ impl ArrayParams {
             ..Common::default()
         };
         let mut out = Vec::with_capacity(items.len());
-        let block_for = self.block_lookup();
         for it in items {
             let ins = Insert {
-                block: block_for(it.i, it.j, it.level).to_string(),
+                block: self.block_for(it.i, it.j, it.level).to_string(),
                 insert: it.insert,
                 scale: Vec3::new(1.0, 1.0, 1.0),
                 rotation: it.rotation,
@@ -319,18 +301,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn block_lookup_agrees_with_block_for_and_the_last_replacement_wins() {
-        let mut p = rect(3, 2);
-        let r = |i, j, level, b: &str| ReplacedItem { i, j, level, block: b.into() };
-        p.replaced = vec![r(1, 0, 0, "A"), r(1, 0, 0, "B"), r(2, 1, 1, "C")];
-        let look = p.block_lookup();
-        for (i, j, level) in [(0, 0, 0), (1, 0, 0), (2, 1, 1), (2, 1, 0)] {
-            assert_eq!(look(i, j, level), p.block_for(i, j, level));
-        }
-        assert_eq!((look(1, 0, 0), look(0, 0, 0)), ("B", "*U1"));
-    }
-
     #[test]
     fn rect_items_go_column_row_level() {
         let items = rect(3, 2).items().unwrap_or_default();

crates/doc/src/dynblock/apply.rs

@@ -674,10 +674,6 @@ fn apply(
 /// Associative hatches of block `b` whose loop is one closed polyline of the block take its
 /// outline again (it may have been stretched).
 fn refill_hatches(b: &mut Block) {
-    // Each loop gets its own copy of the outline, so many small loops on one big outline multiply it;
-    // past this many vertices in all, the remaining loops keep the outline they have.
-    const MAX_REFILLED_VERTICES: usize = 4_000_000;
-    let mut budget = MAX_REFILLED_VERTICES;
     let outlines: HashMap<Handle, Vec<cadcraft_geom::PolyVertex>> = b
         .entities
         .iter()
@@ -693,9 +689,7 @@ fn refill_hatches(b: &mut Block) {
                 for l in &mut hh.loops {
                     if let [s] = l.sources.as_slice()
                         && let Some(vs) = outlines.get(s)
-                        && let Some(left) = budget.checked_sub(vs.len())
                     {
-                        budget = left;
                         l.vertices.clone_from(vs);
                     }
                 }

crates/doc/src/tables.rs

@@ -486,24 +486,16 @@ impl DimStyle {
 
     /// Set fields from a JSON object of field or DIM* variable names (numbers, booleans as
     /// 0/1, colours as ACI numbers or names). Returns the names that were not recognised or
-    /// had unusable values. When several spellings name one field, the last one wins and the
-    /// superseded ones are not validated.
+    /// had unusable values.
     pub fn apply_fields(&mut self, src: &serde_json::Map<String, serde_json::Value>) -> Vec<String> {
         use serde_json::Value;
         let mut rejected = Vec::new();
         let Ok(mut cur) = serde_json::to_value(&*self) else { return src.keys().cloned().collect() };
-        // Spellings of one field (`DIMPOST`, `dimpost`, `textPrefix`…): only the last is applied, so
-        // the style is checked once per field, not once per spelling (each check copies its strings).
-        let last_spelling: std::collections::HashMap<&str, &String> =
-            src.keys().filter_map(|k| DimStyle::field_name(k).filter(|f| *f != "name").map(|f| (f, k))).collect();
         for (k, v) in src {
             let Some(field) = DimStyle::field_name(k).filter(|f| *f != "name") else {
                 rejected.push(k.clone());
                 continue;
             };
-            if last_spelling.get(field) != Some(&k) {
-                continue;
-            }
             let Some(obj) = cur.as_object_mut() else { break };
             let Some(old) = obj.get(field).cloned() else {
                 rejected.push(k.clone());

crates/doc/src/tests.rs

@@ -714,14 +714,3 @@ fn space_names_its_tab() {
     assert_eq!(p.layout(), Some("Sheet A"));
     assert_eq!(p.tab_name(), "Sheet A");
 }
-
-/// Several spellings of one DIM field apply once, the last in the map's order, and none is rejected.
-#[test]
-fn dim_style_spellings_of_one_field_apply_once() {
-    let mut st = DimStyle::default();
-    let m = serde_json::json!({ "textHeight": 2.5, "TEXTHEIGHT": 3.5, "DIMTXT": 4.5 });
-    let m = m.as_object().unwrap();
-    let want = m.values().next_back().and_then(serde_json::Value::as_f64).unwrap();
-    assert!(st.apply_fields(m).is_empty());
-    assert_eq!(st.text_height, want);
-}

crates/engine/src/atomic_write.rs

@@ -16,31 +16,10 @@ use std::fs::{File, OpenOptions, Permissions};
 use std::io::{self, Write};
 use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicU64, Ordering};
-use std::sync::{Arc, Mutex, OnceLock, Weak};
 
 /// Monotonic counter making temporary names unique within this process without a RNG dependency.
 static SEQ: AtomicU64 = AtomicU64::new(0);
 
-/// Locks held from destination metadata inspection through rename, so concurrent writes cannot
-/// combine permissions from one version of a path with the group of another.
-fn path_lock(path: &Path) -> Arc<Mutex<()>> {
-    static LOCKS: OnceLock<Mutex<std::collections::HashMap<PathBuf, Weak<Mutex<()>>>>> = OnceLock::new();
-    let absolute = if path.is_absolute() { path.to_path_buf() } else { std::env::current_dir().unwrap_or_default().join(path) };
-    let key = match (absolute.parent(), absolute.file_name()) {
-        (Some(parent), Some(name)) => std::fs::canonicalize(parent).unwrap_or_else(|_| parent.to_path_buf()).join(name),
-        _ => absolute,
-    };
-    let mut locks = LOCKS.get_or_init(|| Mutex::new(std::collections::HashMap::new())).lock().unwrap_or_else(std::sync::PoisonError::into_inner);
-    locks.retain(|_, lock| lock.strong_count() > 0);
-    if let Some(lock) = locks.get(&key).and_then(Weak::upgrade) {
-        lock
-    } else {
-        let lock = Arc::new(Mutex::new(()));
-        locks.insert(key, Arc::downgrade(&lock));
-        lock
-    }
-}
-
 /// How many fresh temporary names to try before giving up (each collision is another local race).
 const MAX_TRIES: u32 = 32;
 
@@ -54,15 +33,13 @@ pub fn write_atomic(path: &Path, bytes: &[u8]) -> io::Result<()> {
     // A symlinked destination is resolved so the link stays a link and its target is replaced.
     let resolved = resolve_symlink(path)?;
     let path = resolved.as_deref().unwrap_or(path);
-    let lock = path_lock(path);
-    let _guard = lock.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     let permissions = match std::fs::symlink_metadata(path) {
         Ok(meta) if meta.is_file() => Some(meta.permissions()),
         Ok(_) => None,
         Err(e) if e.kind() == io::ErrorKind::NotFound => None,
         Err(e) => return Err(e),
     };
-    write_atomic_with_locked(path, permissions, |file| file.write_all(bytes))
+    write_atomic_with(path, permissions, |file| file.write_all(bytes))
 }
 
 /// The topmost folder missing above `path`: what [`write_atomic_making_folders`] will create.
@@ -90,30 +67,10 @@ pub fn write_atomic_making_folders(path: &Path, bytes: &[u8]) -> io::Result<()>
 /// with `permissions` given to it from its creation (`None`: the usual creation mode). A symlink
 /// at `path` is replaced by the new file, never written through.
 pub fn write_atomic_with(path: &Path, permissions: Option<Permissions>, fill: impl FnOnce(&mut File) -> io::Result<()>) -> io::Result<()> {
-    let lock = path_lock(path);
-    let _guard = lock.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
-    write_atomic_with_locked(path, permissions, fill)
-}
-
-/// [`write_atomic_with`] with permissions derived under the same destination lock as the write.
-pub fn write_atomic_with_permissions(
-    path: &Path,
-    permissions: impl FnOnce() -> io::Result<Option<Permissions>>,
-    fill: impl FnOnce(&mut File) -> io::Result<()>,
-) -> io::Result<()> {
-    let lock = path_lock(path);
-    let _guard = lock.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
-    let permissions = permissions()?;
-    write_atomic_with_locked(path, permissions, fill)
-}
-
-fn write_atomic_with_locked(path: &Path, permissions: Option<Permissions>, fill: impl FnOnce(&mut File) -> io::Result<()>) -> io::Result<()> {
     let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).map_or_else(|| PathBuf::from("."), Path::to_path_buf);
     let (mut file, tmp) = create_temp(&dir, permissions.as_ref())?;
     let write = (|| {
         if let Some(permissions) = permissions {
-            #[cfg(unix)]
-            let permissions = keep_group(&file, path, permissions);
             file.set_permissions(permissions)?;
         }
         fill(&mut file)?;
@@ -133,20 +90,6 @@ fn write_atomic_with_locked(path: &Path, permissions: Option<Permissions>, fill:
     Ok(())
 }
 
-/// `permissions` for the new file when `path` already exists: the group bits mean "this group" only
-/// if the file is still in the old file's group, so the group is restored first. When it can't be
-/// (the user is not a member of it), the group bits are dropped rather than handed to another group.
-#[cfg(unix)]
-fn keep_group(file: &File, path: &Path, permissions: Permissions) -> Permissions {
-    use std::os::unix::fs::{MetadataExt, PermissionsExt, fchown};
-    let Ok(old) = std::fs::symlink_metadata(path) else { return permissions };
-    // A file already in the old group needs no change (and a restrictive syscall policy may refuse a no-op fchown).
-    if !old.is_file() || file.metadata().is_ok_and(|m| m.gid() == old.gid()) || fchown(file, None, Some(old.gid())).is_ok() {
-        return permissions;
-    }
-    Permissions::from_mode(permissions.mode() & !0o070)
-}
-
 /// Flush `dir` so a rename just made in it survives a crash or power loss (POSIX records a
 /// rename in the directory, not in the file). Best effort: some file systems (network shares)
 /// refuse to sync a directory, and the file itself is already on disk.
@@ -288,33 +231,6 @@ mod tests {
         std::fs::remove_dir_all(&dir).ok();
     }
 
-    /// The replacement keeps the old file's group (when the user is in another group, as `id -G`
-    /// says) together with its mode, so the group bits never name a different group.
-    #[cfg(unix)]
-    #[test]
-    fn keeps_the_group_and_mode_of_the_file_it_replaces() {
-        use std::os::unix::fs::{MetadataExt, PermissionsExt, chown};
-        let dir = std::env::temp_dir().join(format!("cadcraft-aw-grp-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
-        std::fs::create_dir_all(&dir).unwrap();
-        let dest = dir.join("out.bin");
-        std::fs::write(&dest, b"old").unwrap();
-        std::fs::set_permissions(&dest, Permissions::from_mode(0o640)).unwrap();
-        let own = std::fs::metadata(&dest).unwrap().gid();
-        let other = std::process::Command::new("id")
-            .arg("-G")
-            .output()
-            .ok()
-            .and_then(|o| String::from_utf8_lossy(&o.stdout).split_whitespace().filter_map(|g| g.parse::<u32>().ok()).find(|g| *g != own));
-        if let Some(gid) = other {
-            chown(&dest, None, Some(gid)).unwrap();
-        }
-        let want = std::fs::metadata(&dest).unwrap();
-        write_atomic(&dest, b"new").unwrap();
-        let got = std::fs::metadata(&dest).unwrap();
-        assert_eq!((got.gid(), got.mode() & 0o777), (want.gid(), 0o640));
-        std::fs::remove_dir_all(&dir).ok();
-    }
-
     #[cfg(unix)]
     #[test]
     fn does_not_follow_a_planted_temp_symlink() {

crates/engine/src/blockedit.rs

@@ -144,10 +144,10 @@ impl BlockEdit {
         }
         let host = &self.host.doc;
         let mut d = editor.clone();
-        // When saving a copy, the source keeps its last saved definition. The editor's own
-        // table entry can still be the one from before BSAVE; the copy gets the edited data.
+        // When the block is saved under another name, the edited block keeps the drawing's
+        // description and block `name` gets the description changed in the editor.
         if !name.eq_ignore_ascii_case(&self.name) {
-            restore_saved_definition(&mut d, host, &self.name);
+            keep_description(&mut d, host, &self.name);
         }
         d.model = host.model.clone();
         d.layouts = host.layouts.clone();
@@ -176,13 +176,16 @@ impl BlockEdit {
     }
 }
 
-/// Keep the source block's saved objects and metadata when the edited objects are saved as a copy.
-/// Without a saved source, drop the empty definition an editor description may have created.
-fn restore_saved_definition(d: &mut Drawing, host: &Drawing, name: &str) {
+/// Give block `name` of `d` the description `host` has for it, or, when `host` has no such block,
+/// drop the empty definition a description gives a block the editor started and never saved.
+fn keep_description(d: &mut Drawing, host: &Drawing, name: &str) {
     match host.block(name) {
         Some(h) => {
-            let key = d.blocks.keys().find(|key| key.eq_ignore_ascii_case(name)).cloned().unwrap_or_else(|| h.name.clone());
-            d.blocks.insert(key, h.clone());
+            if let Some((_, b)) = d.blocks.iter_mut().find(|(k, _)| k.eq_ignore_ascii_case(name))
+                && b.description != h.description
+            {
+                Arc::make_mut(b).description = h.description.clone();
+            }
         }
         None => d.blocks.retain(|k, b| !(k.eq_ignore_ascii_case(name) && b.entities.is_empty())),
     }
@@ -299,7 +302,7 @@ impl DocState {
             let was = be.name.clone();
             let reconcile = |doc: &mut Arc<Drawing>| {
                 let editor = Arc::make_mut(doc);
-                restore_saved_definition(editor, &d, &was);
+                keep_description(editor, &d, &was);
                 editor.blocks.retain(|k, _| !k.eq_ignore_ascii_case(&name));
                 editor.blocks.insert(name.clone(), b.clone());
             };

crates/engine/src/cmd/array.rs

@@ -178,34 +178,14 @@ fn create(s: &mut Session, objs: &[Handle], base: Vec2, p: ArrayParams, assoc: b
     Ok(json!({ "created": n }))
 }
 
-/// The most objects EXPLODE of one associative array makes from its source objects (ten times the
-/// default MAXARRAY).
-const MAX_EXPLODED_OBJECTS: usize = 1_000_000;
-
 /// EXPLODE of an associative array: every item becomes the objects of its block (the source
 /// objects, or a replacement block's reference), in world coordinates. `None` for other objects.
-///
-/// An array that would explode into more than [`MAX_EXPLODED_OBJECTS`] objects (items times the
-/// objects of the source block, which a file sets freely) is not expanded here: `None`, so EXPLODE
-/// takes the array block's own items.
 pub(crate) fn explode_array(d: &Drawing, e: &Entity) -> Option<Vec<Entity>> {
     let EntityKind::Insert(ins) = &e.kind else { return None };
     let p = d.array_params(e)?;
     let blk = d.block(&ins.block)?;
     let m = ins.transform(blk.base.xy());
-    // Count first: a hostile array must be refused before any entity is cloned.
-    let total = blk
-        .entities
-        .iter()
-        .map(|it| match &it.kind {
-            EntityKind::Insert(i) if i.block.eq_ignore_ascii_case(&p.source) => d.block(&i.block).map_or(1, |b| b.entities.len()),
-            _ => 1,
-        })
-        .fold(0usize, usize::saturating_add);
-    if total > MAX_EXPLODED_OBJECTS {
-        return None;
-    }
-    let mut out = Vec::with_capacity(total);
+    let mut out = Vec::new();
     for item in blk.entities.iter() {
         let item = placed(e, item, &m);
         let source = match &item.kind {
@@ -213,9 +193,7 @@ pub(crate) fn explode_array(d: &Drawing, e: &Entity) -> Option<Vec<Entity>> {
             _ => None,
         };
         match source {
-            Some((im, b)) => {
-                out.extend(b.entities.iter().map(|se| placed(&item, se, &im)));
-            }
+            Some((im, b)) => out.extend(b.entities.iter().map(|se| placed(&item, se, &im))),
             None => out.push(item),
         }
     }

crates/engine/src/cmd/array/edit.rs

@@ -188,9 +188,8 @@ fn item_at(d: &Drawing, h: Handle, at: Vec2, tol: f64) -> Option<(u32, u32, u32)
     let mut best: Option<((u32, u32, u32), f64)> = None;
     // Each block's own extents, measured once.
     let mut extents: HashMap<String, (Vec2, Bounds2)> = HashMap::new();
-    let block_for = p.block_lookup();
     for it in p.items()? {
-        let name = block_for(it.i, it.j, it.level);
+        let name = p.block_for(it.i, it.j, it.level);
         let (base, local) = match extents.get(name) {
             Some(x) => *x,
             None => {

crates/engine/src/cmd/blocks/extract.rs

@@ -2,9 +2,9 @@
 //! block name and values, or one row per reference with its handle, layer, position and
 //! rotation — returned, written to a CSV file and/or inserted as a table. Tags match in any case.
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::BTreeMap;
 
-use cadcraft_doc::{Drawing, EntityKind, Insert};
+use cadcraft_doc::{EntityKind, Insert};
 use cadcraft_geom::Vec2;
 use serde_json::{Value, json};
 
@@ -88,73 +88,20 @@ fn matches(spec: &str, text: &str) -> bool {
     spec.split(',').any(|p| wildcard(p.trim(), text))
 }
 
