Merge remote-tracking branch 'origin/main' into fix2709

# Conflicts:
#	crates/io/src/tests.rs

.config/nextest.toml

@@ -0,0 +1,3 @@
+# Minimum cargo-nextest for this repository: GHSA-vc25-qg58-w57c is fixed in 0.9.150 and CI
+# installs exactly that version, so an older nextest refuses to run (exit 92 REQUIRED_VERSION_NOT_MET).
+nextest-version = "0.9.150"

.github/workflows/ast-grep.yml

@@ -0,0 +1,26 @@
+# Structural rules for the command-line code (RFC-0012): lint/ast-grep's rule tests, then a scan.
+# Seconds, no Rust build.
+name: ast-grep
+
+on:
+  push:
+    branches: [main]
+    paths: ["lint/ast-grep/**", "apps/cadcraft-cli/src/**", "apps/cadcraft/src/launch_args.rs", "apps/cadcraft/src/main.rs", ".github/workflows/ast-grep.yml"]
+  pull_request:
+    paths: ["lint/ast-grep/**", "apps/cadcraft-cli/src/**", "apps/cadcraft/src/launch_args.rs", "apps/cadcraft/src/main.rs", ".github/workflows/ast-grep.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ast-grep-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    # Tracked at @main like the other shared workflows.
+    uses: storytold/craft-common-actions/.github/workflows/ast-grep.yml@main
+    with:
+      config: lint/ast-grep/sgconfig.yml
+      paths: apps/cadcraft-cli/src apps/cadcraft/src/launch_args.rs apps/cadcraft/src/main.rs

.github/workflows/packaging-lint.yml

@@ -21,3 +21,27 @@ jobs:
   lint:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
+
+  windows-install-policy:
+    timeout-minutes: 10
+    name: Windows installation policy (no app build)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install the pinned packaging toolchain
+        shell: pwsh
+        run: |
+          $tools = Join-Path $env:RUNNER_TEMP 'craft-install-policy-wix'
+          dotnet tool install --tool-path $tools wix --version 5.0.2
+          if ($LASTEXITCODE -ne 0) { throw 'WiX installation failed.' }
+          $tools >> $env:GITHUB_PATH
+          $policy = Get-Content -Raw -LiteralPath packaging/windows/install-policy.json | ConvertFrom-Json
+          foreach ($extension in @($policy.extensions)) {
+            & (Join-Path $tools 'wix.exe') extension add -g "WixToolset.$extension.wixext/5.0.2"
+            if ($LASTEXITCODE -ne 0) { throw "WiX extension $extension installation failed." }
+          }
+      - name: Build and check non-executable installer fixtures
+        shell: pwsh
+        run: ./packaging/windows/test-install-policy.ps1 -OutputDirectory (Join-Path $env:RUNNER_TEMP 'craft-install-policy-tests')

.github/workflows/release.yml

@@ -62,6 +62,7 @@ jobs:
     permissions:
       # The reusable release workflow tags and uploads the draft release.
       contents: write
+      packages: write
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:

.github/workflows/windows-arm64.yml

@@ -30,3 +30,5 @@ jobs:
     with:
       app-name: cadcraft
       app-dir: CADCraft
+      install-relative-path: Programs/ArtCraft/CADCraft
+      install-scope: perUser

AGENTS.md

@@ -2,8 +2,6 @@
 
 CADCraft is a clean-room, open-source, pure-Rust computer-aided design and drafting application targeting Autodesk AutoCAD parity — and superiority (speed, openness, agent control). It runs natively on macOS, Windows, Linux and FreeBSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop-class), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).
 
-Standards and learnings shared across the crafting apps live in `../../craftrules` (or `storytold/craftrules`). Read its `AGENTS.md` at the start of a session, follow its standards, and contribute reusable learnings back there. Never code: repos don't share code.
-
 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. Behaviour reference: `plan/autocad/*` (`01-observed-ui.md` holds measured observations of the running reference app; `04-menu-tree.txt` the menu tree by name).
 2. Library decisions: `plan/adr/0001-geometry-libraries.md` (what we may depend on, what is rejected for licence reasons).
@@ -12,14 +10,14 @@ Standards and learnings shared across the crafting apps live in `../../craftrule
 `plan/` is gitignored (local only).
 
 ## Never crash
-People trust CADCraft with their drawings; a crash loses their work. **This outranks feature work.** Standard: [`craftrules/standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
+People trust CADCraft with their drawings; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or reports "not available yet"; it never panics.
 - **Input-derived numbers are hostile** (DXF/DWG files, command-line text, MCP/control params): `get()` not `[i]`, checked arithmetic, no NaN casts, cap input-sized allocations and loop counts.
 - **Bound recursion** (nested/cyclic block references: `MAX_BLOCK_DEPTH`).
-- **Last-resort guard:** `Session::execute` and every step of an interactive command (its factory, `begin`, input, `prompt` and `preview`; `crates/engine/src/guard.rs`) run under `catch_unwind`; an escaped panic restores the drawing and reports an error.
-- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`, `hostile_dxf_does_not_panic`).
-- Every production crate root carries `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
+- **Last-resort guard:** `Session::execute` and every step of an interactive command (its factory, `begin`, input, `prompt`, `preview` and the passes after it; `crates/engine/src/guard.rs`) run under `catch_unwind`; an escaped panic restores the drawing and reports an error. It does nothing on wasm, where a panic aborts.
+- **Prove it:** every crash fix lands with a regression test (see `crates/engine/tests/panic_hunt.rs` and `hostile_dxf_does_not_panic` in `crates/io/src/tests.rs`).
+- Every workspace crate manifest carries `[lints] workspace = true` to inherit `[workspace.lints]`; every production crate root carries `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
 
 ## Non-negotiables
 - **Clean-room.** AutoCAD is installed on the dev machine and may be *observed* black-box: run it, use its UI with synthetic drawings, take screenshots (by window id) stored only under `plan/autocad/screenshots/` (never committed). **Never** read, disassemble or copy anything inside the AutoCAD bundle (names/listings only); never copy Autodesk fonts (SHX), hatch patterns (`.pat`), linetypes (`.lin`), templates, CUI/PGP files, icons, artwork or help text; never commit files produced by AutoCAD. File formats come from public specifications (Autodesk's published DXF Reference, the Open Design Alliance's public DWG specification) and our own synthetic tests. Never copy or link GPL/LGPL/AGPL code (LibreDWG, LibreCAD, QCAD, FreeCAD's planegcs, SolveSpace, OpenCASCADE) — don't even read their sources.
@@ -47,22 +45,24 @@ People trust CADCraft with their drawings; a crash loses their work. **This outr
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).
 
 ## Roadmap
-`ROADMAP.md` (committed) is the one-page summary: stage, parity numbers, estimates. It follows craftrules' `standards/progress-docs.md`: the assessment is `docs/target-app-parity.md`, the work list `docs/gaps.md` (pick work from its top rows), milestones `docs/roadmap.md`, deep checklists `docs/geometry-parity.md`, `docs/ui-parity.md`, `docs/file-format-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the affected rows and the docs' status lines and revision history. `cargo xtask parity` regenerates the menu-breadth checklist in `docs/parity-checklist.md`.
+`ROADMAP.md` (committed) is the one-page summary: stage, parity numbers, estimates. The assessment is `docs/target-app-parity.md`, the work list `docs/gaps.md` (pick work from its top rows), milestones `docs/roadmap.md`, deep checklists `docs/geometry-parity.md`, `docs/ui-parity.md`, `docs/file-format-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. PRs don't edit these docs: name the affected rows in the PR description, and maintainers update the rows, status lines and revision history in batches, which keeps open PRs from conflicting. `cargo xtask parity` regenerates the menu-breadth checklist in `docs/parity-checklist.md`.
 
 ## Contributor credits (About window)
 
 - About ▸ Contributors/Models are compiled into the binary from `contributors/contributors.json`
-  (commit stats; generated, never hand-edit) and `contributors/people.toml` (names people chose for
+  (commit stats; never hand-edit) and `contributors/people.toml` (names people chose for
   themselves). See `docs/contributors.md`.
 - **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
   username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
   whether they want to be credited by more than their username: a real name, a display name, and/or
   their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
-  (copy the template at the top of the file, or run
-  `python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "…" --sync-github-name`)
+  (copy the template at the top of the file)
   and include it in their PR, committed as them. If no, change nothing: they are credited as
   `@username` anyway.
 - Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
   GitHub profiles). Never hand-edit `contributors.json`.
-- Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
-  re-verifies who wrote each `people.toml` entry; `--check` only verifies).
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.

ATTRIBUTION.md

@@ -48,14 +48,14 @@ Generated-in-code assets are original and have no file to list:
 | `docs/images/ui-apartment.png` | CADCraft contributors | screenshot of CADCraft itself (examples/apartment.dxf) | MIT OR Apache-2.0 | Original; no Autodesk UI |
 | `docs/images/ui-layout.png` | CADCraft contributors | screenshot of CADCraft itself (a layout of examples/apartment.dxf) | MIT OR Apache-2.0 | Original; no Autodesk UI |
 | `docs/images/ui-bracket.png` | CADCraft contributors | screenshot of CADCraft itself (sample drawing generated in code) | MIT OR Apache-2.0 | Original; no Autodesk UI |
-| `docs/brand/artcraft-logo-white.png` | ArtCraft Team | storytold/craftrules `assets/brand/` | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
-| `docs/brand/artcraft-logo-white.svg` | ArtCraft Team | storytold/craftrules `assets/brand/` | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
-| `docs/brand/artcraft-logo.png` | ArtCraft Team | storytold/craftrules `assets/brand/` | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
-| `docs/brand/artcraft-logo.svg` | ArtCraft Team | storytold/craftrules `assets/brand/` | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
-| `docs/brand/artcraft-mark-black.png` | ArtCraft Team | storytold/craftrules `assets/brand/` | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
-| `docs/brand/artcraft-mark-black.svg` | ArtCraft Team | storytold/craftrules `assets/brand/` | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
-| `docs/brand/artcraft-mark.png` | ArtCraft Team | storytold/craftrules `assets/brand/` | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
-| `docs/brand/artcraft-mark.svg` | ArtCraft Team | storytold/craftrules `assets/brand/` | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
+| `docs/brand/artcraft-logo-white.png` | ArtCraft Team | ArtCraft brand kit | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
+| `docs/brand/artcraft-logo-white.svg` | ArtCraft Team | ArtCraft brand kit | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
+| `docs/brand/artcraft-logo.png` | ArtCraft Team | ArtCraft brand kit | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
+| `docs/brand/artcraft-logo.svg` | ArtCraft Team | ArtCraft brand kit | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
+| `docs/brand/artcraft-mark-black.png` | ArtCraft Team | ArtCraft brand kit | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
+| `docs/brand/artcraft-mark-black.svg` | ArtCraft Team | ArtCraft brand kit | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
+| `docs/brand/artcraft-mark.png` | ArtCraft Team | ArtCraft brand kit | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
+| `docs/brand/artcraft-mark.svg` | ArtCraft Team | ArtCraft brand kit | ArtCraft brand terms (`docs/brand/LICENSE-brand.txt`) | Trademark, not open source |
 
 ## Interface translations
 
@@ -65,14 +65,16 @@ Generated-in-code assets are original and have no file to list:
 | `crates/ui-egui/src/i18n/de.tsv` | the CADCraft contributors | Original German translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/es.tsv` | @PedroGuille | Original Spanish translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/pt_br.tsv` | @WladmirJunior | Original Brazilian Portuguese translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
+| `crates/ui-egui/src/i18n/bs.tsv` | Nine (@nine-codes) with Claude Code (AI-assisted) | Original Bosnian translations of CADCraft English strings, shared with storytold/craft-i18n `locales/bs/` | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; not yet reviewed by a native speaker |
 | `crates/ui-egui/src/i18n/cs.tsv` | @Losminek (AI-assisted) | Original Czech translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/ru.tsv` | @pechnikov2026-star | Original Russian translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/fr.tsv` | @pechnikov2026-star | Original French translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/zh.tsv` | @mayloglog | Original Simplified Chinese translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/sv.tsv` | Erik Holmbom (@holmbom) with Claude Code (AI-assisted) | Original Swedish translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; terminology and the running app reviewed by a native speaker |
-| `crates/ui-egui/src/i18n/it.tsv` | Emanuele Bottelli (AI-assisted) | Original Italian translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
+| `crates/ui-egui/src/i18n/it.tsv` | Emanuele Bottelli (AI-assisted); terminology corrections: Andrea Brandi (@starise) with OpenAI Codex (AI-assisted) | Original Italian translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; targeted Chamfer terminology review by a native speaker |
 | `crates/ui-egui/src/i18n/ko.tsv` | @huk082 (AI-assisted) | Original Korean translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; no font assets added |
 | `crates/ui-egui/src/i18n/ar.tsv` | @hasan-sdaif | Original Arabic translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/hu.tsv` | @Skaywalker | Original Hungarian translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/tr.tsv` | @ogzhnklvz (AI-assisted) | Original Turkish translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; written from the English strings, no other catalog used as a source; the running app reviewed by a native speaker |
 | `crates/ui-egui/src/i18n/el.tsv` | @Camthalion77 with ChatGPT (AI-assisted) | Original Greek translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; independent native proofreading pending |
+| `crates/ui-egui/src/i18n/vi.tsv` | @2ez4gcx with Claude Code (AI-assisted) | Original Vietnamese translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; terminology chosen with a native speaker, full proofreading pending |

CLAUDE.md

@@ -2,8 +2,6 @@
 
 CADCraft is a clean-room, open-source, pure-Rust computer-aided design and drafting application targeting Autodesk AutoCAD parity — and superiority (speed, openness, agent control). It runs natively on macOS, Windows, Linux and FreeBSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop-class), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).
 
-Standards and learnings shared across the crafting apps live in `../../craftrules` (or `storytold/craftrules`). Read its `AGENTS.md` at the start of a session, follow its standards, and contribute reusable learnings back there. Never code: repos don't share code.
-
 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. Behaviour reference: `plan/autocad/*` (`01-observed-ui.md` holds measured observations of the running reference app; `04-menu-tree.txt` the menu tree by name).
 2. Library decisions: `plan/adr/0001-geometry-libraries.md` (what we may depend on, what is rejected for licence reasons).
@@ -12,14 +10,14 @@ Standards and learnings shared across the crafting apps live in `../../craftrule
 `plan/` is gitignored (local only).
 
 ## Never crash
-People trust CADCraft with their drawings; a crash loses their work. **This outranks feature work.** Standard: [`craftrules/standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
+People trust CADCraft with their drawings; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or reports "not available yet"; it never panics.
 - **Input-derived numbers are hostile** (DXF/DWG files, command-line text, MCP/control params): `get()` not `[i]`, checked arithmetic, no NaN casts, cap input-sized allocations and loop counts.
 - **Bound recursion** (nested/cyclic block references: `MAX_BLOCK_DEPTH`).
-- **Last-resort guard:** `Session::execute` and every step of an interactive command (its factory, `begin`, input, `prompt` and `preview`; `crates/engine/src/guard.rs`) run under `catch_unwind`; an escaped panic restores the drawing and reports an error.
-- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`, `hostile_dxf_does_not_panic`).
-- Every production crate root carries `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
+- **Last-resort guard:** `Session::execute` and every step of an interactive command (its factory, `begin`, input, `prompt`, `preview` and the passes after it; `crates/engine/src/guard.rs`) run under `catch_unwind`; an escaped panic restores the drawing and reports an error. It does nothing on wasm, where a panic aborts.
+- **Prove it:** every crash fix lands with a regression test (see `crates/engine/tests/panic_hunt.rs` and `hostile_dxf_does_not_panic` in `crates/io/src/tests.rs`).
+- Every workspace crate manifest carries `[lints] workspace = true` to inherit `[workspace.lints]`; every production crate root carries `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
 
 ## Non-negotiables
 - **Clean-room.** AutoCAD is installed on the dev machine and may be *observed* black-box: run it, use its UI with synthetic drawings, take screenshots (by window id) stored only under `plan/autocad/screenshots/` (never committed). **Never** read, disassemble or copy anything inside the AutoCAD bundle (names/listings only); never copy Autodesk fonts (SHX), hatch patterns (`.pat`), linetypes (`.lin`), templates, CUI/PGP files, icons, artwork or help text; never commit files produced by AutoCAD. File formats come from public specifications (Autodesk's published DXF Reference, the Open Design Alliance's public DWG specification) and our own synthetic tests. Never copy or link GPL/LGPL/AGPL code (LibreDWG, LibreCAD, QCAD, FreeCAD's planegcs, SolveSpace, OpenCASCADE) — don't even read their sources.
@@ -46,4 +44,9 @@ People trust CADCraft with their drawings; a crash loses their work. **This outr
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).
 
 ## Roadmap
-`ROADMAP.md` (committed) is the one-page summary: stage, parity numbers, estimates. It follows craftrules' `standards/progress-docs.md`: the assessment is `docs/target-app-parity.md`, the work list `docs/gaps.md` (pick work from its top rows), milestones `docs/roadmap.md`, deep checklists `docs/geometry-parity.md`, `docs/ui-parity.md`, `docs/file-format-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the affected rows and the docs' status lines and revision history. `cargo xtask parity` regenerates the menu-breadth checklist in `docs/parity-checklist.md`.
+`ROADMAP.md` (committed) is the one-page summary: stage, parity numbers, estimates. The assessment is `docs/target-app-parity.md`, the work list `docs/gaps.md` (pick work from its top rows), milestones `docs/roadmap.md`, deep checklists `docs/geometry-parity.md`, `docs/ui-parity.md`, `docs/file-format-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. PRs don't edit these docs: name the affected rows in the PR description, and maintainers update the rows, status lines and revision history in batches, which keeps open PRs from conflicting. `cargo xtask parity` regenerates the menu-breadth checklist in `docs/parity-checklist.md`.
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.

Cargo.lock

@@ -196,6 +196,56 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.104"
@@ -564,13 +614,14 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cadcraft"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
  "cadcraft-mcp",
  "cadcraft-ui-egui",
  "chrono",
+ "clap",
  "craft-ui",
  "craft-update",
  "craft-window",
@@ -581,8 +632,10 @@ dependencies = [
  "muda",
  "objc2-app-kit 0.3.2",
  "rfd",
+ "ron",
  "serde_json",
  "sys-locale",
+ "thiserror 2.0.21",
  "windows",
  "winit",
  "winresource",
@@ -591,25 +644,30 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-cli"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
  "cadcraft-mcp",
  "cadcraft-render",
+ "clap",
+ "clap_complete",
+ "clap_mangen",
+ "same-file",
  "serde_json",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "cadcraft-color"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-constraints"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-doc",
  "cadcraft-geom",
@@ -619,7 +677,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-doc"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-geom",
@@ -630,14 +688,15 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-dwg"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "acadrust",
+ "log",
 ]
 
 [[package]]
 name = "cadcraft-dxf"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "encoding_rs",
  "log",
@@ -646,7 +705,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-engine"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-constraints",
@@ -667,24 +726,25 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-fonts"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-geom",
  "harfrust 0.14.0",
+ "icu_segmenter",
  "skrifa 0.48.0",
  "unicode-bidi",
 ]
 
 [[package]]
 name = "cadcraft-geom"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-io"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "acadrust",
  "cadcraft-color",
@@ -705,11 +765,12 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-mcp"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
  "cadcraft-render",
+ "clap",
  "getrandom 0.4.3",
  "log",
  "serde_json",
@@ -717,7 +778,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-render"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
@@ -731,7 +792,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-ui-egui"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
@@ -757,7 +818,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-web"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -863,6 +924,65 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "clap"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_complete"
+version = "4.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037e2a1a92236d0aff7e845093f64661d6df4c02c9fcc61a60e9e1d736fa392f"
+dependencies = [
+ "clap",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
+
+[[package]]
+name = "clap_mangen"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "211d617eaa4b735c96c9e0228fcbdb5120ef623f2b8cb67ffb84c3e02dbc28a4"
+dependencies = [
+ "clap",
+ "roff",
+]
+
 [[package]]
 name = "clipboard-win"
 version = "5.4.3"
@@ -872,6 +992,15 @@ dependencies = [
  "error-code",
 ]
 
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "codespan-reporting"
 version = "0.13.1"
@@ -898,6 +1027,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "colored"
 version = "2.2.0"
@@ -983,6 +1118,15 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
 
+[[package]]
+name = "core_maths"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77745e017f5edba1a9c1d854f6f3a52dac8a12dd5af5d2f54aecf61e43d80d30"
+dependencies = [
+ "libm",
+]
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -995,12 +1139,40 @@ dependencies = [
 [[package]]
 name = "craft-docpath"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=9f89fe8f6d72ab4db4cc06f186381a6a254463ab#9f89fe8f6d72ab4db4cc06f186381a6a254463ab"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+
+[[package]]
+name = "craft-fonts-build"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+
+[[package]]
+name = "craft-i18n"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+dependencies = [
+ "fixed_decimal",
+ "icu_decimal",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_normalizer",
+ "icu_plurals",
+ "icu_properties",
+ "icu_provider",
+ "icu_provider_adapters",
+ "icu_provider_blob",
+ "log",
+ "objc2-foundation 0.3.2",
+ "sys-locale",
+ "unicode-bidi",
+ "windows-registry",
+ "writeable",
+]
 
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=9f89fe8f6d72ab4db4cc06f186381a6a254463ab#9f89fe8f6d72ab4db4cc06f186381a6a254463ab"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "hayro-syntax",
  "krilla",
@@ -1010,26 +1182,35 @@ dependencies = [
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=9f89fe8f6d72ab4db4cc06f186381a6a254463ab#9f89fe8f6d72ab4db4cc06f186381a6a254463ab"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
+ "craft-fonts-build",
+ "craft-i18n",
  "egui",
+ "epaint",
+ "js-sys",
  "log",
  "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "serde",
+ "skrifa 0.44.0",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
 ]
 
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=9f89fe8f6d72ab4db4cc06f186381a6a254463ab#9f89fe8f6d72ab4db4cc06f186381a6a254463ab"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
  "chrono",
  "dunce",
  "egui",
  "flate2",
  "getrandom 0.3.4",
+ "image",
  "log",
  "plist",
  "semver",
@@ -1048,7 +1229,7 @@ dependencies = [
 [[package]]
 name = "craft-window"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=9f89fe8f6d72ab4db4cc06f186381a6a254463ab#9f89fe8f6d72ab4db4cc06f186381a6a254463ab"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "egui",
  "objc2 0.6.5",
@@ -1555,6 +1736,17 @@ version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c66915cc5391097de7a2b0b972e8505aa33c0df401fd3a6811dbdb32881ba48"
 
+[[package]]
+name = "fixed_decimal"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2214fb00f669ee96bee5bb29dfb1ddabe058b2bc426817efc79afa03c9bc55ae"
+dependencies = [
+ "displaydoc",
+ "smallvec",
+ "writeable",
+]
+
 [[package]]
 name = "fixedbitset"
 version = "0.5.7"
@@ -1995,7 +2187,7 @@ checksum = "9f4d0e94ddd48749f06bbe4e5389fb9799a0c45bcaf00495042076ef05e3241a"
 [[package]]
 name = "hayro-jbig2"
 version = "0.3.0"
-source = "git+https://github.com/storytold/craft-libs?rev=9f89fe8f6d72ab4db4cc06f186381a6a254463ab#9f89fe8f6d72ab4db4cc06f186381a6a254463ab"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "hayro-ccitt",
 ]
@@ -2009,7 +2201,7 @@ checksum = "c75ab947623ef4ccaa7acf0579edf7cbb5a73838e3839a7be73335e522f433a1"
 [[package]]
 name = "hayro-syntax"
 version = "0.7.2"
-source = "git+https://github.com/storytold/craft-libs?rev=9f89fe8f6d72ab4db4cc06f186381a6a254463ab#9f89fe8f6d72ab4db4cc06f186381a6a254463ab"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "hayro-jbig2",
  "hayro-jpeg2000",
@@ -2029,6 +2221,12 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
 [[package]]
 name = "hermit-abi"
 version = "0.5.3"
@@ -2074,9 +2272,9 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "icu_collections"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -2087,43 +2285,110 @@ dependencies = [
 ]
 
 [[package]]
-name = "icu_locale_core"
-version = "2.4.0"
+name = "icu_decimal"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0"
+checksum = "9eb8f655bba2d0c0459e43a5b0e6cd3cd388109898fb3d85d048165e8b0abd08"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_locale_core",
+ "icu_pattern",
+ "icu_plurals",
+ "icu_provider",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
+ "serde",
  "tinystr",
  "writeable",
  "zerovec",
 ]
 
 [[package]]
-name = "icu_normalizer"
-version = "2.4.0"
+name = "icu_locale_fallback"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
  "icu_properties",
  "icu_provider",
  "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
  "zerovec",
 ]
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_pattern"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc43ce0e76ee8cb0482dc6e2dbb9b76278e8038f45daabf2a2877577e2ceb18f"
+dependencies = [
+ "displaydoc",
+ "either",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e475e6766ef87b1d3c1f97be6363995b0bfaeddbc789671615df598a97ff0593"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_provider",
+ "serde",
+ "zerovec",
+]
 
 [[package]]
 name = "icu_properties"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
  "displaydoc",
  "icu_collections",
@@ -2136,18 +2401,21 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.4.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
+ "postcard",
+ "serde",
+ "stable_deref_trait",
  "writeable",
  "yoke",
  "zerofrom",
@@ -2155,6 +2423,53 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_provider_adapters"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df887bc4f55dbc773c7c45a0c7dfa75be886f7b7812830a71ab7271cc1801820"
+dependencies = [
+ "icu_locale_fallback",
+ "icu_provider",
+]
+
+[[package]]
+name = "icu_provider_blob"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5916b44fac319d3f58e4d8d805a627df19e27937b582cd99fcde3bb6b7ce1b0e"
+dependencies = [
+ "icu_provider",
+ "postcard",
+ "serde",
+ "writeable",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82d07aafccd67af15d02512a6adf5896fbc5ed00f2e99b471d2efa14016db3db"
+dependencies = [
+ "core_maths",
+ "icu_collections",
+ "icu_locale_fallback",
+ "icu_provider",
+ "icu_segmenter_data",
+ "potential_utf",
+ "smallvec",
+ "utf8_iter",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae293c039020f9ec10710af98d29ce6aa2051486638b49c9a6409f3b4a9e98ad"
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -2237,6 +2552,12 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.15.0"
@@ -2371,7 +2692,7 @@ dependencies = [
 [[package]]
 name = "krilla"
 version = "0.8.2"
-source = "git+https://github.com/storytold/craft-libs?rev=9f89fe8f6d72ab4db4cc06f186381a6a254463ab#9f89fe8f6d72ab4db4cc06f186381a6a254463ab"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "base64 0.22.1",
  "bumpalo",
@@ -2469,6 +2790,9 @@ name = "litemap"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "litrs"
@@ -3088,6 +3412,12 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "open"
 version = "5.4.5"
@@ -3400,12 +3730,24 @@ dependencies = [
  "portable-atomic",
 ]
 
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "serde",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
+ "serde_core",
+ "writeable",
  "zerovec",
 ]
 
@@ -3648,6 +3990,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "roff"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "323c417e1d9665a65b263ec744ba09030cfb277e9daa0b018a4ab62e57bc8189"
+
 [[package]]
 name = "ron"
 version = "0.12.2"
@@ -4163,6 +4511,12 @@ dependencies = [
  "unicode-properties",
 ]
 
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
 [[package]]
 name = "subsetter"
 version = "0.2.6"
@@ -4220,7 +4574,10 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eab9a99a024a169fe8a903cf9d4a3b3601109bcc13bd9e3c6fff259138626c4"
 dependencies = [
+ "js-sys",
  "libc",
+ "wasm-bindgen",
+ "web-sys",
 ]
 
 [[package]]
@@ -4372,6 +4729,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a"
 dependencies = [
  "displaydoc",
+ "serde_core",
  "zerovec",
 ]
 
@@ -4614,6 +4972,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
 [[package]]
 name = "utf8-zero"
 version = "0.8.1"
@@ -4626,6 +4990,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "uuid"
 version = "1.29.0"
@@ -5222,6 +5592,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.4.1"
@@ -5462,11 +5843,20 @@ dependencies = [
  "read-fonts 0.39.2",
 ]
 
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
 [[package]]
 name = "writeable"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+dependencies = [
+ "either",
+]
 
 [[package]]
 name = "x11-dl"
@@ -5539,7 +5929,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.13.0"
+version = "0.17.0"
 dependencies = [
  "chrono",
  "serde_json",
@@ -5728,8 +6118,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
+ "litemap",
+ "serde_core",
  "yoke",
  "zerofrom",
+ "zerovec",
 ]
 
 [[package]]
@@ -5738,6 +6131,7 @@ version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
 dependencies = [
+ "serde",
  "yoke",
  "zerofrom",
  "zerovec-derive",
@@ -5756,9 +6150,9 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "9.1.1"
+version = "9.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "518b847fd864440c379748ad684c449f293af68978a485a4ff16f7c901c1f7c4"
+checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
 dependencies = [
  "crc32fast",
  "flate2",

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 # default-members
 
 [workspace.package]
-version = "0.13.0"
+version = "0.17.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -25,13 +25,17 @@ cadcraft-engine = { path = "crates/engine" }
 cadcraft-ui-egui = { path = "crates/ui-egui" }
 cadcraft-mcp = { path = "crates/mcp" }
 # Which paths stored in a drawing (xrefs, data links) may be opened.
-craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "9f89fe8f6d72ab4db4cc06f186381a6a254463ab" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
 # PDF writing (krilla) for plots, and reading them back in tests. The root patches below pin
 # craft-pdf's patched backends to the same revision (Cargo ignores dependency-local patches).
-craft-pdf = { version = "=0.1.0", git = "https://github.com/storytold/craft-libs", rev = "9f89fe8f6d72ab4db4cc06f186381a6a254463ab", default-features = false }
+craft-pdf = { version = "=0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", default-features = false }
+clap = { version = "4", features = ["derive", "env"] }
+clap_complete = "4.6.11"
+clap_mangen = { version = "0.3.3", features = ["env"] }
 
 # foundation
 thiserror = "2"
+same-file = "1"
 serde = { version = "1", features = ["derive", "rc"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
@@ -47,21 +51,25 @@ skrifa = "0.48"
 # so the graph has both) and the Unicode Bidirectional Algorithm for right-to-left drawing text.
 harfrust = "0.14"
 unicode-bidi = "0.3.18"
+# Line-break opportunities between Thai words for MTEXT word wrap (Thai writes no spaces between
+# words): UAX #14 with ICU4X's compiled-in LSTM word model (not its dictionaries).
+icu_segmenter = { version = "~2.3", default-features = false, features = ["compiled_data", "lstm"] }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
 encoding_rs = "0.8.35"
 # XML for the SVG reader (streaming parser, no entity expansion beyond the five predefined ones)
 quick-xml = "0.42"
 
 # ui
-craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "9f89fe8f6d72ab4db4cc06f186381a6a254463ab", features = ["serde"] }
-craft-window = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "9f89fe8f6d72ab4db4cc06f186381a6a254463ab", features = ["egui"] }
+craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["serde"] }
+craft-window = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["egui"] }
 egui = { version = "0.37", default-features = false, features = ["default_fonts", "monochrome_emoji_fonts"] }
 egui_kittest = "0.37"
 eframe = { version = "0.37", default-features = false }
 egui-wgpu = "0.37"
 # Monotonic time on native and web (performance.now on wasm).
 web-time = "1.1"
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "9f89fe8f6d72ab4db4cc06f186381a6a254463ab", features = ["egui"] }
+# craft-update: app-specific pretend versions apply to startup and manual checks.
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
 rfd = "0.17"
 arboard = { version = "3.6", default-features = false }
 
@@ -69,9 +77,11 @@ arboard = { version = "3.6", default-features = false }
 unsafe_code = "forbid"
 
 [workspace.lints.clippy]
+cognitive_complexity = "deny"
+too_many_arguments = "deny"
+wildcard_imports = "deny"
 dbg_macro = "warn"
 todo = "warn"
-too_many_arguments = "allow"
 type_complexity = "allow"
 
 [profile.dev.package."*"]
@@ -91,9 +101,9 @@ debug = 0
 # PDF backends for craft-pdf: pinned to the same reviewed craft-libs revision as craft-pdf itself
 # (Cargo ignores dependency-local patches).
 [patch.crates-io]
-krilla = { version = "=0.8.2", git = "https://github.com/storytold/craft-libs", rev = "9f89fe8f6d72ab4db4cc06f186381a6a254463ab" }
-hayro-syntax = { git = "https://github.com/storytold/craft-libs", rev = "9f89fe8f6d72ab4db4cc06f186381a6a254463ab" }
-hayro-jbig2 = { git = "https://github.com/storytold/craft-libs", rev = "9f89fe8f6d72ab4db4cc06f186381a6a254463ab" }
+krilla = { version = "=0.8.2", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+hayro-syntax = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+hayro-jbig2 = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
 
 # Keep the complete egui family and native event bridge on reviewed fork commits.
 ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }

README.md

@@ -196,7 +196,7 @@ crashed survives the next start. The file stops growing at 16 MiB. `--version` w
 
 | Variable | Effect |
 |---|---|
-| `CADCRAFT_CONFIG_DIR` | Use this directory instead of the platform settings directory (the log goes to its `logs/`) |
+| `CADCRAFT_CONFIG_DIR` | Use this directory instead of the platform settings directory (the log goes to its `logs/`); empty means no settings folder (no log file, autosave, workspace or plotters) |
 | `RUST_LOG` | Log levels for standard error and the log file. Default: `info` for CADCraft's own crates, `warn` for everything else. env_logger-style directives replace that, e.g. `RUST_LOG=debug`, `RUST_LOG=warn,cadcraft_io=trace` or `RUST_LOG=info,wgpu_core=warn`; a directive ending in `*` covers every target starting with it (`cadcraft*=debug`). `cadcraft_engine=debug` also logs every command-line message. |
 
 The logger is `apps/cadcraft/src/logging.rs`; the web build logs to the browser console instead.
@@ -230,6 +230,11 @@ How image exports (PNG 2400×1600, SVG, PDF) are framed: `convert` fits the mode
 rectangle, centred and scaled without distortion; `--view extents` or `--view current` forces
 either framing. To frame a selection set, `zoom {"mode":"object"}` after selecting.
 
+When reading a file leaves something out (records a DXF reader can't place, object records of a
+damaged DWG), `info` reports it (`skipped`, `readNotes`), `convert` warns on stderr and `run`
+prints the DWG notes with its log; the exit code stays 0. MCP `open` replies with the notes as
+`warnings`.
+
 MCP tools include `command_line` (type at the prompt), `execute` (any command with JSON),
 `inspect_drawing`, `query_entities`, `render` (returns a PNG) and, when connected to the app,
 `screenshot` and `ui_click`. The desktop app's JSON control channel is documented in
@@ -238,6 +243,9 @@ MCP tools include `command_line` (type at the prompt), `execute` (any command wi
 To run LISP routines, scripts and alias files, or to drive CADCraft from your own programs, see
 [docs/customization.md](docs/customization.md).
 