-/// The constant attribute values of a block definition whose tags are selected for output.
-fn constants(b: &cadcraft_doc::Block, selected: &[String]) -> Vec<(String, String)> {
-    let mut v: Vec<(String, String)> = Vec::new();
-    for e in b.entities.iter() {
-        if let EntityKind::AttDef(a) = &e.kind
-            && a.constant
-            && selected.iter().any(|tag| tag == &a.tag.to_ascii_uppercase())
-            && !v.iter().any(|(t, _)| t.eq_ignore_ascii_case(&a.tag))
-        {
-            v.push((a.tag.to_ascii_uppercase(), a.text.value.clone()));
-        }
-    }
-    v
-}
-
-/// The attribute values of `ins` that `o.tags` selects: its own, then the constant ones of its
-/// block (`consts`, read once per block). Values no column shows are not copied.
-fn values(ins: &Insert, consts: &[(String, String)], selected: &[String]) -> Vec<(String, String)> {
-    let mut v: Vec<(String, String)> = ins
-        .attribs
-        .iter()
-        .map(|a| (a.tag.to_ascii_uppercase(), a))
-        .filter(|(t, _)| selected.contains(t))
-        .map(|(t, a)| (t, a.text.value.clone()))
-        .collect();
-    for (t, val) in consts {
-        if !v.iter().any(|(k, _)| k.eq_ignore_ascii_case(t)) {
-            v.push((t.clone(), val.clone()));
-        }
-    }
-    v
-}
-
-/// Select the output columns before copying any attribute text. A block definition can contain
-/// many large constants that do not survive the table's 190-column limit.
-fn selected_tags(ents: &[std::sync::Arc<cadcraft_doc::Entity>], d: &Drawing, o: &Options) -> Vec<String> {
-    let mut selected = Vec::new();
-    let mut add = |tag: &str| {
-        let tag = tag.to_ascii_uppercase();
-        if selected.len() < MAX_TAGS && matches(&o.tags, &tag) && !selected.contains(&tag) {
-            selected.push(tag);
-        }
-    };
-    let mut scanned = std::collections::HashSet::new();
-    for entity in ents {
-        let EntityKind::Insert(ins) = &entity.kind else { continue };
-        let anonymous = ins.block.starts_with('*') || d.block(&ins.block).is_some_and(|b| b.anonymous);
-        if anonymous || !matches(&o.blocks, &ins.block) {
-            continue;
-        }
-        for attribute in &ins.attribs {
-            add(&attribute.tag);
-        }
-        // A block's constants are read once, however many inserts reference it.
-        if scanned.insert(ins.block.as_str())
-            && let Some(block) = d.block(&ins.block)
-        {
-            for entity in block.entities.iter() {
-                if let EntityKind::AttDef(attribute) = &entity.kind
-                    && attribute.constant
-                {
-                    add(&attribute.tag);
-                }
+/// The attribute values of `ins`: its own, then the constant ones of its block.
+fn values(d: &cadcraft_doc::Drawing, ins: &Insert) -> Vec<(String, String)> {
+    let mut v: Vec<(String, String)> = ins.attribs.iter().map(|a| (a.tag.to_ascii_uppercase(), a.text.value.clone())).collect();
+    if let Some(b) = d.block(&ins.block) {
+        for e in b.entities.iter() {
+            if let EntityKind::AttDef(a) = &e.kind
+                && a.constant
+                && !v.iter().any(|(t, _)| t.eq_ignore_ascii_case(&a.tag))
+            {
+                v.push((a.tag.to_ascii_uppercase(), a.text.value.clone()));
             }
         }
     }
-    selected
+    v
 }
 
 /// The block references to extract from: `handles` when given, else model space and the layouts.
@@ -165,9 +112,7 @@ fn found(s: &Session, p: &Value, o: &Options) -> Result<Vec<Found>> {
     } else {
         d.model.iter().chain(d.layouts.iter().flat_map(|l| l.entities.iter())).cloned().collect()
     };
-    let selected = selected_tags(&ents, d, o);
     let mut out = Vec::new();
-    let mut consts: HashMap<String, Vec<(String, String)>> = HashMap::new();
     for e in &ents {
         let EntityKind::Insert(ins) = &e.kind else { continue };
         let anonymous = ins.block.starts_with('*') || d.block(&ins.block).is_some_and(|b| b.anonymous);
@@ -176,17 +121,12 @@ fn found(s: &Session, p: &Value, o: &Options) -> Result<Vec<Found>> {
         }
         let block = d.block(&ins.block).map(|b| b.name.clone()).unwrap_or_else(|| ins.block.clone());
         out.push(Found {
+            block,
             handle: e.handle.hex(),
             layer: e.common.layer.clone(),
             at: ins.insert.xy(),
             rotation: ins.rotation.to_degrees(),
-            block: block.clone(),
-            values: values(
-                ins,
-                // Keyed by the resolved definition's exact name: `Part` and `PART` can both exist.
-                consts.entry(block.clone()).or_insert_with(|| d.block(&ins.block).map(|b| constants(b, &selected)).unwrap_or_default()),
-                &selected,
-            ),
+            values: values(d, ins),
         });
     }
     Ok(out)

crates/engine/src/cmd/blocks/xref.rs

@@ -34,7 +34,7 @@ pub(super) fn specs() -> Vec<CommandSpec> {
             .noundo(),
         CommandSpec::new("-xref", "External References", run_dash_xref)
             .alias(&["-xr"])
-            .params("{option: \"?\"|bind|detach|path|unload|reload|overlay|attach|type, names?: \"A,B*\" (default *), exact?: bool (names are literal xref names, no wildcards or commas), path? (path, attach, overlay), insert?: bool (bind: Insert type), overlay?: bool (type), at?, scale?, rotation? (attach)}")
+            .params("{option: \"?\"|bind|detach|path|unload|reload|overlay|attach|type, names?: \"A,B*\" (default *), path? (path, attach, overlay), insert?: bool (bind: Insert type), overlay?: bool (type), at?, scale?, rotation? (attach)}")
             .interactive(|_| Ok(Box::new(XrefM::new("-XREF", XStage::Option)))),
         CommandSpec::new("xbind", "Bind...", run_xbind)
             .menu(&["Modify", "Object", "External Reference", "Bind..."])
@@ -201,46 +201,6 @@ fn run_xattach(s: &mut Session, p: &Value) -> Result<Value> {
 
 /// The xrefs a JSON call names (`names`, default all); an error when none match.
 fn named(s: &Session, cmd: &str, p: &Value) -> Result<Vec<String>> {
-    if p.get("exact").and_then(Value::as_bool) == Some(true) {
-        let lits: Vec<&str> = match p.get("names") {
-            Some(Value::Array(a)) => a.iter().filter_map(Value::as_str).collect(),
-            Some(Value::String(t)) => vec![t.as_str()],
-            _ => str_param(p, "name").into_iter().collect(),
-        };
-        let d = s.doc()?;
-        let mut names = Vec::new();
-        let mut selected = std::collections::HashSet::new();
-        // Symbol names are case-insensitive: two xrefs that differ only by case can't be loaded together.
-        let mut folded = std::collections::HashMap::new();
-        for literal in &lits {
-            if let Some(block) = xrefs(d).find(|block| block.name == *literal) {
-                if let Some(first) = folded.insert(block.name.to_ascii_lowercase(), block.name.clone()).filter(|f| *f != block.name) {
-                    return Err(bad(cmd, format!("xref names \"{first}\" and \"{}\" differ only by case", block.name)));
-                }
-                if selected.insert(block.name.clone()) {
-                    names.push(block.name.clone());
-                }
-                continue;
-            }
-            let normalized = literal.to_ascii_lowercase();
-            let mut matches = xrefs(d).filter(|block| block.name.to_ascii_lowercase() == normalized);
-            if let Some(block) = matches.next() {
-                if matches.next().is_some() {
-                    return Err(bad(cmd, format!("xref name \"{literal}\" is ambiguous ignoring case")));
-                }
-                if let Some(first) = folded.insert(block.name.to_ascii_lowercase(), block.name.clone()).filter(|f| *f != block.name) {
-                    return Err(bad(cmd, format!("xref names \"{first}\" and \"{}\" differ only by case", block.name)));
-                }
-                if selected.insert(block.name.clone()) {
-                    names.push(block.name.clone());
-                }
-            }
-        }
-        if names.is_empty() {
-            return Err(bad(cmd, format!("no xref named \"{}\"", lits.join(","))));
-        }
-        return Ok(names);
-    }
     let pattern = match p.get("names") {
         Some(Value::Array(a)) => a.iter().filter_map(Value::as_str).collect::<Vec<_>>().join(","),
         Some(Value::String(t)) => t.clone(),
@@ -263,19 +223,6 @@ fn run_xref(s: &mut Session, _p: &Value) -> Result<Value> {
     Ok(r)
 }
 
-/// An error when two of `names` (or, with `all`, one of them and any other attached xref) differ only
-/// by case: symbol names are case-insensitive, so such xrefs cannot be handled together, and the
-/// command must refuse before it changes anything.
-fn refuse_case_clash(d: &Drawing, cmd: &str, names: &[String], all: bool) -> Result<()> {
-    let others: Vec<&str> = if all { xrefs(d).map(|b| b.name.as_str()).collect() } else { names.iter().map(String::as_str).collect() };
-    for n in names {
-        if let Some(o) = others.iter().find(|o| *o != n && o.eq_ignore_ascii_case(n)) {
-            return Err(bad(cmd, format!("xref names \"{n}\" and \"{o}\" differ only by case")));
-        }
-    }
-    Ok(())
-}
-
 fn run_dash_xref(s: &mut Session, p: &Value) -> Result<Value> {
     let option = str_param(p, "option").unwrap_or("?").trim().to_ascii_lowercase();
     let host = host(s);
@@ -305,7 +252,6 @@ fn run_dash_xref(s: &mut Session, p: &Value) -> Result<Value> {
         }
         "detach" | "d" => {
             let names = named(s, "-xref", p)?;
-            refuse_case_clash(s.doc()?, "-xref", &names, true)?;
             let mut erased = 0;
             for n in &names {
                 erased += load::detach(s.doc_mut()?, n);
@@ -330,7 +276,6 @@ fn run_dash_xref(s: &mut Session, p: &Value) -> Result<Value> {
         "path" | "p" => {
             let path = str_param(p, "path").map(str::trim).filter(|t| !t.is_empty()).ok_or_else(|| bad("-xref", "`path` is required"))?.to_string();
             let names = named(s, "-xref", p)?;
-            refuse_case_clash(s.doc()?, "-xref", &names, false)?;
             let d = s.doc_mut()?;
             for n in &names {
                 if let Some(b) = d.blocks.get_mut(n) {

crates/engine/src/cmd/blocks/xref/load.rs

@@ -313,23 +313,7 @@ pub(crate) fn load(d: &mut Drawing, name: &str, host: Option<&str>, chosen: bool
 /// [`load`] the xrefs `names` within one set of limits.
 pub(crate) fn load_each(d: &mut Drawing, names: &[String], host: Option<&str>, chosen: bool) -> Vec<Outcome> {
     let mut cx = Ctx::new(host);
-    // Names are case-insensitive, so a name that differs only by case from an earlier one is the same xref.
-    let mut seen = std::collections::HashMap::new();
-    names
-        .iter()
-        .flat_map(|n| match seen.entry(n.to_ascii_lowercase()) {
-            std::collections::hash_map::Entry::Vacant(v) => {
-                v.insert(n.as_str());
-                load_with(d, n, host, chosen, &mut cx)
-            }
-            // Reported, not silent: the skipped xref keeps its status and is not loaded here.
-            std::collections::hash_map::Entry::Occupied(o) => vec![Outcome {
-                name: String::new(),
-                status: XrefStatus::Unresolved,
-                detail: format!("xref \"{n}\" not loaded: it differs only by case from \"{}\"", o.get()),
-            }],
-        })
-        .collect()
+    names.iter().flat_map(|n| load_with(d, n, host, chosen, &mut cx)).collect()
 }
 
 impl Ctx {

crates/engine/src/cmd/curves.rs

@@ -453,32 +453,14 @@ impl Chain {
     }
     /// Point and unit tangent at arc length `d` from the start (clamped).
     pub fn at_length(&self, d: f64) -> Option<(Vec2, Vec2)> {
-        self.at_length_in(&self.end_lengths(), d)
-    }
-    /// The arc length from the chain's start to the end of each segment, for [`Self::at_length_in`].
-    pub fn end_lengths(&self) -> Vec<f64> {
-        self.segs
-            .iter()
-            .scan(0.0, |acc, s| {
-                *acc += s.len();
-                Some(*acc)
-            })
-            .collect()
-    }
-    /// [`Self::at_length`] with the segment end lengths computed once (`ends` from
-    /// [`Self::end_lengths`]), so many samples along one chain each cost a binary search.
-    pub fn at_length_in(&self, ends: &[f64], d: f64) -> Option<(Vec2, Vec2)> {
-        let first = ends.partition_point(|e| d > e + 1e-12);
-        // A segment of no length can't hold the point; the next one that has length does.
-        // `ends` never decreases, so the first segment past `first` with length is found by search
-        // (a run of zero-length segments can be long) instead of a scan.
-        let base = first.checked_sub(1).and_then(|p| ends.get(p)).copied().unwrap_or(0.0);
-        let i = first + ends.get(first..).unwrap_or_default().partition_point(|e| *e <= base);
-        let i = (i < self.segs.len()).then_some(i);
-        if let Some(s) = i.and_then(|i| self.segs.get(i)) {
-            let start = i.and_then(|i| i.checked_sub(1)).and_then(|p| ends.get(p)).copied().unwrap_or(0.0);
-            let t = ((d - start) / s.len()).clamp(0.0, 1.0);
-            return Some((s.at(t), s.tangent(t)));
+        let mut acc = 0.0;
+        for s in &self.segs {
+            let l = s.len();
+            if d <= acc + l + 1e-12 && l > 0.0 {
+                let t = ((d - acc) / l).clamp(0.0, 1.0);
+                return Some((s.at(t), s.tangent(t)));
+            }
+            acc += l;
         }
         self.segs.last().map(|s| (s.end(), s.tangent(1.0)))
     }
@@ -658,34 +640,6 @@ pub fn reverse_vertices(vs: &[PolyVertex], closed: bool) -> Vec<PolyVertex> {
 mod tests {
     use super::*;
 
-    /// The indexed lookup gives the point and tangent a scan from the start gives, also past the
-    /// ends and over a segment of no length.
-    #[test]
-    fn at_length_in_matches_a_scan() {
-        let l = |a: (f64, f64), b: (f64, f64)| Segment::Line(Line::new(Vec2::new(a.0, a.1), Vec2::new(b.0, b.1)));
-        let c = Chain {
-            segs: vec![l((0.0, 0.0), (0.0, 0.0)), l((0.0, 0.0), (4.0, 0.0)), l((4.0, 0.0), (4.0, 0.0)), l((4.0, 0.0), (4.0, 3.0))],
-            closed: false,
-        };
-        let ends = c.end_lengths();
-        for d in [-1.0, 0.0, 1.5, 4.0, 4.0 + 1e-13, 5.0, 7.0, 9.0] {
-            // The scan this replaced.
-            let mut acc = 0.0;
-            let mut want = c.segs.last().map(|s| (s.end(), s.tangent(1.0)));
-            for s in &c.segs {
-                let len = s.len();
-                if d <= acc + len + 1e-12 && len > 0.0 {
-                    let t = ((d - acc) / len).clamp(0.0, 1.0);
-                    want = Some((s.at(t), s.tangent(t)));
-                    break;
-                }
-                acc += len;
-            }
-            assert_eq!(c.at_length_in(&ends, d), want, "d = {d}");
-            assert_eq!(c.at_length(d), want);
-        }
-    }
-
     #[test]
     fn arc_builders() {
         let a = arc_sca(Vec2::new(1.0, 0.0), Vec2::ZERO, std::f64::consts::FRAC_PI_2).unwrap();

crates/engine/src/cmd/draw2/divide.rs

@@ -36,18 +36,16 @@ fn check_block(s: &Session, b: Option<&str>) -> Result<()> {
 pub(crate) fn divide_points(c: &Chain, n: usize) -> Vec<(Vec2, Vec2)> {
     let l = c.len();
     let range = if c.closed { 0..n } else { 1..n };
-    let ends = c.end_lengths();
-    range.filter_map(|i| c.at_length_in(&ends, l * i as f64 / n as f64)).collect()
+    range.filter_map(|i| c.at_length(l * i as f64 / n as f64)).collect()
 }
 
 pub(crate) fn measure_points(c: &Chain, step: f64) -> Vec<(Vec2, Vec2)> {
     let l = c.len();
-    let ends = c.end_lengths();
     let mut out = Vec::new();
     let mut k = 1usize;
     while (k as f64) * step < l - 1e-9 && out.len() < MAX_GEN {
         let d = k as f64 * step;
-        out.extend(c.at_length_in(&ends, d));
+        out.extend(c.at_length(d));
         k += 1;
     }
     out

crates/engine/src/cmd/draw2/revcloud.rs

@@ -58,9 +58,8 @@ pub(crate) fn cloud_vertices(boundary: &[Vec2], arc_len: f64, per_edge: bool, re
             closed: true,
         };
         let k = ((perim / arc_len).round() as usize).clamp(3, MAX_GEN);
-        let ends = chain.end_lengths();
         for j in 0..k {
-            out.extend(chain.at_length_in(&ends, perim * j as f64 / k as f64).map(|x| x.0));
+            out.extend(chain.at_length(perim * j as f64 / k as f64).map(|x| x.0));
         }
     }
     let b = if reverse { -0.5 } else { 0.5 };

crates/engine/src/cmd/file.rs

@@ -625,40 +625,6 @@ pub fn save_keeps_current(_path: &std::path::Path) -> bool {
     false
 }
 