+`cadcraft-cli --help` documents every subcommand and flag; exit codes, streams, environment
+variables and its RFC-0012 conventions are in [docs/cli.md](docs/cli.md).
+
 ## Architecture
 
 ```text
@@ -311,6 +319,7 @@ See [ROADMAP.md](ROADMAP.md) for the stage, measured parity and the estimate of
 Installers and executables are code-signed.
 
 The installer adds CADCraft to the Start menu and asks whether to add a desktop shortcut too (unticked by default). For a silent install with the desktop shortcut: `msiexec /i cadcraft-<ver>-windows-x64.msi /qn DESKTOPSHORTCUT=1`.
+A silent install is per-user by default; add `ALLUSERS=1`, from an elevated terminal or deployment tool, for an all-users install.
 
 **If the app doesn't open on Windows:** the desktop app initializes only DirectX 12 by default.
 Letting wgpu also create an OpenGL instance can crash some graphics drivers (AMD's
@@ -373,7 +382,15 @@ stand on its own.
 | <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/effectcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.effectcraft.png" alt="" width="32" height="32"> | **EffectCraft** | Motion graphics and visual effects | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/designcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.designcraft.png" alt="" width="32" height="32"> | **DesignCraft** | Page layout and publishing | [GitHub](https://github.com/storytold/designcraft) | [Website](https://getartcraft.com/apps/designcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/cadcraft/main/assets/app-icon/cadcraft-64.png" alt="" width="32" height="32"> | **CADCraft** | **Computer-aided design and drafting · you are here** | [GitHub](https://github.com/storytold/cadcraft) | [Website](https://getartcraft.com/apps/cadcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/figcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.figcraft.png" alt="" width="32" height="32"> | **FigCraft** | Interface design and prototyping | [GitHub](https://github.com/storytold/figcraft) | [Website](https://getartcraft.com/apps/figcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/wordcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.wordcraft.png" alt="" width="32" height="32"> | **WordCraft** | Word processing and documents | [GitHub](https://github.com/storytold/wordcraft) | [Website](https://getartcraft.com/apps/wordcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/soundcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.soundcraft.png" alt="" width="32" height="32"> | **SoundCraft** | Audio recording and editing | [GitHub](https://github.com/storytold/soundcraft) | [Website](https://getartcraft.com/apps/soundcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/deckcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.deckcraft.png" alt="" width="32" height="32"> | **DeckCraft** | Presentations and slide decks | [GitHub](https://github.com/storytold/deckcraft) | [Website](https://getartcraft.com/apps/deckcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/cadcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.cadcraft.png" alt="" width="32" height="32"> | **CADCraft** | Computer-aided design | [GitHub](https://github.com/storytold/cadcraft) | [Website](https://getartcraft.com/apps/cadcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/gridcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.gridcraft.png" alt="" width="32" height="32"> | **GridCraft** | Spreadsheets and data | [GitHub](https://github.com/storytold/gridcraft) | [Website](https://getartcraft.com/apps/gridcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/texturecraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.texturecraft.png" alt="" width="32" height="32"> | **TextureCraft** | 3D texture painting | [GitHub](https://github.com/storytold/texturecraft) | [Website](https://getartcraft.com/apps/texturecraft) |
+| <img src="https://raw.githubusercontent.com/storytold/craft-anything/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.craft-anything.png" alt="" width="32" height="32"> | **Craft Anything** | See how any software works, then build your own | [GitHub](https://github.com/storytold/craft-anything) | [Website](https://getartcraft.com/apps/craft-anything) |
+| <img src="https://raw.githubusercontent.com/tangency-labs/solidcraft/main/assets/icons/app/linux/exports/hicolor/64x64/apps/io.tangencylabs.solidcraft.png" alt="" width="32" height="32"> | **SolidCraft** | Parametric 3D CAD by Tangency Labs (community app) | [GitHub](https://github.com/tangency-labs/solidcraft) | |
 
 And [**ArtCraft**](https://getartcraft.com/) itself, our AI image and video studio for artists who want real control.
 

ROADMAP.md

@@ -125,8 +125,8 @@ Ranked; detail and the full beta checklist in [docs/roadmap.md](docs/roadmap.md)
 | 2026-10-12 | HATCHEDIT refuses an explicit bad `scale` or `angle` before it edits anything, so a rejected request leaves the drawing, undo and redo as they were (#724) |
 | 2026-10-10 | Merged main: Ukrainian interface (#36, first string catalog), Dynamic Input pointer boxes with Tab and relative entry (#60), press-drag selection windows (#63), WIPEOUT and hatch gradients kept through DXF/DWG save (#147, #162), SETVAR DIM* as style overrides (#129), UNITS dialog (#38), close-window save prompt (#47), DIMANGULAR on circles (#20), cargo fmt fixed on main. UI/UX 40% → 43% (dynamic input 15% → 45%), localization 3% → 5%; ready for real work ≈ 37% → 38% (weighted 37.2% → 37.7%), mainstream 27% → 28%, essentials 45% → 46%. Beta is now ~37 points away; hours unchanged within rounding. |
 | 2026-10-10 | Added mainstream practitioner (≈ 27%) and essentials user (≈ 45%) numbers; ready for real work unchanged at ≈ 37%. User evidence: 2 praise comments, 0 "switched from AutoCAD" reports, 27 of 37 open issues on the core path. |
-| 2026-10-10 | Stage re-normalized from alpha to **pre-alpha** under the craftrules core-workflow gate: drafting with tracking, blocks, plotting and lossless DWG save fail; dimensioning passes. Alpha is ≈ 125–190 h away. |
-| 2026-10-10 | Full re-measure against AutoCAD 2027 for Mac in the craftrules progress-docs format: menu breadth 245/491 (50%), ready for real work ≈ 37%, stage alpha. Remaining estimates rose (≈ 570 h → 1,300–2,100 h) on new evidence: behaviour audits found tracking/extension/parallel snaps and dynamic input are not real, saves drop unmodelled content, DWG saves as R2000, and the old estimate had no localization, ecosystem, stability, platform or AI rows. New docs: target-app-parity, gaps, roadmap, architecture, localization, file-format, hardware, UI and geometry parity; `docs/parity.md` became `docs/parity-checklist.md`. |
+| 2026-10-10 | Stage re-normalized from alpha to **pre-alpha** under the core-workflow gate: drafting with tracking, blocks, plotting and lossless DWG save fail; dimensioning passes. Alpha is ≈ 125–190 h away. |
+| 2026-10-10 | Full re-measure against AutoCAD 2027 for Mac: menu breadth 245/491 (50%), ready for real work ≈ 37%, stage alpha. Remaining estimates rose (≈ 570 h → 1,300–2,100 h) on new evidence: behaviour audits found tracking/extension/parallel snaps and dynamic input are not real, saves drop unmodelled content, DWG saves as R2000, and the old estimate had no localization, ecosystem, stability, platform or AI rows. New docs: target-app-parity, gaps, roadmap, architecture, localization, file-format, hardware, UI and geometry parity; `docs/parity.md` became `docs/parity-checklist.md`. |
 | 2026-10-10 | About 60 community PRs merged in a day: DXF fidelity (transparency, LWPOLYLINE elevation, frozen VP layers, dimension text rotation, arc-length dims, non-ASCII escapes), CJK font fallback, Save/Don't Save on close, Light/System themes, F2 history, trackpad pan, Linux XWayland drag-and-drop, correctness fixes across draw/modify/constraints. Release v0.4.0. |
 | 2026-10-08 | Releases v0.1.0–v0.3.0: Flatpak, AppImage updates, signed macOS universal, Windows x64/x86/arm64, Linux, FreeBSD and web builds. |
 | 2026-10-07 | Old assessment: menu breadth 233/491 (47%), ≈ 29% weighted parity, 2D drafting ≈ 55%, ≈ 570 h remaining; milestones as reported then: M1 ~85%, M2 ~65%, M3 ~75%, M4 ~50%, M5 ~35%, M6 ~55%, M7 ~55%, M8 ~20%, M9 ~60%, M10 ~70%, M11 0%, M12 ~25%, M13 ~10%. |
@@ -144,7 +144,7 @@ Ranked; detail and the full beta checklist in [docs/roadmap.md](docs/roadmap.md)
 | 2026-10-10 | minor | Readiness-by-audience table with hours to ~95% for each number |
 | 2026-10-10 | minor | Mainstream practitioner and essentials user headline numbers |
 | 2026-10-10 | minor | Stage alpha → pre-alpha under the core-workflow gate; banner, why, headline row |
-| 2026-10-10 | major | Restructured to the progress-docs standard (stage, two numbers, dimensions, features, languages, upcoming, log); full re-measure; milestone detail moved to docs/roadmap.md, parity assessment to docs/target-app-parity.md |
+| 2026-10-10 | major | Progress docs restructured (stage, two numbers, dimensions, features, languages, upcoming, log); full re-measure; milestone detail moved to docs/roadmap.md, parity assessment to docs/target-app-parity.md |
 | 2026-10-07 | major | Alpha checklist, milestone table, ≈ 29% weighted parity estimate |
 
 ## Shared UI workspace integration

SECURITY.md

@@ -0,0 +1,34 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please report it privately through [GitHub's private reporting](https://github.com/storytold/cadcraft/security/advisories/new), not in a public issue or pull request. Say which version you ran, on which platform, and how to reproduce it. A small sample file helps, as long as it holds nothing private.
+
+Maintainers read reports as they arrive, but there is no fixed response time yet.
+
+## Supported versions
+
+Only the latest release gets security fixes. CADCraft is pre-alpha and moves quickly, so please check that a problem still exists there before reporting it.
+
+## What counts
+
+CADCraft treats these as untrusted, and a way past these defences is a vulnerability:
+
+- **Drawing files.** Opening a DXF, DWG or other file must not run code, write outside the paths the user chose, or crash the app. Panics are bugs too, but memory exhaustion or a decoder abort on a crafted file is the more serious case.
+- **AutoLISP in a drawing's folder.** A drawing must not run code that the user didn't choose to load.
+- **The control channel.** It listens on loopback only and needs the session token from an owner-only file on every request. Another local account reaching it without that token is a vulnerability.
+- **Temporary and autosave files.** Autosave files are unsaved drawings: another account must not be able to read them or redirect a write through them.
+- **Updates.** A release must not be replaceable by someone other than the project.
+
+## Known limits
+
+These are known and being worked on, so they don't need a report:
+
+- Agents connected through MCP or the control channel can read and write any path the user can. There are no workspace roots yet.
+- A local process can make the control channel buffer up to 512 MiB before its token is checked. The total is capped, so this can slow the app but not exhaust memory without limit.
+- The DWG worker process has no memory limit of its own yet, so a crafted file can use a lot of memory before it stops. It ends that one open or save, not the app.
+- The web build has no autosave yet.
+
+## What stays on your machine
+
+Crash reports are written to the `crash-reports` folder in the settings folder and are never uploaded. They hold the version, the platform, the panic message and a stack trace, and a message can include a file path, so read a report before you attach it anywhere.

apps/cadcraft-cli/Cargo.toml

@@ -6,6 +6,14 @@ edition.workspace = true
 license.workspace = true
 publish = false
 
+[lib]
+name = "cadcraft_cli"
+path = "src/lib.rs"
+
+[[bin]]
+name = "cadcraft-cli"
+path = "src/main.rs"
+
 [lints]
 workspace = true
 
@@ -14,4 +22,13 @@ cadcraft-engine = { workspace = true }
 cadcraft-io = { workspace = true }
 cadcraft-mcp = { workspace = true }
 cadcraft-render = { workspace = true }
+clap = { workspace = true }
+same-file = { workspace = true }
 serde_json = { workspace = true }
+thiserror = { workspace = true }
+
+[dev-dependencies]
+# Shell completions and man pages (examples/man-and-completions.rs, for the Linux packages); not
+# in the binary.
+clap_complete = { workspace = true }
+clap_mangen = { workspace = true }

apps/cadcraft-cli/examples/man-and-completions.rs

@@ -0,0 +1,41 @@
+//! Writes cadcraft-cli's shell completions ([`clap_complete`]: bash, zsh, fish, elvish,
+//! PowerShell) and man pages ([`clap_mangen`]: `cadcraft-cli.1` and one per subcommand, such as
+//! `cadcraft-cli-convert.1`) into a directory. The Linux packages ship them
+//! (`packaging/linux/package.sh`):
+//!
+//! ```sh
+//! cargo run -p cadcraft-cli --example man-and-completions -- <out-dir>
+//! ```
+
+use std::path::Path;
+use std::process::ExitCode;
+
+use clap::ValueEnum;
+use clap_complete::Shell;
+
+fn main() -> ExitCode {
+    let mut args = std::env::args_os().skip(1);
+    let (Some(dir), None) = (args.next(), args.next()) else {
+        eprintln!("usage: man-and-completions <out-dir>");
+        return ExitCode::from(2);
+    };
+    let dir = Path::new(&dir);
+    match generate(dir) {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(e) => {
+            eprintln!("error: {}: {e}", dir.display());
+            ExitCode::FAILURE
+        }
+    }
+}
+
+pub(crate) fn generate(dir: &Path) -> std::io::Result<()> {
+    std::fs::create_dir_all(dir)?;
+    let mut cmd = cadcraft_cli::command();
+    for &shell in Shell::value_variants() {
+        clap_complete::generate_to(shell, &mut cmd, "cadcraft-cli", dir)?;
+    }
+    // A fresh command: `clap_complete::generate_to` built `cmd`, adding the `help` subcommand,
+    // which `clap_mangen` would otherwise give pages of its own (`cadcraft-cli-help-convert.1`).
+    clap_mangen::generate_to(cadcraft_cli::command(), dir)
+}

apps/cadcraft-cli/src/args.rs

@@ -0,0 +1,823 @@
+//! The command line, as clap types. Values are parsed into their types here and the relations
+//! between flags are checked, so a bad value or combination is a usage error (exit 2) naming the
+//! flag, before any work starts; the handlers receive typed values only. A flag a subcommand
+//! doesn't take is a usage error too, so a typo can't be silently ignored. A value flag never takes
+//! the next flag as its value: a value starting with `-` is written `--save=-out.dxf` (or
+//! `./-out.dxf`).
+
+use std::ffi::{OsStr, OsString};
+use std::path::{Path, PathBuf};
+
+use cadcraft_engine::geom::{Bounds2, Vec2};
+use cadcraft_io::Format;
+use cadcraft_mcp::args::{blank_env_is_unset, name_env_vars};
+use clap::builder::{OsStringValueParser, PathBufValueParser, TypedValueParser};
+use clap::error::ErrorKind;
+use clap::parser::ValueSource;
+use clap::{ArgAction, ArgGroup, ArgMatches, Args, CommandFactory, FromArgMatches, Parser, Subcommand, ValueEnum};
+use serde_json::Value;
+
+/// Help text that names the formats of `list`, built once from [`Format::READ`] or [`Format::WRITE`]
+/// so it can't drift from what the code accepts.
+fn with_formats(cell: &'static std::sync::OnceLock<String>, before: &str, list: &[Format], after: &str) -> &'static str {
+    cell.get_or_init(|| format!("{before}({}){after}", Format::list(list)))
+}
+
+/// The drawing an input argument names.
+fn read_help() -> &'static str {
+    static C: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+    with_formats(&C, "The drawing to read ", Format::READ, "")
+}
+
+fn open_help() -> &'static str {
+    static C: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+    with_formats(&C, "Drawings to open ", Format::READ, "")
+}
+
+fn write_help() -> &'static str {
+    static C: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+    with_formats(&C, "The file to write; its extension picks the format ", Format::WRITE, "")
+}
+
+fn save_help() -> &'static str {
+    static C: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+    with_formats(&C, "Save the drawing to this file; its extension picks the format ", Format::WRITE, "")
+}
+
+fn export_help() -> &'static str {
+    static C: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+    with_formats(&C, "Export the drawing to this file; its extension picks the format ", Format::WRITE, "")
+}
+
+fn convert_about() -> &'static str {
+    static C: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+    with_formats(&C, "Convert a drawing; OUT's extension picks the format ", Format::WRITE, "")
+}
+
+fn convert_long_about() -> &'static str {
+    static C: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+    C.get_or_init(|| {
+        format!(
+            "{}\n\nImage output (png 2400x1600, svg, pdf) shows model space, fitted to the drawing extents unless\n--window or --view says otherwise.",
+            convert_about()
+        )
+    })
+}
+
+/// cadcraft-cli: headless CADCraft
+#[derive(Parser)]
+#[command(name = "cadcraft-cli", version = cadcraft_engine::build_version(), arg_required_else_help = true)]
+pub(crate) struct Cli {
+    #[command(subcommand)]
+    pub(crate) command: Command,
+}
+
+#[derive(Subcommand)]
+pub(crate) enum Command {
+    Info(InfoArgs),
+    Convert(ConvertArgs),
+    Run(RunArgs),
+    Commands(CommandsArgs),
+    Mcp(McpArgs),
+    Perf(PerfArgs),
+    Sample(SampleArgs),
+    Roundtrip(RoundtripArgs),
+}
+
+/// Print a drawing's summary as JSON
+#[derive(Args)]
+pub(crate) struct InfoArgs {
+    #[arg(help = read_help())]
+    pub(crate) file: PathBuf,
+    /// One line of JSON instead of pretty-printed
+    #[arg(long)]
+    pub(crate) compact: bool,
+}
+
+/// Convert a drawing; OUT's extension picks the format
+#[derive(Args)]
+#[command(about = convert_about(), long_about = convert_long_about())]
+pub(crate) struct ConvertArgs {
+    #[arg(value_name = "IN", help = read_help())]
+    pub(crate) input: PathBuf,
+    #[arg(value_name = "OUT", help = write_help())]
+    pub(crate) output: PathBuf,
+    #[command(flatten)]
+    pub(crate) framing: FramingArgs,
+    /// Allow an output that is an input file, replacing the original
+    #[arg(long)]
+    pub(crate) in_place: bool,
+    #[command(flatten)]
+    pub(crate) settings: Settings,
+}
+
+/// The settings the desktop app reads from its environment, for the subcommands that draw or run
+/// commands. A variable is the flag's fallback; an empty one counts as unset, except
+/// `CADCRAFT_CONFIG_DIR`.
+#[derive(Args)]
+#[command(next_help_heading = "Settings")]
+pub(crate) struct Settings {
+    /// The settings folder; plotter configurations are in its `plotters` folder (default: the
+    /// platform's settings folder). An empty value means no settings folder
+    // Not RFC-0012 rule 1.7's "an empty variable counts as unset": an empty value is the
+    // documented way to run with no settings folder (isolated runs, tests), and it predates the
+    // CLI port. Keep it out of any blanket treatment of empty variables.
+    #[arg(long, value_name = "DIR", env = "CADCRAFT_CONFIG_DIR", value_parser = OsStringValueParser::new().map(PathBuf::from))]
+    pub(crate) config_dir: Option<PathBuf>,
+    /// The font that replaces a missing one (FONTALT)
+    #[arg(long, value_name = "FONT", env = "CADCRAFT_FONTALT")]
+    pub(crate) fontalt: Option<String>,
+    /// The fonts tried, in order, for characters a font lacks, comma-separated (FONTFALLBACK)
+    #[arg(long, value_name = "FONTS", env = "CADCRAFT_FONTFALLBACK")]
+    pub(crate) fontfallback: Option<String>,
+}
+
+impl Settings {
+    /// Install the settings for this run; an unset one is the default. An empty or blank
+    /// `--config-dir` is no settings folder.
+    pub(crate) fn apply(&self) {
+        cadcraft_engine::settings_dir::set(self.settings_dir());
+        cadcraft_engine::fonts::ttf::set_font_alt(self.fontalt.as_deref().unwrap_or(""));
+        cadcraft_engine::fonts::ttf::set_fallback_fonts(self.fontfallback.as_deref().unwrap_or(""));
+    }
+
+    /// The settings folder: `--config-dir`, else the platform's; `None` when the flag is empty or
+    /// blank.
+    fn settings_dir(&self) -> Option<PathBuf> {
+        match &self.config_dir {
+            Some(dir) if dir.to_str().is_some_and(|d| d.trim().is_empty()) => None,
+            Some(dir) => Some(dir.clone()),
+            None => cadcraft_engine::settings_dir::platform(|k| std::env::var_os(k)),
+        }
+    }
+}
+
+// What part of model space an image shows: shared by `convert` and `run`.
+#[derive(Args)]
+pub(crate) struct FramingArgs {
+    /// Show this rectangle (drawing units, x0<x1, y0<y1), centred and scaled to fit the image
+    /// without distortion. A negative x0 needs the `=` form: --window=-10,0,10,5
+    #[arg(long, value_name = "x0,y0,x1,y1", value_parser = parse_window, conflicts_with = "view")]
+    pub(crate) window: Option<Bounds2>,
+    /// What part of model space the image shows (case-insensitive)
+    #[arg(long, value_name = "extents|current", value_enum, ignore_case = true)]
+    pub(crate) view: Option<ViewMode>,
+}
+
+/// `--view`.
+#[derive(Clone, Copy, Debug, PartialEq, ValueEnum)]
+pub(crate) enum ViewMode {
+    /// Always fit the drawing extents
+    Extents,
+    /// The current view, as last set by zoom, pan or view.set (a freshly opened drawing's view is
+    /// its extents plus a 10% margin)
+    Current,
+}
+
+/// Open drawings (or start a new one), run scripts and commands in order, save or export the result
+///
+/// Drawings open in the order given, and the last one is current; without any, a new imperial
+/// drawing is used. --script, --script-file and --cmd steps run in the order given, and each
+/// --cmd prints its JSON result on one line (JSON lines); a command with no result prints nothing.
+/// An image --export (png 2400x1600, svg, pdf) shows model space:
+/// the current view if the steps changed it (zoom, pan, view.set…), otherwise the drawing
+/// extents, unless --window or --view says otherwise.
+#[derive(Args)]
+#[command(group(ArgGroup::new("framing").args(["window", "view"]).multiple(true).requires("export")))]
+#[command(after_long_help = r#"--cmd chaining:
+  A --cmd parameter value of exactly "{last}" is replaced with the last object handle an
+  earlier --cmd in the same run returned, so a command can act on what the previous one made:
+    --cmd 'mview {"p1":[20,20],"p2":[200,150]}'        prints {"viewports":["100"]}
+    --cmd 'viewport.set {"handle":"{last}","scale":1}' changes viewport 100
+  It works in any parameter, at any depth (e.g. "handles":["{last}"]); every other string is
+  passed unchanged. With no earlier returned handle the run fails and says so."#)]
+pub(crate) struct RunArgs {
+    #[arg(value_name = "FILE", help = open_help())]
+    pub(crate) files: Vec<PathBuf>,
+    /// Open the built-in sample drawing
+    #[arg(long)]
+    pub(crate) sample: bool,
+    /// Start a new metric drawing
+    #[arg(long)]
+    pub(crate) metric: bool,
+    /// Command-line script text to run (`\n` separates lines)
+    #[arg(long, value_name = "TEXT", action = ArgAction::Append)]
+    pub(crate) script: Vec<String>,
+    /// A script file (.scr) to run
+    #[arg(long, value_name = "F.scr", action = ArgAction::Append)]
+    pub(crate) script_file: Vec<PathBuf>,
+    /// An engine command and its JSON parameters (default {}); see "--cmd chaining" in --help
+    #[arg(long, value_name = "id {json}", action = ArgAction::Append, value_parser = cmd_step)]
+    pub(crate) cmd: Vec<CmdStep>,
+    #[arg(long, value_name = "OUT.dxf", help = save_help())]
+    pub(crate) save: Option<PathBuf>,
+    #[arg(long, value_name = "OUT.png", help = export_help())]
+    pub(crate) export: Option<PathBuf>,
+    #[command(flatten)]
+    pub(crate) framing: FramingArgs,
+    /// Allow an output that is an input file, replacing the original
+    #[arg(long)]
+    pub(crate) in_place: bool,
+    #[command(flatten)]
+    pub(crate) settings: Settings,
+    /// The drawings, in command-line order, set by [`parse`].
+    #[arg(skip)]
+    pub(crate) drawings: Vec<Drawing>,
+    /// The steps, in command-line order, set by [`parse`].
+    #[arg(skip)]
+    pub(crate) steps: Vec<Step>,
+}
+
+/// A drawing `run` opens.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum Drawing {
+    File(PathBuf),
+    Sample,
+    Metric,
+}
+
+/// A `--script`, `--script-file` or `--cmd` of `run`.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum Step {
+    Script(String),
+    ScriptFile(PathBuf),
+    Cmd(CmdStep),
+}
+
+/// `--cmd 'id {json}'`: an engine command and its parameters. `{last}` placeholders are filled in
+/// when it runs.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct CmdStep {
+    pub(crate) id: String,
+    pub(crate) params: Value,
+}
+
+/// Print the command catalog as JSON
+#[derive(Args)]
+pub(crate) struct CommandsArgs {
+    /// Only the commands whose id or label contains this text (case-insensitive)
+    pub(crate) filter: Option<String>,
+    /// One line of JSON instead of pretty-printed
+    #[arg(long)]
+    pub(crate) compact: bool,
+}
+
+/// Run the MCP server on stdio: a headless drawing session, or a bridge to the running app
+#[derive(Args)]
+pub(crate) struct McpArgs {
+    /// Bridge to the app's control channel (its --control port, e.g. 127.0.0.1:7979)
+    #[arg(long, value_name = "HOST:PORT", value_parser = connect_addr)]
+    pub(crate) connect: Option<String>,
+    /// Reach the app at the first call instead of at startup, so the server can start before the
+    /// app is open
+    #[arg(long, requires = "connect")]
+    pub(crate) lazy: bool,
+    /// Like --lazy, and a call that finds nothing at HOST:PORT opens the app with that control
+    /// port first (macOS)
+    #[arg(long, requires = "connect")]
+    pub(crate) launch: bool,
+    #[command(flatten)]
+    pub(crate) settings: Settings,
+}
+
+/// Time the engine on a synthetic N-entity drawing (default 200000), or the canvas display-list
+/// build of a drawing, zoomed in step by step
+#[derive(Args)]
+pub(crate) struct PerfArgs {
+    /// An entity count (clamped to 1-20000000), or a drawing to time
+    #[arg(value_name = "N|FILE", value_parser = PathBufValueParser::new().map(perf_target))]
+    pub(crate) target: Option<PerfTarget>,
+}
+
+/// What `perf` times.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum PerfTarget {
+    /// A synthetic drawing with this many entities, within [`MAX_PERF_COUNT`].
+    Count(usize),
+    File(PathBuf),
+}
+
+/// The largest synthetic drawing `perf` builds.
+const MAX_PERF_COUNT: usize = 20_000_000;
+
+/// `perf N|FILE`: a value that reads as a count is one, clamped to 1..=[`MAX_PERF_COUNT`] so `perf
+/// 0` still times something; anything else is a drawing.
+fn perf_target(p: PathBuf) -> PerfTarget {
+    match p.to_str().and_then(|t| t.parse::<usize>().ok()) {
+        Some(n) => PerfTarget::Count(n.clamp(1, MAX_PERF_COUNT)),
+        None => PerfTarget::File(p),
+    }
+}
+
+/// Open each DXF/DWG, save it as DXF and DWG, reopen and compare; writes report.md and report.json
+///
+/// FOLDER defaults to $CADCRAFT_CORPUS_DIR. With CADCRAFT_CORPUS_STRICT=1 it fails when a file
+/// doesn't open, save or reopen, or loses records on save.
+#[derive(Args)]
+pub(crate) struct RoundtripArgs {
+    /// A drawing, or a folder of them
+    #[arg(value_name = "FILE|FOLDER")]
+    pub(crate) path: Option<PathBuf>,
+    /// Where the report goes (default: `report` beside the files)
+    #[arg(long, value_name = "DIR")]
+    pub(crate) out: Option<PathBuf>,
+    /// Keep the saved files, in `saved` under the report folder
+    #[arg(long)]
+    pub(crate) keep_saved: bool,
+    /// Save only in each file's own format
+    #[arg(long)]
+    pub(crate) same_format: bool,
+    /// Don't count what each file holds (faster; no "read lost" column)
+    #[arg(long)]
+    pub(crate) no_census: bool,
+    /// How far numbers may move and still count as equal
+    #[arg(long, value_name = "T", default_value_t = cadcraft_io::roundtrip::Options::default().abs_tol, value_parser = tolerance)]
+    pub(crate) tolerance: f64,
+}
+
+/// `--tolerance`: a finite number, 0 or more.
+fn tolerance(v: &str) -> Result<f64, ValueError> {
+    match v.parse::<f64>() {
+        Ok(t) if t.is_finite() && t >= 0.0 => Ok(t),
+        _ => Err(ValueError::Tolerance(v.to_string())),
+    }
+}
+
+/// Write a built-in sample drawing
+#[derive(Args)]
+pub(crate) struct SampleArgs {
+    /// Which sample
+    #[arg(value_name = "bracket|floorplan", value_enum)]
+    pub(crate) name: SampleName,
+    #[arg(value_name = "OUT", help = write_help())]
+    pub(crate) output: PathBuf,
+    #[command(flatten)]
+    pub(crate) settings: Settings,
+}
+
+/// `sample`'s drawings.
+#[derive(Clone, Copy, Debug, PartialEq, ValueEnum)]
+pub(crate) enum SampleName {
+    Bracket,
+    #[value(alias = "floor")]
+    Floorplan,
+}
+
+/// What part of model space an image export shows.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum Framing {
+    /// `run`: the current view if the commands changed it, else the extents. `convert`: extents.
+    Auto,
+    Extents,
+    Current,
+    Window(Bounds2),
+}
+
+/// Why a `--window` value is refused: clap prints it after the flag and its value (exit 2).
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum WindowError {
+    #[error("expected four numbers x0,y0,x1,y1")]
+    NeedsFour,
+    #[error("{name} must be a finite number, got `{value}`")]
+    NotFinite { name: &'static str, value: String },
+    #[error("need x0 < x1 and y0 < y1 (lower-left corner first)")]
+    Order,
+    #[error(transparent)]
+    Limits(#[from] cadcraft_io::IoError),
+}
+
+/// Why a value is refused: clap prints it after the flag and its value (exit 2).
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum ValueError {
+    #[error("expected HOST:PORT (the app's --control port, e.g. 127.0.0.1:7979)")]
+    Connect,
+    #[error("expected a command id, then optionally its JSON parameters")]
+    CmdId,
+    #[error(transparent)]
+    CmdJson(#[from] serde_json::Error),
+    #[error("expected a number of 0 or more, got `{0}`")]
+    Tolerance(String),
+}
+
+/// Why `parse` refuses flags clap accepted: clap prints it as a usage error (exit 2).
+#[derive(Debug, thiserror::Error)]
+enum UsageError {
+    /// The framing flags choose what an image shows; a drawing file has nothing to frame.
+    #[error("{flag} only applies to image output (png, svg, pdf), not `{}`", .out.display())]
+    FramingNeedsImage { flag: &'static str, out: PathBuf },
+    /// The output is one of the input files, so writing it would replace the original.
+    #[error("{} is an input file, so the result would replace the original: choose another output, or pass --in-place to overwrite it", .0.display())]
+    OutIsInput(PathBuf),
+}
+
+impl UsageError {
+    fn into_clap(self, cmd: &mut clap::Command) -> clap::Error {
+        let kind = match self {
+            Self::FramingNeedsImage { .. } | Self::OutIsInput(_) => ErrorKind::ArgumentConflict,
+        };
+        cmd.error(kind, self)
+    }
+}
+
+/// Parse `--window x0,y0,x1,y1` (min corner first). Hostile values are errors, never panics.
+pub(crate) fn parse_window(text: &str) -> Result<Bounds2, WindowError> {
+    let parts: Vec<&str> = text.split(',').map(str::trim).collect();
+    let [x0, y0, x1, y1] = parts.as_slice() else {
+        return Err(WindowError::NeedsFour);
+    };
+    let num = |name: &'static str, v: &str| -> Result<f64, WindowError> {
+        match v.parse::<f64>() {
+            Ok(n) if n.is_finite() => Ok(n),
+            _ => Err(WindowError::NotFinite { name, value: v.to_string() }),
+        }
+    };
+    let (x0, y0, x1, y1) = (num("x0", x0)?, num("y0", y0)?, num("x1", x1)?, num("y1", y1)?);
+    if !(x0 < x1 && y0 < y1) {
+        return Err(WindowError::Order);
+    }
+    let w = Bounds2 { min: Vec2::new(x0, y0), max: Vec2::new(x1, y1) };
+    cadcraft_io::check_window(&w)?;
+    Ok(w)
+}
+
+/// `run --cmd 'id {json}'`: the id up to the first space, then JSON parameters (default `{}`).
+/// Whether they suit the command is the command's to say.
+fn cmd_step(s: &str) -> Result<CmdStep, ValueError> {
+    let (id, json) = s.split_once(' ').unwrap_or((s, "{}"));
+    if id.is_empty() {
+        return Err(ValueError::CmdId);
+    }
+    Ok(CmdStep { id: id.to_string(), params: serde_json::from_str(json)? })
+}
+
+impl FramingArgs {
+    /// The framing `--window` or `--view` asks for (clap refuses both together).
+    pub(crate) fn framing(&self) -> Framing {
+        match (self.window, self.view) {
+            (Some(w), _) => Framing::Window(w),
+            (None, Some(ViewMode::Extents)) => Framing::Extents,
+            (None, Some(ViewMode::Current)) => Framing::Current,
+            (None, None) => Framing::Auto,
+        }
+    }
+
+    /// The framing flag given, if any.
+    fn flag(&self) -> Option<&'static str> {
+        if self.window.is_some() {
+            Some("--window")
+        } else if self.view.is_some() {
+            Some("--view")
+        } else {
+            None
+        }
+    }
+}
+
+/// A framing flag given with an output that isn't an image (the extension decides). `run` without
+/// `--export` is clap's `requires` error.
+fn framing_error(cli: &Cli) -> Option<UsageError> {
+    let (framing, out): (&FramingArgs, Option<&Path>) = match &cli.command {
+        Command::Convert(c) => (&c.framing, Some(&c.output)),
+        Command::Run(r) => (&r.framing, r.export.as_deref()),
+        _ => return None,
+    };
+    let (flag, out) = (framing.flag()?, out?);
+    (!cadcraft_io::is_image(out)).then(|| UsageError::FramingNeedsImage { flag, out: out.to_path_buf() })
+}
+
+/// An output that is the same file as an input, without `--in-place`. An output that doesn't exist
+/// can't be an input, and an I/O error in the comparison is left to the open or write that follows.
+fn out_is_input(cli: &Cli) -> Option<UsageError> {
+    let same = |input: &Path, out: &Path| out.exists() && same_file::is_same_file(input, out).unwrap_or(false);
+    match &cli.command {
+        Command::Convert(c) if !c.in_place && same(&c.input, &c.output) => Some(UsageError::OutIsInput(c.output.clone())),
+        Command::Run(r) if !r.in_place => {
+            let inputs = r.drawings.iter().filter_map(|d| if let Drawing::File(f) = d { Some(f) } else { None });
+            let inputs: Vec<&PathBuf> = inputs.collect();
+            [&r.save, &r.export].into_iter().flatten().find(|out| inputs.iter().any(|i| same(i, out))).map(|out| UsageError::OutIsInput(out.clone()))
+        }
+        _ => None,
+    }
+}
+
+/// The backend `cadcraft-cli mcp` serves from.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum McpTarget {
+    /// An in-process drawing session (no `--connect`).
+    Headless,
+    /// The running app's control channel at `HOST:PORT`; `lazy`: reached at the first call;
+    /// `launch`: opened then if it isn't running.
+    Connect { addr: String, lazy: bool, launch: bool },
+}
+
+impl McpArgs {
+    pub(crate) fn target(&self) -> McpTarget {
+        match &self.connect {
+            // `--launch` connects at the first call too (the app opens then).
+            Some(addr) => McpTarget::Connect { addr: addr.clone(), lazy: self.lazy || self.launch, launch: self.launch },
+            None => McpTarget::Headless,
+        }
+    }
+}
+
+/// `mcp --connect`: an empty, flag-like or port-less address is an error, never a silent fall back
+/// to a headless session (#103). The host is not resolved here.
+fn connect_addr(s: &str) -> Result<String, ValueError> {
+    let s = s.trim();
+    let valid = !s.starts_with('-')
+        && s.rsplit_once(':').is_some_and(|(host, port)| {
+            let host = host.strip_prefix('[').and_then(|h| h.strip_suffix(']')).unwrap_or(host);
+            !host.is_empty() && port.parse::<u16>().is_ok()
+        });
+    if valid { Ok(s.to_string()) } else { Err(ValueError::Connect) }
+}
+
+/// The values of `id` with their command-line indices.
+fn indexed<'a, T: Clone + Send + Sync + 'static>(m: &'a ArgMatches, id: &str) -> impl Iterator<Item = (usize, &'a T)> {
+    let at = m.indices_of(id).into_iter().flatten();
+    let values = m.try_get_many::<T>(id).ok().flatten().into_iter().flatten();
+    at.zip(values)
+}
+
+/// The command-line index of flag `id`, when it was given.
+fn flag_index(m: &ArgMatches, id: &str) -> Option<usize> {
+    if m.value_source(id) == Some(ValueSource::CommandLine) { m.indices_of(id).and_then(Iterator::last) } else { None }
+}
+
+/// `run`'s drawings and steps back in command-line order: clap keeps each flag's values apart,
+/// their indices say how they interleave.
+fn run_order(m: &ArgMatches) -> (Vec<Drawing>, Vec<Step>) {
+    let mut drawings: Vec<(usize, Drawing)> = indexed(m, "files").map(|(i, f): (_, &PathBuf)| (i, Drawing::File(f.clone()))).collect();
+    drawings.extend(flag_index(m, "sample").map(|i| (i, Drawing::Sample)));
+    drawings.extend(flag_index(m, "metric").map(|i| (i, Drawing::Metric)));
+    drawings.sort_by_key(|d| d.0);
+    let mut steps: Vec<(usize, Step)> = indexed(m, "script").map(|(i, s): (_, &String)| (i, Step::Script(s.clone()))).collect();
+    steps.extend(indexed(m, "script_file").map(|(i, s): (_, &PathBuf)| (i, Step::ScriptFile(s.clone()))));
+    steps.extend(indexed(m, "cmd").map(|(i, c): (_, &CmdStep)| (i, Step::Cmd(c.clone()))));
+    steps.sort_by_key(|s| s.0);
+    (drawings.into_iter().map(|d| d.1).collect(), steps.into_iter().map(|s| s.1).collect())
+}
+
+/// Parse the arguments (without the binary name). clap reads them as `OsString`s: a path need not
+/// be valid Unicode, text must. A bare `--help` or `-h` is help even after a mistake on the same
+/// line (`run --script --help`): clap reports the mistake first.
+pub(crate) fn parse(args: &[OsString]) -> Result<Cli, clap::Error> {
+    parse_with(command(|k| std::env::var_os(k)), args)
+}
+
+/// The command line. An empty or blank variable counts as unset, except `CADCRAFT_CONFIG_DIR`:
+/// empty means no settings folder. `var` looks a variable up.
+fn command(var: impl Fn(&OsStr) -> Option<OsString> + Copy) -> clap::Command {
+    let blank = move |a: clap::Arg| if a.get_id() == "config_dir" { a } else { blank_env_is_unset(a, var) };
+    Cli::command().mut_args(blank).mut_subcommands(|s| s.mut_args(blank))
+}
+
+/// [`parse`] with `cmd` from [`command`]; a bad value from a variable is a usage error naming the
+/// variable.
+fn parse_with(mut cmd: clap::Command, args: &[OsString]) -> Result<Cli, clap::Error> {
+    let argv = std::iter::once(OsString::from("cadcraft-cli")).chain(args.iter().cloned());
+    let matches = match cmd.try_get_matches_from_mut(argv) {
+        // `use_stderr`: a real error, not the help `-h` asked for (a retry would make it `--help`).
+        Err(e) if e.use_stderr() && args.iter().take_while(|a| *a != "--").any(|a| *a == "--help" || *a == "-h") => {
+            let help = [OsString::from("cadcraft-cli"), args.first().cloned().unwrap_or_default(), OsString::from("--help")];
+            return Err(cmd.try_get_matches_from_mut(help).err().unwrap_or(e));
+        }
+        matches => matches.map_err(|e| name_env_vars(e, &cmd, args))?,
+    };
+    let mut cli = Cli::from_arg_matches(&matches)?;
+    if let (Command::Run(r), Some((_, m))) = (&mut cli.command, matches.subcommand()) {
+        (r.drawings, r.steps) = run_order(m);
+    }
+    if let Some(e) = framing_error(&cli).or_else(|| out_is_input(&cli)) {
+        if let Some(sub) = matches.subcommand_name().and_then(|n| cmd.find_subcommand_mut(n)) {
+            return Err(e.into_clap(sub));
+        }
+        return Err(e.into_clap(&mut cmd));
+    }
+    Ok(cli)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    fn parse_args(a: &[&str]) -> Result<Cli, clap::Error> {
+        parse(&a.iter().map(OsString::from).collect::<Vec<_>>())
+    }
+
+    fn mcp(a: &[&str]) -> Result<McpTarget, clap::Error> {
+        let args: Vec<&str> = std::iter::once("mcp").chain(a.iter().copied()).collect();
+        match parse_args(&args)?.command {
+            Command::Mcp(m) => Ok(m.target()),
+            _ => panic!("{a:?} is not mcp"),
+        }
+    }
+
+    /// Every file argument's help names each format of the list it uses.
+    #[test]
+    fn help_names_every_format() {
+        let cli = Cli::command();
+        let help = |sub: &str, arg: &str| {
+            let a = cli.find_subcommand(sub).and_then(|c| c.get_arguments().find(|a| a.get_id() == arg)).expect("argument exists");
+            a.get_help().map(|h| h.to_string()).unwrap_or_default()
+        };
+        let cases: [(&str, &str, &[Format]); 8] = [
+            ("info", "file", Format::READ),
+            ("convert", "input", Format::READ),
+            ("convert", "output", Format::WRITE),
+            ("run", "files", Format::READ),
+            ("run", "save", Format::WRITE),
+            ("run", "export", Format::WRITE),
+            ("sample", "output", Format::WRITE),
+            ("convert", "", Format::WRITE),
+        ];
+        for (sub, arg, list) in cases {
+            let text = if arg.is_empty() {
+                cli.find_subcommand(sub).and_then(|c| c.get_about()).map(|a| a.to_string()).unwrap_or_default()
+            } else {
+                help(sub, arg)
+            };
+            for f in list {
+                assert!(text.contains(f.extension()), "`{sub} {arg}` help `{text}` lacks {}", f.extension());
+            }
+        }
+    }
+
+    #[test]
+    fn mcp_without_connect_is_headless() {
+        assert_eq!(mcp(&[]).unwrap(), McpTarget::Headless);
+    }
+
+    #[test]
+    fn mcp_connect_with_address_selects_remote() {
+        let to = |addr: &str, lazy, launch| McpTarget::Connect { addr: addr.into(), lazy, launch };
+        assert_eq!(mcp(&["--connect", "127.0.0.1:7979"]).unwrap(), to("127.0.0.1:7979", false, false));
+        assert_eq!(mcp(&["--connect", " localhost:7979 "]).unwrap(), to("localhost:7979", false, false));
+        assert_eq!(mcp(&["--lazy", "--connect", "localhost:7979"]).unwrap(), to("localhost:7979", true, false));
+        assert_eq!(mcp(&["--connect", "localhost:7979", "--launch"]).unwrap(), to("localhost:7979", true, true));
+        assert_eq!(mcp(&["--connect", "[::1]:7979"]).unwrap(), to("[::1]:7979", false, false));
+        // Without an app to reach they mean nothing: never a headless session.
+        for flag in ["--lazy", "--launch"] {
+            assert_eq!(mcp(&[flag]).unwrap_err().kind(), clap::error::ErrorKind::MissingRequiredArgument, "{flag}");
+        }
+    }
+
+    #[test]
+    fn mcp_connect_without_address_is_an_error_not_headless() {
+        for bad in [
+            &["--connect"][..],
+            &["--connect", ""],
+            &["--connect", "  "],
+            &["--connect=-v"],
+            &["--connect", "example.com"],
+            &["--connect", ":7979"],
+            &["--connect", "host:99999"],
+            &["--connect", "[]:1"],
+        ] {
+            let r = mcp(bad);
+            let Err(e) = r else { panic!("{bad:?} should be rejected, got {r:?}") };
+            assert_eq!(e.exit_code(), 2, "{bad:?}");
+            assert!(e.to_string().contains("--connect <HOST:PORT>"), "{bad:?}: {e}");
+        }
+    }
+
+    #[test]
+    fn mcp_rejects_unknown_and_repeated_arguments() {
+        assert!(mcp(&["--conect", "127.0.0.1:7979"]).is_err());
+        assert!(mcp(&["127.0.0.1:7979"]).is_err());
+        // clap names the unknown flag, not the value it left missing.
+        for flag in ["--foo", "-v"] {
+            assert_eq!(mcp(&["--connect", flag]).unwrap_err().kind(), clap::error::ErrorKind::UnknownArgument, "{flag}");
+        }
+        assert!(mcp(&["--connect", "127.0.0.1:1", "--connect", "127.0.0.1:2"]).is_err());
+    }
+
+    #[test]
+    fn run_keeps_command_line_order() {
+        let args =
+            ["run", "a.dxf", "--script", "S1", "--metric", "--cmd", "c1", "b.dxf", "--script-file", "f.scr", "--sample", "--cmd", "c2 {\"n\":1}"];
+        let Command::Run(r) = parse_args(&args).unwrap().command else { panic!("not run") };
+        let file = |f: &str| Drawing::File(f.into());
+        let cmd = |id: &str, params| Step::Cmd(CmdStep { id: id.into(), params });
+        assert_eq!(r.drawings, [file("a.dxf"), Drawing::Metric, file("b.dxf"), Drawing::Sample]);
+        assert_eq!(r.steps, [Step::Script("S1".into()), cmd("c1", json!({})), Step::ScriptFile("f.scr".into()), cmd("c2", json!({"n": 1}))]);
+    }
+
+    #[test]
+    fn cmd_values() {
+        assert_eq!(cmd_step("line").unwrap(), CmdStep { id: "line".into(), params: json!({}) });
+        assert_eq!(cmd_step("line [1]").unwrap(), CmdStep { id: "line".into(), params: json!([1]) });
+        for bad in ["", " {}", "line {bad json", "line "] {
+            assert!(cmd_step(bad).is_err(), "`{bad}` should be rejected");
+        }
+    }
+
+    #[test]
+    fn perf_targets() {
+        let target = |a: &[&str]| -> Option<PerfTarget> {
+            let args: Vec<&str> = std::iter::once("perf").chain(a.iter().copied()).collect();
+            let Command::Perf(p) = parse_args(&args).unwrap().command else { panic!("not perf") };
+            p.target
+        };
+        assert_eq!(target(&[]), None);
+        assert_eq!(target(&["5"]), Some(PerfTarget::Count(5)));
+        assert_eq!(target(&["0"]), Some(PerfTarget::Count(1)));
+        assert_eq!(target(&["999999999"]), Some(PerfTarget::Count(MAX_PERF_COUNT)));
+        assert_eq!(target(&["a.dxf"]), Some(PerfTarget::File("a.dxf".into())));
+        assert_eq!(target(&["1e3"]), Some(PerfTarget::File("1e3".into())));
+    }
+
+    #[test]
+    fn framing_options() {
+        let framing = |out: &str, a: &[&str]| -> Result<Framing, clap::Error> {
+            let args: Vec<&str> = ["convert", "a.dxf", out].iter().chain(a).copied().collect();
+            let Command::Convert(c) = parse_args(&args)?.command else { panic!("not convert") };
+            Ok(c.framing.framing())
+        };
+        let b = |x0, y0, x1, y1| Bounds2::new(Vec2::new(x0, y0), Vec2::new(x1, y1));
+        assert_eq!(framing("b.png", &[]).unwrap(), Framing::Auto);
+        assert_eq!(framing("b.png", &["--view", "extents"]).unwrap(), Framing::Extents);
+        assert_eq!(framing("b.png", &["--view", "CURRENT"]).unwrap(), Framing::Current);
+        assert_eq!(framing("b.png", &["--window", "0,0,2,1"]).unwrap(), Framing::Window(b(0.0, 0.0, 2.0, 1.0)));
+        assert_eq!(framing("b.dxf", &[]).unwrap(), Framing::Auto);
+        let kind = |out: &str, a: &[&str]| framing(out, a).map(|_| ()).unwrap_err().kind();
+        assert_eq!(kind("b.png", &["--view", "selection"]), ErrorKind::InvalidValue);
+        assert_eq!(kind("b.png", &["--window", "0,0,2,1", "--view", "extents"]), ErrorKind::ArgumentConflict);
+        assert_eq!(kind("b.dxf", &["--view", "extents"]), ErrorKind::ArgumentConflict);
+        assert_eq!(kind("b.dxf", &["--window", "0,0,2,1"]), ErrorKind::ArgumentConflict);
+    }
+
+    #[test]
+    fn window_parses() {
+        let b = |x0, y0, x1, y1| Bounds2::new(Vec2::new(x0, y0), Vec2::new(x1, y1));
+        assert_eq!(parse_window("0,0,30,20").unwrap(), b(0.0, 0.0, 30.0, 20.0));
+        assert_eq!(parse_window(" -5.5, -1e3 ,2e3,4 ").unwrap(), b(-5.5, -1000.0, 2000.0, 4.0));
+    }
+
+    #[test]
+    fn hostile_window_is_an_error() {
+        for w in [
+            "",
+            "1,2,3",
+            "1,2,3,4,5",
+            "a,0,1,1",
+            "NaN,0,1,1",
+            "0,0,inf,1",
+            "0,0,1e400,1",
+            "0,0,0,1",
+            "0,0,1,0",
+            "5,0,1,1",
+            "0,5,1,1",
+            "-1e300,-1e300,1e300,1e300",
+            "0,0,1e-12,1e-12",
+        ] {
+            assert!(parse_window(w).is_err(), "`{w}` should be rejected");
+        }
+    }
+
+    /// The subcommands that draw or run commands take the settings flags; the others refuse them.
+    #[test]
+    fn settings_flags() {
+        let Command::Convert(c) =
+            parse_args(&["convert", "a.dxf", "b.png", "--config-dir", "/p", "--fontalt", "Noto Sans", "--fontfallback="]).unwrap().command
+        else {
+            panic!("not convert")
+        };
+        assert_eq!(c.settings.config_dir, Some(PathBuf::from("/p")));
+        assert_eq!((c.settings.fontalt.as_deref(), c.settings.fontfallback.as_deref()), (Some("Noto Sans"), Some("")));
+        for empty in ["--config-dir=", "--config-dir= "] {
+            let Command::Run(r) = parse_args(&["run", "--sample", empty]).unwrap().command else { panic!("not run") };
+            assert_eq!(r.settings.settings_dir(), None, "`{empty}` is no settings folder");
+        }
+        let Command::Convert(c) = parse_args(&["convert", "a.dxf", "b.png", "--config-dir", "/p"]).unwrap().command else { panic!("not convert") };
+        assert_eq!(c.settings.settings_dir(), Some(PathBuf::from("/p")));
+        assert!(parse_args(&["sample", "bracket", "b.dxf", "--fontalt", "x"]).is_ok());
+        assert!(parse_args(&["mcp", "--config-dir", "/p"]).is_ok());
+        assert!(parse_args(&["info", "a.dxf", "--config-dir", "/p"]).is_err());
+    }
+
+    #[test]
+    fn blank_variables_count_as_unset_except_the_config_dir() {
+        let cmd = command(|_| Some("".into()));
+        for sub in cmd.get_subcommands().filter(|s| s.get_arguments().any(|a| a.get_id() == "fontalt")) {
+            let env = |id: &str| sub.get_arguments().find(|a| a.get_id() == id).and_then(|a| a.get_env());
+            assert_eq!((env("fontalt"), env("fontfallback")), (None, None), "{}", sub.get_name());
+            assert_eq!(env("config_dir"), Some(OsStr::new("CADCRAFT_CONFIG_DIR")), "{}", sub.get_name());
+        }
+    }
+
+    /// `--fontalt` falls back to `PATH` and rejects every value here, as a bad value from a
+    /// variable would; tests can't set a variable (`set_var` is unsafe).
+    #[test]
+    fn a_bad_value_from_a_variable_names_the_variable() {
+        // Cargo sets CARGO_PKG_NAME for every test binary, so the variable always has a value.
+        let reject = clap::builder::PossibleValuesParser::new(["never"]);
+        let cmd = || Cli::command().mut_subcommand("sample", |s| s.mut_arg("fontalt", |a| a.env("CARGO_PKG_NAME").value_parser(reject.clone())));
+        let args = |a: &[&str]| a.iter().map(OsString::from).collect::<Vec<_>>();
+        let text = parse_with(cmd(), &args(&["sample"])).err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(text.contains("for 'CARGO_PKG_NAME'") && !text.contains("--fontalt"), "{text}");
+        let text = parse_with(cmd(), &args(&["sample", "--fontalt", "x"])).err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(text.contains("--fontalt"), "{text}");
+    }
+}

apps/cadcraft-cli/src/commands.rs

@@ -0,0 +1,17 @@
+use super::args::CommandsArgs;
+use super::error::Result;
+use super::output::Streams;
+use cadcraft_engine::Session;
+use serde_json::Value;
+
+pub(crate) fn commands(a: &CommandsArgs, io: &mut Streams) -> Result {
+    let s = Session::new();
+    let f = a.filter.as_ref().map(|x| x.to_ascii_lowercase());
+    let v: Vec<Value> = cadcraft_engine::command_specs()
+        .iter()
+        .filter(|c| f.as_ref().is_none_or(|f| c.id.contains(f.as_str()) || c.label.to_ascii_lowercase().contains(f.as_str())))
+        .map(|c| serde_json::to_value(c.info(&s)).unwrap_or_default())
+        .collect();
+    io.json(&Value::Array(v), a.compact);
+    Ok(())
+}

apps/cadcraft-cli/src/convert.rs

@@ -0,0 +1,23 @@
+use super::args::ConvertArgs;
+use super::error::Result;
+use super::output::{Streams, export_framed, export_window, read_note_messages, skipped_message, undrawn_message};
+use super::{open, unicode};
+use cadcraft_engine::Session;
+
+pub(crate) fn convert(a: &ConvertArgs, io: &mut Streams) -> Result {
+    let i = unicode(&a.input)?;
+    let framing = a.framing.framing();
+    let mut s = Session::empty();
+    open(&mut s, &a.input)?;
+    let d = s.doc()?;
+    for m in read_note_messages(d, i).into_iter().chain(skipped_message(d, i)) {
+        io.errln(format_args!("{m}"));
+    }
+    if cadcraft_io::is_image(&a.output)
+        && let Some(m) = undrawn_message(s.doc()?, i)
+    {
+        io.errln(format_args!("{m}"));
+    }
+    let window = export_window(&s, framing, None)?;
+    export_framed(&s, &a.output, window, io)
+}

apps/cadcraft-cli/src/error.rs

@@ -0,0 +1,32 @@
+use crate::output::OutputError;
+use crate::perf::PerfError;
+use crate::roundtrip::RoundtripError;
+use crate::run::RunError;
+
+/// Why a subcommand failed: printed as `error: {e}`, exit 1.
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum CliError {
+    #[error(transparent)]
+    Engine(#[from] cadcraft_engine::EngineError),
+    #[error(transparent)]
+    Doc(#[from] cadcraft_engine::doc::DocError),
+    #[error(transparent)]
+    Format(#[from] cadcraft_io::IoError),
+    #[error(transparent)]
+    Io(#[from] std::io::Error),
+    #[error(transparent)]
+    Run(#[from] RunError),
+    #[error(transparent)]
+    Output(#[from] OutputError),
+    #[error(transparent)]
+    Perf(#[from] PerfError),
+    #[error(transparent)]
+    Roundtrip(#[from] RoundtripError),
+    /// The engine and io crates take file names as text.
+    #[error("{}: the file name is not valid Unicode", .0.display())]
+    NotUnicode(std::path::PathBuf),
+    #[error("cannot connect to {addr}: {source}")]
+    McpConnect { addr: String, source: std::io::Error },
+}
+
+pub(crate) type Result<T = (), E = CliError> = std::result::Result<T, E>;

apps/cadcraft-cli/src/info.rs

@@ -0,0 +1,14 @@
+use super::args::InfoArgs;
+use super::error::Result;
+use super::open;
+use super::output::Streams;
+use cadcraft_engine::Session;
+use serde_json::json;
+
+pub(crate) fn info(a: &InfoArgs, io: &mut Streams) -> Result {
+    let mut s = Session::empty();
+    open(&mut s, &a.file)?;
+    let v = s.execute("drawing.inspect", &json!({ "entities": false }))?;
+    io.json(&v, a.compact);
+    Ok(())
+}

apps/cadcraft-cli/src/lib.rs

@@ -0,0 +1,318 @@
+//! `cadcraft-cli`: headless CADCraft. The subcommands and their options are the clap types in
+//! `args.rs`; `cadcraft-cli --help` lists them.
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+use std::ffi::OsString;
+use std::io::Write;
+
+use cadcraft_engine::Session;
+use serde_json::json;
+
+mod args;
+mod commands;
+mod convert;
+mod error;
+mod info;
+mod mcp;
+mod output;
+mod perf;
+mod roundtrip;
+mod run;
+mod sample;
+
+#[cfg(test)]
+use args::Framing;
+use args::{Command, parse};
+use clap::CommandFactory;
+use commands::commands;
+use convert::convert;
+use error::Result;
+use info::info;
+use mcp::mcp;
+use output::Streams;
+#[cfg(test)]
+use output::{export_window, model_views, write_atomic};
+use perf::perf;
+use roundtrip::roundtrip;
+use run::run_cmds;
+#[cfg(test)]
+use run::{fill_last, returned_handle};
+use sample::sample;
+
+fn install_io() {