-/// The mode of a new backup: no more open than the drawing (`src_mode`, group `src_gid`) nor than the
-/// `.bak` it replaces (`old`: mode and group). The backup keeps the old `.bak`'s group, so when that
-/// differs from the drawing's group, its group bits are dropped and its other bits are capped by
-/// the drawing's group bits: a member of the drawing's group must not gain access through `other`.
-#[cfg(unix)]
-fn backup_mode(src_mode: u32, src_gid: u32, old: Option<(u32, u32)>) -> u32 {
-    let mut mode = src_mode & 0o777;
-    if let Some((old_mode, old_gid)) = old {
-        mode &= old_mode;
-        if old_gid != src_gid {
-            mode = without_group(src_mode, mode);
-        }
-    }
-    mode
-}
-
-/// `mode` for a backup that is not in the drawing's group: no group bits, and `other` capped by the
-/// drawing's group bits (`src_mode`).
-#[cfg(unix)]
-fn without_group(src_mode: u32, mode: u32) -> u32 {
-    (mode & !0o070) & (!0o007 | ((src_mode & 0o070) >> 3))
-}
-
-/// A first backup is created in the process's (or folder's) group, not the drawing's: move it to the
-/// drawing's group before any data is written, else drop its group bits ([`without_group`]).
-#[cfg(unix)]
-fn adopt_source_group(out: &std::fs::File, src: &std::fs::Metadata) -> std::io::Result<()> {
-    use std::os::unix::fs::{MetadataExt, PermissionsExt, fchown};
-    if out.metadata()?.gid() == src.gid() || fchown(out, None, Some(src.gid())).is_ok() {
-        return Ok(());
-    }
-    out.set_permissions(std::fs::Permissions::from_mode(without_group(src.mode(), src.mode() & 0o777)))
-}
-
 /// Before `path` is replaced: copy it to its `.bak`, streamed and written atomically too
 /// ([`crate::atomic_write::write_atomic_with`]). Nothing
 /// to keep when there is no file yet. A file that doesn't look like a drawing
@@ -682,23 +648,19 @@ fn backup(path: &std::path::Path) -> std::io::Result<()> {
     // failed write leaves the old .bak as it was; a symlink at the .bak is replaced, never
     // written through.
     #[cfg(unix)]
-    let source_metadata = src.metadata()?;
-    #[cfg(unix)]
-    let first_backup = std::cell::Cell::new(false);
-    #[cfg(unix)]
-    let permissions = || {
-        use std::os::unix::fs::{MetadataExt, PermissionsExt};
-        let old = std::fs::symlink_metadata(&bak).ok().filter(|m| m.is_file());
-        first_backup.set(old.is_none());
-        Ok(Some(std::fs::Permissions::from_mode(backup_mode(source_metadata.mode(), source_metadata.gid(), old.map(|m| (m.mode(), m.gid()))))))
+    let permissions = {
+        use std::os::unix::fs::PermissionsExt;
+        let mut mode = src.metadata()?.permissions().mode() & 0o777;
+        if let Ok(m) = std::fs::symlink_metadata(&bak)
+            && m.is_file()
+        {
+            mode &= m.permissions().mode();
+        }
+        Some(std::fs::Permissions::from_mode(mode))
     };
     #[cfg(not(unix))]
-    let permissions = || Ok(None);
-    crate::atomic_write::write_atomic_with_permissions(&bak, permissions, |out| {
-        #[cfg(unix)]
-        if first_backup.get() {
-            adopt_source_group(out, &source_metadata)?;
-        }
+    let permissions = None;
+    crate::atomic_write::write_atomic_with(&bak, permissions, |out| {
         std::io::Write::write_all(out, &head)?;
         std::io::copy(&mut src, out).map(|_| ())
     })
@@ -1069,52 +1031,6 @@ mod tests {
     use crate::Session;
     use crate::temp_dir::TempDir;
 
-    /// A backup is never more open than the drawing or the old `.bak`, and loses the group bits when
-    /// it would keep the old `.bak`'s group while the drawing is in another.
-    #[cfg(unix)]
-    #[test]
-    fn backup_mode_drops_group_bits_for_a_different_group() {
-        use super::backup_mode;
-        assert_eq!(backup_mode(0o640, 10, None), 0o640);
-        assert_eq!(backup_mode(0o640, 10, Some((0o664, 10))), 0o640);
-        assert_eq!(backup_mode(0o640, 10, Some((0o664, 20))), 0o600);
-        assert_eq!(backup_mode(0o644, 10, Some((0o644, 20))), 0o604);
-        assert_eq!(backup_mode(0o600, 10, Some((0o664, 10))), 0o600);
-    }
-
-    /// With no `.bak` yet, the first backup takes the drawing's group (when the user is in another
-    /// group, as `id -G` says), never the group the new file would be created in.
-    #[cfg(unix)]
-    #[test]
-    fn first_backup_takes_the_drawings_group() {
-        use std::os::unix::fs::{MetadataExt, PermissionsExt, chown};
-        let dir = TempDir::new("first-bak-grp");
-        let src = dir.join("a.dxf");
-        std::fs::write(&src, "0\nSECTION\n2\nHEADER\n0\nENDSEC\n0\nEOF\n").unwrap();
-        std::fs::set_permissions(&src, std::fs::Permissions::from_mode(0o640)).unwrap();
-        let own = std::fs::metadata(&src).unwrap().gid();
-        let other = std::process::Command::new("id")
-            .arg("-G")
-            .output()
-            .ok()
-            .and_then(|o| String::from_utf8_lossy(&o.stdout).split_whitespace().filter_map(|g| g.parse::<u32>().ok()).find(|g| *g != own));
-        if let Some(gid) = other {
-            chown(&src, None, Some(gid)).unwrap();
-        }
-        super::backup(&src).unwrap();
-        let (s, b) = (std::fs::metadata(&src).unwrap(), std::fs::metadata(super::backup_path(&src)).unwrap());
-        assert_eq!((b.gid(), b.mode() & 0o777), (s.gid(), 0o640));
-    }
-
-    /// The fail-safe when the group cannot be adopted: no group bits, `other` capped by the group's.
-    #[cfg(unix)]
-    #[test]
-    fn without_group_drops_group_bits_and_caps_other() {
-        assert_eq!(super::without_group(0o640, 0o640), 0o600);
-        assert_eq!(super::without_group(0o604, 0o604), 0o600);
-        assert_eq!(super::without_group(0o644, 0o644), 0o604);
-    }
-
     fn active_title(s: &Session) -> String {
         s.state().unwrap().title.clone()
     }

crates/engine/src/cmd/file/compare.rs

@@ -8,7 +8,7 @@ use std::collections::HashMap;
 use std::hash::{Hash, Hasher};
 use std::sync::Arc;
 
-use cadcraft_doc::{BlockBoundsCache, Drawing, Entity, EntityKind, Handle, MAX_BLOCK_DEPTH, Space, entity_bounds_cached};
+use cadcraft_doc::{Drawing, Entity, EntityKind, Handle, MAX_BLOCK_DEPTH, Space, entity_bounds};
 use cadcraft_geom::{Bounds2, Vec2};
 use serde_json::{Value, json};
 
@@ -375,20 +375,16 @@ fn run_compare(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let Diff { added, removed, changed, common, truncated } = diff(&cur, &other, &space);
     let mut boxes = Vec::new();
-    // One block-bounds cache for each drawing, so a block many differing entities refer to is
-    // measured once, not once per entity.
-    let (mut cur_cache, mut other_cache) = (BlockBoundsCache::default(), BlockBoundsCache::default());
-    fn bound<'a>(boxes: &mut Vec<Bounds2>, d: &'a Drawing, h: Handle, cache: &mut BlockBoundsCache<'a>) {
-        if let Some(b) = d.entity(h).map(|e| entity_bounds_cached(d, e, 0, cache)).filter(|b| !b.is_empty() && b.min.is_finite() && b.max.is_finite())
-        {
+    let mut bound = |d: &Drawing, h: Handle| {
+        if let Some(b) = d.entity(h).map(|e| entity_bounds(d, e, 0)).filter(|b| !b.is_empty() && b.min.is_finite() && b.max.is_finite()) {
             boxes.push(b);
         }
-    }
-    added.iter().for_each(|h| bound(&mut boxes, &cur, *h, &mut cur_cache));
-    removed.iter().for_each(|h| bound(&mut boxes, &other, *h, &mut other_cache));
+    };
+    added.iter().for_each(|h| bound(&cur, *h));
+    removed.iter().for_each(|h| bound(&other, *h));
     for (a, b, _, _) in &changed {
-        bound(&mut boxes, &cur, *a, &mut cur_cache);
-        bound(&mut boxes, &other, *b, &mut other_cache);
+        bound(&cur, *a);
+        bound(&other, *b);
     }
     let regions = regions(&boxes);
     let ch: Vec<Value> = changed

crates/engine/src/cmd/layout/saveas.rs

@@ -26,30 +26,11 @@ const MAX_PURGE_PASSES: usize = 64;
 
 /// The file a SAveas typed at the command line suggests: `<layout>.dwt` beside the drawing.
 pub(super) fn default_path(s: &Session, layout: &str) -> String {
-    // A layout name from a file may hold path separators or `..`; the suggestion is one file name
-    // beside the drawing, so those become `_`.
-    let name: String = layout.chars().map(|c| if matches!(c, '/' | '\\' | ':') || c.is_control() { '_' } else { c }).collect();
-    // Windows reserves device names (`CON`, `NUL`, `COM1`...) with any extension, so prefix them.
-    let base = name.split('.').next().unwrap_or("").trim_end().to_ascii_uppercase();
-    let reserved = matches!(base.as_str(), "CON" | "PRN" | "AUX" | "NUL")
-        || (base.len() == 4 && (base.starts_with("COM") || base.starts_with("LPT")) && base.ends_with(|c: char| ('1'..='9').contains(&c)));
-    let file = if reserved { format!("_{name}.dwt") } else { format!("{name}.dwt") };
-    let candidate = match s.state().ok().and_then(|st| st.path.clone()) {
-        Some(p) => std::path::Path::new(&p).with_file_name(&file),
-        None => std::path::PathBuf::from(file),
-    };
-    if !candidate.exists() {
-        return candidate.to_string_lossy().into_owned();
+    let file = format!("{layout}.dwt");
+    match s.state().ok().and_then(|st| st.path.clone()) {
+        Some(p) => std::path::Path::new(&p).with_file_name(&file).to_string_lossy().into_owned(),
+        None => file,
     }
-    let stem = candidate.file_stem().and_then(|s| s.to_str()).unwrap_or("layout");
-    let extension = candidate.extension().and_then(|e| e.to_str()).unwrap_or("dwt");
-    let parent = candidate.parent().unwrap_or_else(|| std::path::Path::new(""));
-    // The suffix range never ends in practice; the fallback only keeps the code panic-free.
-    let alternative = (2u64..)
-        .map(|suffix| parent.join(format!("{stem}-{suffix}.{extension}")))
-        .find(|alternative| !alternative.exists())
-        .unwrap_or(candidate.clone());
-    alternative.to_string_lossy().into_owned()
 }
 
 /// `path` with `.dwt` added when it has no extension; an error for any other file type.
@@ -152,32 +133,3 @@ fn store(path: &str, bytes: &[u8]) -> Result<()> {
         super::super::exchange::deliver_file("layout.saveas", path, bytes, super::super::file::deliver())
     }
 }
-
-#[cfg(test)]
-mod default_path_tests {
-    use super::*;
-
-    /// A layout name with separators suggests a file beside the drawing, not a path elsewhere.
-    #[test]
-    fn layout_name_is_one_file_name() {
-        let s = Session::empty();
-        for name in ["../../etc/x", "a/b", "a\\b", "C:x"] {
-            let p = default_path(&s, name);
-            assert!(!p.contains('/') && !p.contains('\\') && !p.contains(':'), "{p}");
-            assert!(p.ends_with(".dwt"));
-        }
-        assert_eq!(default_path(&s, "Layout1"), "Layout1.dwt");
-    }
-
-    /// Windows device names are prefixed so the suggestion is never a device.
-    #[test]
-    fn reserved_device_names_are_prefixed() {
-        let s = Session::empty();
-        for name in ["CON", "nul", "Com1", "LPT9", "aux.x"] {
-            assert_eq!(default_path(&s, name), format!("_{name}.dwt"));
-        }
-        for name in ["COM0", "CONSOLE", "COM10"] {
-            assert_eq!(default_path(&s, name), format!("{name}.dwt"));
-        }
-    }
-}

crates/engine/src/cmd/modify2/mocoro.rs

@@ -117,12 +117,6 @@ pub(super) fn run_mocoro(s: &mut Session, p: &Value) -> Result<Value> {
             _ => {}
         }
     }
-    // Each Copy clones every selected object: the copies together stay within MAXARRAY, as an array's do.
-    // Erased handles are skipped by `apply`, so only live objects count (none: nothing is copied).
-    let live = counts(s, &objs)?.0;
-    if live > 0 {
-        crate::cmd::array::check_size(s, ops.iter().filter(|o| matches!(o, Op::Copy(_))).count() as u64, live)?;
-    }
     let mut copies = Vec::new();
     for op in ops {
         copies.extend(apply(s, &objs, &mut base, op)?);
@@ -156,12 +150,6 @@ pub(super) struct MocoroM {
 
 impl MocoroM {
     fn run(&mut self, s: &mut Session, op: Op) -> Result<Step> {
-        if matches!(op, Op::Copy(_)) {
-            let live = counts(s, &self.objs)?.0;
-            if live > 0 {
-                crate::cmd::array::check_size(s, 1, live)?;
-            }
-        }
         let before = s.state()?.doc.clone();
         let base = self.base;
         apply(s, &self.objs, &mut self.base, op)?;

crates/engine/src/cmd/modify2/patharray.rs

@@ -34,12 +34,10 @@ pub(crate) fn arraypath(
         _ => (6, if c.closed { l / 6.0 } else { l / 5.0 }),
     };
     crate::cmd::array::check_size(s, n as u64, objs.len())?;
-    // Segment end lengths once: each sample is then a binary search, not a scan from the start.
-    let ends = c.end_lengths();
-    let Some((p0, t0)) = c.at_length_in(&ends, 0.0) else { return Ok(Vec::new()) };
+    let Some((p0, t0)) = c.at_length(0.0) else { return Ok(Vec::new()) };
     let mut mats = Vec::new();
     for i in 1..n {
-        let Some((p, t)) = c.at_length_in(&ends, step * i as f64) else { continue };
+        let Some((p, t)) = c.at_length(step * i as f64) else { continue };
         let mut m = Mat3::translate(p - p0);
         if align {
             m = Mat3::rotate_about(p, t.angle() - t0.angle()).then_before(m);

crates/engine/src/cmd/qselect.rs

@@ -108,9 +108,8 @@ fn property(d: &Drawing, e: &Entity, name: &str) -> Option<Value> {
 
 /// Glob match, case-insensitive: `*` any run, `?` one character, `#` one digit.
 pub fn wildcard(pat: &str, text: &str) -> bool {
-    // Only the characters that can match are lower-cased, so a huge text isn't copied whole.
-    let p: Vec<char> = pat.chars().take(1024).flat_map(char::to_lowercase).collect();
-    let t: Vec<char> = text.chars().take(4096).flat_map(char::to_lowercase).collect();
+    let p: Vec<char> = pat.to_lowercase().chars().take(1024).collect();
+    let t: Vec<char> = text.to_lowercase().chars().take(4096).collect();
     // Iterative matcher with single back-track point (linear-ish, no recursion).
     let (mut pi, mut ti) = (0usize, 0usize);
     let mut star: Option<(usize, usize)> = None;

crates/engine/src/lisp.rs

@@ -123,12 +123,6 @@ pub struct LispState {
     acad_loaded: bool,
     /// Memory caps (lowered by tests).
     pub(crate) limits: Limits,
-    /// Interpreter steps all synchronous callbacks have run, nested ones included. A callback's
-    /// allowance counts what ran since it started, so the callbacks it calls spend its steps.
-    pub(crate) callback_used: u64,
-    /// The `callback_used` value the callback running now (and so every one it calls) must not
-    /// pass: the lowest of its own and its callers' allowances.
-    pub(crate) callback_ceiling: Option<u64>,
 }
 