+    cadcraft_engine::cmd::file::set_io(cadcraft_engine::cmd::file::IoHooks {
+        read: |b, name| cadcraft_io::read(b, name).map_err(|e| e.to_string()),
+        write: |d, name| cadcraft_io::write(d, name).map_err(|e| e.to_string()),
+        plot: Some(|d, space, opts| cadcraft_io::plotter::plot(d, space, opts).map_err(|e| e.to_string())),
+    });
+    cadcraft_engine::cmd::file::set_write_as(|d, name, o| {
+        cadcraft_io::write_with(d, name, &cadcraft_io::SaveOptions { version: o.version, binary: o.binary }).map_err(|e| e.to_string())
+    });
+    // AutoLISP's entget, entmake and entmod see entities as DXF groups.
+    cadcraft_engine::cmd::file::set_entity_codec(cadcraft_engine::cmd::file::EntityCodec {
+        groups: cadcraft_io::entity_groups,
+        entity: cadcraft_io::entity_from_groups,
+    });
+}
+
+/// `path` as text, for the engine and io calls that take a file name as a string.
+fn unicode(path: &std::path::Path) -> Result<&str> {
+    path.to_str().ok_or_else(|| error::CliError::NotUnicode(path.to_path_buf()))
+}
+
+fn open(s: &mut Session, path: &std::path::Path) -> Result {
+    s.execute("open", &json!({ "path": unicode(path)? }))?;
+    Ok(())
+}
+
+/// The command line's clap definition, for generating shell completions and man pages.
+pub fn command() -> clap::Command {
+    args::Cli::command()
+}
+
+/// Run the CLI on its arguments (without the program name). Returns the process exit code (0 ok,
+/// 1 failure, 2 usage). clap reads the arguments as they are: a value that is not valid Unicode
+/// is a usage error, never a panic as with `std::env::args()`.
+pub fn run<I, T>(args: I, out: &mut dyn Write, err: &mut dyn Write) -> i32
+where
+    I: IntoIterator<Item = T>,
+    T: Into<OsString>,
+{
+    let args: Vec<OsString> = args.into_iter().map(Into::into).collect();
+    // Help and `--version` (`help`, `-h`, `<subcommand> --help`, `-V`) come back as errors too,
+    // for `out`, exit 0: the subcommand never runs.
+    let cli = match parse(&args) {
+        Ok(cli) => cli,
+        Err(e) => {
+            let to: &mut dyn Write = if e.use_stderr() { err } else { out };
+            return match write!(to, "{}", e.render()) {
+                Err(w) if w.kind() != std::io::ErrorKind::BrokenPipe => {
+                    let _ = writeln!(err, "error: can't write the output: {w}");
+                    1
+                }
+                _ => e.exit_code(),
+            };
+        }
+    };
+    // The engine's hooks are set-once, so installing them on every call is harmless.
+    install_io();
+    match &cli.command {
+        Command::Convert(a) => a.settings.apply(),
+        Command::Run(a) => a.settings.apply(),
+        Command::Mcp(a) => a.settings.apply(),
+        Command::Sample(a) => a.settings.apply(),
+        Command::Info(_) | Command::Commands(_) | Command::Perf(_) | Command::Roundtrip(_) => {}
+    }
+    let mut io = Streams::new(out, err);
+    let result = match &cli.command {
+        Command::Info(a) => info(a, &mut io),
+        Command::Convert(a) => convert(a, &mut io),
+        Command::Run(a) => run_cmds(a, &mut io),
+        Command::Commands(a) => commands(a, &mut io),
+        Command::Mcp(a) => mcp(a),
+        Command::Perf(a) => perf(a.target.as_ref(), &mut io),
+        Command::Sample(a) => sample(a, &mut io),
+        Command::Roundtrip(a) => roundtrip(a, &mut io),
+    };
+    let mut code = 0;
+    if let Err(e) = result {
+        io.errln(format_args!("error: {e}"));
+        code = 1;
+    }
+    io.finish();
+    if io.stdout_failed() { 1 } else { code }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use cadcraft_engine::doc::Space;
+    use cadcraft_engine::geom::{Bounds2, Vec2};
+
+    fn scratch_dir(tag: &str) -> std::path::PathBuf {
+        let dir = std::env::temp_dir().join(format!("cadcraft-cli-{tag}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).expect("create scratch dir");
+        dir
+    }
+
+    struct FailingWriter(std::io::ErrorKind);
+
+    impl Write for FailingWriter {
+        fn write(&mut self, _: &[u8]) -> std::io::Result<usize> {
+            Err(self.0.into())
+        }
+        fn flush(&mut self) -> std::io::Result<()> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn a_failed_write_of_help_exits_1_unless_the_pipe_is_closed() {
+        let mut err = Vec::new();
+        assert_eq!(run(["--help"], &mut FailingWriter(std::io::ErrorKind::StorageFull), &mut err), 1);
+        assert!(String::from_utf8_lossy(&err).starts_with("error: "));
+        assert_eq!(run(["--help"], &mut FailingWriter(std::io::ErrorKind::BrokenPipe), &mut Vec::new()), 0);
+    }
+
+    #[test]
+    fn write_atomic_replaces_file_and_leaves_no_staging_files() {
+        let dir = scratch_dir("replace");
+        let out = dir.join("a.dxf");
+        write_atomic(&out, b"old").expect("create");
+        write_atomic(&out, b"new").expect("overwrite");
+        assert_eq!(std::fs::read(&out).expect("read"), b"new");
+        assert_eq!(std::fs::read_dir(&dir).expect("list").count(), 1);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn write_atomic_failure_keeps_destination_and_cleans_up() {
+        let dir = scratch_dir("fail");
+        let out = dir.join("target");
+        std::fs::create_dir(&out).expect("dir as destination");
+        std::fs::write(out.join("keep"), b"x").expect("seed");
+        assert!(write_atomic(&out, b"new").is_err());
+        assert_eq!(std::fs::read(out.join("keep")).expect("kept"), b"x");
+        assert_eq!(std::fs::read_dir(&dir).expect("list").count(), 1);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    fn b(x0: f64, y0: f64, x1: f64, y1: f64) -> Bounds2 {
+        Bounds2::new(Vec2::new(x0, y0), Vec2::new(x1, y1))
+    }
+
+    fn sample_session() -> Session {
+        let mut s = Session::empty();
+        s.open_drawing(cadcraft_engine::sample::default_sample(), "Bracket", None);
+        s
+    }
+
+    fn view_box(svg: &str) -> String {
+        let i = svg.find("viewBox=\"").map(|i| i + 9).unwrap_or(0);
+        svg[i..].split('"').next().unwrap_or("").to_string()
+    }
+
+    fn assert_near(a: Bounds2, e: Bounds2) {
+        let d = (a.min - e.min).len().max((a.max - e.max).len());
+        assert!(d < 1e-9, "{a:?} != {e:?}");
+    }
+
+    #[test]
+    fn last_placeholder_takes_the_previous_handle() {
+        let mut s = sample_session();
+        let r = s.execute("line", &json!({"points": [[0, 0], [10, 0]]})).unwrap();
+        let h = returned_handle(&s, &r).expect("LINE returns its handle");
+        assert_eq!(fill_last(&json!({"handle": "{last}"}), Some(h)).unwrap(), json!({"handle": h.hex()}));
+        // Nested, as in a selection list.
+        assert_eq!(fill_last(&json!({"handles": ["{last}", "1"]}), Some(h)).unwrap(), json!({"handles": [h.hex(), "1"]}));
+        // Only the exact token: a name or a sentence that merely contains it stays as written.
+        for p in [json!("last"), json!("{last} "), json!({"name": "last"})] {
+            assert_eq!(fill_last(&p, Some(h)).unwrap(), p);
+        }
+        // Nothing returned yet: an error, not a token passed to the command as a bad handle.
+        assert!(fill_last(&json!({"handle": "{last}"}), None).unwrap_err().to_string().contains("{last}"));
+    }
+
+    /// Handles are read from a result by looking the strings up in the drawing: counts and names
+    /// are not mistaken for handles, and `mview`'s `viewports` works like `handle`/`handles`.
+    #[test]
+    fn returned_handle_reads_only_real_handles() {
+        let mut s = Session::empty();
+        s.new_drawing(false);
+        s.execute("layout.set", &json!({"name": "Layout1"})).unwrap();
+        let r = s.execute("mview", &json!({"p1": [20, 20], "p2": [200, 150]})).unwrap();
+        let h = returned_handle(&s, &r).expect("mview returns its viewport handle");
+        assert!(r["viewports"].as_array().is_some_and(|a| a.iter().any(|v| v.as_str() == Some(h.hex().as_str()))), "{r}");
+        assert_eq!(returned_handle(&s, &json!({"changed": 3, "name": "A1"})), None);
+        // The most recent of several.
+        let a = s.execute("line", &json!({"points": [[0, 0], [1, 0]]})).unwrap();
+        let b = s.execute("line", &json!({"points": [[0, 0], [2, 0]]})).unwrap();
+        let (ha, hb) = (returned_handle(&s, &a).unwrap(), returned_handle(&s, &b).unwrap());
+        assert_eq!(returned_handle(&s, &json!({"handles": [ha.hex(), hb.hex()]})), Some(hb));
+    }
+
+    #[test]
+    fn default_framing_is_extents() {
+        // convert: nothing ran, always the extents.
+        let s = sample_session();
+        assert_eq!(export_window(&s, Framing::Auto, None).unwrap(), None);
+        // run: commands that leave the view alone keep the extents framing.
+        let mut s = sample_session();
+        let before = model_views(&s);
+        s.script("LINE 0,0 10,10\n\n").unwrap();
+        assert_eq!(export_window(&s, Framing::Auto, Some(&before)).unwrap(), None);
+        // A fresh drawing too.
+        let mut s = Session::empty();
+        s.new_drawing(false);
+        let before = model_views(&s);
+        s.execute("circle", &json!({"center": [0, 0], "radius": 5})).unwrap();
+        assert_eq!(export_window(&s, Framing::Auto, Some(&before)).unwrap(), None);
+    }
+
+    #[test]
+    fn zoom_window_frames_export() {
+        let mut s = sample_session();
+        let before = model_views(&s);
+        s.execute("zoom", &json!({"mode": "window", "p1": [0, 0], "p2": [30, 20]})).unwrap();
+        let w = export_window(&s, Framing::Auto, Some(&before)).unwrap().unwrap();
+        // The CLI viewport is 3:2, so a 3:2 window is shown exactly.
+        assert_near(w, b(0.0, 0.0, 30.0, 20.0));
+        assert_eq!(export_window(&s, Framing::Current, Some(&before)).unwrap(), Some(w));
+        // --view extents and --window override the zoom.
+        assert_eq!(export_window(&s, Framing::Extents, Some(&before)).unwrap(), None);
+        let explicit = b(1.0, 1.0, 2.0, 2.0);
+        assert_eq!(export_window(&s, Framing::Window(explicit), Some(&before)).unwrap(), Some(explicit));
+        // A taller window keeps its height; the 3:2 image adds room left and right.
+        s.execute("zoom", &json!({"mode": "center", "center": [5, 5], "height": 4})).unwrap();
+        assert_near(export_window(&s, Framing::Auto, Some(&before)).unwrap().unwrap(), b(2.0, 3.0, 8.0, 7.0));
+    }
+
+    #[test]
+    fn zoom_object_frames_the_selection() {
+        let mut s = sample_session();
+        let before = model_views(&s);
+        // The smallest entity with an area, selected then framed with ZOOM Object.
+        let d = s.doc().unwrap();
+        let bounds = |e: &cadcraft_engine::doc::Entity| cadcraft_engine::doc::entity_bounds(d, e, 0);
+        let e = d
+            .model
+            .iter()
+            .filter(|e| bounds(e).width() > 0.0 && bounds(e).height() > 0.0)
+            .min_by(|a, b| bounds(a).width().total_cmp(&bounds(b).width()))
+            .unwrap();
+        let (h, eb, ext) = (e.handle, bounds(e), d.extents(&Space::Model));
+        s.set_selection(vec![h]);
+        s.execute("zoom", &json!({"mode": "object"})).unwrap();
+        let w = export_window(&s, Framing::Auto, Some(&before)).unwrap().unwrap();
+        assert!(w.contains(eb.min) && w.contains(eb.max));
+        assert!(w.width() < ext.width() && w.height() < ext.height(), "{w:?} vs extents {ext:?}");
+    }
+
+    #[test]
+    fn run_export_honours_zoom() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-cli-165-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = |n: &str| dir.join(n).to_string_lossy().to_string();
+        let run_svg = |extra: &[&str], out: &str| -> String {
+            let mut args: Vec<String> = ["run", "--sample"].iter().chain(extra).map(|a| a.to_string()).collect();
+            args.extend(["--export".to_string(), path(out)]);
+            assert_eq!(run(args, &mut Vec::new(), &mut Vec::new()), 0);
+            std::fs::read_to_string(path(out)).unwrap()
+        };
+        let base = run_svg(&[], "base.svg");
+        let zoomed = run_svg(&["--cmd", r#"zoom {"mode":"window","p1":[0,0],"p2":[30,20]}"#], "zoom.svg");
+        let window = run_svg(&["--window", "0,0,30,20"], "window.svg");
+        let forced = run_svg(&["--cmd", r#"zoom {"mode":"window","p1":[0,0],"p2":[30,20]}"#, "--view", "extents"], "forced.svg");
+        assert_ne!(view_box(&zoomed), view_box(&base));
+        assert_eq!(view_box(&zoomed), "0 0 30.000000 20.000000");
+        assert_eq!(zoomed, window);
+        assert_eq!(forced, base);
+        // Hostile --window: a usage error, nothing written.
+        let mut err = Vec::new();
+        assert_eq!(run(["run", "--sample", "--window", "0,0,NaN,1", "--export", &path("bad.png")], &mut Vec::new(), &mut err), 2);
+        assert!(String::from_utf8_lossy(&err).contains("--window"));
+        assert!(!dir.join("bad.png").exists());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

apps/cadcraft-cli/src/mcp.rs

@@ -0,0 +1,17 @@
+use super::args::{McpArgs, McpTarget};
+use super::error::{CliError, Result};
+
+pub(crate) fn mcp(a: &McpArgs) -> Result {
+    let backend: Box<dyn cadcraft_mcp::Backend> = match a.target() {
+        McpTarget::Connect { addr, lazy: true, launch } => Box::new(cadcraft_mcp::Remote::lazy(&addr, launch)),
+        McpTarget::Connect { addr, .. } => match cadcraft_mcp::Remote::connect(&addr) {
+            Ok(r) => Box::new(r),
+            Err(source) => return Err(CliError::McpConnect { addr, source }),
+        },
+        McpTarget::Headless => Box::new(cadcraft_mcp::Headless::default()),
+    };
+    let stdin = std::io::stdin();
+    let stdout = std::io::stdout();
+    cadcraft_mcp::Server::new(backend).serve(stdin.lock(), stdout.lock())?;
+    Ok(())
+}

apps/cadcraft-cli/src/output.rs

@@ -0,0 +1,212 @@
+use super::args::Framing;
+use super::error::Result;
+use cadcraft_engine::doc::Space;
+use cadcraft_engine::geom::{Bounds2, Vec2};
+use cadcraft_engine::{Session, View};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+/// The process's output streams. A write to stdout that fails never stops the program: once
+/// stdout has failed, later output is dropped and the work goes on, so the rest of `run` (later
+/// `--cmd` results, `--save`, `--export`) still happens and `cadcraft-cli run … --save out.dxf |
+/// head` keeps the drawing. A reader that stopped early (a closed pipe, `cadcraft-cli commands |
+/// head`) is not an error, as in ripgrep; any other write error is reported once on stderr and
+/// makes the exit status 1.
+pub(crate) struct Streams<'a> {
+    out: &'a mut dyn Write,
+    err: &'a mut dyn Write,
+    /// Set once a write to `out` has failed; later output is dropped.
+    gone: bool,
+    /// Set when `out` failed for a reason other than a closed reader.
+    failed: bool,
+}
+
+impl<'a> Streams<'a> {
+    pub(crate) fn new(out: &'a mut dyn Write, err: &'a mut dyn Write) -> Self {
+        Streams { out, err, gone: false, failed: false }
+    }
+
+    /// Write a line to stdout.
+    pub(crate) fn outln(&mut self, args: std::fmt::Arguments) {
+        if !self.gone
+            && let Err(e) = writeln!(self.out, "{args}")
+        {
+            self.out_failed(e);
+        }
+    }
+
+    /// Write `v` to stdout: pretty-printed, or on one line with `compact` (`--compact`).
+    pub(crate) fn json(&mut self, v: &serde_json::Value, compact: bool) {
+        if compact {
+            self.outln(format_args!("{v}"));
+        } else {
+            self.outln(format_args!("{v:#}"));
+        }
+    }
+
+    /// Write a line to stderr. A failing stderr has nowhere to report to, so it is ignored.
+    pub(crate) fn errln(&mut self, args: std::fmt::Arguments) {
+        let _ = writeln!(self.err, "{args}");
+    }
+
+    /// Flush stdout (a pipe that closed during buffered output surfaces here).
+    pub(crate) fn finish(&mut self) {
+        if !self.gone
+            && let Err(e) = self.out.flush()
+        {
+            self.out_failed(e);
+        }
+    }
+
+    /// Whether stdout failed for a reason other than a closed reader: the exit status is 1.
+    pub(crate) fn stdout_failed(&self) -> bool {
+        self.failed
+    }
+
+    fn out_failed(&mut self, e: std::io::Error) {
+        if std::mem::replace(&mut self.gone, true) || e.kind() == std::io::ErrorKind::BrokenPipe {
+            return;
+        }
+        self.errln(format_args!("cadcraft-cli: can't write to stdout: {e}"));
+        self.failed = true;
+    }
+}
+
+/// Why writing or framing an output failed.
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum OutputError {
+    #[error("--view current: the drawing has no model-space view")]
+    NoModelView,
+    #[error("{}: {source}", path.display())]
+    Write { path: PathBuf, source: std::io::Error },
+}
+
+/// The model-space view of every open drawing, by drawing id (to tell whether commands changed it).
+pub(crate) fn model_views(s: &Session) -> Vec<(u64, Option<View>)> {
+    s.docs.iter().map(|st| (st.uid, st.views.iter().find(|(sp, _)| *sp == Space::Model).map(|(_, v)| *v))).collect()
+}
+
+/// The active drawing's current model-space view as a rectangle with the viewport's aspect ratio
+/// (the CLI viewport is 3:2 like the PNG export, so the image shows exactly this view).
+fn current_window(s: &Session) -> Option<Bounds2> {
+    let st = s.state().ok()?;
+    let v = st.views.iter().find(|(sp, _)| *sp == Space::Model).map(|(_, v)| *v)?;
+    let (w, h) = s.viewport_px;
+    let half = Vec2::new(v.height * w / h.max(1.0), v.height) * 0.5;
+    Some(Bounds2::new(v.center - half, v.center + half))
+}
+
+/// The window an image export shows, or `None` to fit the extents. `before` is [`model_views`]
+/// taken before the commands ran (`None` for `convert`, where nothing ran).
+pub(crate) fn export_window(s: &Session, framing: Framing, before: Option<&[(u64, Option<View>)]>) -> Result<Option<Bounds2>, OutputError> {
+    match framing {
+        Framing::Window(w) => Ok(Some(w)),
+        Framing::Extents => Ok(None),
+        Framing::Current => current_window(s).map(Some).ok_or(OutputError::NoModelView),
+        Framing::Auto => {
+            let Some(before) = before else { return Ok(None) };
+            let Ok(st) = s.state() else { return Ok(None) };
+            let now = model_views(s);
+            let was = before.iter().find(|(uid, _)| *uid == st.uid);
+            let is = now.iter().find(|(uid, _)| *uid == st.uid);
+            // Only a view the commands changed counts; a drawing opened by the commands keeps
+            // the extents framing.
+            match (was, is) {
+                (Some(a), Some(b)) if a.1 != b.1 => Ok(current_window(s)),
+                _ => Ok(None),
+            }
+        }
+    }
+}
+
+/// Write `bytes` to `out` through the engine's atomic writer (an exclusively created sibling file
+/// renamed over `out`), so a failed or interrupted write leaves the previous file untouched. An
+/// existing `out` is resolved first: the rename would otherwise replace a symlink with a file and
+/// leave the file it points to (`--in-place` through a link) unchanged. Folders missing above `out`
+/// are created, and the topmost one returned for the caller to report.
+pub(crate) fn write_atomic(out: &Path, bytes: &[u8]) -> Result<Option<std::path::PathBuf>, OutputError> {
+    let target = std::fs::canonicalize(out).unwrap_or_else(|_| out.to_path_buf());
+    let folder = cadcraft_engine::atomic_write::missing_folder(&target);
+    cadcraft_engine::atomic_write::write_atomic_making_folders(&target, bytes)
+        .map_err(|source| OutputError::Write { path: out.to_path_buf(), source })?;
+    Ok(folder)
+}
+
+/// Say that `out` went into a folder that didn't exist, so a mistyped path is noticed.
+pub(crate) fn report_new_folder(folder: Option<std::path::PathBuf>, io: &mut Streams) {
+    if let Some(folder) = folder {
+        io.errln(format_args!("created the folder {}, which did not exist", folder.display()));
+    }
+}
+
+pub(crate) fn export(s: &Session, out: &Path, io: &mut Streams) -> Result {
+    export_framed(s, out, None, io)
+}
+
+pub(crate) fn export_framed(s: &Session, out: &Path, window: Option<Bounds2>, io: &mut Streams) -> Result {
+    let d = s.doc()?;
+    let bytes = cadcraft_io::write_framed(d, out, window)?;
+    let folder = write_atomic(out, &bytes)?;
+    report_new_folder(folder, io);
+    io.errln(format_args!("wrote {} ({} bytes)", out.display(), bytes.len()));
+    if cadcraft_engine::cmd::file::drops_unknown(out) {
+        let lost = cadcraft_engine::cmd::file::not_saved(d);
+        if let Some(m) = cadcraft_engine::cmd::file::not_saved_message(&lost) {
+            io.errln(format_args!("{m}"));
+        }
+    }
+    Ok(())
+}
+
+/// The warning for the model-space entities of `path` an image can't show, by type (those kept
+/// as unknown objects, `Proxy` in `info`), or `None` when there are none.
+pub(crate) fn undrawn_message(d: &cadcraft_engine::doc::Drawing, path: &str) -> Option<String> {
+    let mut types: std::collections::BTreeMap<&str, usize> = std::collections::BTreeMap::new();
+    for e in d.model.iter() {
+        if let cadcraft_engine::doc::EntityKind::Unknown(u) = &e.kind {
+            let n = types.entry(u.dxf_type.as_str()).or_insert(0);
+            *n = n.saturating_add(1);
+        }
+    }
+    let n = types.values().fold(0usize, |a, n| a.saturating_add(*n));
+    if n == 0 {
+        return None;
+    }
+    let list: Vec<String> = types.iter().map(|(t, n)| format!("{t}: {n}")).collect();
+    let entities = if n == 1 { "entity" } else { "entities" };
+    Some(format!("{path}: {n} {entities} not drawn ({})", list.join(", ")))
+}
+
+/// The reader's notes on what it left out of `path` (a damaged DWG's unreadable object records,
+/// #859), one warning line each; empty for a complete read.
+pub(crate) fn read_note_messages(d: &cadcraft_engine::doc::Drawing, path: &str) -> Vec<String> {
+    d.read_notes.iter().map(|note| format!("{path}: {note}")).collect()
+}
+
+/// The warning for the records of `path` the reader could not place, or `None` when there are none.
+pub(crate) fn skipped_message(d: &cadcraft_engine::doc::Drawing, path: &str) -> Option<String> {
+    let n = d.skipped_records.values().fold(0usize, |a, n| a.saturating_add(*n));
+    if n == 0 {
+        return None;
+    }
+    let list: Vec<String> = d.skipped_records.iter().map(|(section, n)| format!("{section}: {n}")).collect();
+    let records = if n == 1 { "record" } else { "records" };
+    Some(format!("{path}: {n} {records} could not be read and are left out ({})", list.join(", ")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::read_note_messages;
+
+    #[test]
+    fn read_notes_become_one_warning_each() {
+        let mut d = cadcraft_engine::doc::Drawing::new_imperial();
+        assert!(read_note_messages(&d, "a.dwg").is_empty());
+        d.read_notes =
+            vec!["DWG: 3 of 10 object records couldn't be read and were left out (LINE × 3); saving over the original file would lose them".into()];
+        assert_eq!(
+            read_note_messages(&d, "a.dwg"),
+            vec!["a.dwg: DWG: 3 of 10 object records couldn't be read and were left out (LINE × 3); saving over the original file would lose them"]
+        );
+    }
+}

apps/cadcraft-cli/src/perf.rs

@@ -0,0 +1,196 @@
+use super::args::PerfTarget;
+use super::error::Result;
+use super::open;
+use super::output::Streams;
+use cadcraft_engine::Session;
+
+/// Why `perf` cannot run.
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum PerfError {
+    #[error("perf: the drawing is empty")]
+    EmptyDrawing,
+}
+
+/// Small deterministic generator (xorshift64*) so perf runs are repeatable without a dependency.
+struct Rng(u64);
+
+impl Rng {
+    fn next(&mut self) -> f64 {
+        self.0 ^= self.0 >> 12;
+        self.0 ^= self.0 << 25;
+        self.0 ^= self.0 >> 27;
+        (self.0.wrapping_mul(0x2545_F491_4F6C_DD1D) >> 11) as f64 / (1u64 << 53) as f64
+    }
+    fn range(&mut self, lo: f64, hi: f64) -> f64 {
+        lo + (hi - lo) * self.next()
+    }
+}
+
+/// A synthetic drawing with `n` mixed entities (lines, circles, arcs, polylines, text) spread
+/// over a square whose side grows with sqrt(n), so density stays constant.
+fn synthetic(n: usize, side: f64) -> Result<cadcraft_engine::doc::Drawing, cadcraft_engine::doc::DocError> {
+    use cadcraft_engine::doc::{self as d, Common, EntityKind, Space};
+    use cadcraft_engine::geom::{PolyVertex, Vec2, Vec3};
+    let mut dr = d::Drawing::new_imperial();
+    let mut r = Rng(0x9E37_79B9_7F4A_7C15);
+    let v3 = |x: f64, y: f64| Vec3::new(x, y, 0.0);
+    for i in 0..n {
+        let (x, y) = (r.range(0.0, side), r.range(0.0, side));
+        let s = r.range(0.5, 8.0);
+        let kind = match i % 5 {
+            0 => EntityKind::Line(d::Line { a: v3(x, y), b: v3(x + r.range(-s, s), y + r.range(-s, s)) }),
+            1 => EntityKind::Circle(d::Circle { center: v3(x, y), radius: s * 0.5 }),
+            2 => EntityKind::Arc(d::Arc { center: v3(x, y), radius: s * 0.5, start: r.range(0.0, 3.0), end: r.range(3.2, 6.2) }),
+            3 => EntityKind::LwPolyline(d::LwPolyline {
+                vertices: (0..6)
+                    .map(|k| PolyVertex {
+                        p: Vec2::new(x + f64::from(k) * s * 0.3, y + r.range(-s, s) * 0.3),
+                        bulge: if k == 2 { 0.4 } else { 0.0 },
+                        start_width: 0.0,
+                        end_width: 0.0,
+                    })
+                    .collect(),
+                closed: i % 2 == 0,
+                const_width: 0.0,
+                elevation: 0.0,
+                plinegen: false,
+            }),
+            _ => EntityKind::Text(d::Text {
+                insert: v3(x, y),
+                align_pt: None,
+                height: s * 0.2,
+                value: format!("T{i}"),
+                rotation: 0.0,
+                width_factor: 1.0,
+                oblique: 0.0,
+                style: "Standard".into(),
+                halign: d::HAlign::Left,
+                valign: d::VAlign::Baseline,
+            }),
+        };
+        dr.add(&Space::Model, Common::default(), kind)?;
+    }
+    Ok(dr)
+}
+
+/// `perf FILE`: the display list built as the canvas builds it (a 1600 x 1000 px view at the
+/// drawing's centre: tolerance, dash level of detail and view window from the zoom band), at
+/// zoom extents and zoomed in 4x at a time, next to the full-detail build plots use.
+fn perf_file(path: &std::path::Path, io: &mut Streams) -> Result {
+    use cadcraft_engine::geom::{Bounds2, Vec2};
+    use cadcraft_engine::render::{Options, build};
+    use std::time::Instant;
+    let ms = |t: Instant| t.elapsed().as_secs_f64() * 1000.0;
+    let mut s = Session::empty();
+    let t = Instant::now();
+    open(&mut s, path)?;
+    let open_ms = ms(t);
+    let st = s.state()?;
+    let (d, space) = (&st.doc, &st.space);
+    let ext = d.extents(space);
+    let size = ext.width().max(ext.height());
+    if ext.is_empty() || !(size.is_finite() && size > 0.0) {
+        return Err(PerfError::EmptyDrawing.into());
+    }
+    io.outln(format_args!("open {open_ms:.0} ms, {} entities, extents {:.1} x {:.1}", d.entity_count(), ext.width(), ext.height()));
+    io.outln(format_args!("{:>8} {:>10} {:>10}", "zoom", "build ms", "prims"));
+    let mut finest = Options::default();
+    for k in 0..5 {
+        let zoom = 4f64.powi(k);
+        let h = size / zoom;
+        let pixel = 2f64.powi((h / 1000.0).max(1e-300).log2().floor() as i32);
+        let half = Vec2::new(h * 0.8, h * 0.5);
+        let visible = Bounds2::new(ext.center() - half, ext.center() + half);
+        let screen = Options { tolerance: pixel * 0.5, min_dash: pixel * 2.0, view: Some(visible.expand(h * 0.8)), ..Default::default() };
+        let t = Instant::now();
+        let n = build(d, space, &screen).prims.len();
+        io.outln(format_args!("{:>7}x {:>10.1} {n:>10}", zoom, ms(t)));
+        finest = screen;
+    }
+    // Plots: every pattern line, everywhere (last, so its large list doesn't weigh on the above).
+    let t = Instant::now();
+    let n = build(d, space, &Options { min_dash: 0.0, view: None, ..finest }).prims.len();
+    io.outln(format_args!("{:>8} {:>10.1} {n:>10}", "full", ms(t)));
+    Ok(())
+}
+
+pub(crate) fn perf(target: Option<&PerfTarget>, io: &mut Streams) -> Result {
+    use cadcraft_engine::doc::Space;
+    use cadcraft_engine::geom::{Bounds2, Vec2};
+    use cadcraft_engine::{select, snap};
+    use std::time::Instant;
+    let n = match target {
+        Some(PerfTarget::File(path)) => return perf_file(path, io),
+        Some(PerfTarget::Count(n)) => *n,
+        None => 200_000,
+    };
+    let side = (n as f64).sqrt() * 10.0;
+    let mut rows: Vec<(String, f64, String)> = Vec::new();
+    let ms = |t: Instant| t.elapsed().as_secs_f64() * 1000.0;
+
+    let t = Instant::now();
+    let d = synthetic(n, side)?;
+    rows.push(("build synthetic drawing".into(), ms(t), format!("{n} entities")));
+
+    // Display list at a 1600 px wide "zoom extents" view (tolerance = half a pixel).
+    let px = side / 1600.0;
+    let opts = cadcraft_engine::render::Options { tolerance: px * 0.5, min_dash: px * 2.0, ..Default::default() };
+    let t = Instant::now();
+    let list = cadcraft_engine::render::build(&d, &Space::Model, &opts);
+    rows.push(("display list build".into(), ms(t), format!("{} prims, {} segments", list.prims.len(), list.segment_count())));
+
+    // Hit testing on a zoomed-in view (aperture = 5 px at 0.02 units/px).
+    let ap = 0.1;
+    let mut r = Rng(42);
+    let pts: Vec<Vec2> = (0..1000).map(|_| Vec2::new(r.range(0.0, side), r.range(0.0, side))).collect();
+    let t = Instant::now();
+    let first = select::pick(&d, &Space::Model, pts.first().copied().unwrap_or(Vec2::ZERO), ap);
+    rows.push(("first pick (incl. index build)".into(), ms(t), format!("{first:?}")));
+    let t = Instant::now();
+    let hits = pts.iter().filter(|p| select::pick(&d, &Space::Model, **p, ap).is_some()).count();
+    let total = ms(t);
+    rows.push(("pick x1000".into(), total, format!("{hits} hits, {:.3} ms/pick", total / 1000.0)));
+
+    // One edit, then a pick: only the touched chunk is re-indexed.
+    let mut edited = d.clone();
+    if let Some(h) = edited.model.last().map(|e| e.handle) {
+        edited.model.modify(h, |e| e.common.layer = "0".into());
+    }
+    let t = Instant::now();
+    let _ = select::pick(&edited, &Space::Model, pts.first().copied().unwrap_or(Vec2::ZERO), ap);
+    rows.push(("pick after one edit (incremental re-index)".into(), ms(t), String::new()));
+
+    let mut sel = 0usize;
+    let t = Instant::now();
+    for k in 0..20 {
+        let c = Vec2::new(r.range(0.0, side), r.range(0.0, side));
+        let half = side * 0.05;
+        sel += select::select_window(&d, &Space::Model, Bounds2::new(c - Vec2::new(half, half), c + Vec2::new(half, half)), k % 2 == 1).len();
+    }
+    rows.push(("window/crossing select x20 (10% side)".into(), ms(t), format!("{sel} selected")));
+
+    let t = Instant::now();
+    let fence: Vec<Vec2> = (0..4).map(|_| Vec2::new(r.range(0.0, side), r.range(0.0, side))).collect();
+    let fsel = select::select_fence(&d, &Space::Model, &fence).len();
+    rows.push(("fence select (3 legs)".into(), ms(t), format!("{fsel} selected")));
+
+    let osmode = snap::mode::END | snap::mode::MID | snap::mode::CEN | snap::mode::QUA | snap::mode::INT;
+    let t = Instant::now();
+    let snaps = pts.iter().filter(|p| snap::osnap(&d, &Space::Model, **p, ap * 2.0, osmode, None, false).is_some()).count();
+    let total = ms(t);
+    rows.push(("osnap x1000".into(), total, format!("{snaps} hits, {:.3} ms/query", total / 1000.0)));
+
+    let t = Instant::now();
+    let bytes = cadcraft_io::write(&d, "perf.dxf")?;
+    rows.push(("DXF write".into(), ms(t), format!("{:.1} MB", bytes.len() as f64 / 1e6)));
+    let t = Instant::now();
+    let back = cadcraft_io::read(&bytes, "perf.dxf")?;
+    rows.push(("DXF read".into(), ms(t), format!("{} entities", back.entity_count())));
+
+    io.outln(format_args!("{:<40} {:>12}  notes", "operation", "ms"));
+    io.outln(format_args!("{}", "-".repeat(80)));
+    for (name, t, note) in rows {
+        io.outln(format_args!("{name:<40} {t:>12.2}  {note}"));
+    }
+    Ok(())
+}

apps/cadcraft-cli/src/roundtrip.rs

@@ -0,0 +1,93 @@
+//! `roundtrip`: the corpus harness of `cadcraft_io::roundtrip::corpus` over a file or folder.
+
+use super::args::RoundtripArgs;
+use super::error::{CliError, Result};
+use super::output::Streams;
+
+/// Why `roundtrip` stopped.
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum RoundtripError {
+    #[error("roundtrip: give a FILE or FOLDER, or set CADCRAFT_CORPUS_DIR")]
+    NoPath,
+    #[error("roundtrip: no such file or folder: {}", .0.display())]
+    Missing(std::path::PathBuf),
+    #[error("roundtrip: no DXF or DWG files in {}", .0.display())]
+    Empty(std::path::PathBuf),
+    #[error("roundtrip: can't write the report to {}: {source}", .path.display())]
+    Report { path: std::path::PathBuf, source: std::io::Error },
+    #[error("roundtrip: {} strict failures:\n{}", .0.len(), .0.join("\n"))]
+    Strict(Vec<String>),
+}
+
+/// What the walk couldn't look at, so the report isn't taken for the whole corpus: said on
+/// stderr, and failures of a strict run.
+fn left_out(w: &cadcraft_io::roundtrip::corpus::Walk) -> Vec<String> {
+    let mut out: Vec<String> = w.unreadable.iter().map(|u| format!("not read: {u}")).collect();
+    if w.truncated {
+        out.push("left out: files or folders past the harness limits".to_string());
+    }
+    out
+}
+
+pub(crate) fn roundtrip(a: &RoundtripArgs, io: &mut Streams) -> Result {
+    use cadcraft_io::roundtrip::corpus;
+    let path = a.path.clone().or_else(|| std::env::var_os("CADCRAFT_CORPUS_DIR").map(Into::into)).ok_or(RoundtripError::NoPath)?;
+    let mut missed = Vec::new();
+    let (root, files, out) = if path.is_dir() {
+        let out = a.out.clone().unwrap_or_else(|| path.join("report"));
+        // The report folder, and the saved copies in it, are never read back as corpus files.
+        let walk = corpus::walk(&path, &[out.clone(), out.join("saved")]);
+        missed = left_out(&walk);
+        for m in &missed {
+            io.errln(format_args!("roundtrip: {m}"));
+        }
+        (path, walk.files, out)
+    } else if path.is_file() {
+        let root = path.parent().map(std::path::Path::to_path_buf).unwrap_or_default();
+        let out = a.out.clone().unwrap_or_else(|| root.join("report"));
+        (root, vec![path], out)
+    } else {
+        return Err(RoundtripError::Missing(path).into());
+    };
+    if files.is_empty() {
+        // A folder it couldn't read isn't an empty one.
+        return Err(if missed.is_empty() { RoundtripError::Empty(root) } else { RoundtripError::Strict(missed) }.into());
+    }
+    let mut opts = corpus::CorpusOptions { cross_format: !a.same_format, census: !a.no_census, ..Default::default() };
+    opts.compare.abs_tol = a.tolerance;
+    if a.keep_saved {
+        opts.keep_saved = Some(out.join("saved"));
+    }
+    let report = corpus::run(&root, &files, &opts, &mut |i, n, rel| eprintln!("[{}/{n}] {rel}", i + 1));
+    for f in &report.files {
+        let routes: Vec<String> = f
+            .routes
+            .iter()
+            .map(|r| match (&r.save_error, &r.reopen_error) {
+                (Some(_), _) => format!("{}: save failed", r.route),
+                (None, Some(_)) => format!("{}: reopen failed", r.route),
+                (None, None) => {
+                    let t = r.comparison.total();
+                    format!("{}: {} lost, {} added, {} changed", r.route, t.lost, t.added, t.changed)
+                }
+            })
+            .collect();
+        match &f.open_error {
+            Some(e) => io.outln(format_args!("{}: open failed: {e}", f.path)),
+            None => io.outln(format_args!("{}: opened; {}", f.path, routes.join("; "))),
+        }
+    }
+    let (md, json) = report.write(&out).map_err(|source| RoundtripError::Report { path: out.clone(), source })?;
+    io.outln(format_args!("report: {}", md.display()));
+    io.outln(format_args!("        {}", json.display()));
+    // CADCRAFT_CORPUS_STRICT=1: a file that doesn't open, save or reopen, or records a writer
+    // leaves out, fail the run (the report is written first).
+    if std::env::var("CADCRAFT_CORPUS_STRICT").is_ok_and(|v| v == "1") {
+        let mut failed = report.strict_failures();
+        failed.extend(missed);
+        if !failed.is_empty() {
+            return Err(CliError::from(RoundtripError::Strict(failed)));
+        }
+    }
+    Ok(())
+}

apps/cadcraft-cli/src/run.rs

@@ -0,0 +1,223 @@
+use super::args::{CmdStep, Drawing, RunArgs, Step};
+use super::error::Result;
+use super::open;
+use super::output::{Streams, export, export_framed, export_window, model_views};
+use cadcraft_engine::Session;
+use cadcraft_engine::doc::Handle;
+use serde_json::Value;
+
+/// A `--cmd` parameter value of exactly `{last}` is filled in with the last object handle an
+/// earlier `--cmd` in the same run returned: `mview` answers `{"viewports":["100"]}`, so
+/// `viewport.set {"handle":"{last}","scale":1}` changes viewport 100. Any other string is passed
+/// through unchanged, and `--script` text is never rewritten.
+const LAST_HANDLE: &str = "{last}";
+
+/// Why a `run` step fails.
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum RunError {
+    #[error("{}: {source}", .path.display())]
+    ReadScript { path: std::path::PathBuf, source: std::io::Error },
+    #[error("--cmd {id}: {source}")]
+    CmdLast { id: String, source: NoLastHandle },
+}
+
+/// A `{last}` placeholder with no handle to fill in.
+#[derive(Debug, PartialEq, thiserror::Error)]
+#[error("`{{last}}` needs an earlier --cmd in this run to have returned a handle")]
+pub(crate) struct NoLastHandle;
+
+/// How deep [`result_handles`] walks a command result (results are the engine's own JSON).
+const RESULT_DEPTH: usize = 16;
+
+/// Result keys whose values are object references: the engine's result convention for handles.
+/// A handle can be a string (`handle`, `viewport`, `insert`…) or a list of them (`handles`,
+/// `viewports`, `members`…). Every other field may hold a user-defined name, a message or a
+/// count, and is never read as a handle — a group named `100` is a name, not object `100`.
+fn handle_field(key: &str) -> bool {
+    matches!(
+        key,
+        "handle"
+            | "handles"
+            | "viewport"
+            | "viewports"
+            | "boundary"
+            | "clip"
+            | "insert"
+            | "members"
+            | "source"
+            | "objects"
+            | "entities"
+            | "selection"
+            | "parts"
+            | "refs"
+            | "matches"
+            | "line"
+            | "arc"
+            | "blocks"
+    )
+}
+
+/// Collect the handles of `v`, a value under a handle field: a handle string, an array of them,
+/// or objects that carry handle fields of their own (`entities`, `parts`).
+fn collect_result_handles(s: &Session, v: &Value, depth: usize, out: &mut Vec<Handle>) {
+    if depth > RESULT_DEPTH {
+        return;
+    }
+    match v {
+        Value::String(t) => {
+            if let Some(h) = Handle::parse_hex(t)
+                && s.doc().is_ok_and(|d| d.entity(h).is_some())
+            {
+                out.push(h);
+            }
+        }
+        Value::Array(a) => a.iter().for_each(|x| collect_result_handles(s, x, depth + 1, out)),
+        Value::Object(m) => {
+            for (k, x) in m {
+                if handle_field(k) {
+                    collect_result_handles(s, x, depth + 1, out);
+                } else {
+                    find_result_handles(s, x, depth + 1, out);
+                }
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Find handle fields nested in containers that are not handles themselves (`groups` in
+/// `groups.list`, whose members are handles): strings here are names, never references.
+fn find_result_handles(s: &Session, v: &Value, depth: usize, out: &mut Vec<Handle>) {
+    if depth > RESULT_DEPTH {
+        return;
+    }
+    match v {
+        Value::Array(a) => a.iter().for_each(|x| find_result_handles(s, x, depth + 1, out)),
+        Value::Object(m) => {
+            for (k, x) in m {
+                if handle_field(k) {
+                    collect_result_handles(s, x, depth + 1, out);
+                } else {
+                    find_result_handles(s, x, depth + 1, out);
+                }
+            }
+        }
+        _ => {}
+    }
+}
+
+/// The object handles a command result mentions, in the order it lists them. A handle-only result
+/// (a handle string or an array of them) counts as it is; otherwise only handle fields do.
+fn result_handles(s: &Session, v: &Value, depth: usize, out: &mut Vec<Handle>) {
+    match v {
+        Value::String(_) => collect_result_handles(s, v, depth, out),
+        Value::Array(a) if a.iter().all(Value::is_string) => collect_result_handles(s, v, depth, out),
+        Value::Array(_) | Value::Object(_) => find_result_handles(s, v, depth, out),
+        _ => {}
+    }
+}
+
+/// The last handle `r` returned: what a later `{last}` stands for.
+pub(crate) fn returned_handle(s: &Session, r: &Value) -> Option<Handle> {
+    let mut hs = Vec::new();
+    result_handles(s, r, 0, &mut hs);
+    hs.last().copied()
+}
+
+/// The active drawing's identity ([`cadcraft_engine::DocState::uid`]): a handle is only meaningful
+/// in the drawing it came from, and `new`, `open`, `document.switch` and `close` can make another
+/// drawing current.
+fn active_drawing(s: &Session) -> Option<u64> {
+    s.docs.get(s.active).map(|st| st.uid)
+}
+
+/// Every `{last}` in `p`, at any depth, replaced by `h`. With no handle to fill in it is an
+/// error, never a token reaching the command as a (bad) handle.
+pub(crate) fn fill_last(p: &Value, h: Option<Handle>) -> Result<Value, NoLastHandle> {
+    match p {
+        Value::String(t) if t.as_str() == LAST_HANDLE => match h {
+            Some(h) => Ok(Value::String(h.hex())),
+            None => Err(NoLastHandle),
+        },
+        Value::Array(a) => a.iter().map(|x| fill_last(x, h)).collect::<Result<Vec<_>, _>>().map(Value::Array),
+        Value::Object(m) => {
+            m.iter().map(|(k, x)| Ok((k.clone(), fill_last(x, h)?))).collect::<Result<serde_json::Map<String, Value>, _>>().map(Value::Object)
+        }
+        other => Ok(other.clone()),
+    }
+}
+
+/// A step ready to run: script text, or a command.
+enum Ready<'a> {
+    Script(String),
+    Cmd(&'a CmdStep),
+}
+
+pub(crate) fn run_cmds(a: &RunArgs, io: &mut Streams) -> Result {
+    let framing = a.framing.framing();
+    let (save, export_to) = (a.save.as_deref(), a.export.as_deref());
+    let mut s = Session::empty();
+    for d in &a.drawings {
+        match d {
+            Drawing::File(f) => open(&mut s, f)?,
+            Drawing::Sample => {
+                s.open_drawing(cadcraft_engine::sample::default_sample(), "Bracket", None);
+            }
+            Drawing::Metric => {
+                s.new_drawing(true);
+            }
+        }
+    }
+    let mut steps: Vec<Ready> = Vec::new();
+    for step in &a.steps {
+        steps.push(match step {
+            Step::Script(text) => Ready::Script(text.replace("\\n", "\n")),
+            Step::ScriptFile(p) => Ready::Script(std::fs::read_to_string(p).map_err(|source| RunError::ReadScript { path: p.clone(), source })?),
+            Step::Cmd(c) => Ready::Cmd(c),
+        });
+    }
+    if s.docs.is_empty() {
+        s.new_drawing(false);
+    }
+    let before = model_views(&s);
+    let mut last_handle: Option<Handle> = None;
+    for step in steps {
+        // A handle belongs to the drawing that returned it: if this step makes another drawing
+        // current (`new`, `open`, `document.switch`, `close`, or a script running one of them),
+        // the remembered handle is stale. A handle the step itself returns is taken afterwards,
+        // so it is a handle of the drawing it made current.
+        let drawing = active_drawing(&s);
+        match step {
+            Ready::Script(body) => {
+                s.script(&body)?;
+                if active_drawing(&s) != drawing {
+                    last_handle = None;
+                }
+            }
+            Ready::Cmd(CmdStep { id, params }) => {
+                let params = fill_last(params, last_handle).map_err(|source| RunError::CmdLast { id: id.clone(), source })?;
+                let r = s.execute(id, &params)?;
+                if active_drawing(&s) != drawing {
+                    last_handle = None;
+                }
+                if let Some(h) = returned_handle(&s, &r) {
+                    last_handle = Some(h);
+                }
+                if !r.is_null() {
+                    io.outln(format_args!("{r}"));
+                }
+            }
+        }
+    }
+    for l in &s.log {
+        io.errln(format_args!("{l}"));
+    }
+    if let Some(p) = save {
+        export(&s, p, io)?;
+    }
+    if let Some(p) = export_to {
+        let window = if cadcraft_io::is_image(p) { export_window(&s, framing, Some(&before))? } else { None };
+        export_framed(&s, p, window, io)?;
+    }
+    Ok(())
+}

apps/cadcraft-cli/src/sample.rs

@@ -0,0 +1,15 @@
+use super::args::{SampleArgs, SampleName};
+use super::error::Result;
+use super::output::{Streams, report_new_folder, write_atomic};
+
+pub(crate) fn sample(a: &SampleArgs, io: &mut Streams) -> Result {
+    let d = match a.name {
+        SampleName::Bracket => cadcraft_engine::sample::bracket(),
+        SampleName::Floorplan => cadcraft_engine::sample::floor_plan(),
+    };
+    let bytes = cadcraft_io::write(&d, &a.output)?;
+    let folder = write_atomic(&a.output, &bytes)?;
+    report_new_folder(folder, io);
+    io.errln(format_args!("wrote {} ({} bytes)", a.output.display(), bytes.len()));
+    Ok(())
+}

apps/cadcraft-cli/tests/dwg_worker.rs

@@ -0,0 +1,33 @@
+//! The DWG reader and writer run in a child process, so a decoder that dies ends one open or save,
+//! not the app. The worker setting is process-wide, so everything runs in one test.
+
+#![cfg(not(any(target_arch = "wasm32", all(target_os = "freebsd", target_arch = "aarch64"))))]
+
+use cadcraft_io::dwg_worker;
+
+#[test]
+fn a_real_worker_reads_and_writes_and_its_death_is_an_error_here() {
+    let drawing = cadcraft_engine::sample::bracket();
+    let in_process = cadcraft_io::write(&drawing, "a.dwg").unwrap();
+
+    dwg_worker::use_worker(env!("CARGO_BIN_EXE_cadcraft-cli").into(), vec![dwg_worker::WORKER_ARG.into()]);
+    let written = cadcraft_io::write(&drawing, "a.dwg").unwrap();
+    assert_eq!(written.get(..6), in_process.get(..6), "the same version of file");
+    let read = cadcraft_io::read(&written, "a.dwg").unwrap();
+    assert_eq!(read.model.len(), drawing.model.len());
+
+    // A decode error comes back as that error, not as the worker stopping.
+    let mut bad = in_process.clone();
+    bad.truncate(64);
+    let e = cadcraft_io::read(&bad, "a.dwg").unwrap_err().to_string();
+    assert!(!e.contains("worker"), "{e}");
+
+    // The worker aborts as the third-party code can. This process goes on.
+    let e = dwg_worker::crash_worker_for_test().unwrap_err();
+    assert!(e.contains("worker stopped"), "{e}");
+    assert!(cadcraft_io::read(&written, "a.dwg").is_ok(), "the next file gets a new worker");
+
+    // No worker to start: the work happens here, as without one.
+    dwg_worker::use_worker("no-such-program-here".into(), Vec::new());
+    assert!(cadcraft_io::read(&written, "a.dwg").is_ok());
+}

apps/cadcraft-cli/tests/it/help.rs

@@ -1,23 +1,23 @@
 //! `--help` is a request, not a failure (#1525): it goes to stdout with exit 0, like `--version`.
-//! Bare `cadcraft-cli` keeps reporting on stderr with exit 1.
+//! Bare `cadcraft-cli` is a usage error: the help on stderr, exit 2.
 
 use std::process::Command;
 
 #[test]
-fn help_flags_print_usage_to_stdout_and_exit_zero() {
+fn help_flags_print_help_to_stdout_and_exit_zero() {
     for args in [&["--help"][..], &["-h"], &["help"]] {
         let out = Command::new(env!("CARGO_BIN_EXE_cadcraft-cli")).args(args).output().expect("run cadcraft-cli");
         assert!(out.status.success(), "{args:?}: {:?}", out.status);
         let stdout = String::from_utf8_lossy(&out.stdout);
-        assert!(stdout.starts_with("usage:"), "{args:?}: {stdout:?}");
+        assert!(stdout.starts_with("cadcraft-cli: headless CADCraft\n"), "{args:?}: {stdout:?}");
         assert!(String::from_utf8_lossy(&out.stderr).is_empty(), "{args:?}: stderr should be empty");
     }
 }
 
 #[test]
-fn bare_invocation_still_reports_on_stderr() {
+fn bare_invocation_reports_on_stderr() {
     let out = Command::new(env!("CARGO_BIN_EXE_cadcraft-cli")).output().expect("run cadcraft-cli");
-    assert_eq!(out.status.code(), Some(1));
-    assert!(out.stdout.is_empty(), "bare invocation keeps its usage on stderr");
-    assert!(String::from_utf8_lossy(&out.stderr).starts_with("usage:"));
+    assert_eq!(out.status.code(), Some(2));
+    assert!(out.stdout.is_empty(), "bare invocation keeps its help on stderr");
+    assert!(String::from_utf8_lossy(&out.stderr).starts_with("cadcraft-cli: headless CADCraft\n"));
 }

apps/cadcraft-cli/tests/it/main.rs

@@ -4,3 +4,4 @@ mod help;
 mod mcp_connect;
 mod skipped_records;
 mod undrawn_entities;
+mod usage;

apps/cadcraft-cli/tests/it/mcp_connect.rs

@@ -33,12 +33,15 @@ fn replies(out: &Output) -> Vec<Value> {
 #[test]
 fn connect_without_address_fails_before_serving() {
     let input = format!("{INIT}\n{CIRCLE}\n");
-    for args in [&["--connect"][..], &["--connect", ""], &["--connect", "--foo"]] {
+    // clap names an unknown flag rather than the value it left missing.
+    for (args, named) in
+        [(&["--connect"][..], "--connect <HOST:PORT>"), (&["--connect", ""], "--connect <HOST:PORT>"), (&["--connect", "--foo"], "'--foo'")]
+    {
         let out = mcp(args, &input);
-        assert!(!out.status.success(), "{args:?} must exit non-zero");
+        assert_eq!(out.status.code(), Some(2), "{args:?} is a usage error");
         assert!(out.stdout.is_empty(), "{args:?} must not answer MCP requests: {}", String::from_utf8_lossy(&out.stdout));
         let err = String::from_utf8_lossy(&out.stderr);
-        assert!(err.contains("--connect needs HOST:PORT"), "{args:?}: {err}");
+        assert!(err.contains(named), "{args:?}: {err}");
     }
 }
 

apps/cadcraft-cli/tests/it/usage.rs

@@ -0,0 +1,950 @@
+//! The command line's behaviour: exit codes, streams and messages for help requests, unknown and
+//! malformed options, value flags in both spellings, repeats and arity. Every case goes through
+//! `invoke`, so the table rows are the record of what each input does. Usage errors are clap's
+//! (exit 2, stderr); a subcommand's own failures are `error: …` with exit 1.
+
+use std::path::{Path, PathBuf};
+
+struct Invoke {
+    code: i32,
+    stdout: String,
+    stderr: String,
+}
+
+fn invoke(args: &[&str]) -> Invoke {
+    let (mut out, mut err) = (Vec::new(), Vec::new());
+    let code = cadcraft_cli::run(args, &mut out, &mut err);
+    Invoke { code, stdout: String::from_utf8_lossy(&out).into_owned(), stderr: String::from_utf8_lossy(&err).into_owned() }
+}
+
+/// What a stream holds.
+#[derive(Clone, Copy)]
+enum Expect {
+    Empty,
+    /// The first line equals this.
+    Line(&'static str),
+    /// The first line starts with this.
+    Starts(&'static str),
+}
+
+use Expect::{Empty, Line, Starts};
+
+struct Case {
+    name: &'static str,
+    args: &'static [&'static str],
+    code: i32,
+    stdout: Expect,
+    stderr: Expect,
+}
+
+const fn case(name: &'static str, args: &'static [&'static str], code: i32, stdout: Expect, stderr: Expect) -> Case {
+    Case { name, args, code, stdout, stderr }
+}
+
+/// A scratch directory holding `b.dxf` (the bracket sample) and `s.scr` (a one-line script).
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new(tag: &str) -> Scratch {
+        let dir = std::env::temp_dir().join(format!("cc-cli-usage-{tag}-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).expect("create scratch dir");
+        let b = dir.join("b.dxf");
+        let r = invoke(&["sample", "bracket", b.to_str().expect("utf-8 path")]);
+        assert_eq!(r.code, 0, "{}", r.stderr);
+        std::fs::write(dir.join("s.scr"), "LINE 0,0 1,1\n").expect("write script");
+        Scratch(dir)
+    }
+
+    /// Replaces `{dir}` with the scratch directory and `{b}` with the sample drawing.
+    fn expand(&self, text: &str) -> String {
+        let dir = self.0.to_str().expect("utf-8 path");
+        text.replace("{b}", &Path::new(dir).join("b.dxf").to_string_lossy()).replace("{dir}", dir)
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn check(what: &str, stream: &str, got: &str, expect: Expect, scratch: &Scratch) {
+    let first = got.lines().next().unwrap_or("");
+    match expect {
+        Empty => assert!(got.is_empty(), "{what}: {stream} should be empty, got {got:?}"),
+        Line(l) => assert_eq!(first, scratch.expand(l), "{what}: {stream}"),
+        Starts(p) => assert!(first.starts_with(&scratch.expand(p)), "{what}: {stream} should start with {p:?}, got {first:?}"),
+    }
+}
+
+fn run_cases(tag: &str, cases: &[Case]) {
+    let scratch = Scratch::new(tag);
+    for c in cases {
+        let args: Vec<String> = c.args.iter().map(|a| scratch.expand(a)).collect();
+        let args: Vec<&str> = args.iter().map(String::as_str).collect();
+        let what = format!("{}: {args:?}", c.name);
+        let r = invoke(&args);
+        assert_eq!(r.code, c.code, "{what}: exit code (stderr {:?})", r.stderr);
+        check(&what, "stdout", &r.stdout, c.stdout, &scratch);
+        check(&what, "stderr", &r.stderr, c.stderr, &scratch);
+    }
+}
+
+#[test]
+fn top_level_requests() {
+    run_cases(
+        "top",
+        &[
+            case("--help", &["--help"], 0, Line("cadcraft-cli: headless CADCraft"), Empty),
+            case("-h", &["-h"], 0, Line("cadcraft-cli: headless CADCraft"), Empty),
+            case("help", &["help"], 0, Line("cadcraft-cli: headless CADCraft"), Empty),
+            case("--version", &["--version"], 0, Starts("cadcraft-cli "), Empty),
+            case("-V", &["-V"], 0, Starts("cadcraft-cli "), Empty),
+            case("version is not a subcommand", &["version"], 2, Empty, Line("error: unrecognized subcommand 'version'")),
+            case("bare", &[], 2, Empty, Line("cadcraft-cli: headless CADCraft")),
+            case("unknown subcommand", &["foo"], 2, Empty, Line("error: unrecognized subcommand 'foo'")),
+            case("unknown top-level flag", &["--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("empty subcommand", &[""], 2, Empty, Line("error: unrecognized subcommand ''")),
+        ],
+    );
+}
+
+/// Each subcommand's help, from `--help`, `-h` or `help <subcommand>`: its first line is the
+/// subcommand's summary.
+#[test]
+fn subcommand_help_requests() {
+    run_cases(
+        "subhelp",
+        &[
+            case("info --help", &["info", "--help"], 0, Line("Print a drawing's summary as JSON"), Empty),
+            case("info -h", &["info", "-h"], 0, Line("Print a drawing's summary as JSON"), Empty),
+            case(
+                "convert --help",
+                &["convert", "--help"],
+                0,
+                Line("Convert a drawing; OUT's extension picks the format (dxf, dwg, dwt, svg, png, pdf)"),
+                Empty,
+            ),
+            case(
+                "convert -h",
+                &["convert", "-h"],
+                0,
+                Line("Convert a drawing; OUT's extension picks the format (dxf, dwg, dwt, svg, png, pdf)"),
+                Empty,
+            ),
+            case(
+                "run --help",
+                &["run", "--help"],
+                0,
+                Line("Open drawings (or start a new one), run scripts and commands in order, save or export the result"),
+                Empty,
+            ),
+            case(
+                "run -h",
+                &["run", "-h"],
+                0,
+                Line("Open drawings (or start a new one), run scripts and commands in order, save or export the result"),
+                Empty,
+            ),
+            case("commands --help", &["commands", "--help"], 0, Line("Print the command catalog as JSON"), Empty),
+            case(
+                "mcp --help",
+                &["mcp", "--help"],
+                0,
+                Line("Run the MCP server on stdio: a headless drawing session, or a bridge to the running app"),
+                Empty,
+            ),
+            case(
+                "perf --help",
+                &["perf", "--help"],
+                0,
+                Line(
+                    "Time the engine on a synthetic N-entity drawing (default 200000), or the canvas display-list build of a drawing, zoomed in step by step",
+                ),
+                Empty,
+            ),
+            case("sample --help", &["sample", "--help"], 0, Line("Write a built-in sample drawing"), Empty),
+            case(
+                "help run",
+                &["help", "run"],
+                0,
+                Line("Open drawings (or start a new one), run scripts and commands in order, save or export the result"),
+                Empty,
+            ),
+            case("help info", &["help", "info"], 0, Line("Print a drawing's summary as JSON"), Empty),
+            case(
+                "help after a flag missing its value",
+                &["run", "--sample", "--script", "--help"],
+                0,
+                Line("Open drawings (or start a new one), run scripts and commands in order, save or export the result"),
+                Empty,
+            ),
+            case(
+                "help after an unknown flag",
+                &["run", "--bogus", "--help"],
+                0,
+                Line("Open drawings (or start a new one), run scripts and commands in order, save or export the result"),
+                Empty,
+            ),
+            case("help after an extra argument", &["info", "{b}", "extra", "-h"], 0, Line("Print a drawing's summary as JSON"), Empty),
+            case("--help after -- is a file name", &["run", "--", "--help"], 1, Empty, Starts("error: invalid parameters for `open`: --help:")),
+            case("run --version", &["run", "--version"], 2, Empty, Line("error: unexpected argument '--version' found")),
+            case("info --version", &["info", "--version"], 2, Empty, Line("error: unexpected argument '--version' found")),
+        ],
+    );
+}
+
+#[test]
+fn unknown_flags_on_every_subcommand() {
+    run_cases(
+        "unknown",
+        &[
+            case("info", &["info", "{b}", "--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("info, flag first", &["info", "--bogus", "{b}"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("info, short flag", &["info", "-x"], 2, Empty, Line("error: unexpected argument '-x' found")),
+            case("info, a file name starting with - after --", &["info", "--", "-x"], 1, Empty, Starts("error: invalid parameters for `open`: -x:")),
+            case("convert", &["convert", "{b}", "{dir}/o.svg", "--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("run", &["run", "--sample", "--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("run, flag first", &["run", "--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("commands", &["commands", "--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("commands -- ends the options", &["commands", "--"], 0, Line("["), Empty),
+            case("mcp", &["mcp", "--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("mcp positional", &["mcp", "extra"], 2, Empty, Line("error: unexpected argument 'extra' found")),
+            case("perf", &["perf", "--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("sample", &["sample", "--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+            case("sample after name", &["sample", "bracket", "--bogus"], 2, Empty, Line("error: unexpected argument '--bogus' found")),
+        ],
+    );
+}
+
+/// `--x=v` is a spelling of `--x v`, and the one a value starting with `-` needs.
+#[test]
+fn value_flags_in_both_forms() {
+    run_cases(
+        "forms",
+        &[
+            case("--window v", &["convert", "{b}", "{dir}/w1.svg", "--window", "0,0,100,100"], 0, Empty, Starts("wrote {dir}/w1.svg (")),
+            case("--window=v", &["convert", "{b}", "{dir}/w2.svg", "--window=0,0,100,100"], 0, Empty, Starts("wrote {dir}/w2.svg (")),
+            case(
+                "run --window v",
+                &["run", "--sample", "--window", "0,0,100,100", "--export", "{dir}/w3.svg"],
+                0,
+                Empty,
+                Starts("wrote {dir}/w3.svg ("),
+            ),
+            case(
+                "run --window=v",
+                &["run", "--sample", "--window=0,0,100,100", "--export", "{dir}/w4.svg"],
+                0,
+                Empty,
+                Starts("wrote {dir}/w4.svg ("),
+            ),
+            case("--view v", &["convert", "{b}", "{dir}/v1.svg", "--view", "extents"], 0, Empty, Starts("wrote {dir}/v1.svg (")),
+            case("--view=v", &["convert", "{b}", "{dir}/v2.svg", "--view=extents"], 0, Empty, Starts("wrote {dir}/v2.svg (")),
+            case("run --view v", &["run", "--sample", "--view", "current", "--export", "{dir}/v3.svg"], 0, Empty, Starts("wrote {dir}/v3.svg (")),
+            case("run --view=v", &["run", "--sample", "--view=extents", "--export={dir}/v4.svg"], 0, Empty, Starts("wrote {dir}/v4.svg (")),
+            case("--script v", &["run", "--sample", "--script", "LINE 0,0 1,1"], 0, Empty, Line("Command: LINE")),
+            case("--script=v", &["run", "--sample", "--script=LINE 0,0 1,1"], 0, Empty, Line("Command: LINE")),
+            case("--script-file v", &["run", "--sample", "--script-file", "{dir}/s.scr"], 0, Empty, Starts("Command: LINE")),
+            case("--script-file=v", &["run", "--sample", "--script-file={dir}/s.scr"], 0, Empty, Starts("Command: LINE")),
+            case("--cmd v", &["run", "--sample", "--cmd", "nosuch"], 1, Empty, Line("error: unknown command `nosuch`")),
+            case("--cmd=v", &["run", "--sample", "--cmd=nosuch"], 1, Empty, Line("error: unknown command `nosuch`")),
+            case("--cmd=-v", &["run", "--sample", "--cmd=-x"], 1, Empty, Line("error: unknown command `-x`")),
+            case("--save v", &["run", "--sample", "--save", "{dir}/s1.dxf"], 0, Empty, Starts("wrote {dir}/s1.dxf (")),
+            case("--save=v", &["run", "--sample", "--save={dir}/s2.dxf"], 0, Empty, Starts("wrote {dir}/s2.dxf (")),
+            case("--export v", &["run", "--sample", "--export", "{dir}/e1.svg"], 0, Empty, Starts("wrote {dir}/e1.svg (")),
+            case("--export=v", &["run", "--sample", "--export={dir}/e2.svg"], 0, Empty, Starts("wrote {dir}/e2.svg (")),
+            case(
+                "--window=-v: negative coordinates need =",
+                &["convert", "{b}", "{dir}/w5.svg", "--window=-1000,-1000,1000,1000"],
+                0,
+                Empty,
+                Starts("wrote {dir}/w5.svg ("),
+            ),
+            case(
+                "--window -v: a value starting with - is a flag",
+                &["convert", "{b}", "{dir}/w6.svg", "--window", "-1000,-1000,1000,1000"],
+                2,
+                Empty,
+                Line("error: unexpected argument '-1' found"),
+            ),
+            case("--connect v", &["mcp", "--connect", "127.0.0.1:1"], 1, Empty, Starts("error: cannot connect to 127.0.0.1:1:")),
+            case("--connect=v", &["mcp", "--connect=127.0.0.1:1"], 1, Empty, Starts("error: cannot connect to 127.0.0.1:1:")),
+        ],
+    );
+}
+
+/// A value flag at the end of the arguments, or followed by another flag, is missing its value:
+/// a flag is never taken as a value.
+#[test]
+fn flags_missing_their_value() {
+    run_cases(
+        "missing",
+        &[
+            case(
+                "convert --window last",
+                &["convert", "{b}", "{dir}/o.svg", "--window"],
+                2,
+                Empty,
+                Line("error: a value is required for '--window <x0,y0,x1,y1>' but none was supplied"),
+            ),
+            case(
+                "convert --view last",
+                &["convert", "{b}", "{dir}/o.svg", "--view"],
+                2,
+                Empty,
+                Line("error: a value is required for '--view <extents|current>' but none was supplied"),
+            ),
+            case(
+                "convert --window then flag",
+                &["convert", "{b}", "{dir}/o.svg", "--window", "--view", "extents"],
+                2,
+                Empty,
+                Line("error: a value is required for '--window <x0,y0,x1,y1>' but none was supplied"),
+            ),
+            case(
+                "convert --view then flag",
+                &["convert", "{b}", "{dir}/o.svg", "--view", "--window", "0,0,1,1"],
+                2,
+                Empty,
+                Line("error: a value is required for '--view <extents|current>' but none was supplied"),
+            ),
+            case(
+                "run --window last",
+                &["run", "--sample", "--window"],
+                2,
+                Empty,
+                Line("error: a value is required for '--window <x0,y0,x1,y1>' but none was supplied"),
+            ),
+            case(
+                "run --view last",
+                &["run", "--sample", "--view"],
+                2,
+                Empty,
+                Line("error: a value is required for '--view <extents|current>' but none was supplied"),
+            ),
+            case(
+                "run --script last",
+                &["run", "--sample", "--script"],
+                2,
+                Empty,
+                Line("error: a value is required for '--script <TEXT>' but none was supplied"),
+            ),
+            case(
+                "run --script then flag",
+                &["run", "--sample", "--script", "--sample"],
+                2,
+                Empty,
+                Line("error: a value is required for '--script <TEXT>' but none was supplied"),
+            ),
+            case(
+                "run --script-file last",
+                &["run", "--script-file"],
+                2,
+                Empty,
+                Line("error: a value is required for '--script-file <F.scr>' but none was supplied"),
+            ),
+            case(
+                "run --script-file then flag",
+                &["run", "--sample", "--script-file", "--sample"],
+                2,
+                Empty,
+                Line("error: a value is required for '--script-file <F.scr>' but none was supplied"),
+            ),
+            case(
+                "run --cmd last",
+                &["run", "--sample", "--cmd"],
+                2,
+                Empty,
+                Line("error: a value is required for '--cmd <id {json}>' but none was supplied"),
+            ),
+            case(
+                "run --cmd then flag",
+                &["run", "--sample", "--cmd", "--sample"],
+                2,
+                Empty,
+                Line("error: a value is required for '--cmd <id {json}>' but none was supplied"),
+            ),
+            case(
+                "run --save last",
+                &["run", "--sample", "--save"],
+                2,
+                Empty,
+                Line("error: a value is required for '--save <OUT.dxf>' but none was supplied"),
+            ),
+            case(
+                "run --export last",
+                &["run", "--sample", "--export"],
+                2,
+                Empty,
+                Line("error: a value is required for '--export <OUT.png>' but none was supplied"),
+            ),
+            case(
+                "mcp --connect last",
+                &["mcp", "--connect"],
+                2,
+                Empty,
+                Line("error: a value is required for '--connect <HOST:PORT>' but none was supplied"),
+            ),
+            case(
+                "mcp --connect then flag",
+                &["mcp", "--connect", "--lazy"],
+                2,
+                Empty,
+                Line("error: a value is required for '--connect <HOST:PORT>' but none was supplied"),
+            ),
+            case(
+                "mcp --connect empty",
+                &["mcp", "--connect", " "],
+                2,
+                Empty,
+                Line("error: invalid value ' ' for '--connect <HOST:PORT>': expected HOST:PORT (the app's --control port, e.g. 127.0.0.1:7979)"),
+            ),
+            case(
+                "mcp --connect without a port",
+                &["mcp", "--connect", "example.com"],
+                2,
+                Empty,
+                Line(
+                    "error: invalid value 'example.com' for '--connect <HOST:PORT>': expected HOST:PORT (the app's --control port, e.g. 127.0.0.1:7979)",
+                ),
+            ),
+            case(
+                "mcp --connect port out of range",
+                &["mcp", "--connect", "host:99999"],
+                2,
+                Empty,
+                Line(
+                    "error: invalid value 'host:99999' for '--connect <HOST:PORT>': expected HOST:PORT (the app's --control port, e.g. 127.0.0.1:7979)",
+                ),
+            ),
+            case(
+                "mcp --connect=-v",
+                &["mcp", "--connect=-v"],
+                2,
+                Empty,
+                Line("error: invalid value '-v' for '--connect <HOST:PORT>': expected HOST:PORT (the app's --control port, e.g. 127.0.0.1:7979)"),
+            ),
+        ],
+    );
+}
+
+#[test]
+fn repeated_and_combined_flags() {
+    run_cases(
+        "repeat",
+        &[
+            case(
+                "--save twice",
+                &["run", "--sample", "--save", "{dir}/a.dxf", "--save", "{dir}/b2.dxf"],
+                2,
+                Empty,
+                Line("error: the argument '--save <OUT.dxf>' cannot be used multiple times"),
+            ),
+            case(
+                "--export twice",
+                &["run", "--sample", "--export", "{dir}/x1.svg", "--export", "{dir}/x2.svg"],
+                2,
+                Empty,
+                Line("error: the argument '--export <OUT.png>' cannot be used multiple times"),
+            ),
+            case(
+                "--window twice",
+                &["run", "--sample", "--window", "0,0,1,1", "--window", "0,0,2,2", "--export", "{dir}/ww.svg"],
+                2,
+                Empty,
+                Line("error: the argument '--window <x0,y0,x1,y1>' cannot be used multiple times"),
+            ),
+            case(
+                "convert --window twice",
+                &["convert", "{b}", "{dir}/cw.svg", "--window", "0,0,1,1", "--window", "0,0,2,2"],
+                2,
+                Empty,
+                Line("error: the argument '--window <x0,y0,x1,y1>' cannot be used multiple times"),
+            ),
+            case(
+                "--view twice, different",
+                &["run", "--sample", "--view", "extents", "--view", "current", "--export", "{dir}/vv.svg"],
+                2,
+                Empty,
+                Line("error: the argument '--view <extents|current>' cannot be used multiple times"),
+            ),
+            case(
+                "--view twice, same",
+                &["run", "--sample", "--view", "extents", "--view", "extents", "--export", "{dir}/vs.svg"],
+                2,
+                Empty,
+                Line("error: the argument '--view <extents|current>' cannot be used multiple times"),
+            ),
+            case("--sample twice", &["run", "--sample", "--sample"], 2, Empty, Line("error: the argument '--sample' cannot be used multiple times")),
+            case("--metric twice", &["run", "--metric", "--metric"], 2, Empty, Line("error: the argument '--metric' cannot be used multiple times")),
+            case(
+                "--lazy twice",
+                &["mcp", "--connect", "127.0.0.1:1", "--lazy", "--lazy"],
+                2,
+                Empty,
+                Line("error: the argument '--lazy' cannot be used multiple times"),
+            ),
+            case(
+                "--launch twice",
+                &["mcp", "--connect", "127.0.0.1:1", "--launch", "--launch"],
+                2,
+                Empty,
+                Line("error: the argument '--launch' cannot be used multiple times"),
+            ),
+            case(
+                "--script, --script-file and --cmd repeat",
+                &[
+                    "run",
+                    "--sample",
+                    "--script",
+                    "LINE 0,0 1,1",
+                    "--script",
+                    "LINE 0,0 2,2",
+                    "--script-file",
+                    "{dir}/s.scr",
+                    "--script-file",
+                    "{dir}/s.scr",
+                ],
+                0,
+                Empty,
+                Starts("Command: LINE"),
+            ),
+            case(
+                "--window and --view",
+                &["run", "--sample", "--window", "0,0,1,1", "--view", "extents", "--export", "{dir}/wv.svg"],
+                2,
+                Empty,
+                Line("error: the argument '--window <x0,y0,x1,y1>' cannot be used with '--view <extents|current>'"),
+            ),
+            case(
+                "convert --window and --view",
+                &["convert", "{b}", "{dir}/cwv.svg", "--window", "0,0,1,1", "--view", "extents"],
+                2,
+                Empty,
+                Line("error: the argument '--window <x0,y0,x1,y1>' cannot be used with '--view <extents|current>'"),
+            ),
+            case(
+                "--view is case-insensitive",
+                &["run", "--sample", "--view", "EXTENTS", "--export", "{dir}/vu.svg"],
+                0,
+                Empty,
+                Starts("wrote {dir}/vu.svg ("),
+            ),
+            case(
+                "--connect twice",
+                &["mcp", "--connect", "127.0.0.1:1", "--connect", "127.0.0.1:2"],
+                2,
+                Empty,
+                Line("error: the argument '--connect <HOST:PORT>' cannot be used multiple times"),
+            ),
+            case("--lazy without --connect", &["mcp", "--lazy"], 2, Empty, Line("error: the following required arguments were not provided:")),
+            case("--launch without --connect", &["mcp", "--launch"], 2, Empty, Line("error: the following required arguments were not provided:")),
+            case("--sample --metric: both accepted", &["run", "--sample", "--metric"], 0, Empty, Empty),
+            case("--sample and a file", &["run", "--sample", "{b}"], 0, Empty, Empty),
+            case("two files", &["run", "{b}", "{b}"], 0, Empty, Empty),
+            case(
+                "--window without export",
+                &["run", "--sample", "--window", "0,0,1,1"],
+                2,
+                Empty,
+                Line("error: the following required arguments were not provided:"),
+            ),
+            case(
+                "--view without export",
+                &["run", "--sample", "--view", "current"],
+                2,
+                Empty,
+                Line("error: the following required arguments were not provided:"),
+            ),
+            case(
+                "--window with a dxf output",
+                &["convert", "{b}", "{dir}/o.dxf", "--window", "0,0,1,1"],
+                2,
+                Empty,
+                Line("error: --window only applies to image output (png, svg, pdf), not `{dir}/o.dxf`"),
+            ),
+            case(
+                "--view with a dxf output",
+                &["convert", "{b}", "{dir}/o.dxf", "--view", "extents"],
+                2,
+                Empty,
+                Line("error: --view only applies to image output (png, svg, pdf), not `{dir}/o.dxf`"),
+            ),
+            case(
+                "run --window with a dxf export",
+                &["run", "--sample", "--window", "0,0,1,1", "--export", "{dir}/o.dxf"],
+                2,
+                Empty,
+                Line("error: --window only applies to image output (png, svg, pdf), not `{dir}/o.dxf`"),
+            ),
+            case(
+                "run --view with a dxf export",
+                &["run", "--sample", "--view", "current", "--export", "{dir}/o.dxf"],
+                2,
+                Empty,
+                Line("error: --view only applies to image output (png, svg, pdf), not `{dir}/o.dxf`"),
+            ),
+        ],
+    );
+}
+
+#[test]
+fn arity_and_positional_arguments() {
+    run_cases(
+        "arity",
+        &[
+            case("info without a file", &["info"], 2, Empty, Line("error: the following required arguments were not provided:")),
+            case("info with two files", &["info", "{b}", "extra"], 2, Empty, Line("error: unexpected argument 'extra' found")),
+            case("info missing file", &["info", "missing.dxf"], 1, Empty, Starts("error: invalid parameters for `open`: missing.dxf:")),
+            case("convert with no files", &["convert"], 2, Empty, Line("error: the following required arguments were not provided:")),
+            case("convert with one file", &["convert", "{b}"], 2, Empty, Line("error: the following required arguments were not provided:")),
+            case(
+                "convert with three files",
+                &["convert", "{b}", "{dir}/o.svg", "{dir}/x.svg"],
+                2,
+                Empty,
+                Line("error: unexpected argument '{dir}/x.svg' found"),
+            ),
+            case("run missing file", &["run", "missing.dxf"], 1, Empty, Starts("error: invalid parameters for `open`: missing.dxf:")),
+            case("commands, no match", &["commands", "zzzznomatch"], 0, Line("[]"), Empty),
+            case(
+                "commands with an extra argument",
+                &["commands", "zzzznomatch", "extra"],
+                2,
+                Empty,
+                Line("error: unexpected argument 'extra' found"),
+            ),
+            case("sample without arguments", &["sample"], 2, Empty, Line("error: the following required arguments were not provided:")),
+            case("sample without an output", &["sample", "bracket"], 2, Empty, Line("error: the following required arguments were not provided:")),
+            case(
+                "sample with a bad name",
+                &["sample", "nosuch", "{dir}/o.dxf"],
+                2,
+                Empty,
+                Line("error: invalid value 'nosuch' for '<bracket|floorplan>'"),
+            ),
+            case(
+                "sample names are case-sensitive",
+                &["sample", "Bracket", "{dir}/o.dxf"],
+                2,
+                Empty,
+                Line("error: invalid value 'Bracket' for '<bracket|floorplan>'"),
+            ),
+            case(
+                "sample with an empty output",
+                &["sample", "bracket", ""],
+                2,
+                Empty,
+                Line("error: a value is required for '<OUT>' but none was supplied"),
+            ),
+            case("info with an empty file name", &["info", ""], 2, Empty, Line("error: a value is required for '<FILE>' but none was supplied")),
+            case("perf with an empty file name", &["perf", ""], 2, Empty, Line("error: a value is required for '[N|FILE]' but none was supplied")),
+            case(
+                "sample with an extra argument",
+                &["sample", "bracket", "{dir}/sx.dxf", "extra"],
+                2,
+                Empty,
+                Line("error: unexpected argument 'extra' found"),
+            ),
+            case("sample floor alias", &["sample", "floor", "{dir}/sf.dxf"], 0, Empty, Starts("wrote {dir}/sf.dxf (")),
+            case("sample with a bad extension", &["sample", "bracket", "{dir}/o.xyz"], 1, Empty, Line("error: unsupported file type `xyz`")),
+            case("perf with a word", &["perf", "abc"], 1, Empty, Starts("error: invalid parameters for `open`: abc:")),
+            case("perf with a negative number", &["perf", "-5"], 2, Empty, Line("error: unexpected argument '-5' found")),
+            case("perf with a missing file", &["perf", "missing.dxf"], 1, Empty, Starts("error: invalid parameters for `open`: missing.dxf:")),
+            case("perf 1", &["perf", "1"], 0, Starts("operation"), Empty),
+            case("perf 0 is raised to 1", &["perf", "0"], 0, Starts("operation"), Empty),
+            case("perf with two counts", &["perf", "1", "2"], 2, Empty, Line("error: unexpected argument '2' found")),
+        ],
+    );
+}
+
+#[test]
+fn bad_values() {
+    run_cases(
+        "values",
+        &[
+            case(
+                "--view sideways",
+                &["convert", "{b}", "{dir}/o.svg", "--view", "sideways"],
+                2,
+                Empty,
+                Line("error: invalid value 'sideways' for '--view <extents|current>'"),
+            ),
+            case(
+                "run --view sideways",
+                &["run", "--sample", "--view", "sideways"],
+                2,
+                Empty,
+                Line("error: invalid value 'sideways' for '--view <extents|current>'"),
+            ),
+            case(
+                "--view sideways before the output check",
+                &["convert", "{b}", "{dir}/o.dxf", "--view", "sideways"],
+                2,
+                Empty,
+                Line("error: invalid value 'sideways' for '--view <extents|current>'"),
+            ),
+            case(
+                "--window 3 numbers",
+                &["convert", "{b}", "{dir}/o.svg", "--window", "1,2,3"],
+                2,
+                Empty,
+                Line("error: invalid value '1,2,3' for '--window <x0,y0,x1,y1>': expected four numbers x0,y0,x1,y1"),
+            ),
+            case(
+                "--window 5 numbers",
+                &["convert", "{b}", "{dir}/o.svg", "--window", "1,2,3,4,5"],
+                2,
+                Empty,
+                Line("error: invalid value '1,2,3,4,5' for '--window <x0,y0,x1,y1>': expected four numbers x0,y0,x1,y1"),
+            ),
+            case(
+                "--window reversed",
+                &["convert", "{b}", "{dir}/o.svg", "--window", "3,3,1,1"],
+                2,
+                Empty,
+                Line("error: invalid value '3,3,1,1' for '--window <x0,y0,x1,y1>': need x0 < x1 and y0 < y1 (lower-left corner first)"),
+            ),
+            case(
+                "--window not numbers",
+                &["convert", "{b}", "{dir}/o.svg", "--window", "a,b,c,d"],
+                2,
+                Empty,
+                Line("error: invalid value 'a,b,c,d' for '--window <x0,y0,x1,y1>': x0 must be a finite number, got `a`"),
+            ),
+            case(
+                "--window NaN",
+                &["convert", "{b}", "{dir}/o.svg", "--window", "NaN,0,1,1"],
+                2,
+                Empty,
+                Line("error: invalid value 'NaN,0,1,1' for '--window <x0,y0,x1,y1>': x0 must be a finite number, got `NaN`"),
+            ),
+            case(
+                "--window too large",
+                &["convert", "{b}", "{dir}/o.svg", "--window", "0,0,1e13,1"],
+                2,
+                Empty,
+                Line("error: invalid value '0,0,1e13,1' for '--window <x0,y0,x1,y1>': export window: coordinates must lie within ±1e12"),
+            ),
+            case(
+                "run --window 3 numbers",
+                &["run", "--sample", "--window", "1,2,3", "--export", "{dir}/o.svg"],
+                2,
+                Empty,
+                Line("error: invalid value '1,2,3' for '--window <x0,y0,x1,y1>': expected four numbers x0,y0,x1,y1"),
+            ),
+            case(
+                "run --window reversed",
+                &["run", "--sample", "--window", "3,3,1,1", "--export", "{dir}/o.svg"],
+                2,
+                Empty,
+                Line("error: invalid value '3,3,1,1' for '--window <x0,y0,x1,y1>': need x0 < x1 and y0 < y1 (lower-left corner first)"),
+            ),
+            case(
+                "--cmd bad json",
+                &["run", "--sample", "--cmd", "line {bad json"],
+                2,
+                Empty,
+                Line("error: invalid value 'line {bad json' for '--cmd <id {json}>': key must be a string at line 1 column 2"),
+            ),
+            case(
+                "--cmd bad json after a good step: nothing runs",
+                &["run", "--sample", "--cmd", "line {\"points\":[[0,0],[1,1]]}", "--cmd", "line {"],
+                2,
+                Empty,
+                Starts("error: invalid value 'line {' for '--cmd <id {json}>': "),
+            ),
+            case(
+                "--cmd without an id",
+                &["run", "--sample", "--cmd", " {}"],
+                2,
+                Empty,
+                Line("error: invalid value ' {}' for '--cmd <id {json}>': expected a command id, then optionally its JSON parameters"),
+            ),
+            case(
+                "--cmd empty",
+                &["run", "--sample", "--cmd="],
+                2,
+                Empty,
+                Line("error: invalid value '' for '--cmd <id {json}>': expected a command id, then optionally its JSON parameters"),
+            ),
+            case("--cmd unknown id", &["run", "--sample", "--cmd", "nosuch"], 1, Empty, Line("error: unknown command `nosuch`")),
+            case(
+                "--cmd {last} with no earlier handle",
+                &["run", "--sample", "--cmd", "erase {\"handles\":[\"{last}\"]}"],
+                1,
+                Empty,
+                Line("error: --cmd erase: `{last}` needs an earlier --cmd in this run to have returned a handle"),
+            ),
+            case("--script-file missing", &["run", "--sample", "--script-file", "missing.scr"], 1, Empty, Starts("error: missing.scr:")),
+        ],
+    );
+}
+
+/// `mcp` serves on the process's real stdin and stdout, so the headless server runs through the
+/// binary, with a closed stdin.
+#[test]
+fn mcp_headless_with_a_closed_stdin() {
+    let out = std::process::Command::new(env!("CARGO_BIN_EXE_cadcraft-cli"))
+        .arg("mcp")
+        .stdin(std::process::Stdio::null())
+        .output()
+        .expect("run cadcraft-cli");
+    assert_eq!(out.status.code(), Some(0));
+    assert!(out.stdout.is_empty() && out.stderr.is_empty());
+}
+
+/// A drawing to open whose name isn't valid Unicode reaches the handler as a path; the engine opens
+/// files by text name, so it is refused there (exit 1), naming the file. Text that isn't Unicode is
+/// a usage error.
+#[cfg(unix)]
+#[test]
+fn non_unicode_arguments() {
+    use std::ffi::OsString;
+    use std::os::unix::ffi::OsStringExt;
+    let invoke_os = |args: Vec<OsString>| {
+        let (mut out, mut err) = (Vec::new(), Vec::new());
+        let code = cadcraft_cli::run(args, &mut out, &mut err);
+        assert!(out.is_empty());
+        (code, String::from_utf8_lossy(&err).into_owned())
+    };
+    let latin1 = || OsString::from_vec(b"caf\xe9.dxf".to_vec());
+    let (code, err) = invoke_os(vec![OsString::from("info"), latin1()]);
+    assert_eq!(code, 1);
+    assert_eq!(err.lines().next(), Some("error: caf\u{FFFD}.dxf: the file name is not valid Unicode"));
+    let (code, err) = invoke_os(vec![OsString::from("run"), OsString::from("--sample"), OsString::from("--cmd"), latin1()]);
+    assert_eq!(code, 2);
+    assert!(err.starts_with("error: invalid UTF-8 was detected"), "{err}");
+}
+
+/// An output name that isn't valid Unicode is written as given: only its extension picks the format.
+#[cfg(unix)]
+#[test]
+fn non_unicode_output_names() {
+    use std::ffi::OsString;
+    use std::os::unix::ffi::OsStringExt;
+    let s = Scratch::new("nonunicode-out");
+    let latin1 = |ext: &str| {
+        let mut n = b"caf\xe9.".to_vec();
+        n.extend_from_slice(ext.as_bytes());
+        s.0.join(OsString::from_vec(n))
+    };
+    let run = |args: Vec<OsString>| {
+        let (mut out, mut err) = (Vec::new(), Vec::new());
+        let code = cadcraft_cli::run(args, &mut out, &mut err);
+        (code, String::from_utf8_lossy(&err).into_owned())
+    };
+    let b = s.0.join("b.dxf");
+    let cases: [(Vec<OsString>, std::path::PathBuf); 3] = [
+        (vec!["sample".into(), "bracket".into(), latin1("dxf").into()], latin1("dxf")),
+        (vec!["convert".into(), b.clone().into(), latin1("svg").into()], latin1("svg")),
+        (vec!["run".into(), "--sample".into(), "--save".into(), latin1("dwg").into()], latin1("dwg")),
+    ];
+    for (args, path) in cases {
+        let (code, err) = run(args.clone());
+        assert_eq!(code, 0, "{args:?}: {err}");
+        assert!(path.exists(), "{path:?}");
+        assert!(std::fs::metadata(&path).expect("stat output").len() > 0, "{path:?}");
+    }
+    // An input with such a name is still refused.
+    let (code, err) = run(vec!["info".into(), latin1("dxf").into()]);
+    assert_eq!(code, 1);
+    assert!(err.contains("not valid Unicode"), "{err}");
+}
+
+/// An output that is an input file is refused before any work (exit 2, the input untouched) unless
+/// `--in-place` allows it; the same file under another spelling counts, another existing file doesn't.
+#[test]
+fn output_that_replaces_an_input() {
+    let s = Scratch::new("inplace");
+    let dir = s.0.to_str().expect("utf-8 path").to_string();
+    let b = format!("{dir}/b.dxf");
+    let original = std::fs::read(&b).expect("read input");
+    std::fs::create_dir_all(format!("{dir}/sub")).expect("create sub");
+    let dotted = format!("{dir}/sub/../b.dxf");
+    #[allow(unused_mut)]
+    let mut spellings = vec![b.clone(), dotted];
+    #[cfg(unix)]
+    {
+        let link = format!("{dir}/link.dxf");
+        std::os::unix::fs::symlink(&b, &link).expect("symlink");
+        spellings.push(link);
+    }
+    for out in &spellings {
+        for args in [vec!["convert", &b, out], vec!["run", &b, "--save", out], vec!["run", &b, "--export", out]] {
+            let r = invoke(&args);
+            assert_eq!(r.code, 2, "{args:?}: {}", r.stderr);
+            assert!(r.stdout.is_empty(), "{args:?}");
+            assert!(r.stderr.starts_with(&format!("error: {out} is an input file")), "{args:?}: {}", r.stderr);
+            assert!(r.stderr.contains("--in-place"), "{args:?}: {}", r.stderr);
+            assert_eq!(std::fs::read(&b).expect("read input"), original, "{args:?}: input changed");
+        }
+    }
+
+    // Another existing file is replaced as before.
+    let other = format!("{dir}/other.dxf");
+    std::fs::write(&other, "x").expect("write other");
+    let r = invoke(&["convert", &b, &other]);
+    assert_eq!(r.code, 0, "{}", r.stderr);
+    assert_ne!(std::fs::read(&other).expect("read other"), b"x");
+
+    // --in-place allows it, for each spelling and flag: the input itself is rewritten, and a
+    // symlink stays a link to it.
+    let line = "line {\"points\":[[0,0],[1,1]]}";
+    let lines = |p: &str| std::fs::read_to_string(p).expect("read input").lines().filter(|l| l.trim_end() == "LINE").count();
+    let before = lines(&b);
+    for out in &spellings {
+        std::fs::write(&b, &original).expect("restore input");
+        let r = invoke(&["convert", &b, out, "--in-place"]);
+        assert_eq!(r.code, 0, "convert {out}: {}", r.stderr);
+        assert_eq!(lines(&b), before, "convert {out} keeps the drawing");
+        for flag in ["--save", "--export"] {
+            std::fs::write(&b, &original).expect("restore input");
+            let r = invoke(&["run", &b, "--cmd", line, "--in-place", flag, out]);
+            assert_eq!(r.code, 0, "{flag} {out}: {}", r.stderr);
+            assert_eq!(lines(&b), before + 1, "{flag} {out}: the input gains the line");
+        }
+    }
+    #[cfg(unix)]
+    {
+        let link = format!("{dir}/link.dxf");
+        assert!(std::fs::symlink_metadata(&link).expect("stat link").file_type().is_symlink(), "{link} is still a symlink");
+    }
+
+    // An output that doesn't exist yet is never an input.
+    let new = format!("{dir}/new.dxf");
+    let r = invoke(&["run", &b, "--save", &new]);
+    assert_eq!(r.code, 0, "{}", r.stderr);
+    assert!(std::path::Path::new(&new).is_file(), "{new} written");
+}
+
+/// JSON results are pretty-printed; `--compact` puts each on one line (RFC-0012 rule 1.3). `run`
+/// prints one line per `--cmd` result either way.
+#[test]
+fn json_output_is_pretty_unless_compact() {
+    let s = Scratch::new("compact");
+    let b = format!("{}/b.dxf", s.0.to_str().expect("utf-8 path"));
+    for args in [&["info", b.as_str()][..], &["commands", "ellipse"]] {
+        let help = invoke(&[args[0], "--help"]);
+        assert!(
+            help.stdout.contains("--compact") && help.stdout.contains("One line of JSON instead of pretty-printed"),
+            "{} --help: {}",
+            args[0],
+            help.stdout
+        );
+        let pretty = invoke(args);
+        assert_eq!(pretty.code, 0, "{args:?}: {}", pretty.stderr);
+        assert!(pretty.stdout.lines().count() > 1, "{args:?} is pretty-printed: {}", pretty.stdout);
+        let compact = invoke(&[args, &["--compact"]].concat());
+        assert_eq!(compact.code, 0, "{args:?} --compact: {}", compact.stderr);
+        assert_eq!(compact.stdout.lines().count(), 1, "{args:?} --compact is one line: {}", compact.stdout);
+        let a: serde_json::Value = serde_json::from_str(&pretty.stdout).expect("pretty JSON");
+        let c: serde_json::Value = serde_json::from_str(&compact.stdout).expect("compact JSON");
+        assert_eq!(a, c, "{args:?}: same JSON either way");
+    }
+    let r = invoke(&["run", "--sample", "--cmd", "drawing.inspect", "--cmd", "drawing.inspect"]);
+    assert_eq!(r.code, 0, "{}", r.stderr);
+    assert_eq!(r.stdout.lines().count(), 2, "one line per --cmd result: {}", r.stdout);
+    assert_eq!(invoke(&["run", "--sample", "--compact"]).code, 2, "run takes no --compact");
+}

apps/cadcraft-cli/tests/man_and_completions.rs

@@ -0,0 +1,30 @@
+//! The clap definition is consistent, and `examples/man-and-completions.rs` writes every shell's
+//! completions and every man page under the names `packaging/linux/package.sh` installs.
+
+// The example itself, so the test runs its code; its `main` is unused here.
+#[allow(dead_code)]
+#[path = "../examples/man-and-completions.rs"]
+mod example;
+
+#[test]
+fn command_is_consistent() {
+    cadcraft_cli::command().debug_assert();
+}
+
+#[test]
+fn the_example_writes_the_files_the_packages_install() {
+    let dir = std::path::Path::new(env!("CARGO_TARGET_TMPDIR")).join(format!("man-and-completions-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    example::generate(&dir).unwrap();
+
+    let mut written: Vec<String> = std::fs::read_dir(&dir).unwrap().map(|e| e.unwrap().file_name().into_string().unwrap()).collect();
+    written.sort();
+    let completions = ["cadcraft-cli.bash", "_cadcraft-cli", "cadcraft-cli.fish", "cadcraft-cli.elv", "_cadcraft-cli.ps1"];
+    let subcommands = ["info", "convert", "run", "commands", "mcp", "perf", "sample", "roundtrip"];
+    let mut expected: Vec<String> = completions.map(String::from).into();
+    expected.push("cadcraft-cli.1".into());
+    expected.extend(subcommands.iter().map(|s| format!("cadcraft-cli-{s}.1")));
+    expected.sort();
+    assert_eq!(written, expected);
+    std::fs::remove_dir_all(&dir).unwrap();
+}

apps/cadcraft-cli/tests/read_notes.rs

@@ -0,0 +1,69 @@
+//! A damaged DWG opens partially (#859); `info` lists the reader's notes on what it left out
+//! (`readNotes`) and `convert` warns with them before writing the copy, so a script or agent sees
+//! the loss. The exit code stays 0.
+
+use std::process::{Command, Output};
+
+fn cli(args: &[&str]) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_cadcraft-cli")).args(args).output().unwrap()
+}
+
+/// A DWG of 200 lines, and a copy damaged so that the reader skips some of its records (found the
+/// way the reader's own test finds one: flipping a few bytes at a time across the objects area).
+fn dwg_and_damaged_copy() -> (Vec<u8>, Vec<u8>) {
+    let mut dxf = String::from("0\nSECTION\n2\nENTITIES\n");
+    for i in 0..200 {
+        dxf += &format!("0\nLINE\n8\n0\n10\n{i}\n20\n0\n11\n{i}\n21\n10\n");
+    }
+    dxf += "0\nENDSEC\n0\nEOF\n";
+    let d = cadcraft_io::read(dxf.as_bytes(), "lines.dxf").unwrap();
+    let opts = cadcraft_io::SaveOptions { version: Some(cadcraft_io::Version::R2000), binary: false };
+    let dwg = cadcraft_io::write_with(&d, "lines.dwg", &opts).unwrap();
+    let damaged = (dwg.len() / 4..dwg.len() * 3 / 5)
+        .step_by(97)
+        .map(|at| {
+            let mut b = dwg.clone();
+            b[at..at + 6].iter_mut().for_each(|x| *x ^= 0xA5);
+            b
+        })
+        .find(|b| cadcraft_io::read(b, "damaged.dwg").is_ok_and(|d| !d.read_notes.is_empty()))
+        .expect("no damaged copy read partially");
+    (dwg, damaged)
+}
+
+#[test]
+fn info_lists_and_convert_warns_about_read_notes() {
+    let dir = std::env::temp_dir().join(format!("cc-cli-read-notes-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let (whole, damaged) = dwg_and_damaged_copy();
+    let path = dir.join("damaged.dwg");
+    std::fs::write(&path, &damaged).unwrap();
+    let path = path.to_str().unwrap();
+
+    let out = cli(&["info", path]);
+    assert!(out.status.success(), "{:?}: {}", out.status, String::from_utf8_lossy(&out.stderr));
+    let v: serde_json::Value = serde_json::from_slice(&out.stdout).unwrap();
+    let notes = v["readNotes"].as_array().unwrap();
+    assert_eq!(notes.len(), 1, "{v}");
+    assert!(notes[0].as_str().unwrap().contains(" couldn't be read and "), "{v}");
+
+    let copy = dir.join("copy.dxf");
+    let out = cli(&["convert", path, copy.to_str().unwrap()]);
+    assert!(out.status.success(), "{:?}: {}", out.status, String::from_utf8_lossy(&out.stderr));
+    let err = String::from_utf8_lossy(&out.stderr);
+    let warnings: Vec<&str> = err.lines().filter(|l| l.contains(" couldn't be read and ")).collect();
+    assert_eq!(warnings.len(), 1, "{err}");
+    assert!(warnings[0].starts_with(&format!("{path}: DWG: ")), "{err}");
+    assert!(copy.exists());
+
+    // A complete read: no notes, and no warning.
+    let intact = dir.join("whole.dwg");
+    std::fs::write(&intact, &whole).unwrap();
+    let out = cli(&["info", intact.to_str().unwrap()]);
+    let v: serde_json::Value = serde_json::from_slice(&out.stdout).unwrap();
+    assert_eq!(v["readNotes"], serde_json::json!([]));
+    let out = cli(&["convert", intact.to_str().unwrap(), copy.to_str().unwrap()]);
+    assert!(out.status.success());
+    assert!(!String::from_utf8_lossy(&out.stderr).contains("couldn't be read"), "{}", String::from_utf8_lossy(&out.stderr));
+    let _ = std::fs::remove_dir_all(&dir);
+}

apps/cadcraft-web/src/main.rs

@@ -14,6 +14,9 @@ pub mod download;
 #[cfg(target_arch = "wasm32")]
 mod host;
 
+#[cfg(any(target_arch = "wasm32", test))]
+mod panel_layout;
+
 #[cfg(target_arch = "wasm32")]
 mod web {
     use cadcraft_engine::Session;
@@ -59,10 +62,14 @@ mod web {
             self.0.raw_input_hook(ctx, raw);
             cadcraft_ui_egui::cmdline::capture_tab(ctx, raw);
         }
-        /// Preferences (interface theme and language) survive reloads; egui state is not kept.
+        /// Preferences and validated panel placement survive reloads; egui memory is not kept.
         fn save(&mut self, storage: &mut dyn eframe::Storage) {
             storage.set_string(cadcraft_ui_egui::options::PROFILE_KEY, self.0.profile_json());
             storage.set_string(cadcraft_ui_egui::PREFS_KEY, self.0.prefs_json());
+            match crate::panel_layout::save(&self.0.ui) {
+                Ok(layout) => storage.set_string(crate::panel_layout::KEY, layout),
+                Err(error) => log::warn!("panel layout was not saved: {error}"),
+            }
         }
         fn persist_egui_memory(&self) -> bool {
             false
@@ -160,6 +167,11 @@ mod web {
                         if let Some(prefs) = cc.storage.and_then(|s| s.get_string(cadcraft_ui_egui::PREFS_KEY)) {
                             app.load_prefs(&prefs);
                         }
+                        if let Some(layout) = cc.storage.and_then(|s| s.get_string(crate::panel_layout::KEY))
+                            && let Err(error) = crate::panel_layout::restore(&mut app.ui, &layout)
+                        {
+                            log::warn!("panel layout was not restored: {error}");
+                        }
                         // `?cpu`: no render state for the app, so the canvas draws with egui shapes.
                         if !crate::wants_cpu(&query())
                             && let Some(rs) = &cc.wgpu_render_state

apps/cadcraft-web/src/panel_layout.rs

@@ -0,0 +1,104 @@
+//! Browser panel layout storage, independent of drawings and native workspace files.
+
+use cadcraft_ui_egui::{UiState, docking};
+use serde_json::{Value, json};
+
+#[cfg(target_arch = "wasm32")]
+pub const KEY: &str = "cadcraft.panel-layout";
+const MAX_BYTES: usize = 64 * 1024;
+
+/// Serialize only validated panel placement and visibility, with a bounded record size.
+pub fn save(ui: &UiState) -> Result<String, String> {
+    docking::validate(&ui.docking)?;
+    let saved = json!({
+        "version": docking::LAYOUT_VERSION,
+        "docking": ui.docking,
+        "showToolsets": ui.show_toolsets,
+        "showPalettes": ui.show_palettes,
+    })
+    .to_string();
+    if saved.len() > MAX_BYTES {
+        return Err("panel layout exceeds 64 KiB".into());
+    }
+    Ok(saved)
+}
+
+/// Validate the entire optional record before changing any UI field.
+pub fn restore(ui: &mut UiState, saved: &str) -> Result<(), String> {
+    if saved.len() > MAX_BYTES {
+        return Err("panel layout exceeds 64 KiB".into());
+    }
+    let value: Value = serde_json::from_str(saved).map_err(|error| error.to_string())?;
+    if value.get("version").and_then(Value::as_u64) != Some(u64::from(docking::LAYOUT_VERSION)) {
+        return Err("unsupported panel layout version".into());
+    }
+    let workspace: docking::Workspace =
+        serde_json::from_value(value.get("docking").cloned().ok_or("missing panel layout")?).map_err(|error| error.to_string())?;
+    docking::validate(&workspace)?;
+    let tools = value.get("showToolsets").and_then(Value::as_bool).ok_or("invalid Tool Sets visibility")?;
+    let palettes = value.get("showPalettes").and_then(Value::as_bool).ok_or("invalid palette visibility")?;
+    ui.docking = workspace;
+    ui.show_toolsets = tools;
+    ui.show_palettes = palettes;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use cadcraft_engine::Session;
+    use cadcraft_ui_egui::{CadApp, Services};
+
+    #[test]
+    fn floating_and_hidden_panels_survive_storage_without_replacing_drawing_state() {
+        let mut source = CadApp::new(Session::default(), Services::default());
+        source.run("ui.dock", json!({"operation":"float","panel":"toolSets","rect":[120,90,340,410]})).unwrap();
+        source.run("ui.dock", json!({"operation":"close","panel":"properties"})).unwrap();
+        let saved = save(&source.ui).unwrap();
+        let mut destination = CadApp::new(Session::default(), Services::default());
+        destination.session.start("line").unwrap();
+        let before = destination.session.doc().unwrap().clone();
+        restore(&mut destination.ui, &saved).unwrap();
+        assert_eq!(destination.ui.docking, source.ui.docking);
+        assert_eq!(destination.ui.show_toolsets, source.ui.show_toolsets);
+        assert_eq!(destination.ui.show_palettes, source.ui.show_palettes);
+        assert_eq!(destination.session.running.as_ref().map(|command| command.id.as_str()), Some("line"));
+        assert_eq!(destination.session.doc().unwrap(), &before);
+    }
+
+    #[test]
+    fn malformed_or_unsupported_storage_is_rejected_atomically() {
+        let mut ui = UiState::default();
+        let before = serde_json::to_value(&ui).unwrap();
+        let valid: Value = serde_json::from_str(&save(&ui).unwrap()).unwrap();
+        for (field, bad) in [
+            ("version", json!(0)),
+            ("version", json!(docking::LAYOUT_VERSION + 1)),
+            ("docking", json!({})),
+            ("showToolsets", json!("false")),
+            ("showPalettes", Value::Null),
+        ] {
+            let mut invalid = valid.clone();
+            invalid[field] = bad;
+            assert!(restore(&mut ui, &invalid.to_string()).is_err());
+            assert_eq!(serde_json::to_value(&ui).unwrap(), before);
+        }
+        for invalid in ["not json".to_string(), " ".repeat(MAX_BYTES + 1)] {
+            assert!(restore(&mut ui, &invalid).is_err());
+            assert_eq!(serde_json::to_value(&ui).unwrap(), before);
+        }
+    }
+
+    #[test]
+    fn storage_cannot_remove_the_document_view() {
+        let mut ui = UiState::default();
+        let before = serde_json::to_value(&ui).unwrap();
+        let mut invalid = ui.clone();
+        invalid.docking.layout.root = None;
+        assert!(save(&invalid).is_err());
+        let mut record: Value = serde_json::from_str(&save(&ui).unwrap()).unwrap();
+        record["docking"] = serde_json::to_value(&invalid.docking).unwrap();
+        assert!(restore(&mut ui, &record.to_string()).is_err());
+        assert_eq!(serde_json::to_value(&ui).unwrap(), before);
+    }
+}

apps/cadcraft/Cargo.toml

@@ -21,7 +21,12 @@ eframe = { workspace = true, features = ["clipboard", "wgpu", "accesskit", "wayl
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+clap = { workspace = true }
+thiserror = { workspace = true }
 chrono = { workspace = true }
+# Reads eframe's app.ron to tell whether a window state was saved (main.rs `saved_window`).
+# Already in Cargo.lock through eframe; same version so nothing is built twice.
+ron = "0.12"
 
 [build-dependencies]
 winresource = "0.1"
@@ -48,6 +53,9 @@ muda = { version = "0.21", default-features = false }
 # View ▸ Accessibility ▸ Animation Effects ▸ Use System Setting: the system's Reduce motion
 # (system_animations.rs). Already in Cargo.lock through muda.
 objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSWorkspace", "NSAccessibility"] }
+# The same winit eframe uses (the storytold fork, patched in the workspace): its opt-in that turns
+# AppKit's terminate (Cmd+Q, Dock Quit) into a close request, so unsaved changes are asked about.
+winit = { version = "0.30", default-features = false }
 
 # Rust HID backends: no proprietary SDK or C HID library.
 [target.'cfg(target_os = "windows")'.dependencies]

apps/cadcraft/src/control_server.rs

@@ -7,7 +7,7 @@
 //! ([`Limits`]): simultaneous connections, request line length, queued requests, and how long a
 //! socket may sit idle or blocked on a write.
 
-use std::io::{BufRead, BufReader, ErrorKind, Read, Write};
+use std::io::{BufRead, BufReader, ErrorKind, Write};
 use std::net::{TcpListener, TcpStream};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
@@ -24,6 +24,9 @@ struct Limits {
     max_clients: usize,
     /// Longest request line in bytes (newline excluded); a longer one closes the connection.
     max_line: usize,
+    /// Request-line bytes buffered at once across all connections; a request that would pass it
+    /// is refused with an error reply.
+    total_bytes: usize,
     /// Requests waiting for the app at once; more are answered `busy`.
     queue: usize,
     /// How long a connection may go without sending a byte before it is closed.
@@ -40,6 +43,8 @@ impl Default for Limits {
             max_clients: 16,
             // Generous, so requests that carry whole drawings or images as base64 still fit.
             max_line: 256 * 1024 * 1024,
+            // Room for one maximal request plus smaller ones, not `max_clients` maximal ones.
+            total_bytes: 512 * 1024 * 1024,
             queue: 64,
             idle_timeout: Duration::from_secs(600),
             write_timeout: Duration::from_secs(30),
@@ -106,6 +111,7 @@ impl Drop for Slot {
 /// Accept clients within the connection limit and give each worker the same session token.
 fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui::Context, limits: Limits, token: Arc<String>) {
     let open = Arc::new(AtomicUsize::new(0));
+    let budget = Budget::new(limits.total_bytes);
     for mut stream in accepted(listener.incoming(), || std::thread::sleep(ACCEPT_RETRY)) {
         let _ = stream.set_write_timeout(Some(limits.write_timeout));
         if open.fetch_add(1, Ordering::SeqCst) >= limits.max_clients {
@@ -117,39 +123,102 @@ fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui:
         let tx = tx.clone();
         let ctx = ctx.clone();
         let token = Arc::clone(&token);
+        let budget = budget.clone();
         let _ = std::thread::Builder::new().spawn(move || {
             let _slot = slot;
-            serve(stream, &tx, &ctx, limits, &token);
+            serve(stream, &tx, &ctx, limits, &token, budget);
         });
     }
 }
 
-/// Read one `\n`-terminated line of at most `max` bytes into `buf` (newline stripped).
-/// `Ok(false)` at end of stream; `Err` when the line is too long or the read fails.
-fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize) -> Result<bool, String> {
+/// A total-bytes budget for request lines buffered across all connections, so
+/// [`Limits::max_clients`] peers can't each hold a [`Limits::max_line`] line at once (#1925).
+#[derive(Clone, Debug)]
+struct Budget {
+    used: Arc<AtomicUsize>,
+    total: usize,
+}
+
+impl Budget {
+    fn new(total: usize) -> Self {
+        Self { used: Arc::new(AtomicUsize::new(0)), total }
+    }
+
+    /// Reserve `n` more bytes, or `false` (nothing reserved) when that would pass the total.
+    fn reserve(&self, n: usize) -> bool {
+        self.used.try_update(Ordering::SeqCst, Ordering::SeqCst, |u| u.checked_add(n).filter(|&t| t <= self.total)).is_ok()
+    }
+}
+
+/// Bytes a connection holds from the [`Budget`] for its current request line; given back when the
+/// next line starts or the connection ends.
+struct Held {
+    budget: Budget,
+    bytes: usize,
+}
+
+impl Held {
+    fn new(budget: Budget) -> Self {
+        Self { budget, bytes: 0 }
+    }
+
+    fn release(&mut self) {
+        self.budget.used.fetch_sub(self.bytes, Ordering::SeqCst);
+        self.bytes = 0;
+    }
+}
+
+impl Drop for Held {
+    fn drop(&mut self) {
+        self.release();
+    }
+}
+
+/// Read one `\n`-terminated line of at most `max` bytes into `buf` (newline stripped), charging
+/// the bytes buffered to `held`. `Ok(false)` at end of stream; `Err` when the line is too long,
+/// the shared budget is used up, or the read fails.
+fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize, held: &mut Held) -> Result<bool, String> {
     buf.clear();
-    // `take` bounds the bytes buffered for one line: a peer can't make us allocate more than `max`.
-    let limit = u64::try_from(max).unwrap_or(u64::MAX).saturating_add(1);
-    let n = reader.take(limit).read_until(b'\n', buf).map_err(|e| match e.kind() {
-        // The idle timeout ran out (Windows reports it as TimedOut, Unix as WouldBlock).
-        ErrorKind::TimedOut | ErrorKind::WouldBlock => "request line not completed in time; closing the connection".to_string(),
-        _ => e.to_string(),
-    })?;
-    if n == 0 {
-        return Ok(false);
-    }
-    if buf.last() == Some(&b'\n') {
-        buf.pop();
-        if buf.last() == Some(&b'\r') {
+    held.release();
+    // A line is at most `max` bytes plus its newline; never buffer more than that.
+    let cap = max.saturating_add(1);
+    loop {
+        let chunk = match reader.fill_buf() {
+            Ok(c) => c,
+            Err(e) if e.kind() == ErrorKind::Interrupted => continue,
+            Err(e) => {
+                return Err(match e.kind() {
+                    // The idle timeout ran out (Windows reports it as TimedOut, Unix as WouldBlock).
+                    ErrorKind::TimedOut | ErrorKind::WouldBlock => "request line not completed in time; closing the connection".to_string(),
+                    _ => e.to_string(),
+                });
+            }
+        };
+        if chunk.is_empty() {
+            // End of stream: nothing read, or a last line without a newline.
+            return Ok(!buf.is_empty());
+        }
+        let line_end = chunk.iter().position(|&b| b == b'\n').map(|i| i + 1);
+        let n = line_end.unwrap_or(chunk.len()).min(cap.saturating_sub(buf.len()));
+        buf.extend_from_slice(chunk.get(..n).unwrap_or(chunk));
+        reader.consume(n);
+        // The chunk is already buffered (a few KiB), so it is added before it is charged: a
+        // refusal still leaves `buf` non-empty and the connection gets an error reply.
+        if !held.budget.reserve(n) {
+            return Err("too many large requests in flight; try again later".to_string());
+        }
+        held.bytes += n;
+        if buf.last() == Some(&b'\n') {
             buf.pop();
+            if buf.last() == Some(&b'\r') {
+                buf.pop();
+            }
+            return Ok(true);
+        }
+        if buf.len() > max {
+            return Err(format!("request line longer than {max} bytes; closing the connection"));
         }
-        return Ok(true);
     }
-    if buf.len() > max {
-        return Err(format!("request line longer than {max} bytes; closing the connection"));
-    }
-    // Last line without a newline, then end of stream.
-    Ok(true)
 }
 
 /// One request line, parsed.
@@ -204,7 +273,7 @@ fn is_http_request_line(text: &str) -> bool {
 
 /// Serve bounded JSON lines, authenticating each request before enqueueing it for the UI.
 /// Invalid credentials close the connection; queue and reply limits report whether a request ran.
-fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context, limits: Limits, token: &str) {
+fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context, limits: Limits, token: &str, budget: Budget) {
     if stream.set_read_timeout(Some(limits.idle_timeout)).is_err() || stream.set_write_timeout(Some(limits.write_timeout)).is_err() {
         return;
     }
@@ -212,8 +281,9 @@ fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context
     let mut out = stream;
     let mut reader = BufReader::new(read);
     let mut buf = Vec::new();
+    let mut held = Held::new(budget);
     loop {
-        let reject = match read_bounded_line(&mut reader, &mut buf, limits.max_line) {
+        let reject = match read_bounded_line(&mut reader, &mut buf, limits.max_line, &mut held) {
             Ok(false) => break,
             // Nothing of a line arrived (idle timeout, or the peer is gone): close without a word.
             // A line nobody asked for would be read as the reply to the client's next request.
@@ -264,6 +334,7 @@ fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::io::Read;
 
     /// A failed accept is followed by a wait before the next one, so a listener that keeps
     /// failing does not spin, and the connections around the failures still come through.
@@ -281,13 +352,13 @@ mod tests {
     fn lines_are_read_up_to_the_limit() {
         let mut buf = Vec::new();
         let mut input: &[u8] = b"aaaaaaaaaa\nbb\r\ncc";
-        assert_eq!(read_bounded_line(&mut input, &mut buf, 10), Ok(true));
+        assert_eq!(read_bounded_line(&mut input, &mut buf, 10, &mut held()), Ok(true));
         assert_eq!(buf, b"aaaaaaaaaa", "a line exactly at the limit is accepted");
-        assert_eq!(read_bounded_line(&mut input, &mut buf, 10), Ok(true));
+        assert_eq!(read_bounded_line(&mut input, &mut buf, 10, &mut held()), Ok(true));
         assert_eq!(buf, b"bb", "CRLF is stripped");
-        assert_eq!(read_bounded_line(&mut input, &mut buf, 10), Ok(true));
+        assert_eq!(read_bounded_line(&mut input, &mut buf, 10, &mut held()), Ok(true));
         assert_eq!(buf, b"cc", "a last line without a newline is still read");
-        assert_eq!(read_bounded_line(&mut input, &mut buf, 10), Ok(false), "then end of stream");
+        assert_eq!(read_bounded_line(&mut input, &mut buf, 10, &mut held()), Ok(false), "then end of stream");
     }
 
     #[test]
@@ -295,11 +366,15 @@ mod tests {
         let mut buf = Vec::new();
         let long = [b'x'; 100];
         let mut input: &[u8] = &long;
-        assert!(read_bounded_line(&mut input, &mut buf, 10).is_err());
+        assert!(read_bounded_line(&mut input, &mut buf, 10, &mut held()).is_err());
         assert!(buf.len() <= 11, "at most limit + 1 bytes are buffered, got {}", buf.len());
         assert_eq!(input.len(), 100 - 11, "the rest of the line is left unread");
     }
 
+    fn held() -> Held {
+        Held::new(Budget::new(usize::MAX))
+    }
+
     fn short() -> Limits {
         Limits {
             queue: 1,
@@ -414,6 +489,40 @@ mod tests {
         drop(rx);
     }
 
+    /// Connections can't together buffer more request-line bytes than the budget: a second large
+    /// request is refused with an error reply while the first still holds its bytes (#1925).
+    #[test]
+    fn requests_past_the_total_budget_are_refused() {
+        let (addr, _rx) = serve_with(Limits { max_line: 1000, total_bytes: 300, idle_timeout: Duration::from_secs(5), ..short() });
+        // The first peer sends 200 bytes of an unfinished line and keeps the connection open.
+        let mut first = TcpStream::connect(addr).unwrap();
+        first.write_all(&[b'a'; 200]).unwrap();
+        std::thread::sleep(Duration::from_millis(200));
+        // The second would take 200 more, past the 300 byte total.
+        let mut second = TcpStream::connect(addr).unwrap();
+        second.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        second.write_all(&[b'b'; 200]).unwrap();
+        let mut line = String::new();
+        BufReader::new(second).read_line(&mut line).unwrap();
+        let v: Value = serde_json::from_str(&line).unwrap();
+        assert_eq!(v["ok"], json!(false));
+        assert!(v["error"].as_str().unwrap_or("").contains("too many large requests"), "{line}");
+        drop(first);
+    }
+
+    #[test]
+    fn the_budget_is_given_back_when_the_connection_ends() {
+        let budget = Budget::new(100);
+        {
+            let mut h = Held::new(budget.clone());
+            let mut buf = Vec::new();
+            let mut input: &[u8] = &[b'x'; 80];
+            assert_eq!(read_bounded_line(&mut input, &mut buf, 1000, &mut h), Ok(true));
+            assert!(!budget.reserve(30), "80 of 100 bytes are held");
+        }
+        assert!(budget.reserve(100), "all given back on drop");
+    }
+
     /// Replies on one authenticated connection preserve the ID of each request.
     #[test]
     fn requests_are_answered_with_their_ids() {

apps/cadcraft/src/env.rs

@@ -0,0 +1,172 @@
+//! The `CADCRAFT_*` variables of the desktop app, read once at startup into [`Env`] and passed on
+//! from there; no library crate reads them. `--help` lists them from [`VARS`]. `--control`'s
+//! fallback, `CADCRAFT_CONTROL_PORT`, is clap's (see `launch_args`).
+
+use std::ffi::OsString;
+use std::fmt::Write as _;
+use std::path::PathBuf;
+
+use cadcraft_ui_egui::switch::Switch;
+
+const CONFIG_DIR: &str = "CADCRAFT_CONFIG_DIR";
+const LOCALE: &str = "CADCRAFT_LOCALE";
+const VSYNC: &str = "CADCRAFT_VSYNC";
+const WAYLAND: &str = "CADCRAFT_WAYLAND";
+const NO_NATIVE_MENU: &str = "CADCRAFT_NO_NATIVE_MENU";
+const SYSTEM_CURSOR: &str = "CADCRAFT_SYSTEM_CURSOR";
+const FONTALT: &str = "CADCRAFT_FONTALT";
+const FONTFALLBACK: &str = "CADCRAFT_FONTFALLBACK";
+
+/// Every variable [`Env`] reads, with its `--help` line.
+pub(crate) const VARS: &[(&str, &str)] = &[
+    (CONFIG_DIR, "the settings folder (logs, autosave, workspace, plotters); empty means no settings folder"),
+    (LOCALE, "the interface language, instead of the system's"),
+    (VSYNC, "1 presents with vsync, 0 without it (default: without on Linux and BSD)"),
+    (WAYLAND, "1 keeps the native Wayland backend instead of XWayland; 0 or unset is off"),
+    (NO_NATIVE_MENU, "macOS: 1 keeps the menus inside the window; 0 or unset is off"),
+    (SYSTEM_CURSOR, "1 uses the system cursor instead of the drawn crosshair; 0 or unset is off"),
+    (FONTALT, "the font that replaces a missing one"),
+    (FONTFALLBACK, "the fonts tried, in order, for characters a font lacks"),
+];
+
+/// The process environment, read once at startup. A blank variable counts as unset, except
+/// `CADCRAFT_CONFIG_DIR`.
+#[derive(Debug, PartialEq)]
+pub(crate) struct Env {
+    /// The settings folder (logs, autosave, workspace, plotters): `CADCRAFT_CONFIG_DIR`; else, when
+    /// that is unset, the platform's (`cadcraft_engine::settings_dir::platform`). `None`: no
+    /// folder, because the variable is empty or blank (the way to run without one) or the
+    /// platform has none.
+    pub(crate) config_dir: Option<PathBuf>,
+    /// The interface language, instead of the system's.
+    pub(crate) locale: Option<String>,
+    /// Present with vsync (default: off on Linux and BSD, on elsewhere).
+    pub(crate) vsync: Switch,
+    /// Keep the native Wayland backend instead of XWayland.
+    #[cfg_attr(not(all(unix, not(target_os = "macos"))), allow(dead_code))]
+    pub(crate) wayland: Switch,
+    /// macOS: keep the menus inside the window.
+    #[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+    pub(crate) no_native_menu: Switch,
+    /// Use the system cursor instead of the drawn crosshair.
+    pub(crate) system_cursor: Switch,
+    /// FONTALT at startup.
+    pub(crate) font_alt: Option<String>,
+    /// FONTFALLBACK at startup.
+    pub(crate) font_fallback: Option<String>,
+}
+
+impl Env {
+    pub(crate) fn read() -> Env {
+        Env::from_vars(|k| std::env::var_os(k))
+    }
+
+    /// [`Env::read`] with `var` looking a variable up.
+    pub(crate) fn from_vars(var: impl Fn(&str) -> Option<OsString>) -> Env {
+        let text = |k: &str| var(k).and_then(|v| v.into_string().ok()).filter(|v| !v.trim().is_empty());
+        let switch = |k: &str| Switch::parse(k, var(k).map(|v| v.to_string_lossy().into_owned()).as_deref());
+        Env {
+            config_dir: match var(CONFIG_DIR) {
+                Some(dir) if dir.to_str().is_some_and(|d| d.trim().is_empty()) => None,
+                Some(dir) => Some(PathBuf::from(dir)),
+                None => cadcraft_engine::settings_dir::platform(&var),
+            },
+            locale: text(LOCALE),
+            vsync: switch(VSYNC),
+            wayland: switch(WAYLAND),
+            no_native_menu: switch(NO_NATIVE_MENU),
+            system_cursor: switch(SYSTEM_CURSOR),
+            font_alt: text(FONTALT),
+            font_fallback: text(FONTFALLBACK),
+        }
+    }
+}
+
+/// The `--help` section that lists [`VARS`].
+pub(crate) fn help() -> String {
+    let width = VARS.iter().map(|(name, _)| name.len()).max().unwrap_or(0) + 3;
+    VARS.iter().fold(String::from("Environment:"), |mut help, (name, line)| {
+        let _ = write!(help, "\n  {name:<width$}{line}");
+        help
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::cell::RefCell;
+
+    fn env<'a>(vars: &'a [(&'a str, &'a str)]) -> impl Fn(&str) -> Option<OsString> + 'a {
+        move |k| vars.iter().find(|(n, _)| *n == k).map(|(_, v)| OsString::from(v))
+    }
+
+    #[test]
+    fn every_variable_read_is_in_the_help_and_every_listed_one_is_read() {
+        let asked = RefCell::new(Vec::new());
+        Env::from_vars(|k| {
+            asked.borrow_mut().push(k.to_owned());
+            None
+        });
+        let ours: Vec<String> = asked.into_inner().into_iter().filter(|k| k.starts_with("CADCRAFT_")).collect();
+        let help = help();
+        let unset = Env::from_vars(|_| None);
+        for k in &ours {
+            assert!(VARS.iter().any(|(name, _)| name == k), "{k} is read but not in VARS");
+        }
+        for (name, line) in VARS {
+            assert!(ours.iter().any(|k| k == name), "{name} is in VARS but not read");
+            assert_ne!(Env::from_vars(env(&[(name, "1")])), unset, "{name} sets no field");
+            assert!(help.lines().any(|l| l.trim_start().starts_with(name) && l.ends_with(line)), "{help}");
+        }
+    }
+
+    #[test]
+    fn values_are_read_and_blank_ones_are_unset() {
+        let vars = [
+            (CONFIG_DIR, "/private/cc"),
+            ("HOME", "/home/u"),
+            ("XDG_CONFIG_HOME", "/x"),
+            ("APPDATA", "C:\\a"),
+            (LOCALE, "cs-CZ"),
+            (VSYNC, " On "),
+            (WAYLAND, "0"),
+            (NO_NATIVE_MENU, "yes"),
+            (SYSTEM_CURSOR, "maybe"),
+            (FONTALT, "Noto Sans"),
+            (FONTFALLBACK, "Vazirmatn, msjh.ttc"),
+        ];
+        let read = Env::from_vars(env(&vars));
+        assert_eq!(
+            read,
+            Env {
+                config_dir: Some(PathBuf::from("/private/cc")),
+                locale: Some("cs-CZ".into()),
+                vsync: Switch::On,
+                wayland: Switch::Off,
+                no_native_menu: Switch::On,
+                system_cursor: Switch::Default,
+                font_alt: Some("Noto Sans".into()),
+                font_fallback: Some("Vazirmatn, msjh.ttc".into()),
+            }
+        );
+        let blank = vars.map(|(k, _)| (k, if k == FONTALT { "  " } else { "" }));
+        let read = Env::from_vars(env(&blank));
+        assert_eq!(read.config_dir, None, "an empty variable means no directory, not the working directory");
+        assert_eq!((read.locale, read.font_alt, read.font_fallback), (None, None, None));
+        assert_eq!([read.vsync, read.wayland, read.no_native_menu, read.system_cursor], [Switch::Default; 4]);
+    }
+
+    #[test]
+    fn config_dir_unset_is_the_platform_folder_set_is_that_folder_blank_is_none() {
+        let platform = [("HOME", "/home/u"), ("XDG_CONFIG_HOME", "/x"), ("APPDATA", "C:\\a")];
+        let expected = cadcraft_engine::settings_dir::platform(env(&platform));
+        assert!(expected.is_some());
+        assert_eq!(Env::from_vars(env(&platform)).config_dir, expected);
+        let set = [platform.as_slice(), &[(CONFIG_DIR, "/private/cc")]].concat();
+        assert_eq!(Env::from_vars(env(&set)).config_dir, Some(PathBuf::from("/private/cc")));
+        for blank in ["", "  "] {
+            let vars = [platform.as_slice(), &[(CONFIG_DIR, blank)]].concat();
+            assert_eq!(Env::from_vars(env(&vars)).config_dir, None, "{blank:?} means no settings folder, not the platform's");
+        }
+    }
+}

apps/cadcraft/src/launch_args.rs

@@ -0,0 +1,158 @@
+//! The desktop app's command line, as clap types: `cadcraft --help` comes from these doc comments
+//! and its Environment section from [`crate::env::VARS`], so the help and the parsers can't disagree. Anything they don't declare is a usage error naming
+//! it (exit status 2), so a typo such as `--sampel` doesn't open the window and then fail to open
+//! the flag as a file; so is a flag without its value, a repeated flag and a bad port, from the
+//! flag or from `CADCRAFT_CONTROL_PORT`. A value never starts with `-`, and a file whose name
+//! starts with `-` goes after `--`.
+
+use std::ffi::OsString;
+use std::path::PathBuf;
+
+use cadcraft_mcp::args::{blank_env_is_unset, name_env_vars};
+use clap::{Command, CommandFactory, FromArgMatches, Parser};
+
+/// Opens CADCraft with the given files
+#[derive(Parser)]
+#[command(name = "cadcraft", version = cadcraft_engine::build_version(), after_help = crate::env::help())]
+pub(crate) struct LaunchArgs {
+    /// Files to open. Put `--` before a name that starts with `-`
+    pub(crate) files: Vec<PathBuf>,
+    /// Start the localhost JSON-lines control server on this port
+    // allow_negative_numbers makes `--control -1` a bad value rather than a missing one.
+    #[arg(long, value_name = "PORT", env = "CADCRAFT_CONTROL_PORT", value_parser = control_port, allow_negative_numbers = true)]
+    pub(crate) control: Option<u16>,
+    /// Open with the sample drawing
+    #[arg(long)]
+    pub(crate) sample: bool,
+}
+
+/// The command line. An empty or blank variable counts as unset.
+pub(crate) fn command() -> Command {
+    LaunchArgs::command().mut_args(|a| blank_env_is_unset(a, |k| std::env::var_os(k)))
+}
+
+/// Parse the launch arguments (without the binary name) with `cmd`, from [`command`]. Old macOS
+/// passes a process serial number (`-psn_…`) when launched from Finder: it is dropped first, unless
+/// it comes after `--`. A bad value from a variable is a usage error naming the variable.
+pub(crate) fn parse(mut cmd: Command, args: impl IntoIterator<Item = OsString>) -> Result<LaunchArgs, clap::Error> {
+    let mut options = true;
+    let args: Vec<OsString> = args
+        .into_iter()
+        .filter(|a| {
+            options &= a != "--";
+            !(options && a.to_str().is_some_and(|s| s.starts_with("-psn_")))
+        })
+        .collect();
+    let argv = std::iter::once(OsString::from("cadcraft")).chain(args.iter().cloned());
+    let matches = cmd.try_get_matches_from_mut(argv).map_err(|e| name_env_vars(e, &cmd, &args))?;
+    LaunchArgs::from_arg_matches(&matches)
+}
+
+/// A control port, for clap's `value_parser`: `--control` and `CADCRAFT_CONTROL_PORT`, which may
+/// carry spaces.
+fn control_port(s: &str) -> Result<u16, NotAPort> {
+    s.trim().parse().map_err(|_| NotAPort)
+}
+
+/// A [`control_port`] value that isn't a port.
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
+#[error("expected a port, 0-65535")]
+struct NotAPort;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use clap::error::ErrorKind;
+
+    /// Parse without the variables, so one exported where the tests run can't change them.
+    fn parse_args(args: &[&str]) -> Result<LaunchArgs, clap::Error> {
+        parse(command().mut_args(|a| a.env(None::<&str>)), args.iter().map(OsString::from))
+    }
+
+    fn usage_error(args: &[&str]) -> String {
+        let Err(e) = parse_args(args) else { panic!("{args:?} parsed") };
+        assert_eq!(e.exit_code(), 2, "{args:?}: {e}");
+        e.to_string()
+    }
+
+    #[test]
+    fn values_are_parsed() {
+        let parsed = parse_args(&["--control", " 50494 ", "--sample", "a.dxf", "b.dwg"]).unwrap();
+        assert_eq!((parsed.control, parsed.sample), (Some(50494), true));
+        assert_eq!(parsed.files, [PathBuf::from("a.dxf"), PathBuf::from("b.dwg")]);
+        let parsed = parse_args(&[]).unwrap();
+        assert_eq!((parsed.control, parsed.sample, parsed.files.len()), (None, false, 0));
+    }
+
+    #[test]
+    fn control_port_rejects_unparseable_values_naming_them() {
+        for bad in ["78787", "-1", "abc", "99999999999999999999"] {
+            assert!(usage_error(&["--control", bad]).contains(&format!("invalid value '{bad}' for '--control <PORT>'")), "{bad}");
+        }
+        assert!(usage_error(&["--control="]).contains("invalid value '' for '--control <PORT>'"));
+    }
+
+    #[test]
+    fn usage_errors_exit_2() {
+        assert!(usage_error(&["--sampel"]).contains("unexpected argument '--sampel'"));
+        assert!(usage_error(&["--control"]).contains("a value is required for '--control <PORT>'"));
+        // A following flag is never taken as the value.
+        assert!(usage_error(&["--control", "--sample"]).contains("a value is required for '--control <PORT>'"));
+        assert!(usage_error(&["--sample", "--sample"]).contains("cannot be used multiple times"));
+        assert!(usage_error(&["--control", "1", "--control", "2"]).contains("cannot be used multiple times"));
+    }
+
+    #[test]
+    fn version_stops_parsing() {
+        let e = parse_args(&["-V", "--control"]).err().unwrap();
+        assert_eq!((e.kind(), e.exit_code()), (ErrorKind::DisplayVersion, 0));
+        assert_eq!(e.to_string(), format!("{}\n", crate::version_string()));
+        let e = parse_args(&["--version", "--bogus"]).err().unwrap();
+        assert_eq!(e.kind(), ErrorKind::DisplayVersion);
+    }
+
+    #[test]
+    fn help_stops_parsing_and_double_dash_ends_options() {
+        let e = parse_args(&["-h", "--sampel", "--control"]).err().unwrap();
+        assert_eq!((e.kind(), e.exit_code()), (ErrorKind::DisplayHelp, 0));
+        let help = parse_args(&["--help"]).err().unwrap().to_string();
+        assert!(help.contains("--control <PORT>") && help.contains("CADCRAFT_CONFIG_DIR"), "{help}");
+
+        assert!(usage_error(&["--sampel", "--", "--help"]).contains("unexpected argument '--sampel'"));
+        let parsed = parse_args(&["a.dxf", "--", "--help", "-x"]).unwrap();
+        assert_eq!(parsed.files, ["a.dxf", "--help", "-x"].map(PathBuf::from));
+    }
+
+    #[test]
+    fn a_finder_process_serial_number_is_dropped() {
+        let parsed = parse_args(&["-psn_0_12345", "a.dxf"]).unwrap();
+        assert_eq!(parsed.files, [PathBuf::from("a.dxf")]);
+        let parsed = parse_args(&["--", "-psn_x.dxf"]).unwrap();
+        assert_eq!(parsed.files, [PathBuf::from("-psn_x.dxf")]);
+    }
+
+    /// A name that isn't valid Unicode is kept as given.
+    #[cfg(unix)]
+    #[test]
+    fn non_unicode_file_names_are_kept() {
+        use std::os::unix::ffi::OsStringExt as _;
+        let latin1 = OsString::from_vec(b"caf\xe9.dxf".to_vec());
+        let parsed = parse(command().mut_args(|a| a.env(None::<&str>)), [latin1.clone(), OsString::from("b.dxf")]).unwrap();
+        assert_eq!(parsed.files, [PathBuf::from(&latin1), PathBuf::from("b.dxf")]);
+    }
+
+    /// `--control` falls back to `PATH` here instead of `CADCRAFT_CONTROL_PORT`: `PATH` is set
+    /// wherever the tests run and is never a port, and tests can't set a variable (`set_var` is
+    /// unsafe).
+    #[test]
+    fn the_flag_wins_over_its_variable_and_a_bad_value_names_the_variable() {
+        let Some(path) = std::env::var_os("PATH").filter(|p| !p.is_empty()) else { return };
+        let path_fallback = || command().mut_args(|a| a.env(None::<&str>)).mut_arg("control", |a| a.env("PATH"));
+        let e = parse(path_fallback(), []).err().unwrap();
+        assert_eq!(e.exit_code(), 2);
+        let text = e.to_string();
+        assert!(text.contains(&format!("invalid value '{}' for 'PATH'", path.to_string_lossy())), "{text}");
+        assert!(!text.contains("--control <PORT>'"), "{text}");
+        assert_eq!(parse(path_fallback(), ["--control", "7"].map(OsString::from)).unwrap().control, Some(7));
+    }
+}

apps/cadcraft/src/logging.rs

@@ -3,7 +3,7 @@
 //! Without a logger every `log::warn!`/`log::error!`/`log::info!` in the workspace (a broken app
 //! icon, the GPU canvas set-up, the control server) vanished. A launch from a desktop menu has no
 //! terminal, so the file is what a bug report can attach: `<settings dir>/logs/cadcraft.log`
-//! (`CADCRAFT_CONFIG_DIR`, or the platform settings directory; see `config_dir` in `main.rs`).
+//! (`CADCRAFT_CONFIG_DIR`, or the platform settings directory; empty means none; see `env.rs`).
 //! Each start moves the previous log to `cadcraft.1.log` (and that one to `.2`), so the log of a
 //! run that crashed survives the next launch.
 //!

apps/cadcraft/src/main.rs

@@ -1,6 +1,6 @@
 //! CADCraft desktop app.
 //!
-//! Usage: `cadcraft [--control <port>] [--sample] [files…]`
+//! Usage: `cadcraft [--control <port>] [--sample] [files…]` (`cadcraft --help` lists the rest; see [`launch_args`])
 //!
 //! `--control <port>` (or `CADCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server:
 //! `{"id":1,"method":"cmdline.input","params":{"text":"circle 0,0 5"}}` → `{"id":1,"ok":true,…}`.
@@ -10,14 +10,16 @@
 //! present mode (`CADCRAFT_VSYNC=0` selects that elsewhere); see `cadcraft_ui_egui::gpu::surface_config`.
 //!
 //! `log` records go to standard error and `<settings dir>/logs/cadcraft.log` (`RUST_LOG` sets the
-//! levels); see [`logging`] and [`config_dir`].
+//! levels); see [`logging`]. The `CADCRAFT_*` variables are read once, at startup; see [`env`].
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 mod control_server;
 mod desktop_theme;
+mod env;
 #[cfg(any(target_os = "windows", test))]
 mod graphics;
+mod launch_args;
 mod logging;
 #[cfg(target_os = "macos")]
 mod native_menu;
@@ -26,6 +28,7 @@ mod system_animations;
 mod workspace;
 
 use cadcraft_engine::Session;
+use cadcraft_ui_egui::switch::Switch;
 use cadcraft_ui_egui::{CadApp, Services, i18n};
 
 struct App {
@@ -39,6 +42,9 @@ struct App {
     workspace_error: Option<String>,
     #[cfg(target_os = "macos")]
     native_menu: Option<native_menu::NativeMenu>,
+    /// `CADCRAFT_NO_NATIVE_MENU`: the menus stay inside the window.
+    #[cfg(target_os = "macos")]
+    menus_in_window: bool,
     /// The `movable` flag last set on the main window.
     #[cfg(target_os = "macos")]
     movable: Option<bool>,
@@ -80,7 +86,7 @@ impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
         self.cad.system_animations = self.system_animations.current();
         // Consume control/open/screenshot queues and time-based autosave, including hidden ticks.
-        self.cad.logic(ctx);
+        self.cad.guarded_logic(ctx);
         // Host frame work runs here, once per frame, and so also on a hidden logic-only tick (which
         // never reaches `App::ui`): native menus stay current, the spacemouse still navigates and a
         // workspace changed while hidden is persisted. `current_pass_index()` is zero on the first
@@ -88,7 +94,7 @@ impl eframe::App for App {
         if ctx.current_pass_index() == 0 {
             #[cfg(target_os = "macos")]
             {
-                if self.native_menu.is_none() && std::env::var_os("CADCRAFT_NO_NATIVE_MENU").is_none() {
+                if self.native_menu.is_none() && !self.menus_in_window {
                     self.native_menu = Some(native_menu::NativeMenu::install(&mut self.cad, ctx));
                 }
                 if let Some(m) = &mut self.native_menu {
@@ -110,7 +116,7 @@ impl eframe::App for App {
         cadcraft_ui_egui::cmdline::capture_tab(ctx, raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.cad.ui(ui);
+        self.cad.guarded_ui(ui);
         #[cfg(target_os = "macos")]
         craft_window::title_bar::sync_movable(ui.ctx(), &mut self.movable);
     }
@@ -121,7 +127,8 @@ impl eframe::App for App {
         self.cad.cancel_screenshots();
         self.cad.shutdown_autosave();
     }
-    /// Preferences (the interface theme) survive restarts; window and egui state are not kept.
+    /// Preferences (the interface theme) survive restarts; eframe saves the window state itself
+    /// (`persist_window`); egui state is not kept.
     fn save(&mut self, storage: &mut dyn eframe::Storage) {
         storage.set_string(cadcraft_ui_egui::options::PROFILE_KEY, self.cad.profile_json());
         storage.set_string(cadcraft_ui_egui::PREFS_KEY, self.cad.prefs_json());
@@ -188,32 +195,51 @@ fn filters_for_save(name: &str) -> [(&'static str, &'static str); 6] {
     filters
 }
 
-/// The per-user settings directory (it holds `logs/` and `autosave/`): `CADCRAFT_CONFIG_DIR` if set, else
-/// `$XDG_CONFIG_HOME/cadcraft` or `~/.config/cadcraft` on Linux and the BSDs,
-/// `~/Library/Application Support/CADCraft` on macOS, `%APPDATA%\CADCraft` on Windows.
-fn config_dir() -> Option<std::path::PathBuf> {
-    config_dir_from(|k| std::env::var_os(k))
+/// Whether eframe's storage file (`app.ron`, a map of keys to strings) holds a saved main window
+/// state. An unreadable or malformed file counts as none, as it does for eframe.
+fn saved_window(app_ron: &str) -> bool {
+    ron::from_str::<std::collections::HashMap<String, String>>(app_ron).is_ok_and(|kv| kv.contains_key(WINDOW_KEY))
 }
 
-/// [`config_dir`] with the environment passed in (`var` looks a variable up). An empty variable
-/// counts as unset, so a blank value never means the working directory.
-fn config_dir_from(var: impl Fn(&str) -> Option<std::ffi::OsString>) -> Option<std::path::PathBuf> {
-    let set = |k: &str| var(k).filter(|v| !v.is_empty()).map(std::path::PathBuf::from);
-    if let Some(dir) = set("CADCRAFT_CONFIG_DIR") {
-        return Some(dir);
-    }
-    if cfg!(target_os = "macos") {
-        set("HOME").map(|h| h.join("Library/Application Support/CADCraft"))
-    } else if cfg!(windows) {
-        set("APPDATA").map(|a| a.join("CADCraft"))
-    } else {
-        // The XDG spec ignores a relative XDG_CONFIG_HOME.
-        set("XDG_CONFIG_HOME").filter(|p| p.is_absolute()).or_else(|| set("HOME").map(|h| h.join(".config"))).map(|c| c.join("cadcraft"))
+/// The window state from the last session is saved and will be restored (#2595).
+fn restores_window() -> bool {
+    eframe::storage_dir(APP_ID).and_then(|dir| std::fs::read_to_string(dir.join("app.ron")).ok()).is_some_and(|ron| saved_window(&ron))
+}
+
+/// The main window: its size, title bar, placement and rendering needs. `restoring`: a window state
+/// saved by the last session is restored instead of opening centred.
+fn window_options(restoring: bool) -> eframe::NativeOptions {
+    eframe::NativeOptions {
+        viewport: egui::ViewportBuilder::default()
+            .with_title("CADCraft")
+            .with_inner_size([1600.0, 1000.0])
+            .with_min_inner_size([900.0, 560.0])
+            .with_drag_and_drop(true)
+            .with_fullsize_content_view(true)
+            .with_titlebar_shown(false)
+            .with_title_shown(false)
+            .with_app_id(APP_ID),
+        // The size, position and maximized state are kept between sessions (#2595); eframe keeps a
+        // restored window on the monitors that are connected now.
+        persist_window: true,
+        // The first launch opens centred on its screen, not cascaded from the top-left corner
+        // (#1129); later launches go back where the window was (eframe would centre over that).
+        // Wayland compositors place windows themselves.
+        centered: !restoring,
+        // CADCraft installs its own capped font chain (`theme::install_fonts`); never run
+        // system-font discovery as a hidden fallback.
+        system_font_fallback: false,
+        // A stencil buffer clips the contents of clipped layout viewports on the GPU.
+        stencil_buffer: STENCIL_BITS,
+        ..Default::default()
     }
 }
 
 const APP_ID: &str = "ai.storyteller.cadcraft";
 
+/// The key eframe saves the main window state under in its storage.
+const WINDOW_KEY: &str = "window";
+
 /// Stencil bits of the window's render pass (see `NativeOptions::stencil_buffer`).
 const STENCIL_BITS: u8 = 8;
 
@@ -227,98 +253,62 @@ fn app_icon() -> Option<egui::IconData> {
 }
 
 fn version_string() -> String {
-    let sha = option_env!("CADCRAFT_BUILD_SHA").unwrap_or("dev");
-    format!("cadcraft {} ({sha})", env!("CARGO_PKG_VERSION"))
-}
-
-/// The control port from `--control <port>` or `CADCRAFT_CONTROL_PORT` (`source`); a value that is
-/// not a port is logged and ignored instead of silently starting no control channel.
-fn control_port_from(source: &str, value: Option<String>) -> Option<u16> {
-    let value = value?;
-    let port = value.trim().parse().ok();
-    if port.is_none() {
-        log::warn!("{source}: {value:?} is not a port number; the control channel is off");
-    }
-    port
-}
-
-/// `--control` followed by `value`: a bare `--control` (last argument) keeps the port already
-/// read from `CADCRAFT_CONTROL_PORT` (`current`) instead of turning the control channel off.
-fn control_flag(current: Option<u16>, value: Option<String>) -> Option<u16> {
-    if value.is_some() {
-        return control_port_from("--control", value);
-    }
-    match current {
-        Some(port) => log::warn!("--control: no port given; using CADCRAFT_CONTROL_PORT ({port})"),
-        None => log::warn!("--control: no port given; the control channel is off"),
-    }
-    current
+    format!("cadcraft {}", cadcraft_engine::build_version())
 }
 
 /// Parse CLI options (`--control`, `--sample`, files, `--version`), install logging and I/O hooks, build the services and app, and run eframe.
 fn main() -> eframe::Result {
+    // A copy of this program started to read or write a DWG file does only that.
+    if let Some(code) = cadcraft_io::dwg_worker::serve_if_asked() {
+        std::process::exit(code);
+    }
+    cadcraft_io::dwg_worker::use_own_worker();
     // First, so every start-up record is captured; see `logging`.
     let logger = logging::install();
     // The update helper relaunches this binary after a self-update; it runs and exits here.
     #[cfg(not(target_arch = "wasm32"))]
-    if let Some(done) = craft_update::self_update::finish(&craft_update::suite::CADCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+    if let Some(done) = craft_update::self_update::finish(&cadcraft_ui_egui::UPDATE_APP, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
         if let Err(e) = done {
             eprintln!("CADCraft update helper failed: {e}");
             std::process::exit(1);
         }
         return Ok(());
     }
-    // lossy, so a value that is not Unicode is reported like any other bad port instead of ignored
-    let mut control_port =
-        control_port_from("CADCRAFT_CONTROL_PORT", std::env::var_os("CADCRAFT_CONTROL_PORT").map(|p| p.to_string_lossy().into_owned()));
-    let mut files = Vec::new();
-    let mut sample = false;
-    let mut args = std::env::args().skip(1);
-    while let Some(a) = args.next() {
-        match a.as_str() {
-            "--control" => control_port = control_flag(control_port, args.next()),
-            "--sample" => sample = true,
-            "--version" | "-V" => {
-                println!("{}", version_string());
-                return Ok(());
-            }
-            _ => files.push(a),
-        }
-    }
+    // `--help` and `--version` print to standard output and exit 0. A usage error (an unknown or
+    // repeated flag, a missing or bad value, a bad CADCRAFT_CONTROL_PORT) names the argument on
+    // standard error and exits 2 before the window opens.
+    let launch = launch_args::parse(launch_args::command(), std::env::args_os().skip(1)).unwrap_or_else(|e| e.exit());
+    let vars = env::Env::read();
+    let (control_port, sample, files) = (launch.control, launch.sample, launch.files);
     // The log file lives under the settings directory; opened after the arguments, so `--version`
     // leaves no file behind. Records logged until now are written to it first.
     if let Some(logger) = logger {
-        match config_dir().map(|d| logger.attach_dir(&d.join(logging::LOG_DIR))) {
+        match vars.config_dir.as_ref().map(|d| logger.attach_dir(&d.join(logging::LOG_DIR))) {
             Some(Ok(path)) => log::info!("{} ({} {}), log file {}", version_string(), std::env::consts::OS, std::env::consts::ARCH, path.display()),
             Some(Err(e)) => log::warn!("no log file: {e}"),
             None => {
                 logger.stderr_only();
-                log::warn!("no log file: no settings directory (set CADCRAFT_CONFIG_DIR)");
+                log::warn!("no log file: no settings directory (an empty CADCRAFT_CONFIG_DIR turns it off)");
             }
         }
     }
     install_io();
-    let surface = cadcraft_ui_egui::gpu::surface_config(std::env::var("CADCRAFT_VSYNC").ok().as_deref(), cfg!(all(unix, not(target_os = "macos"))));
+    cadcraft_engine::settings_dir::set(vars.config_dir.clone());
+    if let Some(dir) = &vars.config_dir {
+        cadcraft_ui_egui::fault::install_report_hook(dir.join(cadcraft_ui_egui::fault::REPORT_DIR));
+    }
+    if let Some(name) = &vars.font_alt {
+        cadcraft_engine::fonts::ttf::set_font_alt(name);
+    }
+    if let Some(list) = &vars.font_fallback {
+        cadcraft_engine::fonts::ttf::set_fallback_fonts(list);
+    }
+    let surface = cadcraft_ui_egui::gpu::surface_config(vars.vsync, cfg!(all(unix, not(target_os = "macos"))));
     let mut options = eframe::NativeOptions {
         // The crosshair is drawn by the app: present without a queue on Linux/BSD, where X11
         // swapchains hold two frames back under vsync (`CADCRAFT_VSYNC=1` restores vsync).
         wgpu_options: eframe::egui_wgpu::WgpuConfiguration::default().with_surface_config(surface),
-        viewport: egui::ViewportBuilder::default()
-            .with_title("CADCraft")
-            .with_inner_size([1600.0, 1000.0])
-            .with_min_inner_size([900.0, 560.0])
-            .with_drag_and_drop(true)
-            .with_fullsize_content_view(true)
-            .with_titlebar_shown(false)
-            .with_title_shown(false)
-            .with_app_id(APP_ID),
-        persist_window: false,
-        // CADCraft installs its own capped font chain (`theme::install_fonts`); never run
-        // system-font discovery as a hidden fallback.
-        system_font_fallback: false,
-        // A stencil buffer clips the contents of clipped layout viewports on the GPU.
-        stencil_buffer: STENCIL_BITS,
-        ..Default::default()
+        ..window_options(restores_window())
     };
     if let Some(icon) = app_icon() {
         options.viewport = options.viewport.with_icon(icon);
@@ -341,26 +331,37 @@ fn main() -> eframe::Result {
     // manager showed a "no" cursor. Run through XWayland when it's there; CADCRAFT_WAYLAND=1
     // keeps the native Wayland backend.
     #[cfg(all(unix, not(target_os = "macos")))]
-    if std::env::var_os("DISPLAY").is_some() && std::env::var_os("CADCRAFT_WAYLAND").is_none() {
+    if std::env::var_os("DISPLAY").is_some() && vars.wayland != Switch::On {
         options.event_loop_builder = Some(Box::new(|b| {
             use winit::platform::x11::EventLoopBuilderExtX11;
             b.with_x11();
         }));
     }
+    // macOS: Quit CADCraft (Cmd+Q), the Dock's Quit and logout end the app through AppKit's
+    // terminate, which would skip the unsaved-changes prompt (#2157). winit turns each into a
+    // close request for the window instead, so it asks first, as the close button does.
+    #[cfg(target_os = "macos")]
+    {
+        options.event_loop_builder = Some(Box::new(|b| {
+            use winit::platform::macos::EventLoopBuilderExtMacOS;
+            b.with_close_requested_on_terminate(true);
+        }));
+    }
     eframe::run_native(
         "CADCraft",
         options,
         Box::new(move |cc| {
             let mut app = CadApp::new(Session::empty(), services());
-            let (workspace, restored, workspace_error) = workspace::Workspace::load();
+            let (workspace, restored, workspace_error) = workspace::Workspace::load(vars.config_dir.as_deref());
             if let Some(ui) = restored {
                 app.ui = ui;
             }
+            app.set_system_cursor_default(vars.system_cursor == Switch::On);
             if let Some(error) = &workspace_error {
                 eprintln!("CADCraft workspace: {error}");
                 app.set_status(error);
             }
-            app.system_languages = std::env::var("CADCRAFT_LOCALE").map(|s| vec![s]).unwrap_or_else(|_| sys_locale::get_locales().collect());
+            app.system_languages = vars.locale.map(|s| vec![s]).unwrap_or_else(|| sys_locale::get_locales().collect());
             // The user profile (Options): drafting settings, selection sizes, drawing-area colours.
             if let Some(profile) = cc.storage.and_then(|s| s.get_string(cadcraft_ui_egui::options::PROFILE_KEY)) {
                 app.load_profile(&profile);
@@ -372,7 +373,7 @@ fn main() -> eframe::Result {
                 cadcraft_ui_egui::autosave::load_prefs(&prefs);
             }
             // Autosave files (SAVEFILEPATH) default to `<settings dir>/autosave`.
-            if let Some(dir) = config_dir() {
+            if let Some(dir) = &vars.config_dir {
                 app.enable_autosave(&dir.join("autosave"));
                 app.enable_update_check();
                 // Startup LISP (acad.lsp, acaddoc.lsp) is read from `<settings>/support`; the
@@ -419,6 +420,8 @@ fn main() -> eframe::Result {
                 #[cfg(target_os = "macos")]
                 native_menu: None,
                 #[cfg(target_os = "macos")]
+                menus_in_window: vars.no_native_menu == Switch::On,
+                #[cfg(target_os = "macos")]
                 movable: None,
             }))
         }),
@@ -427,13 +430,7 @@ fn main() -> eframe::Result {
 
 #[cfg(test)]
 mod tests {
-    use super::{config_dir_from, control_flag, control_port_from, filters_for_save, follow_desktop};
-    use std::ffi::OsString;
-    use std::path::PathBuf;
-
-    fn env<'a>(vars: &'a [(&'a str, &'a str)]) -> impl Fn(&str) -> Option<OsString> + 'a {
-        move |k| vars.iter().find(|(n, _)| *n == k).map(|(_, v)| OsString::from(v))
-    }
+    use super::{filters_for_save, follow_desktop, saved_window, window_options};
 
     #[test]
     fn save_dialog_offers_dwg_with_the_drawing_format_first() {
@@ -451,57 +448,30 @@ mod tests {
         }
     }
 
+    /// #1129: the first launch opens centred, not cascaded from the top-left corner.
     #[test]
-    fn control_port_values_that_are_not_ports_are_ignored() {
-        assert_eq!(control_port_from("--control", Some("7979".into())), Some(7979));
-        assert_eq!(control_port_from("--control", Some(" 7979 ".into())), Some(7979));
-        assert_eq!(control_port_from("--control", None), None);
-        for bad in ["", "abc", "-1", "65536", "99999999999999999999", "\u{0}"] {
-            assert_eq!(control_port_from("--control", Some(bad.into())), None, "{bad:?}");
-        }
+    fn the_first_launch_opens_centred() {
+        let o = window_options(false);
+        assert!(o.centered, "centred on launch");
+        assert!(o.persist_window, "the window state is saved for the next launch");
     }
 
+    /// #2595: a saved window state (size, position, maximized) is restored, not centred over.
     #[test]
-    fn control_without_a_port_keeps_the_environment_port() {
-        // `CADCRAFT_CONTROL_PORT=47321 cadcraft --control` (#844)
-        assert_eq!(control_flag(Some(47321), None), Some(47321));
-        assert_eq!(control_flag(None, None), None);
-        // A port given on the command line still wins over the variable.
-        assert_eq!(control_flag(Some(47321), Some("7979".into())), Some(7979));
-        assert_eq!(control_flag(Some(47321), Some("abc".into())), None);
+    fn a_saved_window_reopens_where_it_was() {
+        let o = window_options(true);
+        assert!(!o.centered, "centring would move a restored window");
+        assert!(o.persist_window);
     }
 
+    /// Only a readable `app.ron` with a window entry counts as a saved window state.
     #[test]
-    fn the_override_variable_wins_and_empty_values_are_unset() {
-        let vars = [("CADCRAFT_CONFIG_DIR", "/tmp/cc"), ("HOME", "/home/u"), ("XDG_CONFIG_HOME", "/x"), ("APPDATA", "C:\\a")];
-        assert_eq!(config_dir_from(env(&vars)), Some(PathBuf::from("/tmp/cc")));
-        let empty = [("CADCRAFT_CONFIG_DIR", ""), ("HOME", ""), ("XDG_CONFIG_HOME", ""), ("APPDATA", "")];
-        assert_eq!(config_dir_from(env(&empty)), None, "no usable variable means no directory, not the working directory");
-        assert_eq!(config_dir_from(env(&[])), None);
-    }
-
-    #[cfg(all(unix, not(target_os = "macos")))]
-    #[test]
-    fn linux_and_bsd_follow_xdg_config_home() {
-        assert_eq!(config_dir_from(env(&[("XDG_CONFIG_HOME", "/x"), ("HOME", "/home/u")])), Some(PathBuf::from("/x/cadcraft")));
-        assert_eq!(config_dir_from(env(&[("HOME", "/home/u")])), Some(PathBuf::from("/home/u/.config/cadcraft")));
-        // The XDG spec says a relative XDG_CONFIG_HOME is ignored.
-        assert_eq!(config_dir_from(env(&[("XDG_CONFIG_HOME", "rel"), ("HOME", "/home/u")])), Some(PathBuf::from("/home/u/.config/cadcraft")));
-    }
-
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn macos_uses_application_support() {
-        assert_eq!(config_dir_from(env(&[("HOME", "/Users/u")])), Some(PathBuf::from("/Users/u/Library/Application Support/CADCraft")));
-    }
-
-    #[cfg(windows)]
-    #[test]
-    fn windows_uses_appdata() {
-        assert_eq!(
-            config_dir_from(env(&[("APPDATA", "C:\\Users\\u\\AppData\\Roaming")])),
-            Some(PathBuf::from("C:\\Users\\u\\AppData\\Roaming").join("CADCraft"))
-        );
+    fn a_saved_window_is_read_from_app_ron() {
+        assert!(saved_window(r#"{"cadcraft.prefs": "{}", "window": "(maximized: true)"}"#));
+        assert!(!saved_window(r#"{"cadcraft.prefs": "{\"window\":1}"}"#), "a value mentioning it is not the key");
+        assert!(!saved_window(""));
+        assert!(!saved_window("{\"window\": "), "truncated");
+        assert!(!saved_window("not ron at all"));
     }
 
     /// View ▸ Theme ▸ System on Linux: winit reports no theme, so the desktop's answer stands in;

apps/cadcraft/src/workspace.rs

@@ -1,6 +1,5 @@
 //! Native workspace preferences. Drawing data and transient dialogs never enter this file.
 
-use std::ffi::OsString;
 use std::fs::{self, File, OpenOptions};
 use std::io::{Read, Write};
 use std::path::{Path, PathBuf};
@@ -24,18 +23,6 @@ pub struct Workspace {
     last_write: Option<Instant>,
 }
 
-fn config_dir_from(platform: &str, get: impl Fn(&str) -> Option<OsString>) -> Option<PathBuf> {
-    if let Some(root) = get("CADCRAFT_CONFIG_DIR") {
-        return (!root.is_empty()).then(|| PathBuf::from(root));
-    }
-    let nonempty = |key| get(key).filter(|value| !value.is_empty()).map(PathBuf::from);
-    match platform {
-        "macos" => nonempty("HOME").map(|home| home.join("Library/Application Support/CADCraft")),
-        "windows" => nonempty("APPDATA").map(|root| root.join("CADCraft")),
-        _ => nonempty("XDG_CONFIG_HOME").map(|root| root.join("cadcraft")).or_else(|| nonempty("HOME").map(|home| home.join(".config/cadcraft"))),
-    }
-}
-
 fn snapshot(ui: &UiState) -> Result<Value, String> {
     cadcraft_ui_egui::docking::validate(&ui.docking)?;
     if !matches!(ui.toolset_tab.as_str(), "Drafting" | "Modeling") {
@@ -139,8 +126,9 @@ fn write(path: &Path, workspace: &Value) -> Result<(), String> {
 }
 
 impl Workspace {
-    pub fn load() -> (Self, Option<UiState>, Option<String>) {
-        Self::at(config_dir_from(std::env::consts::OS, |key| std::env::var_os(key)).map(|root| root.join("workspace.json")))
+    /// The workspace file in the settings directory `config_dir`; without one nothing is kept.
+    pub fn load(config_dir: Option<&Path>) -> (Self, Option<UiState>, Option<String>) {
+        Self::at(config_dir.map(|root| root.join("workspace.json")))
     }
 
     fn at(path: Option<PathBuf>) -> (Self, Option<UiState>, Option<String>) {
@@ -195,6 +183,7 @@ impl Workspace {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::ffi::OsString;
 
     fn temp_dir() -> PathBuf {
         let sequence = TEMP_SEQUENCE.fetch_add(1, Ordering::Relaxed);
@@ -205,20 +194,18 @@ mod tests {
 
     #[test]
     fn profile_override_isolated_or_explicitly_disabled() {
-        let get = |key: &str| match key {
-            "CADCRAFT_CONFIG_DIR" => Some(OsString::from("/private/test-state")),
-            "HOME" | "APPDATA" | "XDG_CONFIG_HOME" => Some(OsString::from("/unrelated-user-profile")),
-            _ => None,
+        let vars = |config: Option<&'static str>| {
+            move |key: &str| match key {
+                "CADCRAFT_CONFIG_DIR" => config.map(OsString::from),
+                "HOME" | "APPDATA" | "XDG_CONFIG_HOME" => Some(OsString::from("/unrelated-user-profile")),
+                _ => None,
+            }
         };
-        for platform in ["macos", "windows", "linux", "freebsd"] {
-            assert_eq!(config_dir_from(platform, get), Some(PathBuf::from("/private/test-state")));
-            assert_eq!(config_dir_from(platform, |key| if key == "CADCRAFT_CONFIG_DIR" { Some(OsString::new()) } else { get(key) }), None);
-        }
-        assert_eq!(
-            config_dir_from("linux", |key| (key == "XDG_CONFIG_HOME").then(|| OsString::from("/config"))),
-            Some(PathBuf::from("/config/cadcraft"))
-        );
-        assert_eq!(config_dir_from("macos", |_| None), None);
+        let dir = |config| crate::env::Env::from_vars(vars(config)).config_dir;
+        assert_eq!(dir(Some("/private/test-state")), Some(PathBuf::from("/private/test-state")));
+        assert_eq!(dir(Some("")), None);
+        let (_, restored, error) = Workspace::load(dir(Some("")).as_deref());
+        assert!(restored.is_none() && error.is_none(), "no settings folder, no workspace file");
     }
 
     #[test]

clippy.toml

@@ -2,3 +2,7 @@ allow-unwrap-in-tests = true
 allow-expect-in-tests = true
 allow-panic-in-tests = true
 allow-indexing-slicing-in-tests = true
+disallowed-types = [
+    { path = "egui::ComboBox", reason = "use craft_ui::ComboBox: egui's combo box menu can't grow back while open (egui#5225)" },
+]
+cognitive-complexity-threshold = 30

contributors/people.toml

@@ -1,13 +1,10 @@
-# Contributor names for the About window (craftrules standards/contributors.md).
+# Contributor names for the About window.
 #
 # Everyone who contributes is credited by GitHub username automatically. Anything more is up to
 # you: add YOUR OWN entry below, in your own PR (commit it yourself). Never add someone else; a
 # maintainer may add a person only when that person asked, recording where in consent_source.
 #
-# Easiest: python3 ../../craftrules/scripts/contributors.py --add-me . \
-#            [--real-name "Ada Lovelace"] [--display-name "Ada"] [--sync-github-name]
-#
-# Or copy this block, replacing your-github-username (every field is optional):
+# Copy this block, replacing your-github-username (every field is optional):
 #
 #   [people.your-github-username]
 #   real_name = "Your Name"        # shown when the viewer picks "Real name"
@@ -91,3 +88,24 @@ sync_github_name = false
 real_name = "Robert Lee"
 sync_github_name = true
 
+[people.2ez4gcx]
+real_name = "Doan Huynh Huu Khuong"
+display_name = "Doan Huynh Huu Khuong"
+sync_github_name = false
+
+
+[people.dylanmtaylor]
+sync_github_name = true
+
+[people.GULERTOLGA]
+sync_github_name = true
+
+[people.Tyler-Chiriboga]
+real_name = "Tyler Chiriboga"
+sync_github_name = true
+
+[people.starise]
+real_name = "Andrea Brandi"
+
+[people.qinshah]
+sync_github_name = true

crates/constraints/src/auto.rs

@@ -52,15 +52,11 @@ fn collect(d: &Drawing, handles: &[Handle]) -> Geo {
                     g.curves.push((GeomRef::whole(h), ga.center, a.radius));
                 }
             }
-            EntityKind::Circle(c) => {
-                if c.center.is_finite() && c.radius.is_finite() {
-                    g.curves.push((GeomRef::whole(h), c.center.xy(), c.radius));
-                }
+            EntityKind::Circle(c) if c.center.is_finite() && c.radius.is_finite() => {
+                g.curves.push((GeomRef::whole(h), c.center.xy(), c.radius));
             }
-            EntityKind::Point(p) => {
-                if p.p.is_finite() {
-                    g.points.push((GeomRef::whole(h), p.p.xy()));
-                }
+            EntityKind::Point(p) if p.p.is_finite() => {
+                g.points.push((GeomRef::whole(h), p.p.xy()));
             }
             EntityKind::LwPolyline(p) => {
                 let n = p.vertices.len();

crates/constraints/src/dof.rs

@@ -11,16 +11,13 @@ use std::collections::HashSet;
 use cadcraft_doc::{Constraint, Drawing, Handle};
 use serde::Serialize;
 
-use crate::model::Model;
-use crate::{Comp, MAX_CONSTRAINTS, SolveError, SolveOptions, build_budgeted, lm};
+use crate::model::{Model, Prep};
+use crate::{Comp, MAX_CONSTRAINTS, MAX_EVAL_WORK, SolveError, SolveOptions, build_with, lm};
 
 /// Most free parameters for which per-object freedom is analysed (null-space basis size).
 const MAX_NULL_COLS: usize = 600;
 /// Largest Jacobian (rows × columns × min) whose rank is computed.
 const MAX_RANK_WORK: f64 = 4e8;
-/// Largest residual-evaluation work (rows × free × per-residual cost, including spline
-/// reconstruction) allowed before building the Jacobian during numerical differentiation.
-const MAX_EVAL_WORK: f64 = 2e9;
 /// Most objects listed in one report.
 const MAX_OBJECTS: usize = 10_000;
 
@@ -139,8 +136,8 @@ fn plural(n: usize, one: &str, many: &str) -> String {