 /// What U and REDO inside the running routine take back: the commands it ran, each as the drawing

crates/engine/src/lisp/builtins/files.rs

@@ -27,14 +27,8 @@ pub(super) fn open(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError>
     if !writing {
         match read_text_file(&path) {
             Some(t) => {
-                // Each line has a String header and a separately allocated buffer. Charge a
-                // conservative 64 bytes per line for both, including the allocator's minimum
-                // allocation size, before collecting so many short lines cannot evade the budget.
-                let count = t.lines().count();
-                charge_bytes(t.len().saturating_add(count.saturating_mul(64)))?;
-                // Exact capacity: collecting would grow by doubling and hold unbilled slack.
-                f.lines = std::collections::VecDeque::with_capacity(count);
-                f.lines.extend(t.lines().map(str::to_string));
+                charge_bytes(t.len())?;
+                f.lines = t.lines().map(str::to_string).collect();
             }
             None => return Ok(Flow::Value(Value::Nil)),
         }
@@ -106,19 +100,8 @@ fn can_write(_path: &str) -> bool {
 #[cfg(not(target_arch = "wasm32"))]
 fn write_text_file(path: &str, text: &str, append: bool) {
     use std::io::Write;
-    // Opened without blocking and without truncating, so a FIFO with no reader fails at once
-    // instead of stalling the interpreter; only a regular file is then truncated and written.
-    let mut o = std::fs::OpenOptions::new();
-    o.create(true).write(true).append(append);
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::OpenOptionsExt;
-        o.custom_flags(libc::O_NONBLOCK);
-    }
-    if let Ok(mut f) = o.open(path)
-        && f.metadata().is_ok_and(|m| m.is_file())
-        && (append || f.set_len(0).is_ok())
-    {
+    let f = std::fs::OpenOptions::new().create(true).write(true).append(append).truncate(!append).open(path);
+    if let Ok(mut f) = f {
         let _ = f.write_all(text.as_bytes());
     }
 }
@@ -135,29 +118,3 @@ fn file_exists(path: &str) -> bool {
 fn file_exists(_path: &str) -> bool {
     false
 }
-
-#[cfg(all(test, unix))]
-mod tests {
-    use super::*;
-
-    /// Writing to a FIFO with no reader returns at once, and a regular file is still replaced.
-    #[test]
-    fn write_to_a_fifo_without_a_reader_does_not_block() {
-        // A fresh directory: `create_dir` fails if the name exists, so no stale pipe or planted symlink is reused.
-        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
-        let dir = std::env::temp_dir().join(format!("cadcraft-lispfifo-{}-{nanos}", std::process::id()));
-        std::fs::create_dir(&dir).unwrap();
-        let fifo = dir.join("pipe");
-        assert!(std::process::Command::new("mkfifo").arg(&fifo).status().unwrap().success());
-        let started = std::time::Instant::now();
-        write_text_file(fifo.to_str().unwrap(), "x", false);
-        assert!(started.elapsed() < std::time::Duration::from_secs(5));
-        let f = dir.join("f.txt");
-        std::fs::write(&f, "long old text").unwrap();
-        write_text_file(f.to_str().unwrap(), "new", false);
-        assert_eq!(std::fs::read_to_string(&f).unwrap(), "new");
-        write_text_file(f.to_str().unwrap(), "+", true);
-        assert_eq!(std::fs::read_to_string(&f).unwrap(), "new+");
-        std::fs::remove_dir_all(&dir).ok();
-    }
-}

crates/engine/src/lisp/builtins/strings.rs

@@ -1,5 +1,5 @@
 use super::args::{R, arity, int, list_arg, string};
-use super::{LispError, OsStr, Value, charge_bytes, check_string_len, read, to_text};
+use super::{LispError, OsStr, Value, check_string_len, read, to_text};
 
 // ---------------- strings ----------------
 
@@ -114,13 +114,7 @@ pub(super) fn read_fn(a: &[Value]) -> R {
     arity(a, 0, 1)?;
     match a.first() {
         None | Some(Value::Nil) => Ok(Value::Nil),
-        Some(v) => {
-            // The strings in the list it makes are new, each as long as its text at most: the
-            // text is charged, though a list result isn't inspected by `charge_result`.
-            let text = string(v)?;
-            charge_bytes(text.len())?;
-            read::read_one(&text)
-        }
+        Some(v) => read::read_one(&string(v)?),
     }
 }
 

crates/engine/src/lisp/drawing.rs

@@ -179,12 +179,7 @@ fn to_json_bounded(v: &Value, depth: usize, budget: &mut u64) -> Option<serde_js
         Value::Nil => serde_json::Value::Null,
         Value::Int(i) => serde_json::json!(i),
         Value::Real(r) => serde_json::json!(r),
-        Value::Str(s) => {
-            // A string is copied whole each time it occurs: it spends the allowance by its length
-            // (one unit per 16 bytes, so about 32 MB in all), shared or not.
-            *budget = budget.checked_sub(s.len() as u64 / 16)?;
-            serde_json::json!(&**s)
-        }
+        Value::Str(s) => serde_json::json!(&**s),
         Value::Cons(_) => {
             let mut arr = Vec::new();
             for x in v.iter() {
@@ -301,16 +296,12 @@ fn groups_to_list(tags: &[Tag]) -> Vec<Value> {
     out
 }
 
-/// The most string bytes an entity list may hold (counted per occurrence, shared or not).
-const MAX_GROUP_TEXT: usize = 32 << 20;
-
 /// An association list back to DXF groups (points split into x, y, z groups). The type
 /// (`0`), the entity name (`-1`), the handle (`5`), the owner (`330`) and the layout (`410`) are
 /// left out: they aren't the entity's to set.
 fn list_to_groups(list: &Value) -> Result<(String, Vec<Tag>), LispError> {
     let mut kind = None;
     let mut tags = Vec::new();
-    let mut text_left = MAX_GROUP_TEXT;
     for item in list.iter() {
         let Value::Cons(c) = &item else { return Err(LispError::bad_arg("listp", &item)) };
         let Value::Int(code) = c.car else { return Err(LispError::bad_arg("fixnump", &c.car)) };
@@ -332,11 +323,7 @@ fn list_to_groups(list: &Value) -> Result<(String, Vec<Tag>), LispError> {
             _ => tags.push(match &v {
                 Value::Int(i) => Tag::i(code, i64::from(*i)),
                 Value::Real(r) => Tag::f(code, *r),
-                Value::Str(s) => {
-                    // Each occurrence of a shared string becomes its own copy in the tag.
-                    text_left = text_left.checked_sub(s.len()).ok_or_else(|| LispError::new("out of memory: the entity list holds too much text"))?;
-                    Tag::s(code, &**s)
-                }
+                Value::Str(s) => Tag::s(code, &**s),
                 Value::Ename(h) => Tag::s(code, h.hex()),
                 other => return Err(LispError::bad_arg("DXF group value", other)),
             }),
@@ -1138,27 +1125,3 @@ pub fn load_source(s: &Session, name: &str) -> Option<String> {
         s.lisp_support_dir().map(|d| candidates.iter().map(|c| d.join(c).to_string_lossy().into_owned()).collect::<Vec<_>>()).unwrap_or_default();
     candidates.iter().chain(&support).find_map(super::builtins::read_text_file)
 }
-
-#[cfg(test)]
-mod budget_tests {
-    use super::*;
-
-    /// One 64 KB string occurring many times is charged by its length each time.
-    #[test]
-    fn shared_strings_spend_the_conversion_budgets() {
-        let big = Value::str(&"x".repeat(64 << 10));
-        // 600 x 64 KB is over the 32 MiB an entity list may hold; 100 x 64 KB is not.
-        let list = |n: usize| {
-            let mut items = vec![Value::cons(Value::Int(0), Value::str("TEXT"))];
-            items.extend(std::iter::repeat_n(Value::cons(Value::Int(1), big.clone()), n));
-            Value::list(items)
-        };
-        assert!(list_to_groups(&list(600)).is_err());
-        assert!(list_to_groups(&list(100)).is_ok());
-        // 1,000 x 64 KB is 4,096,000 units of the 2,000,000 SETVAR allows; 100 x 64 KB is not.
-        let mut budget = TO_JSON_BUDGET;
-        assert!(to_json_bounded(&Value::list(vec![big.clone(); 1_000]), 0, &mut budget).is_none());
-        let mut budget = TO_JSON_BUDGET;
-        assert!(to_json_bounded(&Value::list(vec![big; 100]), 0, &mut budget).is_some());
-    }
-}

crates/engine/src/lisp/eval.rs

@@ -201,10 +201,6 @@ impl Machine {
             if n > budget {
                 return Outcome::Wait(Need::Yield);
             }
-            // Charge a callback's step as it runs, so callbacks it calls see what it already spent.
-            if ctx.depth > 0 {
-                ctx.s.lisp.callback_used = ctx.s.lisp.callback_used.saturating_add(1);
-            }
             let r = match std::mem::replace(&mut self.state, State::Ret(Value::Nil)) {
                 State::Eval(expr) => self.eval(ctx, expr),
                 State::Call(f, args) => self.call(ctx, f, args),
@@ -650,44 +646,29 @@ impl Ctx<'_> {
             super::value::charge_result(&v)?;
             return Ok(v);
         }
-        let cap = self.s.lisp.limits.callback_steps;
-        let start = self.s.lisp.callback_used;
-        // This callback may run until `callback_used` reaches `ceiling`: `cap` steps from now, or
-        // sooner where a caller's allowance ends, so callbacks nested in callbacks share one
-        // allowance instead of each taking a fresh one (an exponential tree otherwise).
-        let outer = self.s.lisp.callback_ceiling;
-        let ceiling = start.saturating_add(cap).min(outer.unwrap_or(u64::MAX));
-        self.s.lisp.callback_ceiling = Some(ceiling);
-        let r = self.drive_callback(f, args, ceiling);
-        self.s.lisp.callback_ceiling = outer;
-        r
-    }
-
-    /// Run callback `f` in slices until it finishes or `callback_used` reaches `ceiling`.
-    fn drive_callback(&mut self, f: &Value, args: Vec<Value>, ceiling: u64) -> Result<Value, LispError> {
         let cap = self.s.lisp.limits.callback_steps;
         let mut m = Machine::calling(f.clone(), args);
         let mut sub = Ctx { s: &mut *self.s, env: &mut *self.env, depth: self.depth + 1 };
         // Drive the callback in bounded slices instead of granting it `u64::MAX` fuel. A `Yield`
-        // (the step budget ran out) is retried until the ceiling, so a constant-memory infinite
+        // (the step budget ran out) is retried until a hard cap, so a constant-memory infinite
         // loop inside a comparator or predicate terminates with an error rather than hanging the
-        // thread and bypassing the blocking execution cap (CWE-400). The steps of callbacks this
-        // one calls are counted in `callback_used` too.
+        // thread and bypassing the blocking execution cap (CWE-400).
+        let mut spent: u64 = 0;
         loop {
-            let remaining = ceiling.saturating_sub(sub.s.lisp.callback_used);
+            let remaining = cap.saturating_sub(spent);
             if remaining == 0 {
                 return Err(LispError::new(format!("callback stopped after {cap} steps")));
             }
             let slice = remaining.min(SYNC_SLICE);
-            let outcome = m.run(&mut sub, slice);
-            match outcome {
-                // The steps were charged as they ran; finishing past the shared allowance is a failure too.
-                Outcome::Done(_) if sub.s.lisp.callback_used > ceiling => {
-                    return Err(LispError::new(format!("callback stopped after {cap} steps")));
-                }
+            match m.run(&mut sub, slice) {
                 Outcome::Done(v) => return Ok(v),
                 Outcome::Error(e) => return Err(e),
-                Outcome::Wait(Need::Yield) => {}
+                Outcome::Wait(Need::Yield) => {
+                    spent = spent.saturating_add(slice);
+                    if spent >= cap {
+                        return Err(LispError::new(format!("callback stopped after {cap} steps")));
+                    }
+                }
                 Outcome::Wait(_) => return Err(LispError::new("this function can't ask for input here")),
             }
         }

crates/engine/src/lisp/tests.rs

@@ -286,35 +286,6 @@ fn reaching_a_callback_slice_boundary_does_not_grant_another_slice() {
     assert!(counts[1] >= counts[0] && counts[1] - counts[0] <= 1, "{counts:?}");
 }
 
-/// Callbacks that call callbacks share one allowance: a branching routine can't multiply it.
-#[test]
-fn nested_callbacks_share_one_step_allowance() {
-    let mut s = session();
-    s.lisp.limits.callback_steps = 1_000_000;
-    // 4^14 leaf calls if every callback took a fresh allowance; the whole tree gets one.
-    let started = std::time::Instant::now();
-    let e = eval(&mut s, "(defun f (n) (if (> n 0) (vl-every '(lambda (x) (f (1- n)) t) '(1 2 3 4)) t)) (f 14)").unwrap_err();
-    assert!(e.contains("callback stopped after 1000000 steps"), "{e}");
-    assert!(started.elapsed() < std::time::Duration::from_secs(60));
-    // The next run starts afresh.
-    assert_eq!(ok(&mut s, "(f 1)"), "T");
-}
-
-/// An outer callback's own steps count against the allowance before the callbacks it calls run.
-#[test]
-fn an_outer_callbacks_steps_are_charged_before_a_nested_one() {
-    let mut s = session();
-    s.lisp.limits.callback_steps = 1_000;
-    ok(&mut s, "(setq inner-steps 0)");
-    // The outer callback spends ~600 steps, then a nested one tries to spend ~600 more.
-    let r = eval(
-        &mut s,
-        "(vl-remove-if '(lambda (x) (repeat 150 (setq a 1)) (vl-remove-if '(lambda (y) (repeat 150 (setq inner-steps (1+ inner-steps)))) '(1)) nil) '(1))",
-    );
-    assert_eq!(r, Err("callback stopped after 1000 steps".into()));
-    assert!(ok(&mut s, "inner-steps").parse::<i64>().unwrap() < 150);
-}
-
 /// System-variable conversion rejects a shared list whose owned JSON expansion would exceed its budget.
 #[test]
 fn setvar_rejects_an_oversized_shared_structure() {
@@ -1016,9 +987,6 @@ fn strings_are_capped() {
     assert!(e.contains("too much text"), "{e}");
     let e = eval(&mut s, "(repeat 200000 (princ \"0123456789\"))").unwrap_err();
     assert!(e.contains("too much text"), "{e}");
-    // READ makes new strings inside the list it returns: they count, though the result is a list.
-    let e = eval(&mut s, "(setq a \"(\\\"0123456789\\\")\") (repeat 100000 (setq b (read a)))").unwrap_err();
-    assert!(e.contains("too much text"), "{e}");
     // The budget is per run: the next one starts afresh.
     assert_eq!(ok(&mut s, "(strcat \"a\" \"b\")"), "\"ab\"");
 }

crates/engine/src/lisp/value.rs

@@ -346,11 +346,7 @@ pub fn equal(a: &Value, b: &Value, fuzz: f64) -> bool {
     // A shared cons DAG can expand into exponentially many node visits when compared as a tree.
     // Bound the total comparisons so `equal` on adversarial shared structure cannot monopolise the
     // thread (CWE-407); exhausting the budget reports "not equal" rather than looping.
-    equal_within(a, b, fuzz, EQUAL_BUDGET)
-}
-
-/// [`equal`] with its work allowance (node visits plus string bytes / 64) given.
-fn equal_within(a: &Value, b: &Value, fuzz: f64, mut budget: u64) -> bool {
+    let mut budget: u64 = EQUAL_BUDGET;
     equal_depth(a, b, fuzz, 0, &mut budget)
 }
 
@@ -377,19 +373,7 @@ fn equal_depth(a: &Value, b: &Value, fuzz: f64, depth: usize, budget: &mut u64)
                 a = na;
                 b = nb;
             }
-            _ => {
-                // Comparing two strings costs their length, not one visit: a shared list of long
-                // equal strings must spend the allowance by the bytes it compares (one unit per 64).
-                if let (Value::Str(x), Value::Str(y)) = (&a, &b) {
-                    let cost = (x.len().min(y.len()) / 64) as u64;
-                    if cost >= *budget {
-                        *budget = 0;
-                        return false;
-                    }
-                    *budget -= cost;
-                }
-                return atom_equal(&a, &b, fuzz);
-            }
+            _ => return atom_equal(&a, &b, fuzz),
         }
     }
 }
@@ -556,20 +540,6 @@ fn write_value(out: &mut String, v: &Value, escape: bool, depth: usize) {
 mod tests {
     use super::*;
 
-    /// `equal` charges the bytes of the strings it compares: a list of long equal strings fits a
-    /// big allowance but not a small one, though it has few nodes.
-    #[test]
-    fn equal_spends_its_allowance_on_string_bytes() {
-        let long = Value::str(&"x".repeat(6_400));
-        let other = Value::str(&"x".repeat(6_400));
-        let list = |v: &Value| Value::list(vec![v.clone(); 100]);
-        let (a, b) = (list(&long), list(&other));
-        // 100 strings x 100 units each, plus about 100 node visits.
-        assert!(equal_within(&a, &b, 0.0, 20_000));
-        assert!(!equal_within(&a, &b, 0.0, 5_000));
-        assert!(equal(&a, &b, 0.0));
-    }
-
     #[test]
     fn reals_print_with_six_significant_digits() {
         assert_eq!(real_text(1.0), "1.0");

crates/engine/tests/bsaveas_source.rs

@@ -1,37 +0,0 @@
-//! Saving an edited block as a copy must retain its source's last saved definition.
-
-use cadcraft_engine::Session;
-use serde_json::json;
-
-/// Add a third line to a block and BSAVE it, BSAVEAS a copy, then edit and save the copy: the
-/// source block keeps the definition of its own last save.
-#[test]
-fn save_as_preserves_the_last_saved_source_definition() {
-    let mut s = Session::new();
-    let mut handles = Vec::new();
-    for y in [5, 9] {
-        let line = s.execute("line", &json!({ "points": [[5, y], [15, y]] })).unwrap();
-        handles.push(line["handles"][0].clone());
-    }
-    s.execute("block", &json!({ "name": "Frame", "base": [5, 5], "handles": handles, "keep": "delete" })).unwrap();
-    s.execute("insert", &json!({ "name": "Frame", "at": [100, 20] })).unwrap();
-    s.execute("bedit", &json!({ "name": "Frame" })).unwrap();
-    assert_eq!(s.doc().unwrap().model.len(), 2);
-
-    s.execute("line", &json!({ "points": [[0, 3], [3, 3]] })).unwrap();
-    s.execute("bsave", &json!({})).unwrap();
-    let saved_source = s.state().unwrap().drawing().block("Frame").unwrap().as_ref().clone();
-    assert_eq!(saved_source.entities.len(), 3);
-    s.execute("bsaveas", &json!({ "name": "Copy" })).unwrap();
-    assert_eq!(s.state().unwrap().block_editor(), Some("Copy"));
-    assert_eq!(s.state().unwrap().drawing().block("Frame").unwrap().as_ref(), &saved_source, "copy composition keeps the saved source");
-
-    // A later save of Copy must not reintroduce the editor table's older source definition.
-    s.execute("line", &json!({ "points": [[0, 6], [4, 6]] })).unwrap();
-    s.execute("bsave", &json!({})).unwrap();
-    s.execute("bclose", &json!({ "save": false })).unwrap();
-    assert_eq!(s.doc().unwrap().block("Frame").unwrap().as_ref(), &saved_source, "editor reconciliation keeps the saved source");
-    assert_eq!(s.doc().unwrap().block("Copy").unwrap().entities.len(), 4, "the copy keeps its own later edit");
-    s.execute("bedit", &json!({ "name": "Frame" })).unwrap();
-    assert_eq!(s.doc().unwrap().model.len(), 3);
-}

crates/engine/tests/it/mocoro.rs

@@ -233,17 +233,3 @@ fn options_on_objects_that_are_gone_record_nothing() {
     assert!(lines(&s).is_empty());
     assert_eq!(undo_len(&s), undo, "no empty undo step");
 }
-
-#[test]
-fn json_form_copies_stay_within_maxarray() {
-    let mut s = Session::new();
-    let l = line(&mut s, [0.0, 0.0], [10.0, 0.0]);
-    // 5,000 Copy options of 30 objects would be 150,000 copies, over the default MAXARRAY of 100,000.
-    let others: Vec<String> = (0..29).map(|i| line(&mut s, [0.0, f64::from(i + 1)], [10.0, f64::from(i + 1)])).collect();
-    let mut hs = vec![l];
-    hs.extend(others);
-    let ops: Vec<Value> = (0..5_000).map(|i| json!({"copy": [0, i]})).collect();
-    let e = s.execute("mocoro", &json!({"handles": hs, "base": [0, 0], "ops": ops})).unwrap_err();
-    assert!(e.to_string().contains("MAXARRAY"), "{e}");
-    assert_eq!(lines(&s).len(), 30, "nothing was copied");
-}

crates/engine/tests/xref.rs

@@ -190,28 +190,6 @@ fn reload_unload_path_and_detach() {
     assert_eq!(objects(&s, "site"), 3, "reload reads the file again");
     assert!(s.doc().unwrap().layer("site|Walls").unwrap().frozen);
 