 /// (constrained or not) and the constraint components they belong to.
 pub fn dof(d: &Drawing, handles: &[Handle]) -> Result<DofReport, SolveError> {
     let cons: Vec<&Constraint> = d.constraints.iter().take(MAX_CONSTRAINTS).collect();
-    let mut members_left = crate::model::MAX_RIGID_WORK;
-    let (comps, _) = build_budgeted(d, &cons, &SolveOptions::default(), &mut members_left)?;
+    let mut prep = Prep::new(crate::model::MAX_RIGID_WORK);
+    let (comps, _) = build_with(d, &cons, &SolveOptions::default(), &mut prep)?;
     let want = |h: Handle| handles.is_empty() || handles.contains(&h);
     let mut objects = Vec::new();
     let mut seen = HashSet::new();
@@ -179,7 +176,7 @@ pub fn dof(d: &Drawing, handles: &[Handle]) -> Result<DofReport, SolveError> {
         if seen.contains(&h) {
             continue;
         }
-        let m = Model::build_budgeted(d, &[h], &mut members_left);
+        let m = Model::build_with(d, &[h], &mut prep);
         let Some(s) = m.slots.first() else { continue };
         seen.insert(h);
         free_objects = true;
@@ -237,5 +234,36 @@ mod budget_tests {
         };
         let comp = Comp { model, built: vec![endpoint], weights: vec![1.0; 2], held: Vec::new(), tol: 1e-9 };
         assert!(analyse(&comp).dof.is_none());
+        // Solving it is refused for the same reason, before any Jacobian is built.
+        assert!(matches!(comp.run(None), Err(SolveError::TooLarge)));
+    }
+
+    /// Many Tangent constraints on one large fit spline rebuild it once while being interpreted,
+    /// and the solve is refused by its rebuild budget instead of running.
+    #[test]
+    fn repeated_spline_tangents_rebuild_once_and_solve_is_bounded() {
+        use cadcraft_doc::{Constraint, Line};
+        use cadcraft_geom::Vec3;
+        let mut d = Drawing::default();
+        let pts: Vec<_> = (0..400).map(|i| Vec2::new(i as f64, (i % 3) as f64)).collect();
+        let h = d.add(&Space::Model, Common::default(), EntityKind::Spline(Spline::fit_with(&pts, false, Default::default()))).unwrap();
+        let l =
+            d.add(&Space::Model, Common::default(), EntityKind::Line(Line { a: Vec3::new(-1.0, 0.0, 0.0), b: Vec3::new(-1.0, 5.0, 0.0) })).unwrap();
+        for id in 1..=200 {
+            d.constraints.push(Constraint {
+                id,
+                kind: ConstraintKind::Tangent,
+                refs: vec![GeomRef::whole(h), GeomRef::whole(l)],
+                name: String::new(),
+                expr: String::new(),
+            });
+        }
+        let cons: Vec<&Constraint> = d.constraints.iter().collect();
+        let (comps, skipped) = crate::build(&d, &cons, &SolveOptions::default()).unwrap();
+        assert!(skipped.is_empty());
+        let comp = comps.first().unwrap();
+        assert_eq!(comp.built.len(), 200);
+        assert!(matches!(comp.run(None), Err(SolveError::TooLarge)));
+        assert!(crate::purge_invalid(&mut d).is_empty());
     }
 }

crates/constraints/src/expr.rs

@@ -284,7 +284,14 @@ impl Env {
     pub fn new() -> Self {
         Env::default()
     }
+    /// Add or replace a named expression. Text longer than [`MAX_LEN`] could never parse, so
+    /// only a bounded prefix of it is kept: it still fails (as too long), without the environment
+    /// holding or copying the whole text.
     pub fn insert(&mut self, name: &str, expr: &str) {
+        let expr = match expr.char_indices().map(|(i, _)| i).find(|i| *i > MAX_LEN) {
+            Some(end) => expr.get(..end).unwrap_or(expr),
+            None => expr,
+        };
         self.exprs.insert(name.to_string(), expr.to_string());
         self.cache.clear();
     }
@@ -309,8 +316,9 @@ impl Env {
         if stack.len() >= MAX_DEPTH {
             return Err(ExprError::TooDeep);
         }
-        let text = self.exprs.get(name).cloned().ok_or_else(|| ExprError::Unknown(name.to_string()))?;
-        let e = parse(&text)?;
+        // Parse the stored text in place: `parse` refuses an oversized expression before reading
+        // it, so a long imported expression referenced many times is never copied (CWE-400).
+        let e = parse(self.exprs.get(name).ok_or_else(|| ExprError::Unknown(name.to_string()))?)?;
         stack.push(name.to_string());
         let r = eval_at_depth(&e, &mut |n, depth| self.value_inner(n, stack, depth), depth);
         stack.pop();
@@ -400,6 +408,22 @@ mod tests {
             .unwrap();
     }
 
+    /// An oversized named expression is kept only as a bounded prefix and still fails, however
+    /// often it is referenced.
+    #[test]
+    fn oversized_named_expression_is_bounded_and_fails() {
+        let mut env = Env::new();
+        let long = format!("1+{}", "é".repeat(500_000));
+        env.insert("big", &long);
+        assert!(env.exprs.get("big").is_some_and(|t| t.len() > MAX_LEN && t.len() <= MAX_LEN + 4));
+        assert_eq!(env.value("big"), Err(ExprError::TooDeep));
+        for _ in 0..200 {
+            assert_eq!(env.eval("big"), Err(ExprError::TooDeep));
+        }
+        env.insert("ok", "1+1+1");
+        assert_eq!(env.value("ok"), Ok(3.0));
+    }
+
     #[test]
     fn rename_replaces_whole_names_only() {
         assert_eq!(rename("d1+d10*d1 / (d1_x+2e1)", "d1", "w"), "w+d10*w / (d1_x+2e1)");

crates/constraints/src/lib.rs

@@ -30,7 +30,7 @@ mod lm;
 mod model;
 mod residual;
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::{BTreeMap, HashMap, HashSet};
 
 use cadcraft_doc::{Constraint, ConstraintKind, Drawing, GeomRef, Handle};
 use cadcraft_geom::Vec2;
@@ -41,7 +41,7 @@ pub use dof::{DofReport, DofStatus, ObjectDof, dof};
 pub use expr::{Env, ExprError};
 pub use model::{ref_points, rigid_points, supported};
 
-use model::Model;
+use model::{Model, Prep};
 use residual::{Built, Form};
 
 /// Most constraints one drawing may hold.
@@ -50,6 +50,11 @@ pub const MAX_CONSTRAINTS: usize = 5000;
 const MAX_CONFLICT_PROBES: usize = 48;
 /// Solver iterations.
 const MAX_ITER: usize = 200;
+/// Largest residual-evaluation work (including spline rebuilds) one numerical Jacobian may take,
+/// shared by solving, redundancy checks and DOF analysis.
+pub(crate) const MAX_EVAL_WORK: f64 = 2e9;
+/// Residual evaluations a solver iteration makes besides its Jacobian (damped trial steps).
+const TRIAL_EVALS: f64 = 14.0;
 
 #[derive(Clone, Debug, PartialEq, thiserror::Error)]
 pub enum SolveError {
@@ -169,10 +174,26 @@ pub fn name_in_use(d: &Drawing, name: &str) -> bool {
     d.parametric.parameters.iter().any(|p| p.name == name) || d.constraints.iter().any(|c| c.name == name)
 }
 
+/// Highest numbered default name [`next_name`] tries.
+const MAX_NAME_SUFFIX: u32 = 100_000;
+
 /// Next free parameter name for a dimensional constraint kind (`d1`, `rad2`, `ang1`, …).
 pub fn next_name(d: &Drawing, kind: ConstraintKind) -> String {
     let prefix = kind.name_prefix();
-    (1..=100_000).map(|i| format!("{prefix}{i}")).find(|n| !name_in_use(d, n)).unwrap_or_else(|| format!("{prefix}_x"))
+    // Collect the suffixes in use in one pass, then take the first free one: checking every
+    // candidate against every name is quadratic in the number of names (CWE-407). Only a
+    // suffix spelled as `format!("{prefix}{i}")` spells it counts (`d07` does not take `d7`).
+    let taken: HashSet<u32> = d
+        .parametric
+        .parameters
+        .iter()
+        .map(|p| p.name.as_str())
+        .chain(d.constraints.iter().map(|c| c.name.as_str()))
+        .filter_map(|n| n.strip_prefix(prefix))
+        .filter(|s| !s.starts_with('0') && s.bytes().all(|b| b.is_ascii_digit()))
+        .filter_map(|s| s.parse::<u32>().ok())
+        .collect();
+    (1..=MAX_NAME_SUFFIX).find(|i| !taken.contains(i)).map_or_else(|| format!("{prefix}_x"), |i| format!("{prefix}{i}"))
 }
 
 /// Next free constraint id.
@@ -251,12 +272,41 @@ impl Comp {
     pub(crate) fn rows(&self, skip: Option<usize>) -> usize {
         self.built.iter().enumerate().filter(|(i, _)| Some(*i) != skip).map(|(_, b)| b.rows).sum()
     }
+    /// Work of one solver iteration's residual evaluations over `free`: every residual twice per
+    /// free parameter, plus a spline rebuild each time a spline's own defining points move (rebuilds
+    /// are shared by residuals at the same points, see [`Model`]).
+    pub(crate) fn eval_work(&self, free: &[usize], skip: Option<usize>) -> f64 {
+        let rows = self.rows(skip) as f64;
+        let evals = 2.0 * free.len() as f64 + TRIAL_EVALS;
+        let mut splines: Vec<Handle> = Vec::new();
+        for (i, b) in self.built.iter().enumerate() {
+            if Some(i) != skip && b.spline_reconstruct_cost(&self.model) > 0.0 {
+                splines.extend(b.refs.iter().map(|r| r.handle).filter(|h| self.model.spline_reconstruct_cost(*h) > 0.0));
+            }
+        }
+        splines.sort_unstable();
+        splines.dedup();
+        let rebuilds: f64 = splines
+            .iter()
+            .filter_map(|h| self.model.slot(*h))
+            .map(|s| {
+                let own = free.iter().filter(|j| (s.off..s.off + s.len).contains(*j)).count() as f64;
+                (2.0 * own + TRIAL_EVALS + 1.0) * self.model.spline_reconstruct_cost(s.handle)
+            })
+            .sum();
+        evals * rows + rebuilds
+    }
     fn run(&self, skip: Option<usize>) -> Result<lm::Outcome, SolveError> {
         let free = self.free(skip);
         let rows = self.rows(skip);
         if rows > lm::MAX_ROWS || (rows as f64) * (rows as f64) * (free.len() as f64) > 4e8 {
             return Err(SolveError::TooLarge);
         }
+        // Numerical differentiation rebuilds a fit spline through a dense solve for every move of
+        // its own fit points: refuse before iterating when that alone is too much (CWE-407).
+        if self.eval_work(&free, skip) > MAX_EVAL_WORK {
+            return Err(SolveError::TooLarge);
+        }
         let f = |x: &[f64], out: &mut Vec<f64>| self.eval(x, out, skip);
         let mut o = lm::solve(&f, &self.model.x0, &free, &self.weights, self.tol, MAX_ITER);
         // A solution the ellipses would be stored differently from (axes swapped, minor axis
@@ -410,24 +460,24 @@ fn slot_scales(model: &Model, s: &model::Slot) -> Vec<(usize, f64)> {
 
 /// Build the component systems. Constraints that cannot be interpreted are returned as skipped.
 pub(crate) fn build(d: &Drawing, cons: &[&Constraint], opts: &SolveOptions) -> Result<(Vec<Comp>, Vec<(u32, String)>), SolveError> {
-    let mut members_left = model::MAX_RIGID_WORK;
-    build_budgeted(d, cons, opts, &mut members_left)
+    build_with(d, cons, opts, &mut Prep::new(model::MAX_RIGID_WORK))
 }
 
-/// Build constraint components with one caller-owned rigid-member sampling budget shared by every model.
+/// Build constraint components sharing one caller-owned geometry preparation (block sampling and
+/// its member budget, spline rebuilds) between every model.
 /// Return constraints that cannot be interpreted as skipped entries.
-pub(crate) fn build_budgeted(
+pub(crate) fn build_with(
     d: &Drawing,
     cons: &[&Constraint],
     opts: &SolveOptions,
-    members_left: &mut usize,
+    prep: &mut Prep,
 ) -> Result<(Vec<Comp>, Vec<(u32, String)>), SolveError> {
     let mut e = env(d);
     let mut skipped = Vec::new();
     let mut comps = Vec::new();
     for group in components(cons) {
         let handles: Vec<Handle> = group.iter().flat_map(|c| c.refs.iter().map(|r| r.handle)).collect();
-        let mut model = Model::build_budgeted(d, &handles, members_left);
+        let mut model = Model::build_with(d, &handles, prep);
         let mut built = Vec::new();
         for c in group {
             let target = if c.kind.is_dimensional() { constraint_value(&mut e, c)? } else { 0.0 };
@@ -640,6 +690,11 @@ pub fn all_satisfied(d: &Drawing) -> bool {
 
 /// Check that a constraint's references make sense for its type.
 pub fn validate(d: &Drawing, c: &Constraint) -> Result<(), String> {
+    validate_with(d, c, &mut Prep::new(model::MAX_RIGID_WORK))
+}
+
+/// [`validate`] sharing block samples and spline rebuilds with other checks of the same drawing.
+fn validate_with(d: &Drawing, c: &Constraint, prep: &mut Prep) -> Result<(), String> {
     let handles: Vec<Handle> = c.refs.iter().map(|r| r.handle).collect();
     for h in &handles {
         match d.entity(*h) {
@@ -648,7 +703,7 @@ pub fn validate(d: &Drawing, c: &Constraint) -> Result<(), String> {
             _ => {}
         }
     }
-    let mut model = Model::build(d, &handles);
+    let mut model = Model::build_with(d, &handles, prep);
     interpret(c, &mut model, 1.0).map(|_| ())
 }
 
@@ -665,7 +720,12 @@ pub fn measure(d: &Drawing, kind: ConstraintKind, refs: &[GeomRef]) -> Result<f6
 /// Returns the removed ids.
 pub fn purge_invalid(d: &mut Drawing) -> Vec<u32> {
     let mut gone = Vec::new();
-    let keep: Vec<bool> = d.constraints.iter().map(|c| validate(d, c).is_ok()).collect();
+    // One preparation for every check: each block is sampled and each spline rebuilt once,
+    // however many constraints refer to them (CWE-407). Its member budget is not shared, so
+    // a constraint is never dropped because earlier ones spent it: every block is still
+    // examined at most once, up to its own member limit.
+    let mut prep = Prep::new(usize::MAX);
+    let keep: Vec<bool> = d.constraints.iter().map(|c| validate_with(d, c, &mut prep).is_ok()).collect();
     let mut i = 0;
     d.constraints.retain(|c| {
         let k = keep.get(i).copied().unwrap_or(true);
@@ -752,6 +812,9 @@ pub fn add(d: &mut Drawing, mut c: Constraint, opts: &SolveOptions) -> Result<u3
         && comp.built.get(pos).is_some_and(|b| b.form == Form::Lock)
     {
         let before = comp.free(Some(pos));
+        if comp.eval_work(&before, Some(pos)) > MAX_EVAL_WORK {
+            return Err(SolveError::TooLarge);
+        }
         let after = comp.free(None);
         let locked: Vec<usize> = before.iter().enumerate().filter(|(_, j)| !after.contains(j)).map(|(k, _)| k).collect();
         let rows_old = comp.rows(Some(pos));

crates/constraints/src/model.rs

@@ -14,9 +14,11 @@
 //! Constraints may append auxiliary unknowns after the entity parameters (contact parameters of
 //! a tangency between curves); they are never written back.
 
+use std::cell::RefCell;
 use std::collections::HashMap;
+use std::rc::Rc;
 
-use cadcraft_doc::{Drawing, EntityKind, GeomRef, Handle, Insert, Sub};
+use cadcraft_doc::{Block, Drawing, EntityKind, GeomRef, Handle, Insert, Sub};
 use cadcraft_geom::{Spline as GSpline, Vec2, ccw_sweep};
 
 use crate::curves::{Ell, Frame, clamped, spline_end};
@@ -70,6 +72,9 @@ pub(crate) struct Slot {
     pub len: usize,
 }
 
+/// The spline last rebuilt for each handle, with the defining points it was rebuilt from.
+type SplineCache = HashMap<Handle, (Vec<Vec2>, Rc<GSpline>)>;
+
 #[derive(Clone, Debug, Default)]
 pub(crate) struct Model {
     pub slots: Vec<Slot>,
@@ -79,20 +84,75 @@ pub(crate) struct Model {
     splines: HashMap<Handle, GSpline>,
     /// Block reference rigid points relative to the insertion point at rotation 0.
     rigid: HashMap<Handle, Vec<Vec2>>,
+    /// Rebuilt splines, shared with every model of the same [`Prep`]: residuals that ask for the
+    /// same spline at the same defining points (several constraints on one spline, or derivatives
+    /// taken along other objects' parameters) reuse one rebuild instead of a dense solve each.
+    rebuilt: Rc<RefCell<SplineCache>>,
+}
+
+/// Geometry preparation shared by every model built for one operation (a solve, a DOF report, a
+/// purge): rigid samples per block, a case-insensitive block-name index and rebuilt splines. A
+/// block referenced by many Inserts is sampled once, an unknown block name costs one hashed
+/// lookup, and a spline referenced by many constraints is rebuilt once (CWE-407).
+#[derive(Debug)]
+pub(crate) struct Prep {
+    /// Block members that may still be examined across the operation.
+    members_left: usize,
+    /// Block-local rigid samples by the name an Insert gives (`None`: no such block).
+    blocks: HashMap<String, Option<Rc<[Vec2]>>>,
+    /// Lower-cased block name to the stored name it resolves to, built on the first exact miss.
+    folded: Option<HashMap<String, String>>,
+    rebuilt: Rc<RefCell<SplineCache>>,
+}
+
+impl Prep {
+    /// Preparation that may examine at most `members` block members in all.
+    pub(crate) fn new(members: usize) -> Prep {
+        Prep { members_left: members, blocks: HashMap::new(), folded: None, rebuilt: Rc::default() }
+    }
+
+    /// The block an Insert names, as [`Drawing::block`] resolves it (exact name, else the first
+    /// stored name equal ignoring ASCII case), without scanning every block on each miss.
+    fn resolve<'d>(&mut self, d: &'d Drawing, name: &str) -> Option<&'d Block> {
+        if let Some(b) = d.blocks.get(name) {
+            return Some(b);
+        }
+        let folded = self.folded.get_or_insert_with(|| {
+            let mut m = HashMap::with_capacity(d.blocks.len());
+            for k in d.blocks.keys() {
+                m.entry(k.to_ascii_lowercase()).or_insert_with(|| k.clone());
+            }
+            m
+        });
+        d.blocks.get(folded.get(&name.to_ascii_lowercase())?).map(|b| &**b)
+    }
+
+    /// Finite characteristic points of a block in its own coordinates, sampled once per name.
+    fn block_points(&mut self, d: &Drawing, name: &str) -> Option<Rc<[Vec2]>> {
+        if let Some(s) = self.blocks.get(name) {
+            return s.clone();
+        }
+        let sampled = self.resolve(d, name).map(|b| sample_block(b, &mut self.members_left));
+        self.blocks.insert(name.to_string(), sampled.clone());
+        sampled
+    }
+
+    /// World positions of an Insert's rigid points, at most [`MAX_RIGID_POINTS`].
+    fn rigid_points(&mut self, d: &Drawing, ins: &Insert) -> Vec<Vec2> {
+        let Some(local) = self.block_points(d, &ins.block) else { return Vec::new() };
+        let Some(block) = self.resolve(d, &ins.block) else { return Vec::new() };
+        let m = ins.transform(block.base.xy());
+        local.iter().map(|p| m.apply(*p)).filter(|p| p.is_finite()).take(MAX_RIGID_POINTS).collect()
+    }
 }
 
 impl Model {
     /// Work for a spline that an endpoint residual actually reconstructs. Fit interpolation
     /// uses dense Gaussian elimination (cubic); control splines clone and evaluate their template.
     pub(crate) fn spline_reconstruct_cost(&self, handle: Handle) -> f64 {
-        let Some(s) = self.splines.get(&handle) else { return 0.0 };
-        let n = s.fit.len() as f64;
-        if fit_mode(s) {
-            n * n * n
-        } else {
-            let n = s.control.len() as f64;
-            n * n
-        }
+        let Some(Shape::Spline { n, fit, .. }) = self.slot(handle).map(|s| s.shape) else { return 0.0 };
+        let n = n as f64;
+        if fit { n * n * n } else { n * n }
     }
 }
 
@@ -115,23 +175,18 @@ pub fn supported(kind: &EntityKind) -> bool {
 /// centres, vertices, nested insertion points) of the block's own objects, at most
 /// [`MAX_RIGID_POINTS`]. Nested blocks are not entered.
 pub fn rigid_points(d: &Drawing, ins: &Insert) -> Vec<Vec2> {
-    let mut members_left = MAX_RIGID_MEMBERS;
-    rigid_points_budgeted(d, ins, &mut members_left)
+    Prep::new(MAX_RIGID_MEMBERS).rigid_points(d, ins)
 }
 
-/// Sample finite block points within per-insert and caller-shared member limits.
-/// Members that contribute no points still consume traversal work; nested blocks are not entered.
-fn rigid_points_budgeted(d: &Drawing, ins: &Insert, members_left: &mut usize) -> Vec<Vec2> {
-    let Some(block) = d.block(&ins.block) else { return Vec::new() };
-    let m = ins.transform(block.base.xy());
+/// Sample a block's finite characteristic points in block coordinates, within the per-block
+/// member limit and the caller-shared `members_left`. Members that contribute no points still
+/// consume traversal work; nested blocks are not entered.
+fn sample_block(block: &Block, members_left: &mut usize) -> Rc<[Vec2]> {
     let mut out = Vec::new();
     // Bound the members examined, not only the points collected: entities that contribute no
-    // points (Text, Ray, …) still cost traversal, so a block full of them — scanned again for
-    // every Insert — would otherwise be unbounded (CWE-407).
-    let mut examined = 0usize;
-    for e in block.entities.iter() {
-        examined += 1;
-        if out.len() >= MAX_RIGID_POINTS || examined > MAX_RIGID_MEMBERS || *members_left == 0 {
+    // points (Text, Ray, …) still cost traversal (CWE-407).
+    for (examined, e) in block.entities.iter().enumerate() {
+        if out.len() >= MAX_RIGID_POINTS || examined >= MAX_RIGID_MEMBERS || *members_left == 0 {
             break;
         }
         *members_left -= 1;
@@ -148,10 +203,10 @@ fn rigid_points_budgeted(d: &Drawing, ins: &Insert, members_left: &mut usize) ->
             EntityKind::LwPolyline(p) => p.vertices.iter().take(MAX_RIGID_POINTS).map(|v| v.p).collect(),
             _ => Vec::new(),
         };
-        out.extend(pts.into_iter().map(|p| m.apply(p)).filter(|p| p.is_finite()));
+        out.extend(pts.into_iter().filter(|p| p.is_finite()));
     }
     out.truncate(MAX_RIGID_POINTS);
-    out
+    out.into()
 }
 
 /// Constraint points of an object as the solver sees them (`Sub`, position): end points,
@@ -187,13 +242,12 @@ fn fit_mode(s: &GSpline) -> bool {
 impl Model {
     /// Build a model for the given entities. Unsupported or missing entities are skipped.
     pub fn build(d: &Drawing, handles: &[Handle]) -> Model {
-        let mut members_left = MAX_RIGID_WORK;
-        Self::build_budgeted(d, handles, &mut members_left)
+        Self::build_with(d, handles, &mut Prep::new(MAX_RIGID_WORK))
     }
 
     /// Add the parameters of one supported entity to `m`, and return its shape; `None` when it is
     /// left out (too large, degenerate or unsupported).
-    fn add_params(m: &mut Model, d: &Drawing, h: Handle, kind: &EntityKind, off: usize, members_left: &mut usize) -> Option<Shape> {
+    fn add_params(m: &mut Model, d: &Drawing, h: Handle, kind: &EntityKind, off: usize, prep: &mut Prep) -> Option<Shape> {
         let shape = match kind {
             EntityKind::Line(l) => {
                 m.x0.extend([l.a.x, l.a.y, l.b.x, l.b.y]);
@@ -243,15 +297,22 @@ impl Model {
                 // fit point; a control polygon's ends are its first and last points when the
                 // knots are clamped.
                 let ends = !sp.closed && (fit || (clamped(sp, false) && clamped(sp, true)));
-                // Missing weights default to 1 in eval; only excess weights are unused.
-                let mut kept = sp.clone();
+                // Keep only what rebuilding reads, so each rebuild copies no unused data: missing
+                // weights default to 1 in eval and only excess weights are unused; a control
+                // spline's fit points are dropped when its control points move (write_back), and
+                // a fit spline is rebuilt from its parameters, not from its old control net.
+                let mut kept = if fit {
+                    GSpline { fit_opts: sp.fit_opts, closed: sp.closed, ..GSpline::default() }
+                } else {
+                    GSpline { fit: Vec::new(), ..sp.clone() }
+                };
                 kept.weights.truncate(kept.control.len());
                 m.splines.insert(h, kept);
                 Shape::Spline { n, fit, ends }
             }
             EntityKind::Insert(ins) => {
                 let base = Vec2::new(ins.insert.x, ins.insert.y);
-                let pts: Vec<Vec2> = rigid_points_budgeted(d, ins, members_left).into_iter().map(|p| (p - base).rotate(-ins.rotation)).collect();
+                let pts: Vec<Vec2> = prep.rigid_points(d, ins).into_iter().map(|p| (p - base).rotate(-ins.rotation)).collect();
                 m.x0.extend([ins.insert.x, ins.insert.y, ins.rotation]);
                 let n = pts.len();
                 m.rigid.insert(h, pts);
@@ -262,16 +323,17 @@ impl Model {
         Some(shape)
     }
 
-    /// Build solver parameters for supported entities while sharing rigid-member sampling work with other models.
-    pub(crate) fn build_budgeted(d: &Drawing, handles: &[Handle], members_left: &mut usize) -> Model {
-        let mut m = Model::default();
+    /// Build solver parameters for supported entities, sharing block sampling, its member budget
+    /// and spline rebuilds with every other model built from `prep`.
+    pub(crate) fn build_with(d: &Drawing, handles: &[Handle], prep: &mut Prep) -> Model {
+        let mut m = Model { rebuilt: Rc::clone(&prep.rebuilt), ..Model::default() };
         for &h in handles {
             if m.index.contains_key(&h) {
                 continue;
             }
             let Some(e) = d.entity(h) else { continue };
             let off = m.x0.len();
-            let Some(shape) = Self::add_params(&mut m, d, h, &e.kind, off, members_left) else { continue };
+            let Some(shape) = Self::add_params(&mut m, d, h, &e.kind, off, prep) else { continue };
             if m.x0.len() > MAX_PARAMS || m.x0.get(off..).unwrap_or(&[]).iter().any(|v| !v.is_finite()) {
                 m.x0.truncate(off);
                 continue;
@@ -373,18 +435,20 @@ impl Model {
         self.slot(r.handle).is_some_and(|s| matches!(s.shape, Shape::Spline { .. }))
     }
 
-    /// The spline of a reference with the defining points taken from `x`.
-    fn spline(&self, x: &[f64], s: &Slot) -> Option<GSpline> {
+    /// The spline of a reference with the defining points taken from `x`. The last rebuild of
+    /// each spline is kept, so asking again at the same points costs a comparison, not a rebuild.
+    fn spline(&self, x: &[f64], s: &Slot) -> Option<Rc<GSpline>> {
         let Shape::Spline { n, fit, .. } = s.shape else { return None };
         let t = self.splines.get(&s.handle)?;
         let pts = (0..n).map(|i| p2(x, s.off + 2 * i)).collect::<Option<Vec<_>>>()?;
-        Some(if fit {
-            t.refit(&pts, t.closed)
-        } else {
-            let mut sp = t.clone();
-            sp.control = pts;
-            sp
-        })
+        if let Some((at, sp)) = self.rebuilt.borrow().get(&s.handle)
+            && *at == pts
+        {
+            return Some(Rc::clone(sp));
+        }
+        let sp = Rc::new(if fit { t.refit(&pts, t.closed) } else { GSpline { control: pts.clone(), ..t.clone() } });
+        self.rebuilt.borrow_mut().insert(s.handle, (pts, Rc::clone(&sp)));
+        Some(sp)
     }
 
     /// The start (`at_end` false) or end of a curve reference, in the curve's own direction:
@@ -421,7 +485,7 @@ impl Model {
                 let e = self.ell_at(x, o, true)?;
                 e.frame(if at_end { e.t1 } else { e.t0 })
             }
-            (Shape::Spline { ends: true, .. }, Sub::Whole | Sub::Start | Sub::End) => spline_end(&self.spline(x, s)?, at_end),
+            (Shape::Spline { ends: true, .. }, Sub::Whole | Sub::Start | Sub::End) => spline_end(&*self.spline(x, s)?, at_end),
             _ => None,
         }
     }
@@ -590,7 +654,8 @@ impl Model {
             }
             let shape = s.shape;
             // A control-point spline loses its fit data once its control points move.
-            let spline = self.spline(x, s).map(|mut sp| {
+            let spline = self.spline(x, s).map(|sp| {
+                let mut sp = GSpline::clone(&sp);
                 if matches!(shape, Shape::Spline { fit: false, .. }) {
                     sp.fit.clear();
                 }
@@ -712,21 +777,21 @@ mod budget_tests {
         }
     }
 
-    /// A second model receives no sampled block points after the first model spends the shared member budget.
-    #[test]
-    fn rigid_sampling_budget_is_shared_between_models() {
-        let mut d = Drawing::default();
-        let mut block = Block::new("BAR");
-        for _ in 0..3 {
+    fn add_block(d: &mut Drawing, name: &str, lines: usize) {
+        let mut block = Block::new(name);
+        for _ in 0..lines {
             block.entities.push(Entity {
                 handle: d.new_handle(),
                 common: Common::default(),
                 kind: EntityKind::Line(Line { a: Vec3::ZERO, b: Vec3::new(1.0, 0.0, 0.0) }),
             });
         }
-        d.blocks.insert("BAR".into(), Arc::new(block));
-        let ins = Insert {
-            block: "BAR".into(),
+        d.blocks.insert(name.into(), Arc::new(block));
+    }
+
+    fn insert(block: &str) -> Insert {
+        Insert {
+            block: block.into(),
             insert: Vec3::ZERO,
             scale: Vec3::new(1.0, 1.0, 1.0),
             rotation: 0.0,
@@ -735,13 +800,79 @@ mod budget_tests {
             rows: 1,
             col_spacing: 0.0,
             row_spacing: 0.0,
-        };
-        let h = d.add(&Space::Model, Common::default(), EntityKind::Insert(ins)).unwrap();
-        let mut budget = 2;
-        let first = Model::build_budgeted(&d, &[h], &mut budget);
-        assert_eq!(first.rigid[&h].len(), 4);
-        assert_eq!(budget, 0);
-        let next = Model::build_budgeted(&d, &[h], &mut budget);
-        assert!(next.rigid[&h].is_empty());
+        }
+    }
+
+    fn add_insert(d: &mut Drawing, block: &str) -> Handle {
+        d.add(&Space::Model, Common::default(), EntityKind::Insert(insert(block))).unwrap()
+    }
+
+    /// The member budget is shared by every model of one preparation, and a block it already
+    /// sampled is reused by later Inserts without examining its members again.
+    #[test]
+    fn rigid_sampling_budget_is_shared_and_blocks_sampled_once() {
+        let mut d = Drawing::default();
+        add_block(&mut d, "BAR", 3);
+        add_block(&mut d, "BAZ", 3);
+        let (bar, baz, bar2) = (add_insert(&mut d, "BAR"), add_insert(&mut d, "BAZ"), add_insert(&mut d, "BAR"));
+        let mut prep = Prep::new(2);
+        let first = Model::build_with(&d, &[bar], &mut prep);
+        assert_eq!(first.rigid[&bar].len(), 4);
+        assert_eq!(prep.members_left, 0);
+        let other = Model::build_with(&d, &[baz], &mut prep);
+        assert!(other.rigid[&baz].is_empty());
+        let again = Model::build_with(&d, &[bar2], &mut prep);
+        assert_eq!(again.rigid[&bar2].len(), 4);
+    }
+
+    /// Block names resolve ignoring ASCII case, as `Drawing::block` does, through one index.
+    #[test]
+    fn block_names_resolve_ignoring_case() {
+        let mut d = Drawing::default();
+        add_block(&mut d, "Bar", 2);
+        let (lower, missing) = (add_insert(&mut d, "bAR"), add_insert(&mut d, "nope"));
+        let mut prep = Prep::new(MAX_RIGID_WORK);
+        let m = Model::build_with(&d, &[lower, missing], &mut prep);
+        assert_eq!(m.rigid[&lower].len(), 4);
+        assert!(m.rigid[&missing].is_empty());
+        assert!(prep.folded.as_ref().is_some_and(|f| f.len() == 1));
+        assert_eq!(rigid_points(&d, &insert("BAR")).len(), 4);
+    }
+
+    /// A spline asked for again at the same defining points is not rebuilt, also from another
+    /// model of the same preparation; moved points rebuild it.
+    #[test]
+    fn spline_rebuilds_are_reused_at_the_same_points() {
+        let mut d = Drawing::default();
+        let pts: Vec<Vec2> = (0..6).map(|i| Vec2::new(i as f64, (i % 2) as f64)).collect();
+        let h = d.add(&Space::Model, Common::default(), EntityKind::Spline(GSpline::fit_with(&pts, false, Default::default()))).unwrap();
+        let mut prep = Prep::new(MAX_RIGID_WORK);
+        let a = Model::build_with(&d, &[h], &mut prep);
+        let b = Model::build_with(&d, &[h], &mut prep);
+        let (sa, sb) = (a.slot(h).unwrap(), b.slot(h).unwrap());
+        assert!(matches!(sa.shape, Shape::Spline { fit: true, .. }));
+        let first = a.spline(&a.x0, sa).unwrap();
+        assert!(Rc::ptr_eq(&first, &a.spline(&a.x0, sa).unwrap()));
+        assert!(Rc::ptr_eq(&first, &b.spline(&b.x0, sb).unwrap()));
+        let mut moved = a.x0.clone();
+        moved[1] += 0.5;
+        let other = a.spline(&moved, sa).unwrap();
+        assert!(!Rc::ptr_eq(&first, &other));
+        assert_eq!(other.fit[0], Vec2::new(0.0, 0.5));
+    }
+
+    /// A control spline's template keeps no fit points and no excess weights.
+    #[test]
+    fn control_template_drops_unused_data() {
+        let mut d = Drawing::default();
+        let mut sp = GSpline::from_control(vec![Vec2::ZERO, Vec2::new(1.0, 2.0), Vec2::new(3.0, 0.0), Vec2::new(4.0, 1.0)], 3);
+        sp.fit = vec![Vec2::ZERO; 10_000];
+        sp.fit_opts.tolerance = 0.5;
+        sp.weights = vec![1.0; 10_000];
+        let h = d.add(&Space::Model, Common::default(), EntityKind::Spline(sp)).unwrap();
+        let m = Model::build(&d, &[h]);
+        let t = &m.splines[&h];
+        assert!(t.fit.is_empty());
+        assert_eq!(t.weights.len(), 4);
     }
 }

crates/constraints/src/residual.rs

@@ -3,7 +3,7 @@
 use cadcraft_doc::{Constraint, ConstraintKind, DistAxis, GeomRef};
 use cadcraft_geom::Vec2;
 
-use crate::curves::circle_at;
+use crate::curves::{Ell, circle_at};
 use crate::model::Model;
 
 /// Contact parameter samples per curve when guessing where two curves touch.
@@ -205,42 +205,7 @@ impl Built {
                 };
                 b.rows = 1;
             }
-            K::Tangent | K::Smooth => {
-                if n != 2 {
-                    return need("two objects");
-                }
-                if c.refs.iter().any(|r| m.is_spline(r)) {
-                    return Self::spline_form(b, m, x);
-                }
-                b.rows = 1;
-                if let (Some((a, bb)), Some((cc, _))) = (ln(0), ci(1)) {
-                    b.form = Form::LC { swap: false };
-                    b.sign = sgn(dir_n(a, bb).cross(cc - a));
-                } else if let (Some((a, bb)), Some((cc, _))) = (ln(1), ci(0)) {
-                    b.form = Form::LC { swap: true };
-                    b.sign = sgn(dir_n(a, bb).cross(cc - a));
-                } else if let (Some((c1, r1)), Some((c2, r2))) = (ci(0), ci(1)) {
-                    b.form = Form::CC;
-                    // sign > 0: external tangency; < 0: internal.
-                    let d = c1.dist(c2);
-                    b.sign = if d >= r1.abs().max(r2.abs()) { 1.0 } else { -1.0 };
-                    b.target = sgn(r1 - r2);
-                } else if let (Some((a, bb)), Some(e)) = (ln(0), el(1)) {
-                    b.form = Form::LE { swap: false };
-                    b.sign = sgn(dir_n(a, bb).cross(e.c - a));
-                } else if let (Some((a, bb)), Some(e)) = (ln(1), el(0)) {
-                    b.form = Form::LE { swap: true };
-                    b.sign = sgn(dir_n(a, bb).cross(e.c - a));
-                } else if (ci(0).is_some() || el(0).is_some()) && (ci(1).is_some() || el(1).is_some()) {
-                    b.form = Form::Contact;
-                    b.rows = 3;
-                    b.aux_init = b.contact_guess(m, x).ok_or_else(|| format!("{} could not find where the curves touch", c.kind.name()))?;
-                } else if ln(0).is_some() && ln(1).is_some() && c.kind == K::Smooth {
-                    b.form = Form::LL;
-                } else {
-                    return need("a line and a circle/arc/ellipse, two curves, or a spline end and a curve");
-                }
-            }
+            K::Tangent | K::Smooth => return Self::tangent_form(b, c, m, x),
             K::Symmetric => {
                 if n != 3 || ln(2).is_none() {
                     return need("two objects and a symmetry line");
@@ -347,154 +312,8 @@ impl Built {
         out.resize(start + self.rows, 0.0);
     }
 
-    fn eval_inner(&self, m: &Model, x: &[f64], out: &mut Vec<f64>) -> Option<()> {
-        use ConstraintKind as K;
-        let r = |i: usize| self.refs.get(i);
-        let pt = |i: usize| m.point(x, r(i)?);
-        let ln = |i: usize| m.line(x, r(i)?);
-        let ci = |i: usize| m.circle(x, r(i)?);
-        let el = |i: usize| m.ellipse(x, r(i)?);
-        match (self.kind, self.form) {
-            (_, Form::Lock) => {}
-            (_, Form::PE { swap }) => {
-                let (p, e) = if swap { (pt(1)?, el(0)?) } else { (pt(0)?, el(1)?) };
-                out.push(e.on(p));
-            }
-            (_, Form::LE { swap }) => {
-                let ((a, b), e) = if swap { (ln(1)?, el(0)?) } else { (ln(0)?, el(1)?) };
-                let d = dir_n(a, b);
-                out.push(self.sign * d.cross(e.c - a) - e.support(d.perp()));
-            }
-            (_, Form::Contact) => {
-                let (p0, d0) = self.curve_at(m, x, 0, *x.get(self.aux)?)?;
-                let (p1, d1) = self.curve_at(m, x, 1, *x.get(self.aux + 1)?)?;
-                out.extend([p0.x - p1.x, p0.y - p1.y, d0.normalized().cross(d1.normalized())]);
-            }
-            (_, Form::EndOn { spline, at_end }) => {
-                let f = m.end_frame(x, r(spline)?, at_end)?;
-                let o = 1 - spline.min(1);
-                if let Some((a, b)) = ln(o) {
-                    let d = dir_n(a, b);
-                    out.extend([d.cross(f.p - a), f.t.cross(d)]);
-                } else if let Some((c, rad)) = ci(o) {
-                    out.extend([f.p.dist(c) - rad, f.t.dot(dir_n(c, f.p))]);
-                } else {
-                    let e = el(o)?;
-                    out.extend([e.on(f.p), f.t.dot(e.normal(f.p))]);
-                }
-            }
-            (_, Form::Join { a_end, b_end, g2 }) => {
-                // Orient both so the first curve runs into the joint and the second out of it.
-                let fa = m.end_frame(x, r(0)?, a_end)?;
-                let fb = m.end_frame(x, r(1)?, b_end)?;
-                let fa = if a_end { fa } else { fa.reversed() };
-                let fb = if b_end { fb.reversed() } else { fb };
-                out.extend([fa.p.x - fb.p.x, fa.p.y - fb.p.y, fa.t.cross(fb.t)]);
-                if g2 {
-                    out.push(fa.k - fb.k);
-                }
-            }
-            (_, Form::Anchor(a)) => {
-                let p = pt(0)?;
-                out.extend([p.x - a.x, p.y - a.y]);
-            }
-            (K::Coincident, Form::PP) => {
-                let (p, q) = (pt(0)?, pt(1)?);
-                out.extend([p.x - q.x, p.y - q.y]);
-            }
-            (K::Coincident, Form::PL { swap }) => {
-                let (p, (a, b)) = if swap { (pt(1)?, ln(0)?) } else { (pt(0)?, ln(1)?) };
-                out.push(dir_n(a, b).cross(p - a));
-            }
-            (K::Coincident, Form::PC { swap }) => {
-                let (p, (c, rad)) = if swap { (pt(1)?, ci(0)?) } else { (pt(0)?, ci(1)?) };
-                out.push(p.dist(c) - rad);
-            }
-            (K::Horizontal | K::Vertical, f) => {
-                let (a, b) = if f == Form::L1 { ln(0).or_else(|| el(0).map(|e| (e.c - e.mj, e.c + e.mj)))? } else { (pt(0)?, pt(1)?) };
-                out.push(if self.kind == K::Horizontal { a.y - b.y } else { a.x - b.x });
-            }
-            (K::Parallel | K::Smooth, Form::LL) => {
-                let ((a1, b1), (a2, b2)) = (ln(0)?, ln(1)?);
-                out.push(dir_n(a1, b1).cross(dir_n(a2, b2)));
-            }
-            (K::Perpendicular, _) => {
-                let ((a1, b1), (a2, b2)) = (ln(0)?, ln(1)?);
-                out.push(dir_n(a1, b1).dot(dir_n(a2, b2)));
-            }
-            (K::Collinear, _) => {
-                let ((a1, b1), (a2, b2)) = (ln(0)?, ln(1)?);
-                let d = dir_n(a1, b1);
-                out.extend([d.cross(a2 - a1), d.cross(b2 - a1)]);
-            }
-            (K::Concentric, _) => {
-                let center = |i: usize| ci(i).map(|(c, _)| c).or_else(|| el(i).map(|e| e.c)).or_else(|| pt(i));
-                let (p, q) = (center(0)?, center(1)?);
-                out.extend([p.x - q.x, p.y - q.y]);
-            }
-            (K::Equal, Form::LL) => {
-                let ((a1, b1), (a2, b2)) = (ln(0)?, ln(1)?);
-                out.push(a1.dist(b1) - a2.dist(b2));
-            }
-            (K::Equal, _) => {
-                let ((_, r1), (_, r2)) = (ci(0)?, ci(1)?);
-                out.push(r1 - r2);
-            }
-            (K::Tangent | K::Smooth, Form::LC { swap }) => {
-                let ((a, b), (c, rad)) = if swap { (ln(1)?, ci(0)?) } else { (ln(0)?, ci(1)?) };
-                out.push(self.sign * dir_n(a, b).cross(c - a) - rad);
-            }
-            (K::Tangent | K::Smooth, _) => {
-                let ((c1, r1), (c2, r2)) = (ci(0)?, ci(1)?);
-                let d = c1.dist(c2);
-                out.push(if self.sign > 0.0 { d - (r1 + r2) } else { d - self.target * (r1 - r2) });
-            }
-            (K::Symmetric, Form::PP) => {
-                let (p, q, (a, b)) = (pt(0)?, pt(1)?, ln(2)?);
-                let d = dir_n(a, b);
-                out.extend([d.cross(p.mid(q) - a), d.dot(q - p)]);
-            }
-            (K::Symmetric, Form::SymLines { crossed }) => {
-                let ((a1, b1), (a2, b2), (a, b)) = (ln(0)?, ln(1)?, ln(2)?);
-                let (a2, b2) = if crossed { (b2, a2) } else { (a2, b2) };
-                let d = dir_n(a, b);
-                out.extend([d.cross(a1.mid(a2) - a), d.dot(a2 - a1), d.cross(b1.mid(b2) - a), d.dot(b2 - b1)]);
-            }
-            (K::Symmetric, _) => {
-                let ((p, r1), (q, r2), (a, b)) = (ci(0)?, ci(1)?, ln(2)?);
-                let d = dir_n(a, b);
-                out.extend([d.cross(p.mid(q) - a), d.dot(q - p), r1 - r2]);
-            }
-            (K::Distance(axis), f) => {
-                let v = match (axis, f) {
-                    (_, Form::PL { swap }) => {
-                        let (p, (a, b)) = if swap { (pt(1)?, ln(0)?) } else { (pt(0)?, ln(1)?) };
-                        dir_n(a, b).cross(p - a)
-                    }
-                    _ => {
-                        let (a, b) = if f == Form::L1 { ln(0)? } else { (pt(0)?, pt(1)?) };
-                        match axis {
-                            DistAxis::Aligned => a.dist(b),
-                            DistAxis::Horizontal => b.x - a.x,
-                            DistAxis::Vertical => b.y - a.y,
-                        }
-                    }
-                };
-                out.push(self.sign * v - self.target);
-            }
-            (K::Angular, Form::ArcSweep) => {
-                out.push(m.arc_sweep(x, r(0)?)? - self.target);
-            }
-            (K::Angular, Form::Rays { rev }) => {
-                let ((a1, b1), (a2, b2)) = (ln(0)?, ln(1)?);
-                let (d1, d2) = (ray(a1, b1, rev[0]), ray(a2, b2, rev[1]));
-                out.push(wrap(d1.cross(d2).atan2(d1.dot(d2)) - self.sign * self.target));
-            }
-            (K::Radius, _) => out.push(ci(0)?.1 - self.target),
-            (K::Diameter, _) => out.push(2.0 * ci(0)?.1 - self.target),
-            _ => {}
-        }
-        Some(())
+    fn eval_inner(&self, model: &Model, values: &[f64], out: &mut Vec<f64>) -> Option<()> {
+        ResidualEval { built: self, model, values, out }.evaluate()
     }
 
     /// Point and derivative of curve reference `i` (circle, arc or ellipse) at parameter `t`.
@@ -527,6 +346,54 @@ impl Built {
     /// Tangent or Smooth with a spline: the spline end and the other curve's nearest end are
     /// joined (Smooth: G2; Tangent between splines: G1), or the spline's end touches a line,
     /// circle, arc or ellipse tangentially. A `start`/`end` reference picks the end.
+    fn tangent_form(mut built: Built, constraint: &Constraint, model: &Model, values: &[f64]) -> Result<Built, String> {
+        use ConstraintKind as K;
+
+        let need = |what: &str| Err(format!("{} needs {what}", constraint.kind.name()));
+        if built.refs.len() != 2 {
+            return need("two objects");
+        }
+        if constraint.refs.iter().any(|reference| model.is_spline(reference)) {
+            return Self::spline_form(built, model, values);
+        }
+
+        let line = |index| r_at(constraint, index).and_then(|reference| model.line(values, reference));
+        let circle = |index| r_at(constraint, index).and_then(|reference| model.circle(values, reference));
+        let ellipse = |index| r_at(constraint, index).and_then(|reference| model.ellipse(values, reference));
+        built.rows = 1;
+
+        if let (Some((start, end)), Some((center, _))) = (line(0), circle(1)) {
+            built.form = Form::LC { swap: false };
+            built.sign = sgn(dir_n(start, end).cross(center - start));
+        } else if let (Some((start, end)), Some((center, _))) = (line(1), circle(0)) {
+            built.form = Form::LC { swap: true };
+            built.sign = sgn(dir_n(start, end).cross(center - start));
+        } else if let (Some((first_center, first_radius)), Some((second_center, second_radius))) = (circle(0), circle(1)) {
+            built.form = Form::CC;
+            // sign > 0: external tangency; < 0: internal.
+            let distance = first_center.dist(second_center);
+            built.sign = if distance >= first_radius.abs().max(second_radius.abs()) { 1.0 } else { -1.0 };
+            built.target = sgn(first_radius - second_radius);
+        } else if let (Some((start, end)), Some(ellipse)) = (line(0), ellipse(1)) {
+            built.form = Form::LE { swap: false };
+            built.sign = sgn(dir_n(start, end).cross(ellipse.c - start));
+        } else if let (Some((start, end)), Some(ellipse)) = (line(1), ellipse(0)) {
+            built.form = Form::LE { swap: true };
+            built.sign = sgn(dir_n(start, end).cross(ellipse.c - start));
+        } else if (circle(0).is_some() || ellipse(0).is_some()) && (circle(1).is_some() || ellipse(1).is_some()) {
+            built.form = Form::Contact;
+            built.rows = 3;
+            built.aux_init =
+                built.contact_guess(model, values).ok_or_else(|| format!("{} could not find where the curves touch", constraint.kind.name()))?;
+        } else if line(0).is_some() && line(1).is_some() && constraint.kind == K::Smooth {
+            built.form = Form::LL;
+        } else {
+            return need("a line and a circle/arc/ellipse, two curves, or a spline end and a curve");
+        }
+
+        Ok(built)
+    }
+
     fn spline_form(mut b: Built, m: &Model, x: &[f64]) -> Result<Built, String> {
         let (Some(r0), Some(r1)) = (b.refs.first().copied(), b.refs.get(1).copied()) else {
             return Err(format!("{} needs two objects", b.kind.name()));
@@ -596,3 +463,292 @@ impl Built {
         if self.kind == ConstraintKind::Angular { v.to_degrees() } else { v }
     }
 }
+
+/// Shared access to a constraint's geometry, values, and output while evaluating one residual.
+struct ResidualEval<'a> {
+    built: &'a Built,
+    model: &'a Model,
+    values: &'a [f64],
+    out: &'a mut Vec<f64>,
+}
+
+impl ResidualEval<'_> {
+    fn evaluate(&mut self) -> Option<()> {
+        use ConstraintKind as K;
+
+        match (self.built.kind, self.built.form) {
+            (_, Form::Lock) => Some(()),
+            (_, Form::PE { swap }) => self.eval_point_ellipse(swap),
+            (_, Form::LE { swap }) => self.eval_line_ellipse(swap),
+            (_, Form::Contact) => self.eval_contact(),
+            (_, Form::EndOn { spline, at_end }) => self.eval_end_on(spline, at_end),
+            (_, Form::Join { a_end, b_end, g2 }) => self.eval_join(a_end, b_end, g2),
+            (_, Form::Anchor(anchor)) => self.eval_anchor(anchor),
+            (K::Coincident, Form::PP) => self.eval_coincident_points(),
+            (K::Coincident, Form::PL { swap }) => self.eval_point_line(swap),
+            (K::Coincident, Form::PC { swap }) => self.eval_point_circle(swap),
+            (K::Horizontal | K::Vertical, form) => self.eval_horizontal_vertical(form),
+            (K::Parallel | K::Smooth, Form::LL) => self.eval_parallel(),
+            (K::Perpendicular, _) => self.eval_perpendicular(),
+            (K::Collinear, _) => self.eval_collinear(),
+            (K::Concentric, _) => self.eval_concentric(),
+            (K::Equal, Form::LL) => self.eval_equal_lines(),
+            (K::Equal, _) => self.eval_equal_circles(),
+            (K::Tangent | K::Smooth, Form::LC { swap }) => self.eval_tangent_line_circle(swap),
+            (K::Tangent | K::Smooth, _) => self.eval_tangent_circles(),
+            (K::Symmetric, Form::PP) => self.eval_symmetric_points(),
+            (K::Symmetric, Form::SymLines { crossed }) => self.eval_symmetric_lines(crossed),
+            (K::Symmetric, _) => self.eval_symmetric_circles(),
+            (K::Distance(axis), form) => self.eval_distance(axis, form),
+            (K::Angular, Form::ArcSweep) => self.eval_angular_arc(),
+            (K::Angular, Form::Rays { rev }) => self.eval_angular_rays(rev),
+            (K::Radius, _) => self.eval_radius(),
+            (K::Diameter, _) => self.eval_diameter(),
+            _ => Some(()),
+        }
+    }
+
+    fn reference(&self, index: usize) -> Option<&GeomRef> {
+        self.built.refs.get(index)
+    }
+
+    fn point(&self, index: usize) -> Option<Vec2> {
+        self.model.point(self.values, self.reference(index)?)
+    }
+
+    fn line(&self, index: usize) -> Option<(Vec2, Vec2)> {
+        self.model.line(self.values, self.reference(index)?)
+    }
+
+    fn circle(&self, index: usize) -> Option<(Vec2, f64)> {
+        self.model.circle(self.values, self.reference(index)?)
+    }
+
+    fn ellipse(&self, index: usize) -> Option<Ell> {
+        self.model.ellipse(self.values, self.reference(index)?)
+    }
+
+    fn eval_point_ellipse(&mut self, swap: bool) -> Option<()> {
+        let (point, ellipse) = if swap { (self.point(1)?, self.ellipse(0)?) } else { (self.point(0)?, self.ellipse(1)?) };
+        self.out.push(ellipse.on(point));
+        Some(())
+    }
+
+    fn eval_line_ellipse(&mut self, swap: bool) -> Option<()> {
+        let (line, ellipse) = if swap { (self.line(1)?, self.ellipse(0)?) } else { (self.line(0)?, self.ellipse(1)?) };
+        let (start, end) = line;
+        let direction = dir_n(start, end);
+        self.out.push(self.built.sign * direction.cross(ellipse.c - start) - ellipse.support(direction.perp()));
+        Some(())
+    }
+
+    fn eval_contact(&mut self) -> Option<()> {
+        let first_parameter = *self.values.get(self.built.aux)?;
+        let second_parameter = *self.values.get(self.built.aux + 1)?;
+        let (first_point, first_tangent) = self.built.curve_at(self.model, self.values, 0, first_parameter)?;
+        let (second_point, second_tangent) = self.built.curve_at(self.model, self.values, 1, second_parameter)?;
+        self.out.extend([
+            first_point.x - second_point.x,
+            first_point.y - second_point.y,
+            first_tangent.normalized().cross(second_tangent.normalized()),
+        ]);
+        Some(())
+    }
+
+    fn eval_end_on(&mut self, spline: usize, at_end: bool) -> Option<()> {
+        let frame = self.model.end_frame(self.values, self.reference(spline)?, at_end)?;
+        let other = 1 - spline.min(1);
+        if let Some((start, end)) = self.line(other) {
+            let direction = dir_n(start, end);
+            self.out.extend([direction.cross(frame.p - start), frame.t.cross(direction)]);
+        } else if let Some((center, radius)) = self.circle(other) {
+            self.out.extend([frame.p.dist(center) - radius, frame.t.dot(dir_n(center, frame.p))]);
+        } else {
+            let ellipse = self.ellipse(other)?;
+            self.out.extend([ellipse.on(frame.p), frame.t.dot(ellipse.normal(frame.p))]);
+        }
+        Some(())
+    }
+
+    fn eval_join(&mut self, a_end: bool, b_end: bool, g2: bool) -> Option<()> {
+        let first = self.model.end_frame(self.values, self.reference(0)?, a_end)?;
+        let second = self.model.end_frame(self.values, self.reference(1)?, b_end)?;
+        let first = if a_end { first } else { first.reversed() };
+        let second = if b_end { second.reversed() } else { second };
+        self.out.extend([first.p.x - second.p.x, first.p.y - second.p.y, first.t.cross(second.t)]);
+        if g2 {
+            self.out.push(first.k - second.k);
+        }
+        Some(())
+    }
+
+    fn eval_anchor(&mut self, anchor: Vec2) -> Option<()> {
+        let point = self.point(0)?;
+        self.out.extend([point.x - anchor.x, point.y - anchor.y]);
+        Some(())
+    }
+
+    fn eval_coincident_points(&mut self) -> Option<()> {
+        let (first, second) = (self.point(0)?, self.point(1)?);
+        self.out.extend([first.x - second.x, first.y - second.y]);
+        Some(())
+    }
+
+    fn eval_point_line(&mut self, swap: bool) -> Option<()> {
+        let (point, (start, end)) = if swap { (self.point(1)?, self.line(0)?) } else { (self.point(0)?, self.line(1)?) };
+        self.out.push(dir_n(start, end).cross(point - start));
+        Some(())
+    }
+
+    fn eval_point_circle(&mut self, swap: bool) -> Option<()> {
+        let (point, (center, radius)) = if swap { (self.point(1)?, self.circle(0)?) } else { (self.point(0)?, self.circle(1)?) };
+        self.out.push(point.dist(center) - radius);
+        Some(())
+    }
+
+    fn eval_horizontal_vertical(&mut self, form: Form) -> Option<()> {
+        use ConstraintKind as K;
+
+        let (first, second) = if form == Form::L1 {
+            self.line(0).or_else(|| self.ellipse(0).map(|ellipse| (ellipse.c - ellipse.mj, ellipse.c + ellipse.mj)))?
+        } else {
+            (self.point(0)?, self.point(1)?)
+        };
+        let value = if self.built.kind == K::Horizontal { first.y - second.y } else { first.x - second.x };
+        self.out.push(value);
+        Some(())
+    }
+
+    fn eval_parallel(&mut self) -> Option<()> {
+        let ((first_start, first_end), (second_start, second_end)) = (self.line(0)?, self.line(1)?);
+        self.out.push(dir_n(first_start, first_end).cross(dir_n(second_start, second_end)));
+        Some(())
+    }
+
+    fn eval_perpendicular(&mut self) -> Option<()> {
+        let ((first_start, first_end), (second_start, second_end)) = (self.line(0)?, self.line(1)?);
+        self.out.push(dir_n(first_start, first_end).dot(dir_n(second_start, second_end)));
+        Some(())
+    }
+
+    fn eval_collinear(&mut self) -> Option<()> {
+        let ((first_start, first_end), (second_start, second_end)) = (self.line(0)?, self.line(1)?);
+        let direction = dir_n(first_start, first_end);
+        self.out.extend([direction.cross(second_start - first_start), direction.cross(second_end - first_start)]);
+        Some(())
+    }
+
+    fn eval_concentric(&mut self) -> Option<()> {
+        let center = |index| {
+            self.circle(index).map(|(center, _)| center).or_else(|| self.ellipse(index).map(|ellipse| ellipse.c)).or_else(|| self.point(index))
+        };
+        let (first, second) = (center(0)?, center(1)?);
+        self.out.extend([first.x - second.x, first.y - second.y]);
+        Some(())
+    }
+
+    fn eval_equal_lines(&mut self) -> Option<()> {
+        let ((first_start, first_end), (second_start, second_end)) = (self.line(0)?, self.line(1)?);
+        self.out.push(first_start.dist(first_end) - second_start.dist(second_end));
+        Some(())
+    }
+
+    fn eval_equal_circles(&mut self) -> Option<()> {
+        let ((_, first_radius), (_, second_radius)) = (self.circle(0)?, self.circle(1)?);
+        self.out.push(first_radius - second_radius);
+        Some(())
+    }
+
+    fn eval_tangent_line_circle(&mut self, swap: bool) -> Option<()> {
+        let ((start, end), (center, radius)) = if swap { (self.line(1)?, self.circle(0)?) } else { (self.line(0)?, self.circle(1)?) };
+        self.out.push(self.built.sign * dir_n(start, end).cross(center - start) - radius);
+        Some(())
+    }
+
+    fn eval_tangent_circles(&mut self) -> Option<()> {
+        let ((first_center, first_radius), (second_center, second_radius)) = (self.circle(0)?, self.circle(1)?);
+        let distance = first_center.dist(second_center);
+        let residual = if self.built.sign > 0.0 {
+            distance - (first_radius + second_radius)
+        } else {
+            distance - self.built.target * (first_radius - second_radius)
+        };
+        self.out.push(residual);
+        Some(())
+    }
+
+    fn eval_symmetric_points(&mut self) -> Option<()> {
+        let (first, second, (line_start, line_end)) = (self.point(0)?, self.point(1)?, self.line(2)?);
+        let direction = dir_n(line_start, line_end);
+        self.out.extend([direction.cross(first.mid(second) - line_start), direction.dot(second - first)]);
+        Some(())
+    }
+
+    fn eval_symmetric_lines(&mut self, crossed: bool) -> Option<()> {
+        let ((first_start, first_end), (second_start, second_end), (line_start, line_end)) = (self.line(0)?, self.line(1)?, self.line(2)?);
+        let (second_start, second_end) = if crossed { (second_end, second_start) } else { (second_start, second_end) };
+        let direction = dir_n(line_start, line_end);
+        self.out.extend([
+            direction.cross(first_start.mid(second_start) - line_start),
+            direction.dot(second_start - first_start),
+            direction.cross(first_end.mid(second_end) - line_start),
+            direction.dot(second_end - first_end),
+        ]);
+        Some(())
+    }
+
+    fn eval_symmetric_circles(&mut self) -> Option<()> {
+        let ((first_center, first_radius), (second_center, second_radius), (line_start, line_end)) =
+            (self.circle(0)?, self.circle(1)?, self.line(2)?);
+        let direction = dir_n(line_start, line_end);
+        self.out.extend([
+            direction.cross(first_center.mid(second_center) - line_start),
+            direction.dot(second_center - first_center),
+            first_radius - second_radius,
+        ]);
+        Some(())
+    }
+
+    fn eval_distance(&mut self, axis: DistAxis, form: Form) -> Option<()> {
+        let value = match (axis, form) {
+            (_, Form::PL { swap }) => {
+                let (point, (start, end)) = if swap { (self.point(1)?, self.line(0)?) } else { (self.point(0)?, self.line(1)?) };
+                dir_n(start, end).cross(point - start)
+            }
+            _ => {
+                let (first, second) = if form == Form::L1 { self.line(0)? } else { (self.point(0)?, self.point(1)?) };
+                match axis {
+                    DistAxis::Aligned => first.dist(second),
+                    DistAxis::Horizontal => second.x - first.x,
+                    DistAxis::Vertical => second.y - first.y,
+                }
+            }
+        };
+        self.out.push(self.built.sign * value - self.built.target);
+        Some(())
+    }
+
+    fn eval_angular_arc(&mut self) -> Option<()> {
+        let reference = self.reference(0)?;
+        self.out.push(self.model.arc_sweep(self.values, reference)? - self.built.target);
+        Some(())
+    }
+
+    fn eval_angular_rays(&mut self, reversed: [bool; 2]) -> Option<()> {
+        let ((first_start, first_end), (second_start, second_end)) = (self.line(0)?, self.line(1)?);
+        let (first, second) = (ray(first_start, first_end, reversed[0]), ray(second_start, second_end, reversed[1]));
+        let residual = wrap(first.cross(second).atan2(first.dot(second)) - self.built.sign * self.built.target);
+        self.out.push(residual);
+        Some(())
+    }
+
+    fn eval_radius(&mut self) -> Option<()> {
+        self.out.push(self.circle(0)?.1 - self.built.target);
+        Some(())
+    }
+
+    fn eval_diameter(&mut self) -> Option<()> {
+        self.out.push(2.0 * self.circle(0)?.1 - self.built.target);
+        Some(())
+    }
+}

crates/constraints/src/tests.rs

@@ -489,3 +489,30 @@ fn arc_solved_with_a_negative_radius_keeps_its_points() {
         }
     }
 }
+
+/// The default name is the first free numbered one, found in one pass over many names in use.
+#[test]
+fn next_name_skips_names_in_use() {
+    let mut d = Drawing::default();
+    assert_eq!(next_name(&d, ConstraintKind::Radius), "rad1");
+    for i in (1..=20_000).filter(|i| *i != 15_000) {
+        d.parametric.parameters.push(cadcraft_doc::Parameter { name: format!("d{i}"), expr: "1".into(), description: String::new() });
+    }
+    assert_eq!(next_name(&d, ConstraintKind::Distance(DistAxis::Aligned)), "d15000");
+    d.parametric.parameters.push(cadcraft_doc::Parameter { name: "d15000".into(), expr: "1".into(), description: String::new() });
+    assert_eq!(next_name(&d, ConstraintKind::Distance(DistAxis::Aligned)), "d20001");
+    // A differently spelled suffix does not occupy the plain name.
+    let mut d = Drawing::default();
+    for name in ["d01", "d+1", "d1x", "D1"] {
+        d.parametric.parameters.push(cadcraft_doc::Parameter { name: name.into(), expr: "1".into(), description: String::new() });
+    }
+    assert_eq!(next_name(&d, ConstraintKind::Distance(DistAxis::Aligned)), "d1");
+    d.constraints.push(Constraint {
+        id: 1,
+        kind: ConstraintKind::Distance(DistAxis::Aligned),
+        refs: Vec::new(),
+        name: "d1".into(),
+        expr: "1".into(),
+    });
+    assert_eq!(next_name(&d, ConstraintKind::Distance(DistAxis::Aligned)), "d2");
+}

crates/doc/src/dynblock.rs

@@ -5,7 +5,7 @@
 //! whose `ACAD_ENHANCEDBLOCK` entry is an evaluation graph (`ACAD_EVALUATION_GRAPH`), and the
 //! graph lists the block's *parameters* (a distance, a point, visibility states, a lookup…) and
 //! *actions* (what changing a parameter does to the block's objects: stretch, move, look up…).
-//! [`dynamic_block`] reads them into the model below without changing the kept data, so a drawing
+//! [`dynamic_block`](crate::dynblock::dynamic_block) reads them into the model below without changing the kept data, so a drawing
 //! saved again still carries them exactly as read.
 //!
 //! Every count and index here comes from the file: they are capped by the data actually present
@@ -194,7 +194,9 @@ pub struct Action {
 #[derive(Clone, Debug, PartialEq, Serialize)]
 #[serde(tag = "type", rename_all = "camelCase", rename_all_fields = "camelCase")]
 pub enum ActionKind {
-    /// Moves the vertices inside `frame` of the objects listed (all of an object not listed).
+    /// Moves the points of its objects inside `frame`: a line's or polyline's points inside it
+    /// (the whole of one outside it), any other object whole. `vertices` are the point indices the
+    /// file lists for each object, used only when the frame can't be tested (see `apply`).
     Stretch {
         frame: Vec<Vec2>,
         #[serde(serialize_with = "hex_vertices")]
@@ -321,8 +323,9 @@ impl<'a> Cursor<'a> {
     }
 }
 
-/// The objects `xdict`'s `ACAD_ENHANCEDBLOCK` evaluation graph lists, when the dictionary has one.
-fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle) -> Option<Vec<&'a ForeignObject>> {
+/// `xdict`'s `ACAD_ENHANCEDBLOCK` evaluation graph object, when the dictionary has one. Only the
+/// dictionary's own tags are read, so asking whether a block is dynamic never walks the graph.
+fn evaluation_graph<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle) -> Option<&'a ForeignObject> {
     let dict = objects.get(&xdict)?;
     let mut graph = None;
     let mut tags = dict.tags.iter();
@@ -332,7 +335,12 @@ fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle
             break;
         }
     }
-    let graph = objects.get(&graph?).filter(|o| o.kind.eq_ignore_ascii_case("ACAD_EVALUATION_GRAPH"))?;
+    objects.get(&graph?).copied().filter(|o| o.kind.eq_ignore_ascii_case("ACAD_EVALUATION_GRAPH"))
+}
+
+/// The objects `xdict`'s `ACAD_ENHANCEDBLOCK` evaluation graph lists, when the dictionary has one.
+fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle) -> Option<Vec<&'a ForeignObject>> {
+    let graph = evaluation_graph(objects, xdict)?;
     let members = section(&sections(&graph.tags), "AcDbEvalGraph").iter().filter(|t| t.code == 360).filter_map(|t| Handle::parse_hex(&t.value));
     // Deduplicate member handles before resolving them: a graph can list the same member many
     // times, and parsing each occurrence into its own owned parameter multiplies a single large
@@ -341,13 +349,42 @@ fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle
     Some(members.take(MAX_NODES).filter(|h| seen.insert(*h)).filter_map(|h| objects.get(&h).copied()).collect())
 }
 
+/// The kept foreign objects of a drawing by handle. Building it walks every object, so a caller
+/// that asks about many blocks (listing them) builds it once and passes it to
+/// [`dynamic_block_in`] and [`is_dynamic_block_in`] instead of rebuilding it per block, which
+/// multiplies the block count by the object count (CWE-407).
+pub struct ObjectIndex<'a>(HashMap<Handle, &'a ForeignObject>);
+
+impl<'a> ObjectIndex<'a> {
+    pub fn new(d: &'a Drawing) -> Self {
+        ObjectIndex(d.foreign.objects.iter().map(|o| (o.handle, o)).collect())
+    }
+}
+
+/// The extension dictionary of block `name`'s record, if it has one.
+fn block_xdict(d: &Drawing, name: &str) -> Option<Handle> {
+    d.foreign.records.get(&("BLOCK_RECORD".to_string(), name.trim().to_ascii_uppercase()))?.xdict
+}
+
 /// The dynamic block data of block `name` (any case; `*Model_Space` for a drawing that is a
 /// block's own drawing), or `None` when it has none.
 pub fn dynamic_block(d: &Drawing, name: &str) -> Option<DynamicBlock> {
-    let xdict = d.foreign.records.get(&("BLOCK_RECORD".to_string(), name.trim().to_ascii_uppercase()))?.xdict?;
-    let objects: HashMap<Handle, &ForeignObject> = d.foreign.objects.iter().map(|o| (o.handle, o)).collect();
+    // A block without an extension dictionary is never dynamic: answer before indexing objects.
+    block_xdict(d, name)?;
+    dynamic_block_in(d, &ObjectIndex::new(d), name)
+}
+
+/// Whether block `name` is a dynamic block (has an evaluation graph), without reading its
+/// parameters and actions; `objects` is the drawing's [`ObjectIndex`].
+pub fn is_dynamic_block_in(d: &Drawing, objects: &ObjectIndex<'_>, name: &str) -> bool {
+    block_xdict(d, name).and_then(|x| evaluation_graph(&objects.0, x)).is_some()
+}
+
+/// [`dynamic_block`] with the drawing's [`ObjectIndex`] already built.
+pub fn dynamic_block_in(d: &Drawing, objects: &ObjectIndex<'_>, name: &str) -> Option<DynamicBlock> {
+    let xdict = block_xdict(d, name)?;
     let mut out = DynamicBlock::default();
-    for o in graph_members(&objects, xdict)? {
+    for o in graph_members(&objects.0, xdict)? {
         let secs = sections(&o.tags);
         let node = Cursor::new(section(&secs, "AcDbEvalExpr")).int(90);
         let element = Cursor::new(section(&secs, "AcDbBlockElement")).string(300);

crates/doc/src/dynblock/apply.rs

@@ -54,7 +54,11 @@ fn record_handle(d: &Drawing, name: &str) -> Option<Handle> {
 
 /// The object entry `key` of dictionary `dict` refers to.
 fn entry(d: &Drawing, dict: Handle, key: &str) -> Option<Handle> {
-    let o = d.foreign.objects.iter().find(|o| o.handle == dict)?;
+    dictionary_entry(d.foreign.objects.iter().find(|o| o.handle == dict)?, key)
+}
+
+/// The object entry `key` (any case) of dictionary object `o` names.
+fn dictionary_entry(o: &ForeignObject, key: &str) -> Option<Handle> {
     let mut tags = o.tags.iter();
     while let Some(t) = tags.next() {
         if t.code == 3 && t.value.eq_ignore_ascii_case(key) {
@@ -66,7 +70,11 @@ fn entry(d: &Drawing, dict: Handle, key: &str) -> Option<Handle> {
 
 /// Every entry of dictionary `dict`: (key, object).
 fn entries(d: &Drawing, dict: Handle) -> Vec<(String, Handle)> {
-    let Some(o) = d.foreign.objects.iter().find(|o| o.handle == dict) else { return Vec::new() };
+    d.foreign.objects.iter().find(|o| o.handle == dict).map(dictionary_entries).unwrap_or_default()
+}
+
+/// Every entry of dictionary object `o`: (key, object).
+fn dictionary_entries(o: &ForeignObject) -> Vec<(String, Handle)> {
     let mut out = Vec::new();
     let mut key: Option<&str> = None;
     for t in &o.tags {
@@ -403,7 +411,31 @@ fn move_entity(e: &mut Entity, vertices: Option<&[i32]>, v: Vec2) {
     }
 }
 
-/// Whether point `p` lies inside a stretch frame (two corners, or a polygon).
+/// Most points of a stretch frame whose objects' points are tested against it one by one. A frame
+/// is two corners or a short polygon; testing every point of every object against every edge of a
+/// longer one would grow with their product, so the action's own vertex lists are used instead.
+const MAX_FRAME_POINTS: usize = 1000;
+
+/// The indices of `points` inside stretch frame `frame`, or `None` when none is: an object the
+/// action selects that lies outside its frame moves whole.
+fn inside(frame: &[Vec2], points: impl Iterator<Item = Vec2>) -> Option<Vec<i32>> {
+    let idx: Vec<i32> = points.enumerate().filter(|(_, p)| in_frame(frame, *p)).filter_map(|(i, _)| i32::try_from(i).ok()).collect();
+    (!idx.is_empty()).then_some(idx)
+}
+
+/// The distance from `p` to the segment `a`-`b`, however short (`Line::dist` takes one shorter than
+/// `EPS` for its first point). It is measured from `a`, so a short segment far from the origin keeps
+/// the digits rounding there would drop.
+fn segment_dist(a: Vec2, b: Vec2, p: Vec2) -> f64 {
+    let d = b - a;
+    let w = p - a;
+    let l2 = d.len2();
+    let t = if l2 > 0.0 { (w.dot(d) / l2).clamp(0.0, 1.0) } else { 0.0 };
+    (w - d * t).len()
+}
+
+/// Whether point `p` lies inside a stretch frame (two corners, or a polygon). A point on its edge is
+/// inside, for a polygon as for two corners: within a billionth of the edge's length of it.
 fn in_frame(frame: &[Vec2], p: Vec2) -> bool {
     match frame {
         [a, b] => p.x >= a.x.min(b.x) && p.x <= a.x.max(b.x) && p.y >= a.y.min(b.y) && p.y <= a.y.max(b.y),
@@ -412,6 +444,9 @@ fn in_frame(frame: &[Vec2], p: Vec2) -> bool {
             let mut j = f.len() - 1;
             for i in 0..f.len() {
                 let (Some(pi), Some(pj)) = (f.get(i), f.get(j)) else { break };
+                if segment_dist(*pj, *pi, p) <= 1e-9 * pi.dist(*pj) {
+                    return true;
+                }
                 if (pi.y > p.y) != (pj.y > p.y) && p.x < (pj.x - pi.x) * (p.y - pi.y) / (pj.y - pi.y) + pi.x {
                     inside = !inside;
                 }
@@ -464,7 +499,10 @@ fn apply(
                 _ => 0.0,
             })
         };
-        let mult = if mult == 0.0 { 1.0 } else { mult };
+        // A zero multiplier would move nothing. AutoCAD 2024 moves such an action by the
+        // parameter's change and leaves its angle offset out (measured on a stretch action written
+        // with multiplier 0, angle offset 1 and group 280 = 1).
+        let (mult, angle) = if mult == 0.0 { (1.0, 0.0) } else { (mult, angle) };
         let v = Vec2::new(comp(0), comp(1)).rotate(angle) * mult;
         if !(v.x.is_finite() && v.y.is_finite()) || (v.x == 0.0 && v.y == 0.0) {
             continue;
@@ -473,6 +511,8 @@ fn apply(
         // this action's selection, so a selection that repeats a handle does not re-scan the
         // vertex list and re-clone its index vector per occurrence (CWE-400).
         let vtx_by_handle: HashMap<Handle, &Vec<i32>> = vertices.iter().rev().map(|(vh, i)| (*vh, i)).collect();
+        // Whether the frame (two corners or a polygon) is tested point by point.
+        let framed = (2..=MAX_FRAME_POINTS).contains(&frame.len());
         let mut handled: HashSet<Handle> = HashSet::new();
         for h in &a.selection {
             if !handled.insert(*h) {
@@ -502,7 +542,18 @@ fn apply(
                 continue;
             }
             let Some(c) = copy_of(h) else { continue };
-            let idx = vtx_by_handle.get(h).map(|i| (*i).clone());
+            // The points of a line or polyline that move are those inside the frame where the
+            // dynamic block has them, all of them when none is, as AutoCAD 2024 moves them. It
+            // doesn't go by the vertex lists the action stores, which a block from another program
+            // can get wrong. A polyline's vertices are in its own plane: in the block's when its
+            // extrusion is exactly along z (a mirrored one is read flipped into it). Any tilt, however
+            // small, moves them by as much as the elevation times the tilt, so a tilted one keeps the
+            // stored list.
+            let idx = match def.entities.get(*h).map(|e| (&e.kind, e.common.extrusion)) {
+                Some((EntityKind::Line(l), _)) if framed => inside(frame, [l.a.xy(), l.b.xy()].into_iter()),
+                Some((EntityKind::LwPolyline(pl), n)) if framed && n.x == 0.0 && n.y == 0.0 => inside(frame, pl.vertices.iter().map(|v| v.p)),
+                _ => vtx_by_handle.get(h).map(|i| (*i).clone()),
+            };
             moves.entry(c).or_default().push((idx, v));
         }
     }
@@ -649,19 +700,33 @@ fn refill_hatches(b: &mut Block) {
 
 /// The value records of the references to the dynamic block whose record is `def_record` (from
 /// any one of them, by graph id): AutoCAD's layout of each record, class ids included.
+///
+/// Each record is copied once at most: a key naming a record an earlier key already took is
+/// skipped. Records are copied per key (and copied again per key when a new reference's data is
+/// made), so a file listing one large record under many keys would otherwise multiply its size by
+/// the key count (CWE-400); AutoCAD gives every key its own record.
 fn templates(d: &Drawing, def_record: Handle) -> HashMap<String, Vec<RawTag>> {
     let objects: HashMap<Handle, &ForeignObject> = d.foreign.objects.iter().map(|o| (o.handle, o)).collect();
+    // Dictionary entries looked up through the index, not by scanning every object per
+    // dictionary (which is quadratic in the object count).
+    let entry = |dict: Handle, key: &str| objects.get(&dict).and_then(|o| dictionary_entry(o, key));
     let mut out: HashMap<String, Vec<RawTag>> = HashMap::new();
+    let mut taken: HashSet<Handle> = HashSet::new();
     for rep in d.foreign.objects.iter().filter(|o| o.kind.eq_ignore_ascii_case("DICTIONARY")) {
         // A representation dictionary whose data names this dynamic block.
-        let Some(rd) = entry(d, rep.handle, "AcDbRepData").and_then(|h| objects.get(&h)) else { continue };
+        let Some(rd) = dictionary_entry(rep, "AcDbRepData").and_then(|h| objects.get(&h)) else { continue };
         if !rd.tags.iter().any(|t| t.code == 340 && Handle::parse_hex(&t.value) == Some(def_record)) {
             continue;
         }
-        let Some(values) = entry(d, rep.handle, "AppDataCache").and_then(|c| entry(d, c, "ACAD_ENHANCEDBLOCKDATA")) else { continue };
-        for (k, h) in entries(d, values) {
+        let Some(values) = dictionary_entry(rep, "AppDataCache").and_then(|c| entry(c, "ACAD_ENHANCEDBLOCKDATA")) else { continue };
+        let Some(values) = objects.get(&values) else { continue };
+        for (k, h) in dictionary_entries(values) {
+            if out.contains_key(&k) || taken.contains(&h) {
+                continue;
+            }
             if let Some(x) = objects.get(&h).filter(|x| x.kind.eq_ignore_ascii_case("XRECORD")) {
-                out.entry(k).or_insert_with(|| x.tags.clone());
+                taken.insert(h);
+                out.insert(k, x.tags.clone());
             }
         }
     }
@@ -1001,4 +1066,23 @@ mod tests {
         assert_eq!(by_tag(&d, &def), vec![(10, Handle(1)), (20, Handle(2))]);
         assert_eq!(by_tag(&d, &anon), vec![(20, Handle(5)), (1_000_001, Handle(6))]);
     }
+
+    #[test]
+    fn a_value_record_listed_under_many_keys_is_copied_once() {
+        // One large XRECORD named by many keys of a reference's value dictionary: the templates
+        // keep one copy, not one per key.
+        let mut d = Drawing::new_imperial();
+        let (def_record, rep, rd, cache, values, record) = (Handle(0x10), Handle(0x20), Handle(0x21), Handle(0x22), Handle(0x23), Handle(0x24));
+        let keys: Vec<String> = (0..1000).map(|i| i.to_string()).collect();
+        let entries: Vec<(&str, Handle)> = keys.iter().map(|k| (k.as_str(), record)).collect();
+        let f = std::sync::Arc::make_mut(&mut d.foreign);
+        f.objects.push(dictionary(rep, Handle(1), &[("AcDbRepData", rd), ("AppDataCache", cache)]));
+        f.objects.push(ForeignObject { handle: rd, kind: "ACDB_BLOCKREPRESENTATION_DATA".into(), tags: vec![tag(340, def_record.hex())] });
+        f.objects.push(dictionary(cache, rep, &[("ACAD_ENHANCEDBLOCKDATA", values)]));
+        f.objects.push(dictionary(values, cache, &entries));
+        f.objects.push(ForeignObject { handle: record, kind: "XRECORD".into(), tags: (0..1000).map(|_| tag(1, "x")).collect() });
+        let t = templates(&d, def_record);
+        assert_eq!(t.len(), 1, "one record, one template");
+        assert_eq!(t.get("0").map(Vec::len), Some(1000));
+    }
 }

crates/doc/src/entity.rs

@@ -44,14 +44,16 @@ mod dim;
 mod fill;
 mod layout;
 mod text;
+mod wipeout;
 
 pub use block::{Attrib, AttribModes, AttribProps, Insert, MultilineAttrib, mtext_literal};
 pub use common::{Common, Handle, Lineweight, RawTag, Transparency};
-pub use curves::{Arc, Circle, Ellipse, Face3d, Line, LwPolyline, Point, Polyline3d, RayLine, Solid};
+pub use curves::{Arc, Circle, Ellipse, Face3d, Line, LwPolyline, Point, PolyfaceMesh, Polyline3d, RayLine, Solid};
 pub use dim::{AssocSnap, DimAssoc, DimBreak, DimKind, DimMarks, Dimension, Inspection, JoggedRadius, Leader, MLeader};
-pub use fill::{Gradient, Hatch, HatchLoop, Wipeout};
+pub use fill::{Gradient, Hatch, HatchLoop};
 pub use layout::{Image, Table, TableCell, Viewport};
 pub use text::{HAlign, MText, MTextColumnType, MTextColumns, Text, VAlign};
+pub use wipeout::Wipeout;
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Unknown {
     pub dxf_type: String,
@@ -84,6 +86,7 @@ pub enum EntityKind {
     Solid(Solid),
     Trace(Solid),
     Face3d(Face3d),
+    PolyfaceMesh(PolyfaceMesh),
     Region(Region),
     Viewport(Viewport),
     Image(Image),
@@ -138,6 +141,7 @@ impl EntityKind {
             EntityKind::Solid(_) => "2D Solid",
             EntityKind::Trace(_) => "Trace",
             EntityKind::Face3d(_) => "3D Face",
+            EntityKind::PolyfaceMesh(_) => "Polyface Mesh",
             EntityKind::Region(_) => "Region",
             EntityKind::Viewport(_) => "Viewport",
             EntityKind::Image(_) => "Raster Image",
@@ -173,6 +177,7 @@ impl EntityKind {
             EntityKind::Solid(_) => "SOLID",
             EntityKind::Trace(_) => "TRACE",
             EntityKind::Face3d(_) => "3DFACE",
+            EntityKind::PolyfaceMesh(_) => "POLYLINE",
             EntityKind::Region(_) => "REGION",
             EntityKind::Viewport(_) => "VIEWPORT",
             EntityKind::Image(_) => "IMAGE",
@@ -216,21 +221,17 @@ impl EntityKind {
                 let c = &s.corners;
                 vec![Prim::Fill(vec![c[0].xy(), c[1].xy(), c[3].xy(), c[2].xy()])]
             }
-            EntityKind::Face3d(f) => {
-                let c = &f.corners;
-                let pts = [c[0].xy(), c[1].xy(), c[2].xy(), c[3].xy(), c[0].xy()];
-                pts.windows(2).filter_map(|w| Some(Prim::Seg(Segment::Line(GLine::new(*w.first()?, *w.get(1)?))))).collect()
+            EntityKind::Face3d(f) => f.visible_edges().into_iter().map(|(a, b)| Prim::Seg(Segment::Line(GLine::new(a.xy(), b.xy())))).collect(),
+            // Each face's visible edges (an edge flagged hidden, by a negative index, isn't drawn).
+            EntityKind::PolyfaceMesh(m) => {
+                m.faces3d().iter().flat_map(Face3d::visible_edges).map(|(a, b)| Prim::Seg(Segment::Line(GLine::new(a.xy(), b.xy())))).collect()
             }
             EntityKind::Region(r) => r.segments().into_iter().map(Prim::Seg).collect(),
             EntityKind::Hatch(h) => {
                 h.loops.iter().flat_map(|l| Polyline { vertices: l.vertices.clone(), closed: true }.segments()).map(Prim::Seg).collect()
             }
             EntityKind::Wipeout(w) => {
-                let mut pts = w.boundary.clone();
-                if let Some(f) = pts.first().copied() {
-                    pts.push(f);
-                }
-                pts.windows(2).filter_map(|w| Some(Prim::Seg(Segment::Line(GLine::new(*w.first()?, *w.get(1)?))))).collect()
+                w.closed_boundary().windows(2).filter_map(|w| Some(Prim::Seg(Segment::Line(GLine::new(*w.first()?, *w.get(1)?))))).collect()
             }
             EntityKind::Viewport(v) => {
                 let c = v.center.xy();
@@ -361,9 +362,13 @@ impl EntityKind {
                 i.scale.y *= s;
                 i.scale.z *= s;
                 i.rotation = cadcraft_geom::norm_angle(i.rotation + rot);
+                // Mirrored as AutoCAD 2024 mirrors a block reference: the X scale factor
+                // negated, the rotation 180 degrees plus twice the mirror line's angle less the
+                // old one, and a MINSERT grid's columns running the other way.
                 if mirror {
-                    i.scale.y = -i.scale.y;
-                    i.rotation = cadcraft_geom::norm_angle(rot - (i.rotation - rot));
+                    i.scale.x = -i.scale.x;
+                    i.rotation = cadcraft_geom::norm_angle(std::f64::consts::PI + rot - (i.rotation - rot));
+                    i.col_spacing = -i.col_spacing;
                 }
                 for a in &mut i.attribs {
                     transform_text(&mut a.text, m, s, rot, false);
@@ -426,6 +431,7 @@ impl EntityKind {
             }
             EntityKind::Solid(so) | EntityKind::Trace(so) => so.corners.iter_mut().for_each(t3),
             EntityKind::Face3d(f) => f.corners.iter_mut().for_each(t3),
+            EntityKind::PolyfaceMesh(pm) => pm.vertices.iter_mut().for_each(t3),
             EntityKind::Region(r) => {
                 for v in r.loops.iter_mut().flat_map(|l| l.vertices.iter_mut()) {
                     v.p = m.apply(v.p);
@@ -467,6 +473,92 @@ impl EntityKind {
         }
     }
 
+    /// Scale every height of the object by `f` about the height `base_z`: the Z of its points,
+    /// its elevation. With [`EntityKind::transform`] scaling about the base point's XY this is a
+    /// uniform 3D scale about the base point, as AutoCAD 2024's SCALE makes it. Sizes `transform`
+    /// already scales (text and helix heights, an insert's Z scale) are left alone; splines,
+    /// regions and wipeouts lie in the XY plane.
+    pub fn scale_heights(&mut self, base_z: f64, f: f64) {
+        let scale = |h: &mut f64| *h = base_z + (*h - base_z) * f;
+        let z = |p: &mut Vec3| scale(&mut p.z);
+        let text_z = |t: &mut Text| {
+            z(&mut t.insert);
+            if let Some(a) = &mut t.align_pt {
+                z(a);
+            }
+        };
+        let attribs_z = |attribs: &mut Vec<Attrib>| {
+            for a in attribs {
+                text_z(&mut a.text);
+                if let Some(ml) = &mut a.multiline {
+                    z(&mut ml.mtext.insert);
+                }
+            }
+        };
+        match self {
+            EntityKind::Line(l) => {
+                z(&mut l.a);
+                z(&mut l.b);
+            }
+            EntityKind::Point(p) => z(&mut p.p),
+            EntityKind::Circle(c) => z(&mut c.center),
+            EntityKind::Arc(a) => z(&mut a.center),
+            EntityKind::Ellipse(e) => z(&mut e.center),
+            EntityKind::LwPolyline(p) => scale(&mut p.elevation),
+            EntityKind::Polyline3d(p) => p.points.iter_mut().for_each(z),
+            EntityKind::Helix(h) => z(&mut h.center),
+            EntityKind::Ray(r) | EntityKind::XLine(r) => z(&mut r.base),
+            EntityKind::Text(t) => text_z(t),
+            EntityKind::AttDef(a) => {
+                text_z(&mut a.text);
+                if let Some(ml) = &mut a.multiline {
+                    z(&mut ml.mtext.insert);
+                }
+            }
+            EntityKind::MText(t) => z(&mut t.insert),
+            EntityKind::Insert(i) => {
+                z(&mut i.insert);
+                attribs_z(&mut i.attribs);
+            }
+            EntityKind::Dimension(d) => {
+                for p in [&mut d.defpt, &mut d.text_mid, &mut d.p13, &mut d.p14, &mut d.p15, &mut d.p16] {
+                    z(p);
+                }
+                if let Some(j) = &mut d.marks.jog_line {
+                    z(j);
+                }
+                if let Some(j) = &mut d.marks.jogged {
+                    z(&mut j.center);
+                    z(&mut j.jog);
+                }
+                d.marks.breaks.iter_mut().for_each(|b| z(&mut b.at));
+                d.block = None;
+            }
+            EntityKind::MLine(ml) => ml.vertices.iter_mut().for_each(|v| z(&mut v.p)),
+            EntityKind::Leader(l) => l.vertices.iter_mut().for_each(z),
+            EntityKind::MLeader(ml) => {
+                ml.leaders.iter_mut().flatten().for_each(z);
+                z(&mut ml.landing);
+                if let Some(t) = &mut ml.text {
+                    z(&mut t.insert);
+                }
+                if let Some(b) = &mut ml.block {
+                    z(&mut b.insert);
+                    attribs_z(&mut b.attribs);
+                }
+            }
+            EntityKind::Hatch(h) => scale(&mut h.elevation),
+            EntityKind::Solid(so) | EntityKind::Trace(so) => so.corners.iter_mut().for_each(z),
+            EntityKind::Face3d(fc) => fc.corners.iter_mut().for_each(z),
+            EntityKind::PolyfaceMesh(m) => m.vertices.iter_mut().for_each(z),
+            EntityKind::Viewport(v) => z(&mut v.center),
+            EntityKind::Image(i) => z(&mut i.insert),
+            EntityKind::Table(t) => z(&mut t.insert),
+            EntityKind::Tolerance(t) => z(&mut t.insert),
+            EntityKind::Spline(_) | EntityKind::Region(_) | EntityKind::Wipeout(_) | EntityKind::Unknown(_) => {}
+        }
+    }
+
     /// Grip points (editable defining points), in display order.
     pub fn grips(&self) -> Vec<Vec2> {
         // A broken table has a grip for each part.
@@ -528,6 +620,7 @@ impl EntityKind {
             }
             EntityKind::Solid(s) | EntityKind::Trace(s) => s.corners.iter().map(|c| c.xy()).collect(),
             EntityKind::Face3d(f) => f.corners.iter().map(|c| c.xy()).collect(),
+            EntityKind::PolyfaceMesh(m) => m.vertices.iter().map(|v| v.xy()).collect(),
             EntityKind::Region(r) => vec![r.bounds().center()],
             EntityKind::Viewport(v) => {
                 let c = v.center.xy();
@@ -535,7 +628,7 @@ impl EntityKind {
                 Bounds2::new(c - h, c + h).corners().to_vec()
             }
             EntityKind::Image(i) => vec![i.insert.xy()],
-            EntityKind::Wipeout(w) => w.boundary.clone(),
+            EntityKind::Wipeout(w) => w.vertices().to_vec(),
             EntityKind::Table(t) => vec![t.insert.xy()],
             EntityKind::Tolerance(t) => vec![t.insert.xy()],
             EntityKind::Unknown(_) => Vec::new(),

crates/doc/src/entity/block.rs

@@ -1,6 +1,6 @@
 use super::common::{Common, Lineweight};
 use super::text::{MText, Text};
-use super::*;
+use super::{Color, Deserialize, EntityKind, Mat3, Serialize, Vec2, Vec3};
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]

crates/doc/src/entity/common.rs

@@ -1,4 +1,4 @@
-use super::*;
+use super::{Color, Deserialize, Serialize, Vec3};
 
 /// A database handle (DXF group 5), unique per drawing.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
@@ -130,3 +130,20 @@ pub struct RawTag {
     pub code: i32,
     pub value: String,
 }
+
+impl Common {
+    /// Whether "Match orientation to layout" is on for this annotative object (AutoCAD's
+    /// `AcadAnnoPO` xdata = 1). AutoCAD draws such text upright and ignores its stored rotation.
+    /// The object's own `AcadAnnotative` xdata never reaches [`Common::xdata`] (the reader drops
+    /// it), so the `AcadAnnoPO` flag alone decides.
+    pub fn matches_layout_orientation(&self) -> bool {
+        let app = self.xdata.iter().position(|t| t.code == 1001 && t.value.trim().eq_ignore_ascii_case("AcadAnnoPO"));
+        let Some(at) = app else { return false };
+        self.xdata
+            .iter()
+            .skip(at + 1)
+            .take_while(|t| t.code != 1001)
+            .find(|t| t.code == 1070)
+            .is_some_and(|t| t.value.trim().parse::<i64>().is_ok_and(|v| v != 0))
+    }
+}

crates/doc/src/entity/curves.rs

@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, PolyVertex, Serialize, Vec3};
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Line {
@@ -69,6 +69,52 @@ pub struct Face3d {
     pub hidden_edges: u8,
 }
 
+impl Face3d {
+    /// The edges drawn: side i (corner i to the next) unless bit i of `hidden_edges` hides it,
+    /// without the zero-length side of a triangle.
+    pub fn visible_edges(&self) -> Vec<(Vec3, Vec3)> {
+        let c = self.corners;
+        (0..4).filter(|i| self.hidden_edges & (1 << i) == 0).map(|i| (c[i], c[(i + 1) % 4])).filter(|(a, b)| a != b).collect()
+    }
+}
+
+/// POLYLINE polyface mesh (DXF flag 64): its vertices, and faces naming three or four of them
+/// by 1-based index as DXF stores them (0: no fourth vertex; a negative index hides the edge
+/// that starts at that vertex).
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct PolyfaceMesh {
+    pub vertices: Vec<Vec3>,
+    pub faces: Vec<[i32; 4]>,
+}
+
+impl PolyfaceMesh {
+    /// The faces as 3D faces (what EXPLODE makes). Faces with fewer than three vertices or an
+    /// index outside the vertex list are skipped.
+    pub fn faces3d(&self) -> Vec<Face3d> {
+        self.faces.iter().filter_map(|f| self.face3d(f)).collect()
+    }
+    /// One face record as a 3D face: `None` when it names fewer than three vertices before a 0,
+    /// or one outside the vertex list.
+    pub fn face3d(&self, f: &[i32; 4]) -> Option<Face3d> {
+        let mut corners: Vec<Vec3> = Vec::with_capacity(4);
+        let mut hidden = 0u8;
+        for &ix in f.iter().take_while(|&&ix| ix != 0) {
+            let at = usize::try_from(ix.unsigned_abs()).ok().and_then(|n| n.checked_sub(1));
+            let p = *at.and_then(|n| self.vertices.get(n))?;
+            if ix < 0 {
+                hidden |= 1 << corners.len();
+            }
+            corners.push(p);
+        }
+        match corners.as_slice() {
+            // A triangle's closing edge is the 3DFACE's fourth (the third is degenerate).
+            [a, b, c] => Some(Face3d { corners: [*a, *b, *c, *c], hidden_edges: hidden | if hidden & 4 != 0 { 8 } else { 0 } }),
+            [a, b, c, d] => Some(Face3d { corners: [*a, *b, *c, *d], hidden_edges: hidden }),
+            _ => None,
+        }
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct RayLine {
     pub base: Vec3,

crates/doc/src/entity/dim.rs

@@ -1,7 +1,7 @@
 use super::block::Insert;
 use super::common::Handle;
 use super::text::MText;
-use super::*;
+use super::{Deserialize, GSpline, Serialize, Vec2, Vec3, one, standard, yes};
 
 #[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -52,6 +52,11 @@ pub struct Dimension {
     /// Anonymous block with the rendered geometry (from files); regenerated when edited.
     #[serde(default)]
     pub block: Option<String>,
+    /// Insertion point (DXF group 12): a dimension moved by an older AutoCAD keeps its offset
+    /// here with the `*D` block's contents left where they were, and is drawn translated by it.
+    /// Zero once the geometry is regenerated from the definition points.
+    #[serde(default)]
+    pub insertion_point: Vec3,
     /// Per-dimension style overrides (DIMOVERRIDE): DimStyle field names (camelCase) → values,
     /// merged over the named style.
     #[serde(default, skip_serializing_if = "serde_json::Map::is_empty")]
@@ -92,7 +97,7 @@ impl DimMarks {
         *self == DimMarks::default()
     }
 
-    /// Transform the points and angles (part of [`EntityKind::transform`]).
+    /// Transform the points and angles (part of [`super::EntityKind::transform`]).
     pub(super) fn transform(&mut self, t3: &dyn Fn(&mut Vec3), rot: f64, s: f64, mirror: bool) {
         if let Some(a) = &mut self.oblique {
             *a = cadcraft_geom::norm_angle(if mirror { rot - (*a - rot) } else { *a + rot });

crates/doc/src/entity/fill.rs

@@ -1,5 +1,5 @@
 use super::common::Handle;
-use super::*;
+use super::{Color, Deserialize, PolyVertex, Serialize, Vec2, one};
 
 /// A hatch boundary loop: closed polyline with bulges.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -54,8 +54,3 @@ pub struct Gradient {
     #[serde(default)]
     pub centered: bool,
 }
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Wipeout {
-    pub boundary: Vec<Vec2>,
-}

crates/doc/src/entity/layout.rs

@@ -1,5 +1,5 @@
 use super::common::Handle;
-use super::*;
+use super::{Color, Deserialize, Serialize, Vec2, Vec3, standard, yes};
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]

crates/doc/src/entity/mline.rs

@@ -207,6 +207,41 @@ pub struct MLineGeometry {
     pub fill: Vec<Vec<Vec2>>,
 }
 
+/// For each segment direction in `dirs`, the first non-zero direction at or after it and the
+/// first at or before it, both wrapping around (`Vec2::X` when every direction is zero).
+///
+/// Two linear passes: searching from every segment separately is quadratic in a run of
+/// coincident vertices, which a hostile file can make as long as it likes (CWE-407).
+fn usable_directions(dirs: &[Vec2]) -> (Vec<Vec2>, Vec<Vec2>) {
+    let n = dirs.len();
+    let (Some(first), Some(last)) = (dirs.iter().position(|d| *d != Vec2::ZERO), dirs.iter().rposition(|d| *d != Vec2::ZERO)) else {
+        return (vec![Vec2::X; n], vec![Vec2::X; n]);
+    };
+    let (mut ahead, mut behind) = (vec![Vec2::X; n], vec![Vec2::X; n]);
+    // Walking backwards from the last usable direction, the latest one seen is the next ahead.
+    let mut cur = Vec2::X;
+    for k in 0..n {
+        let i = (last + n - k) % n;
+        if let Some(d) = dirs.get(i).filter(|d| **d != Vec2::ZERO) {
+            cur = *d;
+        }
+        if let Some(a) = ahead.get_mut(i) {
+            *a = cur;
+        }
+    }
+    // Walking forwards from the first usable direction, the latest one seen is the nearest behind.
+    for k in 0..n {
+        let i = (first + k) % n;
+        if let Some(d) = dirs.get(i).filter(|d| **d != Vec2::ZERO) {
+            cur = *d;
+        }
+        if let Some(b) = behind.get_mut(i) {
+            *b = cur;
+        }
+    }
+    (ahead, behind)
+}
+
 impl MLine {
     /// A multiline through `pts` in style `def`.
     pub fn new(def: &MLineStyle, pts: &[Vec2], closed: bool, just: MLineJust, scale: f64) -> MLine {
@@ -268,16 +303,11 @@ impl MLine {
         let dirs = self.directions();
         let n = self.vertices.len();
         let nseg = dirs.len();
-        // A degenerate segment takes its neighbour's direction.
-        let dir = |i: usize| -> Vec2 {
-            (0..nseg).map(|k| dirs.get((i + k) % nseg.max(1)).copied().unwrap_or_default()).find(|d| *d != Vec2::ZERO).unwrap_or(Vec2::X)
-        };
-        let dir_back = |i: usize| -> Vec2 {
-            (0..nseg)
-                .map(|k| dirs.get((i + nseg - k % nseg) % nseg.max(1)).copied().unwrap_or_default())
-                .find(|d| *d != Vec2::ZERO)
-                .unwrap_or(Vec2::X)
-        };
+        // A degenerate segment takes its neighbour's direction: the first usable one at or after
+        // it (`ahead`), or at or before it (`behind`), wrapping around.
+        let (ahead, behind) = usable_directions(&dirs);
+        let dir = |i: usize| -> Vec2 { ahead.get(i).copied().unwrap_or(Vec2::X) };
+        let dir_back = |i: usize| -> Vec2 { behind.get(i).copied().unwrap_or(Vec2::X) };
         let end = |d: Vec2, angle: f64| {
             let u = d.rotate(angle);
             let s = angle.sin();
@@ -426,3 +456,61 @@ impl crate::Drawing {
         self.mline_style(&name).or_else(|| self.mline_style(STANDARD_MLINE_STYLE)).cloned().unwrap_or_default()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The nearest usable directions found by searching from each segment, as miters did before.
+    fn searched(dirs: &[Vec2]) -> (Vec<Vec2>, Vec<Vec2>) {
+        let n = dirs.len();
+        let ahead = (0..n).map(|i| (0..n).filter_map(|k| dirs.get((i + k) % n).copied()).find(|d| *d != Vec2::ZERO).unwrap_or(Vec2::X));
+        let behind = (0..n).map(|i| (0..n).filter_map(|k| dirs.get((i + n - k) % n).copied()).find(|d| *d != Vec2::ZERO).unwrap_or(Vec2::X));
+        (ahead.collect(), behind.collect())
+    }
+
+    #[test]
+    fn usable_directions_match_a_search_from_each_segment() {
+        let (z, a, b, c) = (Vec2::ZERO, Vec2::Y, -Vec2::X, Vec2::new(0.6, 0.8));
+        for dirs in [
+            vec![],
+            vec![z],
+            vec![a],
+            vec![z, z, z],
+            vec![a, z, z, b],
+            vec![z, a, z, b, z],
+            vec![z, z, c],
+            vec![c, z, z],
+            vec![a, b, c],
+            vec![z, a, z, z, b, c, z],
+        ] {
+            assert_eq!(usable_directions(&dirs), searched(&dirs), "{dirs:?}");
+        }
+    }
+
+    #[test]
+    fn coincident_vertices_at_a_corner_take_the_corner_miter() {
+        // Every vertex of a run on one point mitres between the segment before the run and the one after.
+        let style = MLineStyle::default();
+        let corner = MLine::new(&style, &[Vec2::ZERO, Vec2::Y, Vec2::new(-1.0, 1.0)], false, MLineJust::Zero, 1.0);
+        let pts = [Vec2::ZERO, Vec2::Y, Vec2::Y, Vec2::Y, Vec2::new(-1.0, 1.0)];
+        let run = MLine::new(&style, &pts, false, MLineJust::Zero, 1.0);
+        let (expected, got) = (corner.miters(), run.miters());
+        assert_eq!(got.get(1..4), Some(&[expected[1]; 3][..]));
+        assert_eq!((got.first(), got.last()), (expected.first(), expected.last()));
+    }
+
+    #[test]
+    fn a_long_run_of_coincident_vertices_takes_linear_time() {
+        // 200 000 vertices on one point but the last: the miters must not search the run once per
+        // vertex (quadratic, minutes) to find the one usable direction.
+        let mut pts = vec![Vec2::ZERO; 200_000];
+        pts.push(Vec2::new(1.0, 0.0));
+        let m = MLine::new(&MLineStyle::default(), &pts, false, MLineJust::Zero, 1.0);
+        let t = std::time::Instant::now();
+        let miters = m.miters();
+        assert_eq!(miters.len(), pts.len());
+        assert!(miters.iter().all(|v| v.is_finite()));
+        assert!(t.elapsed() < std::time::Duration::from_secs(5), "{:?}", t.elapsed());
+    }
+}

crates/doc/src/entity/region.rs

@@ -9,6 +9,9 @@ use super::HatchLoop;
 /// Most loops one region has (hostile files and edits).
 pub const MAX_REGION_LOOPS: usize = 10_000;
 
+/// Most polygon edges [`Region::renest`] tests, over all its point-in-loop tests.
+pub const MAX_RENEST_EDGE_VISITS: usize = 50_000_000;
+
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
 pub struct Region {
     /// Closed loops with bulges; `outer` false for islands.
@@ -76,20 +79,49 @@ impl Region {
     }
 
     /// Set each loop's `outer` flag from how deeply other loops enclose it: an even depth is
-    /// an outer loop, odd an island.
-    pub fn renest(&mut self) {
+    /// an outer loop, odd an island. `false`, with the flags left as they were, when that takes
+    /// more than [`MAX_RENEST_EDGE_VISITS`] polygon edge tests.
+    #[must_use]
+    pub fn renest(&mut self) -> bool {
         let polys = self.tessellate(self.fine_tol());
-        let depth: Vec<usize> = polys
+        // A loop's probe can only be inside loops whose box holds it: test only those. A box with
+        // a non-finite corner says nothing (an edge through a non-finite point never counts, so
+        // such a polygon need not be closed), so its loop is always tested.
+        let boxes: Vec<Option<Bounds2>> = polys
             .iter()
-            .enumerate()
-            .map(|(i, l)| {
-                let Some(p) = probe(l) else { return 0 };
-                polys.iter().enumerate().filter(|(j, o)| *j != i && point_in_polygon(o, p)).count()
+            .map(|l| {
+                let b = Bounds2::from_points(l.iter().copied());
+                (l.iter().all(|p| p.is_finite()) && b.min.is_finite() && b.max.is_finite()).then_some(b)
             })
             .collect();
+        let mut visits = 0usize;
+        let mut depth = Vec::with_capacity(polys.len());
+        for (i, l) in polys.iter().enumerate() {
+            let Some(p) = probe(l) else {
+                depth.push(0);
+                continue;
+            };
+            let mut d = 0;
+            for (j, (o, b)) in polys.iter().zip(&boxes).enumerate() {
+                if j == i || b.is_some_and(|b| !b.contains(p)) {
+                    continue;
+                }
+                // Each loop against every other is loops x vertices: bounded so a region of many
+                // large nested loops cannot hold the thread (CWE-407).
+                visits = visits.saturating_add(o.len());
+                if visits > MAX_RENEST_EDGE_VISITS {
+                    return false;
+                }
+                if point_in_polygon(o, p) {
+                    d += 1;
+                }
+            }
+            depth.push(d);
+        }
         for (l, d) in self.loops.iter_mut().zip(depth) {
             l.outer = d % 2 == 0;
         }
+        true
     }
 
     /// Area, perimeter, bounding box, centroid and second moments (outer loops counted
@@ -128,3 +160,37 @@ fn probe(l: &[Vec2]) -> Option<Vec2> {
         (a.dist(b) > 1e-12).then(|| (a + b) * 0.5).filter(|m| m.is_finite())
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn square(c: f64, half: f64, n: usize, outer: bool) -> HatchLoop {
+        // `n` vertices along the bottom edge, then the other three corners.
+        let mut vertices: Vec<PolyVertex> =
+            (0..n).map(|k| PolyVertex::new(Vec2::new(c - half + 2.0 * half * k as f64 / n as f64, c - half))).collect();
+        vertices.extend([Vec2::new(c + half, c - half), Vec2::new(c + half, c + half), Vec2::new(c - half, c + half)].map(PolyVertex::new));
+        HatchLoop { vertices, outer, sources: Vec::new() }
+    }
+
+    #[test]
+    fn renest_sets_depth_parity_and_skips_loops_far_away() {
+        // Three nested squares, and one beside them.
+        let mut r =
+            Region { loops: vec![square(0.0, 3.0, 1, false), square(0.0, 2.0, 1, false), square(0.0, 1.0, 1, false), square(10.0, 1.0, 1, false)] };
+        assert!(r.renest());
+        assert_eq!(r.loops.iter().map(|l| l.outer).collect::<Vec<_>>(), [true, false, true, true]);
+    }
+
+    #[test]
+    fn renest_of_many_large_nested_loops_stops_at_its_budget() {
+        // Concentric loops of many vertices each: each probe is inside the box of every larger
+        // loop (about loops² / 2 pairs), so each of those tests is a full polygon scan.
+        let loops = 300;
+        let n = 3 * MAX_RENEST_EDGE_VISITS / (loops * loops);
+        let mut r = Region { loops: (0..loops).map(|i| square(0.0, 1.0 + i as f64, n, false)).collect() };
+        let before = r.clone();
+        assert!(!r.renest());
+        assert_eq!(r, before, "flags left as they were");
+    }
+}

crates/doc/src/entity/text.rs

@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Serialize, Vec2, Vec3, one, standard};
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]

crates/doc/src/entity/wipeout.rs

@@ -0,0 +1,162 @@
+//! WIPEOUT is always a closed masking polygon, unlike a polyline with an open/closed flag.
+//! One exact terminal copy of the first point is a closure marker, not an editable corner.
+//! Preserve logical corners when editing, adding a separate marker if the endpoints meet.
+//! Grips, edits and explicit outlines share this rule; other duplicates are not simplified.
+
+use std::borrow::Cow;
+
+use cadcraft_geom::Vec2;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Wipeout {
+    /// Ordered boundary, implicitly closed or ending in a repeated first point.
+    pub boundary: Vec<Vec2>,
+}
+
+impl Wipeout {
+    /// Editable vertices, excluding one exactly repeated closing point, without changing storage.
+    pub fn vertices(&self) -> &[Vec2] {
+        match self.boundary.split_last() {
+            Some((last, vertices)) if vertices.first() == Some(last) => vertices,
+            _ => &self.boundary,
+        }
+    }
+
+    /// An explicitly closed outline for geometry, rendering and export. Already closed or
+    /// empty/single-point boundaries are borrowed; otherwise one closing point is appended.
+    pub fn closed_boundary(&self) -> Cow<'_, [Vec2]> {
+        if self.vertices().len() < self.boundary.len() || self.boundary.len() < 2 {
+            Cow::Borrowed(&self.boundary)
+        } else {
+            let mut points = self.boundary.clone();
+            points.extend(self.boundary.first());
+            Cow::Owned(points)
+        }
+    }
+
+    /// Move an editable vertex, carrying an existing closing marker with vertex zero. If an
+    /// implicit boundary's endpoints meet, add a marker so both corners remain addressable.
+    /// Invalid indices/non-finite points leave the boundary unchanged.
+    pub fn set_vertex(&mut self, index: usize, to: Vec2) -> Option<()> {
+        let count = self.vertices().len();
+        if index >= count || !to.is_finite() {
+            return None;
+        }
+        let explicit = count < self.boundary.len();
+        *self.boundary.get_mut(index)? = to;
+        if explicit
+            && index == 0
+            && let Some(last) = self.boundary.last_mut()
+        {
+            *last = to;
+        }
+        if !explicit && self.vertices().len() < count {
+            // The moved endpoint is a logical corner, not the newly implied closing marker.
+            if let Some(first) = self.boundary.first().copied() {
+                self.boundary.push(first);
+            }
+        }
+        Some(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::EntityKind;
+
+    #[test]
+    fn vertices_and_grips_exclude_only_the_exact_closing_point() {
+        let (a, b, c) = (Vec2::ZERO, Vec2::new(7.0, 1.0), Vec2::new(3.0, 7.0));
+        let near_a = Vec2::new(1e-13, 0.0);
+        for (boundary, expected) in [
+            (vec![], vec![]),
+            (vec![a], vec![a]),
+            (vec![a, a], vec![a]),
+            (vec![a, b, c], vec![a, b, c]),
+            (vec![a, b, c, a], vec![a, b, c]),
+            (vec![a, b, a, c, a], vec![a, b, a, c]),
+            (vec![a, b, c, a, a], vec![a, b, c, a]),
+            (vec![a, b, c, near_a], vec![a, b, c, near_a]),
+        ] {
+            let wipeout = Wipeout { boundary: boundary.clone() };
+            assert_eq!(wipeout.vertices(), expected);
+            assert_eq!(EntityKind::Wipeout(wipeout.clone()).grips(), expected);
+            assert_eq!(wipeout.boundary, boundary);
+        }
+    }
+
+    #[test]
+    fn explicit_outline_is_stable_and_does_not_add_zero_length_closing_edges() {
+        let points = vec![Vec2::ZERO, Vec2::new(7.0, 1.0), Vec2::new(3.0, 7.0)];
+        let implicit = Wipeout { boundary: points.clone() };
+        let mut expected = points.clone();
+        expected.push(points[0]);
+        assert!(matches!(implicit.closed_boundary(), Cow::Owned(_)));
+        assert_eq!(implicit.closed_boundary().as_ref(), expected);
+        assert_eq!(implicit.boundary, points);
+        let explicit = Wipeout { boundary: expected.clone() };
+        assert!(matches!(explicit.closed_boundary(), Cow::Borrowed(_)));
+        assert_eq!(explicit.closed_boundary().as_ref(), expected);
+        let a = EntityKind::Wipeout(implicit).prims();
+        let b = EntityKind::Wipeout(explicit).prims();
+        assert_eq!(a, b);
+        assert_eq!(a.len(), 3);
+        for boundary in [vec![], vec![Vec2::ZERO]] {
+            let wipeout = Wipeout { boundary: boundary.clone() };
+            assert!(matches!(wipeout.closed_boundary(), Cow::Borrowed(_)));
+            assert_eq!(wipeout.closed_boundary().as_ref(), boundary);
+            assert!(EntityKind::Wipeout(wipeout).prims().is_empty());
+        }
+    }
+
+    #[test]
+    fn moving_endpoints_together_keeps_both_corners_editable() {
+        let points = [Vec2::ZERO, Vec2::new(8.0, 0.0), Vec2::new(8.0, 6.0), Vec2::new(0.0, 6.0)];
+        for explicit in [false, true] {
+            for index in [0, 3] {
+                let other = 3 - index;
+                let mut boundary = points.to_vec();
+                if explicit {
+                    boundary.push(points[0]);
+                }
+                let mut wipeout = Wipeout { boundary };
+                let mut expected = points;
+                expected[index] = points[other];
+                for _ in 0..2 {
+                    assert_eq!(wipeout.set_vertex(index, points[other]), Some(()));
+                    assert_eq!(wipeout.vertices(), expected);
+                    assert_eq!(wipeout.boundary.len(), 5, "one separate closing marker, no growth");
+                }
+                expected[other] = Vec2::new(-2.0, 4.0);
+                assert_eq!(wipeout.set_vertex(other, expected[other]), Some(()));
+                assert_eq!(wipeout.vertices(), expected);
+                assert_eq!(wipeout.boundary.len(), 5);
+                assert_eq!(wipeout.boundary.first(), wipeout.boundary.last());
+            }
+        }
+    }
+
+    #[test]
+    fn editing_keeps_the_closure_but_not_other_coincident_vertices_attached() {
+        let (a, b, c, to) = (Vec2::ZERO, Vec2::new(7.0, 1.0), Vec2::new(3.0, 7.0), Vec2::new(2.0, 3.0));
+        for explicit in [false, true] {
+            let mut boundary = vec![a, b, a, c];
+            if explicit {
+                boundary.push(a);
+            }
+            let mut wipeout = Wipeout { boundary };