-    // `exact`: a name is literal, so `#` or `*` in it doesn't reach other xrefs.
-    assert!(s.execute("-xref", &json!({ "option": "reload", "names": "s#te", "exact": true })).is_err());
-    assert!(s.execute("-xref", &json!({ "option": "reload", "names": "*", "exact": true })).is_err());
-    s.execute("-xref", &json!({ "option": "reload", "names": "SITE", "exact": true })).unwrap();
-
-    // Two xrefs that differ only by case: an exact selection of both is refused before anything loads,
-    // and reload-all loads one of them once.
-    let mut twin = Block::new("SITE");
-    twin.xref_path = Some("site.dxf".into());
-    s.doc_mut().unwrap().blocks.insert("SITE".into(), Arc::new(twin));
-    assert!(s.execute("-xref", &json!({ "option": "reload", "names": ["site", "SITE"], "exact": true })).is_err());
-    let r = s.execute("-xref", &json!({ "option": "reload" })).unwrap();
-    assert_eq!(r["xrefs"].as_array().map(Vec::len), Some(1));
-    // Detaching one of them, or giving both a new path, is refused before anything changes.
-    assert!(s.execute("-xref", &json!({ "option": "detach", "names": "site", "exact": true })).is_err());
-    assert!(s.doc().unwrap().block("site").is_some());
-    assert!(s.execute("-xref", &json!({ "option": "path", "names": "*", "path": "other.dxf" })).is_err());
-    for k in ["site", "SITE"] {
-        assert_eq!(s.doc().unwrap().blocks.get(k).and_then(|b| b.xref_path.clone()).as_deref(), Some("site.dxf"), "{k}");
-    }
-    s.doc_mut().unwrap().blocks.remove("SITE");
-
     s.execute("-xref", &json!({ "option": "unload", "names": "site" })).unwrap();
     assert_eq!((status(&s, "site"), objects(&s, "site")), (Some(XrefStatus::Unloaded), 0));
     assert!(s.doc().unwrap().block("site|Tree").is_none());

crates/fonts/build.rs

@@ -43,16 +43,13 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
     rerun_if_changed(&manifest)?;
     // Resolve the checkout root once so every manifest file can be confined inside it.
     let root = dir.canonicalize().map_err(|e| format!("{}: {e}", dir.display()))?;
-    // The manifest itself is confined too (a symlink in the checkout can't point it elsewhere), must
-    // be a regular file, and is read through a limit so `/dev/zero` can't fill memory.
-    let text = read_manifest(&resolve_font(&root, "fonts/manifest.txt")?)?;
+    let text = std::fs::read_to_string(&manifest).map_err(|e| format!("{}: {e}", manifest.display()))?;
     let wasm = std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|a| a == "wasm32");
     let mut out = String::new();
-    for (n, line) in text.lines().enumerate().map(|(n, l)| (n + 1, l.trim())).filter(|(_, l)| !l.is_empty() && !l.starts_with('#')) {
+    for line in text.lines().map(str::trim).filter(|l| !l.is_empty() && !l.starts_with('#')) {
         let f: Vec<&str> = line.split(" | ").map(str::trim).collect();
-        // The line's text is not repeated: it comes from the checkout and goes to the build output.
         let [family, style, file, scripts, ..] = f.as_slice() else {
-            return Err(format!("malformed manifest line {n}"));
+            return Err(format!("malformed manifest line: {line}"));
         };
         if BARRED_FAMILIES.iter().any(|barred| family.starts_with(barred)) {
             println!("cargo::warning=craft-fonts: not embedding {family} {style} (AGENTS.md: no Adobe fonts)");
@@ -76,28 +73,6 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
     Ok(out)
 }
 
-/// The most a manifest may hold; the real one is a few KiB.
-const MAX_MANIFEST_BYTES: u64 = 1 << 20;
-
-/// Read the regular file `path` as text, at most [`MAX_MANIFEST_BYTES`].
-fn read_manifest(path: &std::path::Path) -> Result<String, String> {
-    use std::io::Read as _;
-    // stat never blocks, but opening a FIFO with no writer does, so refuse non-regular files first.
-    if !std::fs::metadata(path).is_ok_and(|m| m.is_file()) {
-        return Err(format!("{}: not a regular file", path.display()));
-    }
-    let file = std::fs::File::open(path).map_err(|e| format!("{}: {e}", path.display()))?;
-    if !file.metadata().is_ok_and(|m| m.is_file()) {
-        return Err(format!("{}: not a regular file", path.display()));
-    }
-    let mut text = String::new();
-    file.take(MAX_MANIFEST_BYTES + 1).read_to_string(&mut text).map_err(|e| format!("{}: {e}", path.display()))?;
-    if text.len() as u64 > MAX_MANIFEST_BYTES {
-        return Err(format!("{}: larger than {MAX_MANIFEST_BYTES} bytes", path.display()));
-    }
-    Ok(text)
-}
-
 /// Resolve a manifest `file` field to a real path *confined to the checkout* `root` (CWE-22).
 ///
 /// The field is rejected if it is absolute or contains a parent (`..`) component, and the

crates/fonts/src/lib.rs

@@ -184,9 +184,6 @@ pub fn shape_stroke_dir(s: &str, height: f64, width_factor: f64, oblique: f64, b
     let mut under_start: Option<f64> = None;
     let mut over_start: Option<f64> = None;
     let mut gap = stroke::GAP * sc * wf;
-    // Retained fallback-outline points over the line, as the TrueType path caps them: a short string
-    // repeating one detailed glyph would otherwise copy its outline per occurrence.
-    let mut points_left = ttf::MAX_SHAPED_POINTS;
     // The simple path lays a line out left to right: one asked to run right to left goes through
     // the bidi path even without right-to-left letters.
     if (complex::needed(s) || base_rtl == Some(true))
@@ -205,13 +202,7 @@ pub fn shape_stroke_dir(s: &str, height: f64, width_factor: f64, oblique: f64, b
             None if !c.is_whitespace() => match ttf::fallback_glyph(c) {
                 Some(g) => {
                     let (y, scale) = stroke_fallback_metrics(&g, c, h);
-                    let contours = match points_left.checked_sub(g.points) {
-                        Some(rest) => {
-                            points_left = rest;
-                            ttf::place_glyph_at(&g, Vec2::new(x, y), scale, wf, shear)
-                        }
-                        None => Vec::new(),
-                    };
+                    let contours = ttf::place_glyph_at(&g, Vec2::new(x, y), scale, wf, shear);
                     if !contours.is_empty() {
                         out.push_glyph(contours, ttf::text_glyph_at(&g, c, Vec2::new(x + y * shear, y), scale, wf, shear));
                     }

crates/fonts/src/mtext.rs

@@ -153,40 +153,6 @@ pub struct MTextLayout {
     pub bounds: Bounds2,
     /// Plain text of each laid-out line.
     pub lines: Vec<String>,
-    /// Whether the geometry stops short: the layout reached its allowance of retained points
-    /// ([`Allowance`]) and the segments after that are not drawn.
-    pub truncated: bool,
-}
-
-/// The points all the segments of one layout may keep together, each counted for both copies the
-/// layout holds: the allowance one shaped line has (`MAX_SHAPED_POINTS`), so a short repeated detailed glyph over many segments cannot multiply it.
-pub(crate) struct Allowance(usize);
-
-impl Allowance {
-    pub(crate) fn new() -> Self {
-        Allowance(crate::ttf::MAX_SHAPED_POINTS)
-    }
-
-    /// Whether any allowance is left, before a segment is shaped.
-    pub(crate) fn left(&self) -> bool {
-        self.0 > 0
-    }
-
-    /// Charge the points of `sh`; false (and nothing left) when it does not fit.
-    pub(crate) fn charge(&mut self, sh: &Shaped) -> bool {
-        // Kept twice: in the piece and again in the layout's flat `strokes`.
-        let n = 2 * (sh.strokes.iter().map(Vec::len).sum::<usize>() + sh.glyphs.iter().flatten().map(Vec::len).sum::<usize>());
-        match self.0.checked_sub(n) {
-            Some(rest) => {
-                self.0 = rest;
-                true
-            }
-            None => {
-                self.0 = 0;
-                false
-            }
-        }
-    }
 }
 
 /// Inline character format.
@@ -884,7 +850,6 @@ pub fn layout_mtext_with(contents: &str, p: &MTextParams) -> MTextLayout {
     let insert = p.insert;
     let xf = |q: Vec2| insert + q.rotate(rotation);
     let mut out = MTextLayout { lines: lines.iter().map(|l| l.text.clone()).collect(), ..Default::default() };
-    let mut allowance = Allowance::new();
     for (l, base_y) in lines.iter().zip(baselines) {
         let x0 = match col {
             0 => 0.0,
@@ -894,15 +859,7 @@ pub fn layout_mtext_with(contents: &str, p: &MTextParams) -> MTextLayout {
         for it in &l.items {
             let Some(sg) = &it.seg else { continue };
             let fm = fmt(it.fmt);
-            if !allowance.left() {
-                out.truncated = true;
-                continue;
-            }
             let mut sh = seg_shape(sg, fm, it.x);
-            if !allowance.charge(&sh) {
-                out.truncated = true;
-                continue;
-            }
             let off = Vec2::new(x0, top + base_y);
             sh.map(|q| xf(q + off));
             match out.pieces.last_mut() {
@@ -939,17 +896,6 @@ mod tests {
         assert_eq!(l.lines[0], "alpha beta gamma");
     }
 
-    /// The points of all the segments of one layout are charged against one allowance.
-    #[test]
-    fn a_layout_shares_one_point_allowance() {
-        let big = Shaped { strokes: vec![vec![Vec2::ZERO; crate::ttf::MAX_SHAPED_POINTS / 4 + 1]], ..Default::default() };
-        let mut a = Allowance::new();
-        assert!(a.left() && a.charge(&big), "the first segment fits");
-        assert!(!a.charge(&big), "the second does not, though each alone would");
-        assert!(!a.left(), "and nothing is left to shape another");
-        assert!(!layout_mtext("plain text", Vec2::ZERO, 1.0, 0.0, 1, 0.0, 1.0).truncated);
-    }
-
     #[test]
     fn strips_formatting() {
         assert_eq!(plain_mtext("{\\fArial|b1;Bold}\\Pline 2"), "Bold\nline 2");

crates/fonts/src/mtext/para.rs

@@ -677,7 +677,6 @@ pub(super) fn layout(contents: &str, p: &MTextParams, base: &Fmt) -> MTextLayout
     let insert = p.insert;
     let xf = |q: Vec2| insert + q.rotate(rotation);
     let mut out = MTextLayout { lines: lines.iter().map(|l| l.text.clone()).collect(), ..Default::default() };
-    let mut allowance = super::Allowance::new();
     for (l, (c, base_y)) in lines.iter().zip(placed) {
         let pp = paras.props(l.para);
         let slot = if reversed { n_cols.saturating_sub(1).saturating_sub(c) } else { c };
@@ -697,15 +696,7 @@ pub(super) fn layout(contents: &str, p: &MTextParams, base: &Fmt) -> MTextLayout
         };
         for it in &l.items {
             let fm = fmt(it.fmt);
-            if !allowance.left() {
-                out.truncated = true;
-                continue;
-            }
             let mut sh = seg_shape(&it.seg, fm, it.x);
-            if !allowance.charge(&sh) {
-                out.truncated = true;
-                continue;
-            }
             let off = Vec2::new(col_x + shift + per_gap * it.gap as f64, top + base_y);
             sh.map(|q| xf(q + off));
             match out.pieces.last_mut() {

crates/fonts/src/ttf.rs

@@ -932,7 +932,7 @@ pub fn fallback_for(c: char) -> Option<Face> {
 #[derive(Default)]
 pub(crate) struct GlyphOutline {
     pub(crate) contours: Arc<[Vec<Vec2>]>,
-    pub(crate) points: usize,
+    points: usize,
     pub(crate) advance: f64,
     pub(crate) cap: f64,
     /// The font maps the character (false: the missing-glyph shape).

crates/io/src/dxf_ext.rs

@@ -844,33 +844,15 @@ pub(crate) fn apply_anno(d: &mut cadcraft_doc::Drawing, p: AnnoPayload) {
             std::sync::Arc::make_mut(b).annotative = true;
         }
     }
-    // Which layout holds each paper space object, found once: `modify_entity` searches every
-    // layout for a handle model space lacks, which a long list of missing handles made quadratic.
-    let mut in_layout: std::collections::HashMap<Handle, usize> = Default::default();
-    if !p.objects.is_empty() {
-        // First layout wins, as `modify_entity` did.
-        for (i, l) in d.layouts.iter().enumerate() {
-            for h in l.entities.handles() {
-                in_layout.entry(h).or_insert(i);
-            }
-        }
-    }
     for o in p.objects {
         let Some(h) = Handle::parse_hex(&o.handle) else { continue };
-        let store = if d.model.contains(h) {
-            &mut d.model
-        } else if let Some(l) = in_layout.get(&h).and_then(|&i| d.layouts.get_mut(i)) {
-            &mut l.entities
-        } else {
-            continue;
-        };
         let mut scales: Vec<cadcraft_doc::AnnoScale> = Vec::new();
         for s in o.scales.into_iter().filter(|s| s.is_valid() && !s.name.trim().is_empty()) {
             if scales.len() < cadcraft_doc::MAX_SCALES && !scales.iter().any(|x| x.name.eq_ignore_ascii_case(&s.name)) {
                 scales.push(s);
             }
         }
-        store.modify(h, |e| {
+        let _ = d.modify_entity(h, |e| {
             if cadcraft_doc::can_be_annotative(&e.kind) {
                 e.common.anno_scales = scales;
             }

crates/io/src/dxf_raw.rs

@@ -339,8 +339,7 @@ pub(crate) fn read(secs: &[Section], d: &mut Drawing) {
     }
     let root = objects.first().filter(|(k, _, _)| is_dictionary(k)).and_then(|(_, _, t)| head(t).handle);
     let root_entries = objects.first().filter(|(k, _, _)| is_dictionary(k)).map(|(_, _, t)| entries(t)).unwrap_or_default();
-    let root_keys = root_key_index(&root_entries);
-    let root_key = |h: &str| root_keys.get(h).map(|k| (*k).to_string());
+    let root_key = |h: &str| root_entries.iter().find(|(_, eh)| eh == h).map(|(k, _)| k.clone());
     // An extension dictionary of an entity or record (not of another object).
     let is_xdict = |k: usize| {
         let Some((_, _, t)) = objects.get(k) else { return false };
@@ -495,16 +494,6 @@ fn extension_dictionaries(
     dictionaries
 }
 
-/// The root dictionary's key for each entry handle (the first key when several name one handle),
-/// built once: a lookup per object scanning the entries made a large dictionary quadratic.
-fn root_key_index(root_entries: &[(String, String)]) -> HashMap<&str, &str> {
-    let mut index = HashMap::with_capacity(root_entries.len());
-    for (key, handle) in root_entries {
-        index.entry(handle.as_str()).or_insert(key.as_str());
-    }
-    index
-}
-
 /// Determine which objects belong to unmodelled dictionary entries or owners.
 fn retained_objects(
     objects: &[(String, usize, &[Tag])],
@@ -515,8 +504,7 @@ fn retained_objects(
     root_entries: &[(String, String)],
     xdict_of: &HashMap<String, String>,
 ) -> HashMap<usize, bool> {
-    let root_keys = root_key_index(root_entries);
-    let root_key = |handle: &str| root_keys.get(handle).copied();
+    let root_key = |handle: &str| root_entries.iter().find(|(_, entry_handle)| entry_handle == handle).map(|(key, _)| key);
     let is_xdict = |index: usize| {
         let Some((_, _, tags)) = objects.get(index) else { return false };
         let header = head(tags);

crates/io/src/dxf_write/sections.rs

@@ -1204,56 +1204,33 @@ fn add_class_instance_counts(tags: &mut Vec<Tag>, target: Version) {
         return;
     }
     let mut counts: HashMap<String, i64> = HashMap::new();
-    let mut classes = 0;
     for t in tags.iter().filter(|t| t.code == 0) {
         let kind = t.str();
         if kind != "CLASS" {
             *counts.entry(kind.to_ascii_uppercase()).or_default() += 1;
-        } else {
-            classes += 1;
         }
     }
 
-    // One pass into a new list: inserting each missing count in place shifted every later tag,
-    // quadratic in the number of CLASS records.
-    // Tags move by value (no clone); the old and new buffers coexist while it runs. At most one
-    // group 91 is added per CLASS record, so that is all the room the new list needs beyond the old one.
-    let old = std::mem::take(tags);
-    tags.reserve(old.len() + classes);
-    let mut it = old.into_iter();
-    let mut pending = it.next();
-    while let Some(t) = pending.take() {
-        if t.code != 0 || t.str() != "CLASS" {
-            tags.push(t);
-            pending = it.next();
+    let mut start = 0;
+    while start < tags.len() {
+        if tags.get(start).is_none_or(|t| t.code != 0 || t.str() != "CLASS") {
+            start += 1;
             continue;
         }
-        let mut record = vec![t];
-        for n in it.by_ref() {
-            if n.code == 0 {
-                pending = Some(n);
-                break;
-            }
-            record.push(n);
-        }
-        let name = record.iter().skip(1).find(|t| t.code == 1).map(Tag::str).unwrap_or_default().to_ascii_uppercase();
+        let end = tags[start + 1..].iter().position(|t| t.code == 0).map_or(tags.len(), |i| start + 1 + i);
+        let name = tags[start + 1..end].iter().find(|t| t.code == 1).map(Tag::str).unwrap_or_default().to_ascii_uppercase();
         let count = counts.get(&name).copied().unwrap_or(0);
-        // The first 91 gets the count; without one, a 91 goes in after the first 90.
-        let mut added = record.iter().skip(1).any(|t| t.code == 91);
-        let mut replaced = false;
-        for (i, t) in record.into_iter().enumerate() {
-            let code = t.code;
-            if i > 0 && code == 91 && !replaced {
-                tags.push(Tag::i(91, count));
-                replaced = true;
-                continue;
-            }
-            tags.push(t);
-            if i > 0 && code == 90 && !added {
-                tags.push(Tag::i(91, count));
-                added = true;
-            }
-        }
+        let inserted = if let Some(i) = tags[start + 1..end].iter().position(|t| t.code == 91) {
+            tags[start + 1 + i] = Tag::i(91, count);
+            false
+        } else if let Some(i) = tags[start + 1..end].iter().position(|t| t.code == 90) {
+            tags.insert(start + 2 + i, Tag::i(91, count));
+            true
+        } else {
+            false
+        };
+        // Inserting the group shifts the next record's start by one.
+        start = end + usize::from(inserted);
     }
 }
 
@@ -1281,31 +1258,3 @@ fn mark_xrefs(tags: &mut [Tag], d: &Drawing) {
         }
     }
 }
-
-#[cfg(test)]
-mod class_count_tests {
-    use super::*;
-
-    fn record(kind: &str, name: &str, extra: &[Tag]) -> Vec<Tag> {
-        let mut r = vec![Tag::s(0, kind), Tag::s(1, name), Tag::i(90, 0)];
-        r.extend_from_slice(extra);
-        r
-    }
-
-    /// The first 91 gets the count, a CLASS without one gets it after its 90, in one pass over many records.
-    #[test]
-    fn counts_are_set_and_added_in_one_pass() {
-        let mut tags = record("CLASS", "FOO", &[]);
-        tags.extend(record("CLASS", "BAR", &[Tag::i(91, 7), Tag::i(91, 8)]));
-        for i in 0..50_000 {
-            tags.extend(record("CLASS", &format!("X{i}"), &[]));
-        }
-        tags.push(Tag::s(0, "FOO"));
-        let started = std::time::Instant::now();
-        add_class_instance_counts(&mut tags, Version::R2018);
-        assert!(started.elapsed() < std::time::Duration::from_secs(5));
-        assert_eq!(&tags[..4], &[Tag::s(0, "CLASS"), Tag::s(1, "FOO"), Tag::i(90, 0), Tag::i(91, 1)]);
-        assert_eq!(&tags[4..9], &[Tag::s(0, "CLASS"), Tag::s(1, "BAR"), Tag::i(90, 0), Tag::i(91, 0), Tag::i(91, 8)]);
-        assert_eq!(tags.iter().filter(|t| t.code == 91).count(), 50_003);
-    }
-}

crates/io/src/pdf.rs

@@ -50,8 +50,6 @@ const MAX_LAYER_NAME: usize = 1000;
 /// Most link annotations in one file, and the longest link target (bytes).
 const MAX_LINKS: usize = 10_000;
 const MAX_URL: usize = 2048;
-/// The most link annotations in one PDF, over all pages (a page holds at most [`MAX_LINKS`]).
-const MAX_FILE_ANNOTATIONS: usize = 100_000;
 /// Longest title and page label written (characters).
 const MAX_TEXT: usize = 1000;
 
@@ -359,10 +357,7 @@ fn sheet_name(space: &Space) -> String {
 /// Write a vector PDF with one page per space (at most [`MAX_PAGES`]), each labelled with its
 /// layout name. The options apply to every sheet; layouts use their own page setups.
 pub fn pdf_sheets(d: &Drawing, spaces: &[Space], o: &PdfOptions) -> Result<Vec<u8>> {
-    // Links are file-wide (`pdf_items` reads them from `o`), so a sheet's own options carry none:
-    // a copy of the list per sheet multiplied it by the sheet count.
-    let sheet = PdfOptions { links: Vec::new(), ..o.clone() };
-    let items: Vec<(Space, PdfOptions)> = spaces.iter().take(MAX_PAGES + 1).map(|s| (s.clone(), sheet.clone())).collect();
+    let items: Vec<(Space, PdfOptions)> = spaces.iter().take(MAX_PAGES + 1).map(|s| (s.clone(), o.clone())).collect();
     pdf_items(d, &items, o)
 }
 
@@ -458,16 +453,8 @@ fn write_pdf(d: &Drawing, items: &[(Space, PdfOptions)], o: &PdfOptions, text_as
         let mut writer = Writer::new(settings, metadata);
         let mut fonts = fonts::Fonts::new(!text_as_geometry);
         let mut groups = Groups::default();
-        // Link annotations of the whole file: each page keeps its own copy of the targets, so the
-        // pages times the links must not multiply without a bound.
-        let mut annotations_left = MAX_FILE_ANNOTATIONS;
         for (s, po) in items {
-            // Once the budget is spent no link is built (scanned and cloned) for later pages.
-            let mut page = sheet(drawn, s, po, if annotations_left == 0 { &links[..0] } else { &links })?;
-            // Only targets `write_page` accepts count against the budget.
-            page.links.retain(|(_, url)| uri(url).is_some());
-            page.links.truncate(annotations_left);
-            annotations_left -= page.links.len();
+            let page = sheet(drawn, s, po, &links)?;
             let doc = writer.document_mut();
             // Groups are added to the document, so they must exist before the page starts.
             groups.add(doc, d, &page.layers);
@@ -638,8 +625,7 @@ pub(crate) fn placement(space: &Space, bounds: &Bounds2, fit: bool, sheet: &Shee
 /// The hyperlinks to plot: the options' own, then (with [`PdfOptions::hyperlinks`]) those the
 /// drawing file gave its entities as `PE_URL` extended data, at most [`MAX_LINKS`] in all.
 fn all_links(d: &Drawing, o: &PdfOptions) -> Vec<(Handle, String)> {
-    // A target past MAX_URL is refused at the annotation anyway; it is left out before it is copied.
-    let mut out: Vec<(Handle, String)> = o.links.iter().filter(|(_, u)| u.len() <= MAX_URL).take(MAX_LINKS).cloned().collect();
+    let mut out: Vec<(Handle, String)> = o.links.iter().take(MAX_LINKS).cloned().collect();
     if !o.hyperlinks {
         return out;
     }

crates/io/src/svg_read.rs

@@ -590,10 +590,7 @@ fn hidden(e: &BytesStart) -> bool {
 }
 
 fn attr(e: &BytesStart, name: &[u8]) -> Option<String> {
-    // Stop at the first malformed attribute: skipping errors resumed the parser's duplicate check,
-    // which rescans the attributes before it each time, so many duplicates were quadratic.
-    for a in e.attributes() {
-        let Ok(a) = a else { return None };
+    for a in e.attributes().flatten() {
         if a.key.into_inner().as_bytes() == name {
             return a.normalized_value(XmlVersion::Explicit1_0).ok().map(|v| v.into_owned());
         }

crates/io/src/tests.rs

@@ -396,16 +396,6 @@ fn many_distinct_symbol_names_read_quickly() {
     assert_eq!(d.text_style("ST0").map(|s| s.height), Some(2.0));
 }
 
-/// Elements with many duplicate attributes are read in bounded time.
-#[test]
-fn svg_duplicate_attributes_are_not_rescanned() {
-    let dup = " x=\"1\"".repeat(20_000);
-    let svg = format!("<svg xmlns=\"http://www.w3.org/2000/svg\">{}</svg>", format!("<rect{dup} width=\"1\" height=\"1\"/>").repeat(20));
-    let started = std::time::Instant::now();
-    let _ = read(svg.as_bytes(), "dup.svg");
-    assert!(started.elapsed() < std::time::Duration::from_secs(10), "took {:?}", started.elapsed());
-}
-
 #[test]
 fn hostile_dxf_does_not_panic() {
     for t in [

crates/mcp/Cargo.toml

@@ -21,6 +21,3 @@ getrandom = "0.4"
 [dev-dependencies]
 # Reads the pixels of rendered PNGs in the tests.
 tiny-skia = { workspace = true }
-[target.'cfg(unix)'.dependencies]
-# O_NOFOLLOW when reading the token file (MIT OR Apache-2.0).
-libc = "0.2"

crates/mcp/src/backend.rs

@@ -1,7 +1,7 @@
 //! Where MCP tool calls end up: a control-channel method call.
 
 use std::io::{BufRead, BufReader, Read, Write};
-use std::net::{Ipv4Addr, SocketAddr, TcpStream, ToSocketAddrs};
+use std::net::{TcpStream, ToSocketAddrs};
 use std::time::Duration;
 
 use cadcraft_engine::Session;
@@ -76,17 +76,9 @@ impl Remote {
     /// The per-session token for this port, read (and cached) from the owner-only token file. A
     /// missing file is not fatal here: the request is sent without a token and the server replies
     /// with an authentication error the user can act on.
-    ///
-    /// The desktop app listens only on `127.0.0.1:PORT`, so the token goes only to that exact
-    /// peer: a name that also resolves elsewhere (`localhost` → `::1`, where another local account
-    /// may listen on the same port) must not be handed the desktop's credential (CWE-522).
     fn token(&mut self) -> Option<&str> {
-        let port = port_of(&self.addr)?;
-        let peer = self.conn.as_ref().and_then(|(_, s)| s.peer_addr().ok());
-        if peer != Some(SocketAddr::from((Ipv4Addr::LOCALHOST, port))) {
-            return None;
-        }
         if self.token.is_none()
+            && let Some(port) = port_of(&self.addr)
             && let Ok(t) = crate::control_token::read(port)
         {
             self.token = Some(t);
@@ -215,14 +207,6 @@ fn is_read_only(method: &str) -> bool {
 
 impl Remote {
     /// Put the current token (if any) on `req`, replacing the one it carries.
-    /// Connect if needed, put the token for the peer actually connected to on `req`, and send it.
-    fn sign_and_send(&mut self, req: &mut Value) -> Result<String, (std::io::Error, bool)> {
-        if self.conn.is_none() {
-            self.reach().map_err(|e| (e, false))?;
-        }
-        self.set_token(req);
-        self.roundtrip(&req.to_string())
-    }
     fn set_token(&mut self, req: &mut Value) {
         let token = self.token().map(str::to_string);
         if let Some(obj) = req.as_object_mut() {
@@ -235,7 +219,7 @@ impl Remote {
     /// Send `req` and parse the reply, refreshing the token before a safe retry after a transport
     /// error. A mutation that may have reached the server is never resent automatically.
     fn exchange(&mut self, method: &str, req: &mut Value) -> Result<Value, String> {
-        let reply = match self.sign_and_send(req) {
+        let reply = match self.roundtrip(&req.to_string()) {
             Ok(r) => r,
             Err((e, sent)) => {
                 self.token = None;
@@ -248,7 +232,8 @@ impl Remote {
                     ));
                 }
                 // A restarted server may have rotated its token before dropping the old socket.
-                self.sign_and_send(req).map_err(|(e, _)| {
+                self.set_token(req);
+                self.roundtrip(&req.to_string()).map_err(|(e, _)| {
                     self.token = None;
                     self.conn = None;
                     format!("CADCraft at {}: {e}", self.addr)
@@ -271,12 +256,14 @@ impl Backend for Remote {
         let id = self.next_id;
         self.next_id += 1;
         let mut req = json!({"id": id, "method": method, "params": params});
+        self.set_token(&mut req);
         let mut v = self.exchange(method, &mut req)?;
         // The token is read before `--launch` opens the app, which then writes a new one (#2087); the
         // file can also be left over from an earlier session. Once, so a wrong token can't loop.
         if unauthorized(&v) && v.get("state").and_then(Value::as_str) == Some("not-run") {
             self.token = None;
             self.conn = None;
+            self.set_token(&mut req);
             v = self.exchange(method, &mut req)?;
         }
         if v.get("ok").and_then(Value::as_bool) == Some(true) {
@@ -608,24 +595,6 @@ mod tests {
         })
     }
 
-    /// A listener on another loopback address with the desktop's port (here `::1`) never receives
-    /// the desktop's token.
-    #[test]
-    fn token_is_not_sent_to_another_loopback_listener() {
-        let Ok(listener) = TcpListener::bind("[::1]:0") else { return };
-        let addr = listener.local_addr().unwrap();
-        crate::control_token::issue(addr.port()).unwrap();
-        let server = fake_app(listener, move |req, _| {
-            assert!(req.get("token").is_none(), "token leaked to {addr}");
-            json!({"ok": true, "result": "x"})
-        });
-        let mut remote = Remote::lazy(&addr.to_string(), false);
-        let got = remote.call("ping", json!({}));
-        crate::control_token::revoke(addr.port());
-        assert_eq!(got, Ok(json!("x")));
-        assert_eq!(server.join().unwrap(), 1);
-    }
-
     /// `--launch` reads the token before it opens the app, so the first request carries the token
     /// of an earlier session (or none); the app refuses it without running it, and the call is
     /// resent once with the token the app has just written (#2087).

crates/mcp/src/control_token.rs

@@ -32,9 +32,7 @@ fn private_dir() -> io::Result<PathBuf> {
     if let Some(h) = std::env::var_os("HOME").filter(|v| !v.is_empty()) {
         return Ok(PathBuf::from(h).join(".cache"));
     }
-    // The shared temporary directory would put the credential at a path any local account can
-    // predict and plant a link at: refuse instead.
-    Err(io::Error::new(io::ErrorKind::NotFound, "XDG_RUNTIME_DIR or HOME is required for a private control token"))
+    Ok(std::env::temp_dir())
 }
 
 /// Require the Windows per-user local app-data directory for session token storage.
@@ -77,31 +75,7 @@ fn issue_at(path: &std::path::Path, bytes: &[u8]) -> io::Result<()> {
 
 /// Read the token for `port`, trimming trailing whitespace. Used by clients (the MCP bridge).
 pub fn read(port: u16) -> io::Result<String> {
-    read_at(&token_path(port)?)
-}
-
-/// Read a token file the issuer wrote: not through a link, a plain file, and (Unix) readable by
-/// its owner only, so a file another account planted or left open is not taken as the credential.
-fn read_at(path: &std::path::Path) -> io::Result<String> {
-    use std::io::Read;
-    let mut options = std::fs::OpenOptions::new();
-    options.read(true);
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::OpenOptionsExt;
-        options.custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK);
-    }
-    let file = options.open(path)?;
-    let meta = file.metadata()?;
-    if !meta.is_file() {
-        return Err(io::Error::new(io::ErrorKind::InvalidData, "the control token is not a plain file"));
-    }
-    #[cfg(unix)]
-    if std::os::unix::fs::PermissionsExt::mode(&meta.permissions()) & 0o077 != 0 {
-        return Err(io::Error::new(io::ErrorKind::PermissionDenied, "the control token file is readable by other users"));
-    }
-    let mut raw = String::new();
-    file.take(1024).read_to_string(&mut raw)?;
+    let raw = std::fs::read_to_string(token_path(port)?)?;
     let token = raw.trim().to_string();
     if token.is_empty() {
         return Err(io::Error::new(io::ErrorKind::InvalidData, "empty control token"));
@@ -207,24 +181,6 @@ mod tests {
         assert_eq!(windows_private_dir(Some("private-app-data".into())).unwrap(), PathBuf::from("private-app-data"));
     }
 
-    /// A link, or a file other users can read, is not accepted as the token.
-    #[cfg(unix)]
-    #[test]
-    fn read_refuses_links_and_shared_files() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = std::env::temp_dir().join(format!("cadcraft-token-read-{}", std::process::id()));
-        std::fs::create_dir_all(&dir).unwrap();
-        let secret = dir.join("secret");
-        issue_at(&secret, b"abc").unwrap();
-        assert_eq!(read_at(&secret).unwrap(), "abc");
-        let link = dir.join("link");
-        std::os::unix::fs::symlink(&secret, &link).unwrap();
-        assert!(read_at(&link).is_err());
-        std::fs::set_permissions(&secret, std::fs::Permissions::from_mode(0o644)).unwrap();
-        assert!(read_at(&secret).is_err());
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
     /// Token issuance creates its missing directory hierarchy before writing the credential.
     #[test]
     fn issuance_creates_missing_parent() {

crates/render/src/hatch.rs

@@ -12,7 +12,7 @@ use super::{Builder, Ctx, Ink, fill, ink, max_scale};
 use cadcraft_color::{Color, Rgb};
 use cadcraft_doc::library::{PatternLine, pattern_for};
 use cadcraft_doc::{Drawing, Entity, Gradient, Hatch};
-use cadcraft_geom::{Bounds2, PolyVertex, Polyline, Vec2, point_in_polygon};
+use cadcraft_geom::{Bounds2, Polyline, Vec2, point_in_polygon};
 use std::sync::atomic::{AtomicBool, Ordering};
 
 /// Draw a hatch entity: `rgb` is its resolved colour, `tol` the chord tolerance.
@@ -130,15 +130,8 @@ const MAX_DEDUP_COMPARISONS: u64 = 50_000_000;
 pub fn fill_loops(h: &Hatch, tol: f64) -> Vec<Vec<Vec2>> {
     // One point budget for all the loops: many short arcs across loops must not add up unbounded.
     let mut budget = cadcraft_geom::MAX_TESSELLATED_POINTS;
-    // Source loops that are the same boundary up to start vertex and winding are tessellated once, so a
-    // duplicate cannot be sampled coarser than its twin by the shared budget and then escape `dedup_polygons`.
-    let mut seen = std::collections::HashSet::new();
-    let mut loops: Vec<Vec<Vec2>> = h
-        .loops
-        .iter()
-        .filter(|l| seen.insert(canonical_key(&l.vertices)))
-        .map(|l| Polyline { vertices: l.vertices.clone(), closed: true }.tessellate_within(tol, &mut budget))
-        .collect();
+    let mut loops: Vec<Vec<Vec2>> =
+        h.loops.iter().map(|l| Polyline { vertices: l.vertices.clone(), closed: true }.tessellate_within(tol, &mut budget)).collect();
     dedup_polygons(&mut loops);
     let max_depth = match h.style {
         1 => 1,
@@ -156,50 +149,6 @@ pub fn fill_loops(h: &Hatch, tol: f64) -> Vec<Vec<Vec2>> {
     loops.iter().enumerate().filter(|(i, l)| depth(*i, l) <= max_depth).map(|(_, l)| l.clone()).collect()
 }
 
-/// Start index of the least rotation of `s` (two-pointer scan, O(n)).
-fn least_rotation(s: &[[u64; 3]]) -> usize {
-    let n = s.len();
-    let (mut i, mut j, mut k) = (0, 1, 0);
-    while i < n && j < n && k < n {
-        let (a, b) = (s.get((i + k) % n), s.get((j + k) % n));
-        if a == b {
-            k += 1;
-            continue;
-        }
-        if a > b {
-            i += k + 1;
-        } else {
-            j += k + 1;
-        }
-        if i == j {
-            j += 1;
-        }
-        k = 0;
-    }
-    i.min(j)
-}
-
-/// A key equal for loops that are the same boundary starting at another vertex or wound the other way
-/// (reversing moves each bulge to the other end of its edge and negates it). Exact bits only; the
-/// tolerance-based `dedup_polygons` still catches near matches.
-fn canonical_key(v: &[PolyVertex]) -> Vec<[u64; 3]> {
-    let bits = |x: f64| (x + 0.0).to_bits(); // -0.0 and 0.0 match
-    let n = v.len();
-    let fwd: Vec<[u64; 3]> = v.iter().map(|q| [bits(q.p.x), bits(q.p.y), bits(q.bulge)]).collect();
-    let rev: Vec<[u64; 3]> = (0..n)
-        .map(|j| {
-            let i = n - 1 - j;
-            let edge = v.get((i + n - 1) % n).map_or(0.0, |q| -q.bulge);
-            v.get(i).map_or([0; 3], |q| [bits(q.p.x), bits(q.p.y), bits(edge)])
-        })
-        .collect();
-    let rotated = |s: &[[u64; 3]]| {
-        let k = least_rotation(s);
-        s.iter().cycle().skip(k).take(s.len()).copied().collect::<Vec<_>>()
-    };
-    rotated(&fwd).min(rotated(&rev))
-}
-
 /// A point of a loop to test its nesting with: the middle of its first non-degenerate edge
 /// (vertices may touch an enclosing loop; edge midpoints rarely do).
 fn probe(l: &[Vec2]) -> Option<Vec2> {
@@ -421,7 +370,6 @@ pub fn reads_solid(d: &Drawing, h: &Hatch, px: f64) -> bool {
 /// `px`: a pixel in the hatch's units for the level of detail (a dash or dot repeat under two
 /// pixels is one continuous run); 0 = full detail, as plots, exports and picks use. `view`: only
 /// the part of the hatch inside it is generated; `None` = all of it.
-#[cfg(test)]
 pub fn pattern_lines(d: &Drawing, h: &Hatch, loops: &[Vec<Vec2>], px: f64, view: Option<&Bounds2>) -> Vec<Vec<Vec2>> {
     pattern_lines_until(d, h, loops, px, view, None)
 }
@@ -435,21 +383,6 @@ pub(crate) fn pattern_lines_until(
     px: f64,
     view: Option<&Bounds2>,
     cancel: Option<&AtomicBool>,
-) -> Vec<Vec<Vec2>> {
-    pattern_lines_within(d, h, loops, px, view, cancel, MAX_RUNS, MAX_HATCH_WORK)
-}
-
-/// [`pattern_lines_until`] with the most runs and the dash-work allowance given.
-#[allow(clippy::too_many_arguments)]
-fn pattern_lines_within(
-    d: &Drawing,
-    h: &Hatch,
-    loops: &[Vec<Vec2>],
-    px: f64,
-    view: Option<&Bounds2>,
-    cancel: Option<&AtomicBool>,
-    max_runs: usize,
-    work_limit: u64,
 ) -> Vec<Vec<Vec2>> {
     let lines = lines_of(d, h);
     let scale = scale_of(h);
@@ -458,7 +391,7 @@ fn pattern_lines_within(
     // Shared work budget across all families and spans, counting dash-processing steps even when
     // they emit no geometry: gap-only families produce no runs, so `out.len()` alone cannot bound
     // their cost (CWE-400).
-    let mut work: u64 = work_limit;
+    let mut work: u64 = MAX_HATCH_WORK;
     for fam in &lines {
         // A family with dashes but no positive (ink) element can never draw: skip it so its gaps
         // are not swept at all.
@@ -473,8 +406,8 @@ fn pattern_lines_within(
             continue;
         }
         let dashes: Vec<f64> = fam.dashes.iter().map(|d| d * scale).collect();
-        Family { max_runs, origin, ang, delta, spacing, dashes: &dashes }.sweep(loops, px, view, cancel, &mut out, &mut work);
-        if out.len() >= max_runs || work == 0 || is_set(cancel) {
+        Family { origin, ang, delta, spacing, dashes: &dashes }.sweep(loops, px, view, cancel, &mut out, &mut work);
+        if out.len() >= MAX_RUNS || work == 0 || is_set(cancel) {
             break;
         }
     }
@@ -485,8 +418,6 @@ fn pattern_lines_within(
 const SWATCH_REPEATS: f64 = 6.0;
 /// Most runs a swatch holds.
 const MAX_SWATCH_RUNS: usize = 4000;
-/// The dash-work allowance of a swatch (a hatch's is [`MAX_HATCH_WORK`]).
-const MAX_SWATCH_WORK: u64 = 2_000_000;
 
 /// A preview of a pattern for a pattern picker: the runs of its line families `lines` inside the
 /// `side` × `side` square with a corner at the origin, at a scale that shows a few repeats of the
@@ -513,19 +444,14 @@ pub fn pattern_swatch(lines: &[PatternLine], side: f64) -> Vec<Vec<Vec2>> {
         pattern_lines: lines.to_vec(),
     };
     let square = vec![Vec2::new(0.0, 0.0), Vec2::new(side, 0.0), Vec2::new(side, side), Vec2::new(0.0, side)];
-    // The generator stops at the swatch's own limits, so a compact pattern is never made in full
-    // (about a million runs) to keep a few thousand.
-    let mut runs = pattern_lines_within(&Drawing::default(), &h, &[square], 0.0, None, None, MAX_SWATCH_RUNS, MAX_SWATCH_WORK);
+    let mut runs = pattern_lines(&Drawing::default(), &h, &[square], 0.0, None);
     runs.truncate(MAX_SWATCH_RUNS);
-    runs.shrink_to_fit();
     runs
 }
 
 /// One pattern line family, scaled and placed: parallel lines `spacing` apart through `origin`
 /// at angle `ang`, each shifted along itself by `delta`'s along-line part from the last.
 struct Family<'a> {
-    /// Most runs the hatch may hold in all ([`MAX_RUNS`], less for a swatch).
-    max_runs: usize,
     origin: Vec2,
     ang: f64,
     delta: Vec2,
@@ -564,13 +490,6 @@ impl Family<'_> {
 
     /// Intersect a pattern family with boundary loops, respecting view, output, cancellation, and shared dash-work limits.
     fn sweep(&self, loops: &[Vec<Vec2>], px: f64, view: Option<&Bounds2>, cancel: Option<&AtomicBool>, out: &mut Vec<Vec<Vec2>>, work: &mut u64) {
-        // Transforming the boundary is charged before it is done, at the scanline rate (one unit per 8 vertices).
-        let verts: u64 = loops.iter().map(|l| l.len() as u64).sum();
-        let transform_charge = verts / 8 + 1;
-        if transform_charge > *work {
-            return;
-        }
-        *work -= transform_charge;
         let local: Vec<Vec<Vec2>> = loops.iter().map(|l| l.iter().map(|p| self.to_local(*p)).collect()).collect();
         let bb = Bounds2::from_points(local.iter().flatten().copied());
         if bb.is_empty() {
@@ -589,17 +508,10 @@ impl Family<'_> {
         // family draws anything at all).
         let draws = self.dashes.iter().any(|d| *d >= 0.0);
         let solid_line = self.dashes.is_empty() || pat_len < 1e-12 || (px > 0.0 && pat_len < 2.0 * px && draws);
-        // Each scanline visits every boundary edge and sorts the intersections. Charge both the
-        // traversal and an n*ceil(log2(n)) upper bound for sorting, scaled to one unit per eight
-        // operations, whether or not any dash is made.
-        let edges: u64 = local.iter().map(|l| l.len() as u64).sum();
-        let sort_levels = if edges > 1 { (u64::BITS - (edges - 1).leading_zeros()) as u64 } else { 0 };
-        let crossings_charge = edges.saturating_add(edges.saturating_mul(sort_levels)) / 8 + 1;
         for k in k0..=k1 {
-            if out.len() >= self.max_runs || crossings_charge > *work || is_set(cancel) {
+            if out.len() >= MAX_RUNS || *work == 0 || is_set(cancel) {
                 return;
             }
-            *work -= crossings_charge;
             let y = k as f64 * self.spacing;
             let xs = crossings(&local, y);
             let offset = shift_per_line * k as f64;
@@ -629,10 +541,10 @@ impl Family<'_> {
         'outer: while x < x1 {
             for d in self.dashes {
                 guard += 1;
-                if guard > 100_000 || out.len() >= self.max_runs || *work == 0 {
+                *work = work.saturating_sub(1);
+                if guard > 100_000 || out.len() >= MAX_RUNS || *work == 0 {
                     break 'outer;
                 }
-                *work -= 1;
                 let len = d.abs();
                 if *d > 0.0 {
                     let a = x.max(x0);

crates/render/src/linetype_text.rs

@@ -29,17 +29,11 @@ const MAX_TEXTS: usize = 10_000;
 /// repeated many times).
 const MAX_POINTS: usize = 2_000_000;
 
-/// Upper bound on the points of all the texts of one run: each placement keeps its own copy of the
-/// label's outline, so a long label times [`MAX_TEXTS`] would otherwise be too much to hold.
-const MAX_TEXT_POINTS: usize = 4_000_000;
-
 /// One text or shape element of the pattern, shaped once at the origin.
 struct Element {
     /// Distance from the start of a pattern repeat to the anchor (where the element ends).
     at: f64,
     local: Shaped,
-    /// Points in `local`, each placement's cost against [`MAX_TEXT_POINTS`].
-    points: usize,
     rotation: f64,
     absolute: bool,
     offset: Vec2,
@@ -64,7 +58,6 @@ pub fn texts(d: &Drawing, pts: &[Vec2], lt: &Linetype, scale: f64, min_pattern:
         return out;
     }
     let mut walk = Walk { pts, i: 0, start: 0.0 };
-    let mut points_left = MAX_TEXT_POINTS;
     let mut base = 0.0;
     let mut points = 0usize;
     'repeats: while base <= len {
@@ -74,8 +67,6 @@ pub fn texts(d: &Drawing, pts: &[Vec2], lt: &Linetype, scale: f64, min_pattern:
             if s > len + 1e-9 || out.len() >= MAX_TEXTS || points > MAX_POINTS {
                 break 'repeats;
             }
-            let Some(left) = points_left.checked_sub(el.points) else { break 'repeats };
-            points_left = left;
             let Some((p, dir)) = walk.at(s) else { break 'repeats };
             let origin = p + dir * el.offset.x + dir.perp() * el.offset.y;
             let rot = if el.absolute { el.rotation } else { dir.angle() + el.rotation };
@@ -120,7 +111,6 @@ fn elements(d: &Drawing, lt: &Linetype, scale: f64) -> Vec<Element> {
         {
             out.push(Element {
                 at,
-                points: point_count(&local),
                 local,
                 rotation: finite(el.rotation),
                 absolute: el.absolute,
@@ -145,16 +135,8 @@ fn elements(d: &Drawing, lt: &Linetype, scale: f64) -> Vec<Element> {
             ..TextParams::new(Vec2::ZERO, height)
         };
         let (local, _) = cadcraft_fonts::place(&font, text, &params);
-        // Points plus one per stroke and glyph slot, and one for the label itself, so a label of empty
-        // glyphs still has a cost proportional to its size.
-        let points = local.strokes.iter().map(Vec::len).sum::<usize>()
-            + local.glyphs.iter().flatten().map(Vec::len).sum::<usize>()
-            + local.strokes.len()
-            + local.glyphs.len()
-            + 1;
         out.push(Element {
             at,
-            points,
             local,
             rotation: finite(el.rotation),
             absolute: el.absolute,
@@ -235,20 +217,6 @@ mod tests {
         assert!(texts(&d, &[Vec2::ZERO, Vec2::new(2.0, 0.0)], &plain, 1.0, 0.0).is_empty());
     }
 
-    /// A long label repeated along a long run stops at the point allowance, well before MAX_TEXTS.
-    #[test]
-    fn placed_labels_stop_at_the_point_allowance() {
-        let d = Drawing::new_imperial();
-        let mut lt = gas();
-        lt.pattern[1].text = Some("MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM".into());
-        // 0.95 per repeat over 9,000: about 9,500 repeats, under the 50,000 the run is drawn for.
-        let t = texts(&d, &[Vec2::ZERO, Vec2::new(9_000.0, 0.0)], &lt, 1.0, 0.0);
-        let points: usize =
-            t.iter().map(|s| s.strokes.iter().map(Vec::len).sum::<usize>() + s.glyphs.iter().flatten().map(Vec::len).sum::<usize>()).sum();
-        assert!(!t.is_empty() && t.len() < MAX_TEXTS, "{}", t.len());
-        assert!(points <= MAX_TEXT_POINTS, "{points}");
-    }
-
     /// A shape file written for this test: shape 130 a 2 x 2 box with its pen ending at x = 2.
     fn register_shapes() {
         let src = "*130,7,BOX\n1,020,024,028,02C,2,020,0\n";

crates/render/src/table.rs

@@ -133,20 +133,6 @@ pub fn table_geometry(d: &Drawing, t: &Table) -> TableGeom {
     if parts.len() <= 1 {
         return layout(d, t);
     }
-    // Every part is laid out and kept, so the cells of all of them count together (a header repeated
-    // on each part adds to each); past the limit only the table's outline is drawn.
-    let cols = t.col_widths.len().min(10_000);
-    let total: usize = parts.iter().map(|p| p.rows.len().min(10_000).saturating_mul(cols)).fold(0, usize::saturating_add);
-    if total > MAX_LAYOUT_CELLS {
-        // One outline per part, at the part's origin and as tall as its displayed rows.
-        let w = edges(&t.col_widths, cols).last().copied().unwrap_or(0.0);
-        let mut g = TableGeom::default();
-        for p in parts {
-            let h: f64 = p.rows.iter().take(10_000).map(|r| t.row_heights.get(*r).copied().filter(|v| v.is_finite()).unwrap_or(0.0)).sum();
-            outline_box(&mut g, p.origin, w, h);
-        }
-        return g;
-    }
     let mut g = TableGeom::default();
     for p in parts {
         let mut pg = layout(d, &part_table(t, &p.rows, p.origin));
@@ -170,20 +156,16 @@ fn part_table(t: &Table, rows: &[usize], origin: Vec2) -> Table {
     // Otherwise `layout` renders an outline, so materialising millions of empty cells here would be
     // wasted work an attacker can trigger with a compact dimension array (CWE-789).
     if rows.len().min(10_000).saturating_mul(cols) <= MAX_LAYOUT_CELLS {
-        // `run[i]`: how many rows from part row `i` follow one another in the table, found once so a
-        // merge is cut by a lookup, not by walking the rows it spans.
-        let mut run = vec![1u32; rows.len()];
-        for i in (0..rows.len().saturating_sub(1)).rev() {
-            if rows.get(i + 1).zip(rows.get(i)).is_some_and(|(next, this)| *next == this + 1) {
-                run[i] = run.get(i + 1).copied().unwrap_or(0).saturating_add(1);
-            }
-        }
         for (i, row) in cells.iter_mut().enumerate() {
             row.resize_with(cols, Default::default);
             for cell in row.iter_mut() {
                 if let Some((rs, cs)) = cell.merged {
                     // Rows of the merge that follow in this part.
-                    let n = rs.max(1).min(run.get(i).copied().unwrap_or(1));
+                    let start = rows.get(i).copied().unwrap_or(0);
+                    let mut n = 1u32;
+                    while n < rs && rows.get(i + n as usize).is_some_and(|r| *r == start + n as usize) {
+                        n += 1;
+                    }
                     cell.merged = (n > 1 || cs > 1).then_some((n, cs));
                 }
             }
@@ -204,27 +186,6 @@ fn part_table(t: &Table, rows: &[usize], origin: Vec2) -> Table {
     }
 }
 
-/// The table's outline alone, for a table too large to lay out.
-fn outline(t: &Table) -> TableGeom {
-    let rows = t.row_heights.len().min(10_000);
-    let cols = t.col_widths.len().min(10_000);
-    let (w, h) = (edges(&t.col_widths, cols).last().copied().unwrap_or(0.0), edges(&t.row_heights, rows).last().copied().unwrap_or(0.0));
-    let mut g = TableGeom::default();
-    outline_box(&mut g, t.insert.xy(), w, h);
-    g
-}
-
-/// The four sides of a `w` by `h` box hanging down from `o`.
-fn outline_box(g: &mut TableGeom, o: Vec2, w: f64, h: f64) {
-    let p = |x: f64, y: f64| o + Vec2::new(x, -y);
-    let corners = [p(0.0, 0.0), p(w, 0.0), p(w, h), p(0.0, h), p(0.0, 0.0)];
-    for s in corners.windows(2) {
-        if let [a, b] = s {
-            g.lines.push(TableLine { a: *a, b: *b, color: Color::ByBlock, lineweight: Lineweight::ByBlock });
-        }
-    }
-}
-
 /// Lay out one part.
 fn layout(d: &Drawing, t: &Table) -> TableGeom {
     let st = table_style_of(d, t);
@@ -242,7 +203,14 @@ fn layout(d: &Drawing, t: &Table) -> TableGeom {
     }
     let cov = coverage(t);
     if rows.saturating_mul(cols) > MAX_LAYOUT_CELLS || cov.is_err() {
-        return outline(t);
+        let (w, h) = (x_at(cols), y_at(rows));
+        let corners = [p(0.0, 0.0), p(w, 0.0), p(w, h), p(0.0, h), p(0.0, 0.0)];
+        for s in corners.windows(2) {
+            if let [a, b] = s {
+                g.lines.push(TableLine { a: *a, b: *b, color: Color::ByBlock, lineweight: Lineweight::ByBlock });
+            }
+        }
+        return g;
     }
     let k = style_scale(&st, t);
     // Cell styles by name, scaled to the table.

crates/render/src/tests.rs

@@ -1165,55 +1165,3 @@ fn without_linetypes_every_line_is_drawn_whole() {
     let drawn = build(&drawing("DASHED"), &Space::Model, &Options::default());
     assert!(drawn.prims.len() > 2 * continuous.prims.len(), "drawn with its linetype: {} primitives", drawn.prims.len());
 }
-
-/// A broken table whose parts, with their repeated labels, together hold more cells than a table may
-/// lay out is drawn as its outline, though the table's own cells are within the limit.
-#[test]
-fn broken_table_cells_count_across_its_parts() {
-    let d = Drawing::new_imperial();
-    let t = cadcraft_doc::Table {
-        col_widths: vec![1.0; 600],
-        row_heights: vec![1.0; 1000],
-        title: true,
-        header: true,
-        breaks: Some(cadcraft_doc::TableBreak { enabled: true, height: 3.0, ..Default::default() }),
-        ..Default::default()
-    };
-    assert!(t.parts().len() > 500 && 1000 * 600 <= crate::MAX_LAYOUT_CELLS);
-    let g = crate::table_geometry(&d, &t);
-    let parts = t.parts();
-    assert_eq!((g.lines.len(), g.texts.len(), g.fills.len()), (4 * parts.len(), 0, 0));
-    // Each part's box starts at its own origin.
-    let top = |i: usize| g.lines[4 * i].a;
-    assert!((0..parts.len()).all(|i| top(i) == parts[i].origin));
-}
-
-#[test]
-fn rotated_and_reversed_copies_of_a_curved_loop_fill_once() {
-    let ring = |rot: usize, rev: bool| {
-        let mut v: Vec<PolyVertex> = [(0.0, 0.0, 0.5), (4.0, 0.0, -0.25), (4.0, 3.0, 0.0), (0.0, 3.0, 0.1)]
-            .map(|(x, y, bulge)| PolyVertex { bulge, ..PolyVertex::new(Vec2::new(x, y)) })
-            .to_vec();
-        if rev {
-            // The same boundary wound the other way: bulges move to the other end of their edge and flip.
-            let b: Vec<f64> = v.iter().map(|q| q.bulge).collect();
-            v.reverse();
-            let n = v.len();
-            for (j, q) in v.iter_mut().enumerate() {
-                q.bulge = -b[(n - 1 - j + n - 1) % n];
-            }
-        }
-        v.rotate_left(rot);
-        HatchLoop { vertices: v, outer: true, sources: Vec::new() }
-    };
-    let mut h = pattern_hatch("SOLID", 1.0, (0.0, 0.0, 1.0, 1.0));
-    h.loops = vec![ring(0, false), ring(2, false), ring(1, true), ring(3, true)];
-    assert_eq!(loops_of(&h).len(), 1);
-    // A different boundary is kept.
-    h.loops.push(HatchLoop {
-        vertices: ring(0, false).vertices.into_iter().map(|q| PolyVertex { bulge: 0.0, ..q }).collect(),
-        outer: true,
-        sources: Vec::new(),
-    });
-    assert_eq!(loops_of(&h).len(), 2);
-}

crates/render/tests/it/hatch_fill.rs

@@ -211,14 +211,3 @@ fn brick_joints_are_drawn_once_half_a_brick_apart_course_to_course() {
         assert!(next.iter().all(|nx| (nx - x[0]).rem_euclid(500) == 250), "courses {course}/{}: {x:?} {next:?}", course + 1);
     }
 }
-
-/// A pattern with a huge number of tiny dashes makes a swatch of a few thousand runs, stopping
-/// there; and many scanlines over a many-edged boundary are charged to the hatch's work allowance.
-#[test]
-fn compact_patterns_stop_at_the_swatch_limits() {
-    let lines = vec![PatternLine { angle: 0.0, origin: (0.0, 0.0), delta: (0.0, 1.0), dashes: vec![1e-6, -1e-6] }];
-    let started = std::time::Instant::now();
-    let runs = cadcraft_render::pattern_swatch(&lines, 1.0);
-    assert!(!runs.is_empty() && runs.len() <= 4000, "{}", runs.len());
-    assert!(started.elapsed() < std::time::Duration::from_secs(20));
-}

crates/ui-egui/src/i18n/tests.rs

@@ -161,25 +161,13 @@ fn missing_marked_ui_literals(language: &str) -> BTreeSet<String> {
 
 /// Every `.rs` file under `dir`, at any depth, so code split into submodules stays scanned.
 fn module_files(dir: &std::path::Path, files: &mut Vec<std::path::PathBuf>) {
-    if !std::fs::symlink_metadata(dir).is_ok_and(|metadata| metadata.file_type().is_dir()) {
-        return;
-    }
     let Ok(entries) = std::fs::read_dir(dir) else { return };
-    // `file_type` doesn't follow links, so a symlink (a directory alias or a file) is skipped,
-    // not walked again as a new subtree.
-    // An unreadable entry must fail the scan, not silently shrink the translation report.
-    let mut paths: Vec<_> = entries
-        .map(|e| {
-            let e = e.expect("read module directory entry");
-            let kind = e.file_type().expect("read module entry type");
-            (e.path(), kind)
-        })
-        .collect();
-    paths.sort_by(|a, b| a.0.cmp(&b.0));
-    for (path, kind) in paths {
-        if kind.is_dir() {
+    let mut paths: Vec<_> = entries.flatten().map(|e| e.path()).collect();
+    paths.sort();
+    for path in paths {
+        if path.is_dir() {
             module_files(&path, files);
-        } else if kind.is_file() && path.extension().is_some_and(|x| x == "rs") {
+        } else if path.extension().is_some_and(|x| x == "rs") {
             files.push(path);
         }
     }

crates/ui-egui/src/managers.rs

@@ -309,7 +309,7 @@ fn point_style(app: &mut CadApp, ctx: &egui::Context, open: &mut bool) -> Action
 enum Field {
     Num(&'static str, &'static str, f64),
     Bool(&'static str, &'static str, bool),
-    Choice(&'static str, &'static str, String, std::sync::Arc<[String]>),
+    Choice(&'static str, &'static str, String, Vec<String>),
 }
 
 struct Style {
@@ -374,8 +374,7 @@ fn mleader_style(app: &mut CadApp, ctx: &egui::Context, open: &mut bool) -> Acti
         no_drawing(ctx, "Multileader Style", open);
         return None;
     };
-    // One list shared by every row: a copy per style multiplied the two counts.
-    let text_styles: std::sync::Arc<[String]> = d.text_styles.iter().map(|s| s.name.clone()).collect();
+    let text_styles: Vec<String> = d.text_styles.iter().map(|s| s.name.clone()).collect();
     let mut styles: Vec<Style> = d
         .mleader_styles
         .iter()
@@ -386,7 +385,7 @@ fn mleader_style(app: &mut CadApp, ctx: &egui::Context, open: &mut bool) -> Acti
                 Field::Num("textHeight", "Text height", s.text_height),
                 Field::Num("landingGap", "Landing gap", s.landing_gap),
                 Field::Num("dogleg", "Landing length", s.dogleg),
-                Field::Choice("textStyle", "Text style", s.text_style.clone(), std::sync::Arc::clone(&text_styles)),
+                Field::Choice("textStyle", "Text style", s.text_style.clone(), text_styles.clone()),
             ],
         })
         .collect();
@@ -455,7 +454,7 @@ fn style_manager(ctx: &egui::Context, open: &mut bool, title: &str, cmd: &'stati
                             ui.label(*label);
                             let mut picked = None;
                             craft_ui::ComboBox::from_id_salt((cmd, *key)).selected_text(v.as_str()).show_ui(ui, |ui| {
-                                for c in choices.iter() {
+                                for c in choices {
                                     if ui.selectable_label(c == v, c).clicked() && c != v {
                                         picked = Some(c.clone());
                                     }

crates/ui-egui/src/xrefs.rs

@@ -197,7 +197,7 @@ pub fn section(app: &mut CadApp, ui: &mut egui::Ui) {
 fn details(ui: &mut egui::Ui, r: &Row, path_id: egui::Id, act: &mut Option<Act>) {
     let name = r.name.clone();
     let loaded = r.status == "Loaded" || r.status == "Unreferenced";
-    let op = |option: &str| json!({ "option": option, "names": name, "exact": true });
+    let op = |option: &str| json!({ "option": option, "names": name });
     ui.horizontal_wrapped(|ui| {
         ui.add_space(8.0);
         if ui.button(crate::tl!("Reload")).clicked() {
@@ -221,7 +221,7 @@ fn details(ui: &mut egui::Ui, r: &Row, path_id: egui::Id, act: &mut Option<Act>)
             .on_hover_text(crate::tl!("Make it a block of this drawing, keeping its layer names"))
             .clicked()
         {
-            *act = Some(Act::Run("-xref", json!({ "option": "bind", "names": name, "exact": true, "insert": true })));
+            *act = Some(Act::Run("-xref", json!({ "option": "bind", "names": name, "insert": true })));
         }
         if ui.add_enabled(r.status != "Not Found", egui::Button::new(crate::tl!("Open"))).clicked() {
             *act = Some(Act::Run("xopen", json!({ "name": name })));
@@ -235,7 +235,7 @@ fn details(ui: &mut egui::Ui, r: &Row, path_id: egui::Id, act: &mut Option<Act>)
         let a = ui.radio_value(&mut overlay, false, crate::tl!("Attach")).clicked();
         let o = ui.radio_value(&mut overlay, true, crate::tl!("Overlay")).clicked();
         if (a || o) && overlay != r.overlay {
-            *act = Some(Act::Run("-xref", json!({ "option": "type", "names": name, "exact": true, "overlay": overlay })));
+            *act = Some(Act::Run("-xref", json!({ "option": "type", "names": name, "overlay": overlay })));
         }
     });
     ui.add_space(4.0);
@@ -248,7 +248,7 @@ fn details(ui: &mut egui::Ui, r: &Row, path_id: egui::Id, act: &mut Option<Act>)
         let apply = ui.add_enabled(!text.trim().is_empty() && text != r.path, egui::Button::new(crate::tl!("Apply"))).clicked()
             || (edit.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) && text != r.path);
         if apply {
-            *act = Some(Act::Run("-xref", json!({ "option": "path", "names": name, "exact": true, "path": text.trim() })));
+            *act = Some(Act::Run("-xref", json!({ "option": "path", "names": name, "path": text.trim() })));
             ui.data_mut(|d| d.remove::<String>(path_id));
         } else if text != r.path {
             ui.data_mut(|d| d.insert_temp(path_id, text));

crates/ui-egui/tests/flatpak_updates.rs

@@ -1,27 +0,0 @@
-//! Release and source Flatpaks must allow release checks and host update helpers.
-fn finish_args(manifest: &str) -> Vec<&str> {
-    manifest
-        .split("finish-args:")
-        .nth(1)
-        .unwrap_or_default()
-        .lines()
-        .take_while(|line| line.is_empty() || line.starts_with(' ') || line.starts_with('#'))
-        .filter_map(|line| line.trim().strip_prefix("- "))
-        .map(|arg| arg.trim_matches(['\'', '"']))
-        .collect()
-}
-
-#[test]
-fn flatpak_update_permissions() {
-    let manifests = [
-        include_str!("../../../packaging/linux/flatpak/ai.storyteller.cadcraft.bundle.yml"),
-        include_str!("../../../packaging/linux/flatpak/ai.storyteller.cadcraft.yml"),
-    ];
-    let args = manifests.map(finish_args);
-    assert_eq!(args[0], args[1], "source and release permissions must agree");
-    for permissions in args {
-        for required in ["--share=network", "--talk-name=org.freedesktop.Flatpak"] {
-            assert!(permissions.contains(&required), "missing update permission: {required}");
-        }
-    }
-}

packaging/linux/flatpak/ai.storyteller.cadcraft.bundle.yml

@@ -17,8 +17,6 @@ runtime-version: '26.08'
 sdk: org.freedesktop.Sdk
 command: cadcraft
 finish-args:
-  # The shared updater inspects and updates this installation via flatpak-spawn --host.
-  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland

packaging/linux/flatpak/ai.storyteller.cadcraft.yml

@@ -18,8 +18,6 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: cadcraft
 finish-args:
-  # The shared updater inspects and updates this installation via flatpak-spawn --host.
-  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland

xtask/src/stats.rs

@@ -136,18 +136,6 @@ pub fn run(_root: &Path, exact: bool) -> Result<(), String> {
 mod tests {
     use super::{Counts, count_tests};
 
-    /// A new private directory in the temp folder. It is created, never reused: an existing path
-    /// (planted by another user, or a symlink) makes the test fail instead of redirecting its writes.
-    fn fresh_dir(tag: &str) -> std::path::PathBuf {
-        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_nanos());
-        let p = std::env::temp_dir().join(format!("cadcraft-{tag}-{}-{nanos}", std::process::id()));
-        let mut b = std::fs::DirBuilder::new();
-        #[cfg(unix)]
-        std::os::unix::fs::DirBuilderExt::mode(&mut b, 0o700);
-        b.create(&p).unwrap();
-        p
-    }
-
     #[test]
     fn counts_attributes_and_proptest_blocks() {
         let src = "#[test]\nfn a() {}\n// #[test] commented\n    #[test]\nfn b() {}\nproptest! {\n}\n";
@@ -159,7 +147,8 @@ mod tests {
     #[test]
     fn walk_does_not_follow_directory_symlinks() {
         use std::os::unix::fs::symlink;
-        let base = fresh_dir("xtask");
+        let base = std::env::temp_dir().join(format!("cadcraft-xtask-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
         let real = base.join("real");
         std::fs::create_dir_all(&real).unwrap();
         std::fs::write(real.join("a.rs"), "fn a() {}\n").unwrap();
@@ -173,7 +162,8 @@ mod tests {
     /// Traversal reports an exhausted entry budget and accepts a tree that exactly fits it.
     #[test]
     fn walk_reports_budget_exhaustion() {
-        let base = fresh_dir("stats-budget");
+        let base = std::env::temp_dir().join(format!("cadcraft-stats-budget-{}", std::process::id()));
+        std::fs::create_dir_all(&base).unwrap();
         std::fs::write(base.join("a.rs"), "fn a() {}\n").unwrap();
         let error = super::walk_inner(&base, &mut Counts::default(), &mut 0).unwrap_err();
         assert!(error.contains("budget exhausted"));