+            assert_eq!(wipeout.set_vertex(0, to), Some(()));
+            let mut expected = vec![to, b, a, c];
+            if explicit {
+                expected.push(to);
+            }
+            assert_eq!(wipeout.boundary, expected);
+            for (index, point) in [(4, a), (usize::MAX, a), (0, Vec2::new(f64::NAN, 0.0)), (0, Vec2::new(0.0, f64::INFINITY))] {
+                assert_eq!(wipeout.set_vertex(index, point), None);
+                assert_eq!(wipeout.boundary, expected);
+            }
+        }
+    }
+}

crates/doc/src/extents.rs

@@ -36,11 +36,26 @@ fn text_box(t: &crate::Text, len: usize) -> Bounds2 {
 /// as when drawing. Dimensional constraints of dynamic blocks (layer `*ADSK_CONSTRAINTS`) and the
 /// entities a visibility state hides are invisible this way, and they sit far from the block's
 /// geometry in real drawings. Layer "0" takes the insert's layer, which the caller has checked.
-fn in_block_visible(d: &Drawing, e: &Entity) -> bool {
+/// `off_counts`: a layer turned off counts too, as in the drawing's extents ([`extent_bounds`]).
+fn in_block_visible(d: &Drawing, e: &Entity, off_counts: bool) -> bool {
     // Attribute definitions are not drawn in an insert (its attribs are, see below).
-    !matches!(e.kind, EntityKind::AttDef(_))
-        && e.common.visible
-        && (e.common.layer == "0" || d.layer(&e.common.layer).is_none_or(crate::Layer::visible))
+    !matches!(e.kind, EntityKind::AttDef(_)) && e.common.visible && layer_counts(d, &e.common.layer, off_counts)
+}
+
+/// Whether what lies on `layer` inside an insert counts: layer "0" takes the insert's layer, which
+/// the caller has checked; a frozen layer never counts, one turned off only with `off_counts`.
+fn layer_counts(d: &Drawing, layer: &str, off_counts: bool) -> bool {
+    layer == "0" || d.layer(layer).is_none_or(|l| !l.frozen && (l.on || off_counts))
+}
+
+/// The layer an insert's attribute draws on, as the renderer takes it: its own, else its
+/// definition's (layer "0" being the insert's).
+fn attrib_layer<'a>(d: &'a Drawing, ins: &crate::Insert, a: &'a crate::Attrib) -> &'a str {
+    a.props.layer.as_deref().unwrap_or_else(|| {
+        d.block(&ins.block)
+            .and_then(|blk| blk.entities.iter().find(|be| matches!(&be.kind, EntityKind::AttDef(ad) if ad.tag.eq_ignore_ascii_case(&a.tag))))
+            .map_or("0", |be| be.common.layer.as_str())
+    })
 }
 
 /// A text that draws no glyph (empty, or only blanks and non-breaking spaces) takes no room.
@@ -52,7 +67,9 @@ fn blank(s: &str) -> bool {
 fn mtext_box(t: &crate::MText) -> Bounds2 {
     let lines = t.contents.split("\\P").count().max(1);
     let longest = t.contents.split("\\P").map(|l| l.chars().count()).max().unwrap_or(1);
-    let mut w = if t.width > 0.0 { t.width } else { t.height * 0.8 * longest as f64 };
+    let estimate = t.height * 0.8 * longest as f64;
+    // The wrap width only narrows the box: a garbage width must not stretch the drawing extents (#2465).
+    let mut w = if t.width > 0.0 { t.width.min(estimate) } else { estimate };
     let mut h = t.height * 1.66 * lines as f64;
     if let Some(c) = t.columns.as_ref().filter(|_| t.width > 0.0) {
         // Columns side by side, the text flowing down each in turn.
@@ -75,16 +92,50 @@ fn mtext_box(t: &crate::MText) -> Bounds2 {
     Bounds2::from_points(pts)
 }
 
+/// The box of what `e` draws (block contents on layers turned off left out).
 pub fn entity_bounds(d: &Drawing, e: &Entity, depth: usize) -> Bounds2 {
+    bounds_of(d, e, depth, false, &mut HashMap::new())
+}
+
+/// The box `e` takes in the drawing's extents: as [`entity_bounds`], but block contents on a layer
+/// turned off count, as AutoCAD 2024's ZOOM Extents counts them (a frozen layer's do not).
+pub fn extent_bounds(d: &Drawing, e: &Entity) -> Bounds2 {
+    bounds_of(d, e, 0, true, &mut HashMap::new())
+}
+
+/// The bounds of block contents measured so far, kept across the entities of one unchanged
+/// drawing. Measuring many entities with [`entity_bounds_cached`] or [`extent_bounds_cached`]
+/// and one cache measures each block definition once per depth for all of them; a fresh cache per
+/// entity would measure a block again for every reference to it, R references to a block of B
+/// entities costing R x B (CWE-407). Use a cache only while the drawing it measured is unchanged.
+#[derive(Default)]
+pub struct BlockBoundsCache<'a> {
+    /// By block name and depth, block contents on layers turned off left out ([`entity_bounds`]).
+    drawn: HashMap<(&'a str, usize), Bounds2>,
+    /// The same with those contents counted ([`extent_bounds`]).
+    extents: HashMap<(&'a str, usize), Bounds2>,
+}
+
+/// [`entity_bounds`] reusing the block bounds `cache` holds from earlier calls on drawing `d`.
+pub fn entity_bounds_cached<'a>(d: &'a Drawing, e: &Entity, depth: usize, cache: &mut BlockBoundsCache<'a>) -> Bounds2 {
+    bounds_of(d, e, depth, false, &mut cache.drawn)
+}
+
+/// [`extent_bounds`] reusing the block bounds `cache` holds from earlier calls on drawing `d`.
+pub fn extent_bounds_cached<'a>(d: &'a Drawing, e: &Entity, cache: &mut BlockBoundsCache<'a>) -> Bounds2 {
+    bounds_of(d, e, 0, true, &mut cache.extents)
+}
+
+fn bounds_of<'a>(d: &'a Drawing, e: &Entity, depth: usize, off_counts: bool, blocks: &mut HashMap<(&'a str, usize), Bounds2>) -> Bounds2 {
     // A top-level annotative object measures as it draws at the current annotation scale.
     if depth == 0 {
         match d.anno_draw(e) {
             crate::AnnoDraw::Plain => {}
             crate::AnnoDraw::Hidden => return Bounds2::EMPTY,
-            crate::AnnoDraw::Scaled(f) => return bounds_in(d, &crate::anno_scaled(e, f), 0, &mut HashMap::new()),
+            crate::AnnoDraw::Scaled(f) => return bounds_in(d, &crate::anno_scaled(e, f), 0, blocks, off_counts),
         }
     }
-    bounds_in(d, e, depth, &mut HashMap::new())
+    bounds_in(d, e, depth, blocks, off_counts)
 }
 
 /// [`entity_bounds`] with the bounds of block contents (in block coordinates) already computed,
@@ -93,11 +144,16 @@ pub fn entity_bounds(d: &Drawing, e: &Entity, depth: usize) -> Bounds2 {
 /// definition per depth instead of one per reference (which grows exponentially with the nesting
 /// depth). The depth is part of the key because [`MAX_BLOCK_DEPTH`] cuts a deep visit short: its
 /// bounds must not stand in for a shallower reference to the same block (#706).
-fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<(&'a str, usize), Bounds2>) -> Bounds2 {
+fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<(&'a str, usize), Bounds2>, off_counts: bool) -> Bounds2 {
     match &e.kind {
         EntityKind::Table(t) if t.is_broken() => t.bounds(),
         EntityKind::Text(t) if blank(&t.value) => Bounds2::EMPTY,
         EntityKind::MText(t) if blank(&t.contents) => Bounds2::EMPTY,
+        // Text that matches the layout's orientation is drawn upright (#2498).
+        EntityKind::Text(t) if e.common.matches_layout_orientation() => {
+            text_box(&crate::Text { rotation: 0.0, ..t.clone() }, t.value.chars().count())
+        }
+        EntityKind::MText(t) if e.common.matches_layout_orientation() => mtext_box(&crate::MText { rotation: 0.0, ..t.clone() }),
         EntityKind::Text(t) => text_box(t, t.value.chars().count()),
         EntityKind::AttDef(a) => text_box(&a.text, a.tag.chars().count()),
         EntityKind::MText(t) => mtext_box(t),
@@ -115,8 +171,8 @@ fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<
                     Some(b) => *b,
                     None => {
                         let mut inner = Bounds2::EMPTY;
-                        for be in blk.entities.iter().filter(|be| in_block_visible(d, be)) {
-                            inner = inner.union(&bounds_in(d, be, depth + 1, blocks));
+                        for be in blk.entities.iter().filter(|be| in_block_visible(d, be, off_counts)) {
+                            inner = inner.union(&bounds_in(d, be, depth + 1, blocks, off_counts));
                         }
                         blocks.insert((blk.name.as_str(), depth), inner);
                         inner
@@ -131,7 +187,7 @@ fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<
                 }
             }
             for a in &ins.attribs {
-                if !a.invisible {
+                if !a.invisible && layer_counts(d, attrib_layer(d, ins, a), off_counts) {
                     b = b.union(&match a.multiline_text() {
                         Some(m) => mtext_box(&m),
                         None => text_box(&a.text, a.text.value.chars().count()),
@@ -172,13 +228,17 @@ fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<
                     Some(cached) => *cached,
                     None => {
                         let mut inner = Bounds2::EMPTY;
-                        for be in blk.entities.iter().filter(|be| in_block_visible(d, be)) {
-                            inner = inner.union(&bounds_in(d, be, depth + 1, blocks));
+                        for be in blk.entities.iter().filter(|be| in_block_visible(d, be, off_counts)) {
+                            inner = inner.union(&bounds_in(d, be, depth + 1, blocks, off_counts));
                         }
                         blocks.insert((blk.name.as_str(), depth), inner);
                         inner
                     }
                 };
+                // The block draws translated by the insertion point (group 12), so its bounds
+                // move with it (#2634); the cache above keeps the block's own bounds.
+                let off = dm.insertion_point.xy();
+                let inner = if off == Vec2::ZERO { inner } else { Bounds2 { min: inner.min + off, max: inner.max + off } };
                 b = b.union(&inner);
             }
             b
@@ -193,7 +253,7 @@ fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<
             }
             if let Some(ins) = &m.block {
                 let be = Entity { handle: e.handle, common: e.common.clone(), kind: EntityKind::Insert(ins.clone()) };
-                b = b.union(&bounds_in(d, &be, depth, blocks));
+                b = b.union(&bounds_in(d, &be, depth, blocks, off_counts));
             }
             b
         }
@@ -309,6 +369,37 @@ mod tests {
         entity_bounds(&Drawing::default(), &Entity::new(crate::Handle(1), kind), 0)
     }
 
+    fn mtext(contents: &str, width: f64) -> crate::MText {
+        crate::MText {
+            insert: Vec3::new(10.0, 10.0, 0.0),
+            height: 2.5,
+            width,
+            attach: 1,
+            rotation: 0.0,
+            style: "Standard".into(),
+            contents: contents.into(),
+            line_spacing: 1.0,
+            line_spacing_exact: false,
+            columns: None,
+        }
+    }
+
+    /// A garbage wrap width only narrows an MTEXT's box, never widens it: a huge group 41 must not
+    /// stretch the drawing extents (#2465).
+    #[test]
+    fn a_huge_mtext_wrap_width_does_not_inflate_the_extents() {
+        let b = bounds(EntityKind::MText(mtext("AB", 300_000_009_519_104.0)));
+        // "AB" at height 2.5 is 2 chars * 0.8 * 2.5 = 4 wide.
+        assert!(b.max.x <= 10.0 + 4.0 + 1e-9, "box ends at x = {}", b.max.x);
+        assert!(b.min.x >= 10.0 - 1e-9);
+    }
+
+    /// A wrap width narrower than the text still bounds the box to that width.
+    #[test]
+    fn a_narrow_mtext_wrap_width_still_sets_the_box_width() {
+        let b = bounds(EntityKind::MText(mtext("A LONG LINE OF WRAPPING TEXT", 5.0)));
+        assert!((b.max.x - b.min.x - 5.0).abs() < 1e-9, "width {}", b.max.x - b.min.x);
+    }
     #[test]
     fn right_justified_text_is_left_of_alignment_point() {
         let b = bounds(EntityKind::Text(text(HAlign::Right, VAlign::Baseline)));
@@ -374,4 +465,53 @@ mod tests {
         empty.text = Some(crate::MText { contents: " ".into(), ..mtext });
         assert!(bounds(EntityKind::MLeader(empty)).max.x < 26.0);
     }
+
+    #[test]
+    fn a_shared_block_cache_measures_as_a_fresh_one_for_each_entity() {
+        let line = |a: (f64, f64), b: (f64, f64), layer: &str| {
+            let mut e = Entity::new(crate::Handle(1), EntityKind::Line(crate::Line { a: Vec3::new(a.0, a.1, 0.0), b: Vec3::new(b.0, b.1, 0.0) }));
+            e.common.layer = layer.into();
+            e
+        };
+        let ins = |block: &str, at: f64| {
+            Entity::new(
+                crate::Handle(2),
+                EntityKind::Insert(crate::Insert {
+                    block: block.into(),
+                    insert: Vec3::new(at, at, 0.0),
+                    scale: Vec3::new(1.0, 1.0, 1.0),
+                    rotation: 0.0,
+                    attribs: Vec::new(),
+                    cols: 1,
+                    rows: 1,
+                    col_spacing: 0.0,
+                    row_spacing: 0.0,
+                }),
+            )
+        };
+        let mut d = Drawing::new_imperial();
+        d.ensure_layer("OFF");
+        if let Some(l) = d.layer_mut("OFF") {
+            l.on = false;
+        }
+        // A block with a part on a layer turned off (left out when drawn, counted in extents),
+        // and a block that nests it.
+        let mut b = crate::Block::new("B");
+        b.entities.push(line((0.0, 0.0), (1.0, 1.0), "0"));
+        b.entities.push(line((0.0, 0.0), (5.0, 5.0), "OFF"));
+        d.blocks.insert("B".into(), std::sync::Arc::new(b));
+        let mut n = crate::Block::new("N");
+        n.entities.push(ins("B", 10.0));
+        d.blocks.insert("N".into(), std::sync::Arc::new(n));
+        let ents: Vec<Entity> = (0..50).map(|i| ins(if i % 2 == 0 { "B" } else { "N" }, f64::from(i))).collect();
+        // One cache for both kinds of measure, interleaved: neither may answer for the other.
+        let mut cache = BlockBoundsCache::default();
+        for e in &ents {
+            let (drawn, extents) = (entity_bounds_cached(&d, e, 0, &mut cache), extent_bounds_cached(&d, e, &mut cache));
+            let (want_drawn, want_extents) = (entity_bounds(&d, e, 0), extent_bounds(&d, e));
+            assert_eq!((drawn.min, drawn.max), (want_drawn.min, want_drawn.max));
+            assert_eq!((extents.min, extents.max), (want_extents.min, want_extents.max));
+            assert!(extents.width() > drawn.width());
+        }
+    }
 }

crates/doc/src/foreign.rs

@@ -6,7 +6,7 @@
 //! named object dictionary, a table record, a block, an entity); references to objects that are
 //! gone are dropped. Commands don't edit it.
 
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
 
 use crate::{Handle, RawTag};
 
@@ -89,8 +89,170 @@ impl Foreign {
             && self.data_store.is_empty()
     }
 
-    /// The entities the data store has records for (their 320 handles).
+    /// The entities with a geometry record in the data store: an `ACDSRECORD` naming the entity
+    /// (320) that holds its `ASM_Data`. A 320 without one doesn't keep an entity's geometry.
     pub fn data_store_entities(&self) -> std::collections::BTreeSet<Handle> {
-        self.data_store.iter().filter(|t| t.code == 320).filter_map(|t| Handle::parse_hex(t.value.trim())).collect()
+        let mut out = std::collections::BTreeSet::new();
+        for rec in data_store_records(&self.data_store) {
+            let is_record = rec.first().is_some_and(|t| t.value.trim().eq_ignore_ascii_case("ACDSRECORD"));
+            if is_record && rec.iter().any(|t| t.code == 2 && t.value.trim().eq_ignore_ascii_case("ASM_Data")) {
+                out.extend(data_store_owner(rec).and_then(|t| Handle::parse_hex(t.value.trim())));
+            }
+        }
+        out
+    }
+}
+
+/// Whether a solid modeler entity (3DSOLID, REGION, BODY) holds its ACIS geometry as SAT text
+/// (groups 1 and 3), which DXF 2013 and later no longer has: those files keep it in the data
+/// store section, so an entity with SAT text and no record there can't be written to one (#2334).
+pub fn sat_text_acis(u: &crate::Unknown, handle: Handle, stored: &std::collections::BTreeSet<Handle>) -> bool {
+    ["3DSOLID", "REGION", "BODY"].iter().any(|t| u.dxf_type.eq_ignore_ascii_case(t)) && !stored.contains(&handle) && has_sat_text(&u.tags)
+}
+
+/// The entities a DXF of 2013 or later leaves out because they hold SAT-text ACIS data
+/// ([`sat_text_acis`]), counted by DXF type, across model space, layouts and block definitions.
+pub fn sat_text_dropped(d: &crate::Drawing) -> BTreeMap<String, usize> {
+    let stored = d.foreign.data_store_entities();
+    let mut out = BTreeMap::new();
+    // The writer saves xrefs as references: their blocks (and `xref|` ones) hold nothing in the file.
+    let own_blocks = d.blocks.values().filter(|b| b.xref_path.is_none() && !xref_dependent(&b.name));
+    let stores = std::iter::once(&d.model).chain(d.layouts.iter().map(|l| &l.entities)).chain(own_blocks.map(|b| &b.entities));
+    for e in stores.flat_map(|s| s.iter()) {
+        if let crate::EntityKind::Unknown(u) = &e.kind
+            && sat_text_acis(u, e.handle, &stored)
+        {
+            let n: &mut usize = out.entry(u.dxf_type.to_ascii_uppercase()).or_default();
+            *n = n.saturating_add(1);
+        }
+    }
+    out
+}
+
+/// Whether a symbol name belongs to an attached xref (`xref|name`): the DXF writer leaves such
+/// symbols out, and the contents of xref blocks too ([`Block::xref_path`](crate::Block::xref_path)).
+pub fn xref_dependent(name: &str) -> bool {
+    name.contains('|')
+}
+
+/// The records of a data store section's groups: each starts at a `0` group and runs to the next
+/// (the section's own groups before the first record are not part of one).
+pub fn data_store_records(tags: &[RawTag]) -> Vec<&[RawTag]> {
+    let mut out = Vec::new();
+    let mut start = tags.iter().position(|t| t.code == 0).unwrap_or(tags.len());
+    while start < tags.len() {
+        let end = tags.iter().skip(start + 1).position(|t| t.code == 0).map_or(tags.len(), |k| start + 1 + k);
+        out.push(tags.get(start..end).unwrap_or(&[]));
+        start = end;
+    }
+    out
+}
+
+/// Whether an entity's groups hold SAT text: groups 1 and 3 inside its `AcDbModelerGeometry`
+/// subclass. A file of a version before the subclass markers has no `100` groups: all of its
+/// groups (before the extended data) are the entity's.
+pub fn has_sat_text(tags: &[RawTag]) -> bool {
+    let own = tags.iter().take_while(|r| r.code < 1000);
+    let marked = tags.iter().take_while(|r| r.code < 1000).any(|r| r.code == 100);
+    let mut in_modeler = !marked;
+    for r in own {
+        if r.code == 100 {
+            in_modeler = r.value.trim().eq_ignore_ascii_case("AcDbModelerGeometry");
+        } else if in_modeler && (r.code == 1 || r.code == 3) {
+            return true;
+        }
+    }
+    false
+}
+
+/// The group naming the entity a data store record belongs to: its first `320`. A record is kept
+/// or dropped by this handle alone, in the writer and wherever the store is read.
+pub fn data_store_owner(record: &[RawTag]) -> Option<&RawTag> {
+    record.iter().find(|t| t.code == 320)
+}
+
+impl Foreign {
+    /// The kept objects by handle (the first of any that share one).
+    fn object_index(&self) -> BTreeMap<Handle, &ForeignObject> {
+        let mut m = BTreeMap::new();
+        for o in &self.objects {
+            m.entry(o.handle).or_insert(o);
+        }
+        m
+    }
+
+    /// The kept object `root` and the kept objects it owns, directly or not (dictionary entries
+    /// and child pointers, groups 350 and 360), `root` first.
+    pub fn tree(&self, root: Handle) -> Vec<Handle> {
+        // Indexed once: a file can keep many objects, and a lookup per pointer would grow with
+        // their product.
+        let by_handle = self.object_index();
+        let mut out = vec![root];
+        let mut seen = BTreeSet::from([root]);
+        let mut i = 0;
+        while let Some(&h) = out.get(i) {
+            i += 1;
+            let Some(o) = by_handle.get(&h) else { continue };
+            for c in o.tags.iter().filter(|t| matches!(t.code, 350 | 360)).filter_map(|t| Handle::parse_hex(t.value.trim())) {
+                if out.len() < 4096 && by_handle.contains_key(&c) && seen.insert(c) {
+                    out.push(c);
+                }
+            }
+        }
+        out
+    }
+
+    /// Copy the objects of `tree` (see [`Foreign::tree`]) of `src` into this one under the handles
+    /// `fresh` (the same order; two more follow for a field list), `owner` taking the place of the
+    /// root's owner. References to objects outside the tree become null. Fields keep a field
+    /// list: this one gets a copy of the source's if it has none.
+    pub fn adopt_tree(&mut self, src: &Foreign, tree: &[Handle], fresh: &[Handle], owner: Handle) {
+        if fresh.len() < tree.len() + 2 {
+            return;
+        }
+        let map: BTreeMap<Handle, Handle> = tree.iter().copied().zip(fresh.iter().copied()).collect();
+        let by_handle = src.object_index();
+        let mut kinds = Vec::new();
+        for (n, h) in tree.iter().enumerate() {
+            let Some(o) = by_handle.get(h) else { continue };
+            let mut c = (*o).clone();
+            let Some(&new) = fresh.get(n) else { continue };
+            c.handle = new;
+            for t in &mut c.tags {
+                if t.code == 5 {
+                    t.value = new.hex();
+                } else if matches!(t.code, 320..=369 | 390..=399) {
+                    let to = Handle::parse_hex(t.value.trim()).and_then(|h| map.get(&h).copied()).or((n == 0 && t.code == 330).then_some(owner));
+                    t.value = to.map_or_else(|| "0".to_string(), Handle::hex);
+                }
+            }
+            kinds.push(c.kind.clone());
+            self.objects.push(c);
+        }
+        if let Some(list) = src.objects.iter().find(|o| o.kind == "FIELDLIST").filter(|_| !self.objects.iter().any(|o| o.kind == "FIELDLIST")) {
+            let (Some(&h), Some(&nod)) = (fresh.get(tree.len()), fresh.get(tree.len() + 1)) else { return };
+            let mut c = list.clone();
+            c.handle = h;
+            for t in &mut c.tags {
+                match t.code {
+                    5 => t.value = h.hex(),
+                    330 => t.value = "0".to_string(),
+                    _ => {}
+                }
+            }
+            if let Some(t) = c.tags.iter_mut().find(|t| t.code == 330) {
+                t.value = nod.hex();
+            }
+            self.targets.insert(nod, ("NOD".to_string(), String::new()));
+            self.dictionary.push(("ACAD_FIELDLIST".to_string(), h));
+            kinds.push(c.kind.clone());
+            self.objects.push(c);
+        }
+        for k in kinds {
+            let named = |c: &Vec<RawTag>| c.iter().any(|t| t.code == 1 && t.value.eq_ignore_ascii_case(&k));
+            if !self.classes.iter().any(named) {
+                self.classes.extend(src.classes.iter().filter(|c| named(c)).cloned());
+            }
+        }
     }
 }

crates/doc/src/format.rs

@@ -0,0 +1,100 @@
+use std::path::Path;
+
+/// A file format, chosen by the file name's extension (ASCII case-insensitive).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Format {
+    Dxf,
+    Dwg,
+    /// A drawing template: DWG content.
+    Dwt,
+    Svg,
+    /// Gzip-compressed SVG.
+    Svgz,
+    Png,
+    Pdf,
+}
+
+impl Format {
+    /// The formats a drawing can be read from by name. DXF and DWG are also recognised by content.
+    pub const READ: &'static [Format] = &[Format::Dxf, Format::Dwg, Format::Svg, Format::Svgz];
+    /// The formats a drawing can be written to.
+    pub const WRITE: &'static [Format] = &[Format::Dxf, Format::Dwg, Format::Dwt, Format::Svg, Format::Png, Format::Pdf];
+
+    /// The format `path`'s extension names. A name without an extension is DXF; an unknown
+    /// extension is `None`.
+    pub fn from_path(p: impl AsRef<Path>) -> Option<Format> {
+        let ext = p.as_ref().extension().map(|e| e.to_string_lossy().to_ascii_lowercase()).unwrap_or_default();
+        Some(match ext.as_str() {
+            "dxf" | "" => Format::Dxf,
+            "dwg" => Format::Dwg,
+            "dwt" => Format::Dwt,
+            "svg" => Format::Svg,
+            "svgz" => Format::Svgz,
+            "png" => Format::Png,
+            "pdf" => Format::Pdf,
+            _ => return None,
+        })
+    }
+
+    /// The extension, lower case and without the dot.
+    pub fn extension(self) -> &'static str {
+        match self {
+            Format::Dxf => "dxf",
+            Format::Dwg => "dwg",
+            Format::Dwt => "dwt",
+            Format::Svg => "svg",
+            Format::Svgz => "svgz",
+            Format::Png => "png",
+            Format::Pdf => "pdf",
+        }
+    }
+
+    /// Written as an image (model space fitted to a frame), so framing applies. SVGZ is read only.
+    pub fn is_image(self) -> bool {
+        matches!(self, Format::Svg | Format::Png | Format::Pdf)
+    }
+
+    /// A drawing file (DXF, DWG, template) rather than an image.
+    pub fn is_drawing(self) -> bool {
+        matches!(self, Format::Dxf | Format::Dwg | Format::Dwt)
+    }
+
+    /// Written as DWG, which drops the object types the DWG writer doesn't know.
+    pub fn drops_unknown(self) -> bool {
+        matches!(self, Format::Dwg | Format::Dwt)
+    }
+
+    /// `formats` as "dxf, dwg, svg": the list help text shows.
+    pub fn list(formats: &[Format]) -> String {
+        formats.iter().map(|f| f.extension()).collect::<Vec<_>>().join(", ")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn from_path_by_extension() {
+        for f in [Format::Dxf, Format::Dwg, Format::Dwt, Format::Svg, Format::Svgz, Format::Png, Format::Pdf] {
+            assert_eq!(Format::from_path(format!("a/b.{}", f.extension())), Some(f));
+            assert_eq!(Format::from_path(format!("B.{}", f.extension().to_ascii_uppercase())), Some(f));
+        }
+        assert_eq!(Format::from_path("Drawing1"), Some(Format::Dxf), "no extension is DXF");
+        assert_eq!(Format::from_path("dir.dwg/Drawing1"), Some(Format::Dxf));
+        assert_eq!(Format::from_path("a."), Some(Format::Dxf));
+        assert_eq!(Format::from_path("a.txt"), None);
+        assert_eq!(Format::from_path("a.dxf.bak"), None);
+        assert_eq!(Format::from_path(std::path::Path::new("x.PnG")), Some(Format::Png));
+    }
+
+    #[test]
+    fn classes() {
+        assert!(Format::READ.contains(&Format::Svgz) && !Format::WRITE.contains(&Format::Svgz));
+        assert!(Format::WRITE.contains(&Format::Dwt) && !Format::READ.contains(&Format::Dwt));
+        assert!(Format::WRITE.iter().filter(|f| f.is_image()).count() == 3 && !Format::Svgz.is_image());
+        assert!(Format::Dwt.drops_unknown() && Format::Dwg.drops_unknown() && !Format::Dxf.drops_unknown());
+        assert!(Format::Dwt.is_drawing() && !Format::Pdf.is_drawing());
+        assert_eq!(Format::list(Format::READ), "dxf, dwg, svg, svgz");
+    }
+}

crates/doc/src/lib.rs

@@ -10,6 +10,7 @@ mod array;
 mod constraint;
 mod entity;
 mod extents;
+mod format;
 mod gdt;
 mod header;
 pub mod library;
@@ -26,7 +27,8 @@ pub use cadcraft_color as color;
 pub use cadcraft_geom as geom;
 pub use constraint::*;
 pub use entity::*;
-pub use extents::{MAX_BLOCK_DEPTH, entity_bounds};
+pub use extents::{BlockBoundsCache, MAX_BLOCK_DEPTH, entity_bounds, entity_bounds_cached, extent_bounds, extent_bounds_cached};
+pub use format::Format;
 pub use gdt::*;
 pub use header::{HVal, Header};
 pub use plotstyle::*;
@@ -130,6 +132,10 @@ pub struct Drawing {
     /// Records of the file this drawing was read from that the reader could not place (a damaged
     /// file), counted by the section they came from. Never written to a file.
     pub skipped_records: BTreeMap<String, usize>,
+    /// A save option, set on the copy SAVEAS `portableFonts` writes: the file gets Windows fonts
+    /// for the Linux fonts of text styles, and each style keeps its own in CADCraft xdata, so the
+    /// drawing reopens with it. Never set on an open drawing.
+    pub portable_fonts: bool,
 }
 
 impl Default for Drawing {
@@ -189,6 +195,7 @@ impl Drawing {
             read_notes: Vec::new(),
             refedit: None,
             skipped_records: BTreeMap::new(),
+            portable_fonts: false,
         }
     }
 
@@ -367,13 +374,22 @@ impl Drawing {
         !self.hidden_objects.is_empty() && self.hidden_objects.contains(&h)
     }
 
-    /// Bounds of all visible entities in a space.
+    /// Whether an entity counts in the extents: as AutoCAD 2024 counts it for ZOOM Extents and
+    /// EXTMIN/EXTMAX, on a layer that is off too, but not on a frozen one.
+    pub fn in_extents(&self, e: &Entity) -> bool {
+        e.common.visible && self.layer(&e.common.layer).is_none_or(|l| !l.frozen) && !self.is_hidden_object(e.handle)
+    }
+
+    /// Bounds of the entities in a space that count in its extents ([`Drawing::in_extents`]).
     pub fn extents(&self, space: &Space) -> cadcraft_geom::Bounds2 {
         let mut b = cadcraft_geom::Bounds2::EMPTY;
+        // One block-bounds cache for the whole space: every reference to a block reuses its
+        // measured contents instead of measuring the definition again.
+        let mut cache = BlockBoundsCache::default();
         if let Some(store) = self.space(space) {
             for e in store.iter() {
-                if self.is_visible(e) {
-                    b = b.union(&entity_bounds(self, e, 0));
+                if self.in_extents(e) {
+                    b = b.union(&extent_bounds_cached(self, e, &mut cache));
                 }
             }
         }

crates/doc/src/store.rs

@@ -189,6 +189,19 @@ impl EntityStore {
             None => false,
         }
     }
+    /// The objects directly under and above `h` in the draw order (None at the bottom or the
+    /// top), when `h` is here.
+    pub fn neighbours(&self, h: Handle) -> Option<(Option<Handle>, Option<Handle>)> {
+        let pos = self.chunk_pos(self.chunk_id(h)?)?;
+        let items = &self.chunks.get(pos)?.items;
+        let i = items.iter().position(|e| e.handle == h)?;
+        let below = match i.checked_sub(1) {
+            Some(j) => items.get(j),
+            None => pos.checked_sub(1).and_then(|p| self.chunks.get(p)).and_then(|c| c.items.last()),
+        };
+        let above = items.get(i + 1).or_else(|| self.chunks.get(pos + 1).and_then(|c| c.items.first()));
+        Some((below.map(|e| e.handle), above.map(|e| e.handle)))
+    }
     /// Move `h` directly above (`above`) or under `anchor` in the draw order. False (and nothing
     /// moves) when either is absent or they are the same object.
     pub fn move_next_to(&mut self, h: Handle, anchor: Handle, above: bool) -> bool {
@@ -364,4 +377,26 @@ mod tests {
             assert_eq!(s.get(Handle(h)).map(|e| e.handle.0), Some(h));
         }
     }
+
+    #[test]
+    fn neighbours_across_chunks() {
+        let mut s = EntityStore::new();
+        for h in 1..=3000 {
+            s.push(ent(h));
+        }
+        assert_eq!(s.neighbours(Handle(1)), Some((None, Some(Handle(2)))));
+        assert_eq!(s.neighbours(Handle(1500)), Some((Some(Handle(1499)), Some(Handle(1501)))));
+        // The first and last objects of a chunk look into the chunks next to it.
+        let k = CHUNK_MAX as u64;
+        assert_eq!(s.neighbours(Handle(k)), Some((Some(Handle(k - 1)), Some(Handle(k + 1)))));
+        assert_eq!(s.neighbours(Handle(k + 1)), Some((Some(Handle(k)), Some(Handle(k + 2)))));
+        assert_eq!(s.neighbours(Handle(3000)), Some((Some(Handle(2999)), None)));
+        assert_eq!(s.neighbours(Handle(9999)), None);
+        assert!(s.move_next_to(Handle(3000), Handle(1), false));
+        assert_eq!(s.neighbours(Handle(1)), Some((Some(Handle(3000)), Some(Handle(2)))));
+        assert_eq!(s.neighbours(Handle(3000)), Some((None, Some(Handle(1)))));
+        let mut one = EntityStore::new();
+        one.push(ent(7));
+        assert_eq!(one.neighbours(Handle(7)), Some((None, None)));
+    }
 }

crates/doc/src/tables.rs

@@ -799,6 +799,10 @@ pub struct PageSetup {
     /// The layout's paper units are millimetres (plot paper units 1 in DXF) whatever the
     /// drawing's MEASUREMENT says; otherwise paper units follow MEASUREMENT (#1058).
     pub paper_mm: bool,
+    /// The paper image origin (DXF groups 148/149, in plot paper units) as the file had it, so a
+    /// save keeps where the sheet sits; `None` for a page CADCraft made, written as 0,0 (#2109).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub image_origin: Option<Vec2>,
 }
 
 impl Default for PageSetup {
@@ -820,6 +824,7 @@ impl Default for PageSetup {
             show_plot_styles: false,
             plot_transparency: false,
             paper_mm: false,
+            image_origin: None,
         }
     }
 }
@@ -835,11 +840,15 @@ pub struct Layout {
     /// Saved paper-space view (centre, height).
     #[serde(default)]
     pub view: Option<(Vec2, f64)>,
+    /// The layout's limits (LAYOUT groups 10/11, lower left and upper right) as the file had
+    /// them; `None` for a layout CADCraft made, written as 0,0 to 12,9 (#2109).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub limits: Option<(Vec2, Vec2)>,
 }
 
 impl Layout {
     pub fn new(name: &str, tab_order: u32) -> Self {
-        Layout { name: name.into(), tab_order, page: PageSetup::default(), entities: EntityStore::new(), view: None }
+        Layout { name: name.into(), tab_order, page: PageSetup::default(), entities: EntityStore::new(), view: None, limits: None }
     }
 }
 

crates/doc/src/tests.rs

@@ -44,15 +44,123 @@ fn add_and_extents() {
 }
 
 #[test]
-fn hidden_layers_excluded_from_extents() {
+fn frozen_layers_are_left_out_of_extents_and_layers_turned_off_are_not() {
     let mut d = Drawing::new_imperial();
     let c = Common { layer: "Hidden".into(), ..Default::default() };
     d.add(&Space::Model, c, line((100.0, 100.0), (200.0, 200.0))).unwrap();
     d.add(&Space::Model, Common::default(), line((0.0, 0.0), (1.0, 1.0))).unwrap();
     d.layer_mut("Hidden").unwrap().on = false;
+    assert_eq!(d.extents(&Space::Model).max, Vec2::new(200.0, 200.0));
+    d.layer_mut("Hidden").unwrap().frozen = true;
     assert_eq!(d.extents(&Space::Model).max, Vec2::new(1.0, 1.0));
 }
 
+/// DXF group 12: a dimension moved by an older AutoCAD keeps its `*D` block where it was and
+/// the move in the insertion point, and the block draws translated by it. Extents follow the
+/// drawing, not the stale block contents (#2634).
+#[test]
+fn dimension_insertion_point_moves_its_block_in_extents() {
+    let moved = |ins: Vec3| {
+        let mut d = Drawing::new_metric();
+        let mut blk = Block::new("*D1");
+        blk.entities.push(on_layer("0", line((850.0, 920.0), (860.0, 920.0)), 2));
+        d.blocks.insert("*D1".into(), std::sync::Arc::new(blk));
+        let dm = Dimension {
+            kind: DimKind::Aligned,
+            defpt: Vec3::new(5.0, 1.0, 0.0),
+            text_mid: Vec3::ZERO,
+            p13: Vec3::ZERO,
+            p14: Vec3::new(10.0, 0.0, 0.0),
+            p15: Vec3::ZERO,
+            p16: Vec3::ZERO,
+            text: String::new(),
+            style: "Standard".into(),
+            measurement: 0.0,
+            text_rotation: 0.0,
+            user_text_pos: false,
+            block: Some("*D1".into()),
+            insertion_point: ins,
+            overrides: Default::default(),
+            assoc: Vec::new(),
+            marks: Default::default(),
+        };
+        d.add(&Space::Model, Common::default(), EntityKind::Dimension(dm)).unwrap();
+        d
+    };
+    // Without the offset the block's far-away contents reach the extents.
+    assert!(moved(Vec3::ZERO).extents(&Space::Model).max.x > 800.0);
+    // With it, the block draws at the definition points and the extents stay at the drawing.
+    assert!(moved(Vec3::new(-850.0, -920.0, 0.0)).extents(&Space::Model).max.x < 20.0);
+}
+
+/// ZOOM Extents in AutoCAD 2024 (accoreconsole, EXTMIN/EXTMAX read back; AutoCAD pads them by a
+/// few hundredths): a layer turned off counts and a frozen one does not, for an entity, for an
+/// entity inside a block, and for a block reference itself.
+#[test]
+fn extents_count_layers_turned_off_as_autocad() {
+    let mut d = Drawing::new_imperial();
+    for (name, on, frozen) in [("OFFL", false, false), ("FRZ", true, true), ("BOFF", false, false), ("BFRZ", true, true)] {
+        let mut l = Layer::new(name);
+        (l.on, l.frozen) = (on, frozen);
+        d.layers.push(l);
+    }
+    for (layer, b) in [("0", (10.0, 10.0)), ("OFFL", (100.0, 0.0)), ("FRZ", (0.0, 200.0))] {
+        d.add(&Space::Model, Common { layer: layer.into(), ..Default::default() }, line((0.0, 0.0), b)).unwrap();
+    }
+    // AutoCAD: (-0.013, -0.009)…(100.027, 10.006).
+    assert_eq!(extents_pair(&d), (Vec2::ZERO, Vec2::new(100.0, 10.0)));
+
+    let mut d = Drawing::new_imperial();
+    for (name, on, frozen) in [("FRZ", true, true), ("BOFF", false, false), ("BFRZ", true, true)] {
+        let mut l = Layer::new(name);
+        (l.on, l.frozen) = (on, frozen);
+        d.layers.push(l);
+    }
+    let mut blk = Block::new("BX");
+    blk.entities.push(on_layer("0", line((0.0, 0.0), (1.0, 1.0)), 1));
+    blk.entities.push(on_layer("BOFF", line((0.0, 0.0), (50.0, 0.0)), 2));
+    blk.entities.push(on_layer("BFRZ", line((0.0, 0.0), (0.0, 70.0)), 3));
+    d.blocks.insert("BX".into(), std::sync::Arc::new(blk));
+    let at = |x: f64| match plain_insert("BX") {
+        EntityKind::Insert(i) => EntityKind::Insert(Insert { insert: Vec3::new(x, x, 0.0), ..i }),
+        k => k,
+    };
+    d.add(&Space::Model, Common::default(), at(1000.0)).unwrap();
+    d.add(&Space::Model, Common { layer: "FRZ".into(), ..Default::default() }, at(-500.0)).unwrap();
+    // AutoCAD: (1000, 1000)…(1050, 1001).
+    assert_eq!(extents_pair(&d), (Vec2::new(1000.0, 1000.0), Vec2::new(1050.0, 1001.0)));
+
+    // An insert's attributes lie on their own layer, else on their definition's: one on a frozen
+    // layer either way does not count, one on a layer turned off does.
+    let mut d = Drawing::new_imperial();
+    for (name, on, frozen) in [("IOFF", false, false), ("AOFF", false, false), ("AFRZ", true, true)] {
+        let mut l = Layer::new(name);
+        (l.on, l.frozen) = (on, frozen);
+        d.layers.push(l);
+    }
+    let attrib = |tag: &str, at: (f64, f64), layer: Option<&str>| {
+        let mut a = plain_attrib(tag);
+        a.text.insert = Vec3::new(at.0, at.1, 0.0);
+        a.props.layer = layer.map(str::to_string);
+        a
+    };
+    let mut blk = Block::new("BA");
+    blk.entities.push(on_layer("0", line((0.0, 0.0), (1.0, 1.0)), 1));
+    blk.entities.push(on_layer("AFRZ", EntityKind::AttDef(plain_attrib("DEF")), 2));
+    d.blocks.insert("BA".into(), std::sync::Arc::new(blk));
+    let ins = match plain_insert("BA") {
+        EntityKind::Insert(i) => {
+            let attribs =
+                vec![attrib("OWN", (0.0, 300.0), Some("AFRZ")), attrib("DEF", (0.0, -400.0), None), attrib("OFF", (40.0, 0.0), Some("AOFF"))];
+            EntityKind::Insert(Insert { attribs, ..i })
+        }
+        k => k,
+    };
+    d.add(&Space::Model, Common { layer: "IOFF".into(), ..Default::default() }, ins).unwrap();
+    let (min, max) = extents_pair(&d);
+    assert!(min.y > -1.0 && max.y < 50.0 && max.x > 40.0, "{min:?} {max:?}");
+}
+
 #[test]
 fn rays_and_xlines_do_not_stretch_extents() {
     // ZOOM Extents ignores infinite lines; real drawings carry stray rays millions of units away.
@@ -315,6 +423,31 @@ fn plain_insert(block: &str) -> EntityKind {
     })
 }
 
+/// An attribute (or its definition) `tag` at the origin, one unit high, reading "x".
+fn plain_attrib(tag: &str) -> Attrib {
+    Attrib {
+        tag: tag.into(),
+        text: Text {
+            insert: Vec3::ZERO,
+            align_pt: None,
+            height: 1.0,
+            value: "x".into(),
+            rotation: 0.0,
+            width_factor: 1.0,
+            oblique: 0.0,
+            style: "Standard".into(),
+            halign: HAlign::Left,
+            valign: VAlign::Baseline,
+        },
+        invisible: false,
+        constant: false,
+        prompt: String::new(),
+        props: Default::default(),
+        multiline: None,
+        modes: Default::default(),
+    }
+}
+
 fn on_layer(layer: &str, kind: EntityKind, h: u64) -> Entity {
     Entity { handle: Handle(h), common: Common { layer: layer.into(), ..Default::default() }, kind }
 }
@@ -383,24 +516,18 @@ fn block_entity_with_invisible_flag_is_ignored_in_insert_extents() {
 }
 
 #[test]
-fn block_entity_on_off_or_frozen_layer_is_ignored() {
-    for frozen in [false, true] {
-        let mut d = drawing_with_block(far_line("Hidden"));
-        assert!(d.layer("Hidden").is_none(), "block contents do not create layers");
-        let mut layer = Layer::new("Hidden");
-        if frozen {
-            layer.frozen = true;
-        } else {
-            layer.on = false;
-        }
-        d.layers.push(layer);
-        assert_eq!(extents_pair(&d), (Vec2::ZERO, Vec2::new(1.0, 1.0)), "frozen = {frozen}");
-        // Turned back on, it counts again.
-        let l = d.layer_mut("Hidden").unwrap();
-        l.on = true;
-        l.frozen = false;
-        assert_eq!(d.extents(&Space::Model).max, Vec2::new(6000.0, 6000.0));
-    }
+fn block_entity_on_frozen_layer_is_ignored_and_on_a_layer_turned_off_counts() {
+    let mut d = drawing_with_block(far_line("Hidden"));
+    assert!(d.layer("Hidden").is_none(), "block contents do not create layers");
+    let mut layer = Layer::new("Hidden");
+    layer.frozen = true;
+    d.layers.push(layer);
+    assert_eq!(extents_pair(&d), (Vec2::ZERO, Vec2::new(1.0, 1.0)));
+    // Thawed but turned off, it counts.
+    let l = d.layer_mut("Hidden").unwrap();
+    l.frozen = false;
+    l.on = false;
+    assert_eq!(d.extents(&Space::Model).max, Vec2::new(6000.0, 6000.0));
 }
 
 #[test]
@@ -548,6 +675,7 @@ fn invisible_dimblock_entity_is_ignored_in_dimension_extents() {
                 overrides: Default::default(),
                 assoc: vec![],
                 marks: Default::default(),
+                insertion_point: Vec3::ZERO,
             }),
         )
         .unwrap();
@@ -558,10 +686,10 @@ fn invisible_dimblock_entity_is_ignored_in_dimension_extents() {
     hidden.common.visible = false;
     dim(&mut d, hidden);
     assert!(d.extents(&Space::Model).max.x < 100.0);
-    // Hidden by its layer state.
+    // Hidden by its layer state (frozen; a layer turned off still counts).
     let mut d = Drawing::new_imperial();
     let mut l = Layer::new("*ADSK_CONSTRAINTS");
-    l.on = false;
+    l.frozen = true;
     d.layers.push(l);
     dim(&mut d, on_layer("*ADSK_CONSTRAINTS", line((5000.0, 5000.0), (6000.0, 6000.0)), 2));
     assert!(d.extents(&Space::Model).max.x < 100.0);

crates/doc/tests/it/face3d_hidden_edges.rs

@@ -0,0 +1,19 @@
+//! A 3D face draws only its visible edges: `hidden_edges` bit i hides the side from corner i to
+//! the next, as DXF group 70 defines it, and a triangle's zero-length side isn't drawn.
+
+use cadcraft_doc::{EntityKind, Face3d, Prim};
+use cadcraft_geom::Vec3;
+
+fn sides(f: Face3d) -> usize {
+    EntityKind::Face3d(f).prims().iter().filter(|p| matches!(p, Prim::Seg(_))).count()
+}
+
+#[test]
+fn hidden_edges_are_not_drawn() {
+    let quad = [Vec3::new(0.0, 0.0, 0.0), Vec3::new(1.0, 0.0, 0.0), Vec3::new(1.0, 1.0, 0.0), Vec3::new(0.0, 1.0, 0.0)];
+    assert_eq!(sides(Face3d { corners: quad, hidden_edges: 0 }), 4);
+    assert_eq!(sides(Face3d { corners: quad, hidden_edges: 1 | 4 }), 2);
+    assert_eq!(sides(Face3d { corners: quad, hidden_edges: 15 }), 0);
+    let triangle = [quad[0], quad[1], quad[2], quad[2]];
+    assert_eq!(sides(Face3d { corners: triangle, hidden_edges: 0 }), 3);
+}

crates/doc/tests/it/main.rs

@@ -1,2 +1,3 @@
+mod face3d_hidden_edges;
 mod lin_pat_parse;
 mod sub_segment_alias;

crates/dwg/Cargo.toml

@@ -8,6 +8,12 @@ license.workspace = true
 [lints]
 workspace = true
 
-[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+[dependencies]
+log = { workspace = true }
+
+# The same targets as build.rs's `no_dwg_bridge` leave acadrust out: wasm32, and FreeBSD aarch64,
+# where acadrust 0.6.6 passes a `*const c_char` (u8 there) to its own `*const i8` sysctlbyname.
+# 0.6.7 and 0.6.8 fix that but read some damaged DWGs as empty with no note (tests.rs, #800).
+[target.'cfg(not(any(target_arch = "wasm32", all(target_os = "freebsd", target_arch = "aarch64"))))'.dependencies]
 # MPL-2.0: used as an unmodified dependency only (see plan/adr/0001 and NOTICE).
-acadrust = "0.6.5"
+acadrust = "0.6.6"

crates/dwg/build.rs

@@ -0,0 +1,12 @@
+//! Sets `no_dwg_bridge` on the targets built without acadrust (see Cargo.toml): the DWG functions
+//! there return an error that says to use DXF.
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo::rustc-check-cfg=cfg(no_dwg_bridge)");
+    let arch = std::env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();
+    let os = std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
+    if arch == "wasm32" || (os == "freebsd" && arch == "aarch64") {
+        println!("cargo::rustc-cfg=no_dwg_bridge");
+    }
+}

crates/dwg/src/lib.rs

@@ -19,10 +19,8 @@
 //!   crashing.
 //!
 //! These bound the input- and output-size variants. A small file that declares a huge internal
-//! table or section can still make the dependency allocate before any size is known; fully fixing
-//! that requires an upstream fix in `acadrust` (validate declared sizes against a decoded-memory
-//! budget) or running the decode in a separate worker with an OS memory limit. The limits here
-//! keep the blast radius bounded in the meantime.
+//! table or section can still make the dependency allocate before any size is known, so the app
+//! runs both directions in a child process ([`worker`]): what that kills is the child.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
@@ -58,13 +56,18 @@ impl Limits {
 }
 
 /// A byte count in megabytes for messages ("9.9 MB", "1024 MB").
-#[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+#[cfg_attr(no_dwg_bridge, allow(dead_code))]
 fn mb(n: u64) -> String {
     let m = n as f64 / f64::from(1u32 << 20);
     if m >= 100.0 { format!("{m:.0} MB") } else { format!("{m:.1} MB") }
 }
 
-#[cfg(not(target_arch = "wasm32"))]
+#[cfg(not(no_dwg_bridge))]
+pub mod worker;
+#[cfg(not(no_dwg_bridge))]
+pub use worker::{WORKER_ARG, crash_worker_for_test, decode, encode_as, encode_noted, serve_if_asked, use_own_worker, use_worker};
+
+#[cfg(not(no_dwg_bridge))]
 mod native {
     use std::io::{Cursor, Write};
     use std::panic::AssertUnwindSafe;
@@ -104,17 +107,17 @@ mod native {
         }
         let mut notes = read_notes(&outcome.stats);
         let mut doc = outcome.document;
-        current_style_names(&mut doc);
-        table_merges(&mut doc);
-        table_style_rows(&mut doc, false);
-        let orphans = drop_orphaned_dgn_components(&mut doc);
+        let orphans = guarded(AssertUnwindSafe(|| post_process(&mut doc))).map_err(|_| "the DWG post-processing failed on this file".to_string())?;
         if orphans > 0 {
             let (s, were) = if orphans == 1 { ("", "was") } else { ("s", "were") };
             notes.push(format!("DWG: {orphans} DGN line style component{s} that no line style definition uses {were} left out"));
         }
         let mut out = CappedWriter { buf: Vec::new(), limit: limits.max_dxf_bytes, exceeded: false };
-        let written = std::panic::catch_unwind(AssertUnwindSafe(|| acadrust::DxfWriter::new(&doc).write_to_writer(&mut out)))
-            .map_err(|_| "the DWG→DXF conversion failed on this file".to_string())?;
+        let written = std::panic::catch_unwind(AssertUnwindSafe(|| {
+            acadrust::DxfWriter::new(&doc).write_to_writer(&mut out)?;
+            mtext_contents(&doc, &mut out)
+        }))
+        .map_err(|_| "the DWG→DXF conversion failed on this file".to_string())?;
         if out.exceeded {
             return Err(format!(
                 "DWG: converting this {} file produced more than {} of drawing data (the limit); \
@@ -127,6 +130,94 @@ mod native {
         Ok((add_header_vars(out.buf, &doc.header), notes))
     }
 
+    /// acadrust 0.6.6's ASCII writer treats a caret followed by a literal space as already
+    /// escaped, and turns line feeds into paragraph codes. Serialize affected MTEXT contents
+    /// from the native values instead, using its lossless string writer. All other groups,
+    /// including embedded-object data, remain byte-for-byte as the DXF writer emitted them.
+    fn mtext_contents(doc: &acadrust::CadDocument, out: &mut CappedWriter) -> acadrust::Result<()> {
+        use acadrust::io::dxf::{DxfStreamWriter, DxfTextWriter};
+        let contents: std::collections::HashMap<_, _> = doc
+            .entities()
+            .filter_map(|e| match e {
+                acadrust::EntityType::MText(t) if t.value.contains(['^', '\t', '\n']) => Some((t.common.handle.value(), t.value.as_str())),
+                _ => None,
+            })
+            .collect();
+        if contents.is_empty() {
+            return Ok(());
+        }
+        let dxf = std::mem::take(&mut out.buf);
+        let mut lines = dxf.split_inclusive(|b| *b == b'\n');
+        let (mut mtext, mut text, mut written) = (false, None, false);
+        while let Some(code) = lines.next() {
+            let value = lines.next().ok_or_else(|| std::io::Error::other("incomplete DWG bridge DXF pair"))?;
+            match code.trim_ascii() {
+                b"0" => {
+                    mtext = value.trim_ascii() == b"MTEXT";
+                    text = None;
+                    written = false;
+                }
+                b"5" if mtext => {
+                    text = std::str::from_utf8(value.trim_ascii()).ok().and_then(|s| u64::from_str_radix(s, 16).ok()).and_then(|h| contents.get(&h));
+                }
+                b"101" => mtext = false,
+                b"1" | b"3" if mtext && text.is_some() => {
+                    if let Some(&text) = text
+                        && !written
+                    {
+                        let mut writer = DxfTextWriter::new(&mut *out);
+                        if doc.version < acadrust::DxfVersion::AC1021
+                            && let Some(encoding) = acadrust::io::dxf::code_page::encoding_from_code_page(&doc.header.code_page)
+                        {
+                            writer.set_encoding(encoding);
+                        }
+                        // Each character can expand to two caret-escape characters. Keep
+                        // those pairs together and each group within 250 characters.
+                        let mut rest = text;
+                        while let Some((end, _)) = rest.char_indices().nth(125) {
+                            let (chunk, tail) = rest.split_at(end);
+                            writer.write_xrecord_string(3, chunk)?;
+                            rest = tail;
+                        }
+                        writer.write_xrecord_string(1, rest)?;
+                        written = true;
+                    }
+                    continue;
+                }
+                _ => {}
+            }
+            out.write_all(code)?;
+            out.write_all(value)?;
+        }
+        Ok(())
+    }
+
+    #[cfg(test)]
+    #[test]
+    fn mtext_contents_keeps_other_groups_and_the_output_limit() -> acadrust::Result<()> {
+        for version in [acadrust::DxfVersion::AC1015, acadrust::DxfVersion::AC1032] {
+            let mut doc = acadrust::CadDocument::new();
+            doc.version = version;
+            doc.header.code_page = "ANSI_1252".into();
+            let mut t = acadrust::MText::with_value("é ^ C", acadrust::Vector3::ZERO);
+            t.common.handle = acadrust::Handle::new(0x10);
+            doc.add_entity(acadrust::EntityType::MText(Box::new(t)))?;
+            // Only the MTEXT's own 1/3 groups change. The embedded object's groups and the
+            // following TEXT record must survive byte-for-byte, including their spaces.
+            let prefix = b"  0\r\nMTEXT\r\n  5\r\n10\r\n  8\r\n0\r\n";
+            let suffix = b"101\r\nEmbedded Object\r\n  1\r\n^ embedded\r\n  3\r\n^ tail\r\n  0\r\nTEXT\r\n  1\r\n^ plain\r\n";
+            let raw = [prefix.as_slice(), b"  3\r\nold\r\n  1\r\ntext\r\n", suffix.as_slice()].concat();
+            let mut out = CappedWriter { buf: raw.clone(), limit: 4096, exceeded: false };
+            mtext_contents(&doc, &mut out)?;
+            let value: &[u8] = if version == acadrust::DxfVersion::AC1015 { b"\xe9 ^  C" } else { "é ^  C".as_bytes() };
+            assert_eq!(out.buf, [prefix.as_slice(), b"  1\r\n", value, b"\r\n", suffix.as_slice()].concat());
+            let mut limited = CappedWriter { buf: raw, limit: 1, exceeded: false };
+            assert!(mtext_contents(&doc, &mut limited).is_err());
+            assert!(limited.exceeded);
+        }
+        Ok(())
+    }
+
     /// Most record types named in the skipped-records note.
     const NOTE_TYPES: usize = 6;
 
@@ -237,6 +328,72 @@ mod native {
     /// cells already carry merges are left alone. Each range's first cell gets the span; the
     /// cells it covers are marked merged with no span of their own, as CADCraft's DXF writer does.
     fn table_merges(doc: &mut acadrust::CadDocument) {
+        table_merges_within(doc, MAX_MERGE_CELLS);
+    }
+
+    /// The most table cells [`table_merges`] visits in one document: each range is capped, but
+    /// can cover rows × cols cells, so the total is bounded too.
+    const MAX_MERGE_CELLS: usize = 1 << 24;
+
+    /// A table cell's own text height only when the file says it overrides the table style's.
+    /// acadrust's DXF writer writes a cell style's height (group 140) whenever the cell has a
+    /// style record, even a default 0.18 with no override flag, and CADCraft reads a 140 as an
+    /// override (#2501). The override is the cell style's TEXT_HEIGHT property flag or the
+    /// content's format override bit 128; without either the height is cleared (0 is no
+    /// override), so the table style's height applies.
+    fn table_cell_heights(doc: &mut acadrust::CadDocument) {
+        use acadrust::entities::table::CellStylePropertyFlags;
+        const CONTENT_TEXT_HEIGHT: i32 = 128;
+        for e in doc.entities_mut() {
+            let acadrust::entities::EntityType::Table(t) = e else { continue };
+            for cell in t.rows.iter_mut().flat_map(|r| r.cells.iter_mut()) {
+                // The first content's own height (group 144) when its format override sets bit 128.
+                // CADCraft keeps one height for the cell's text, so a later content's override
+                // must not stand in for the first content's.
+                let content_height = cell
+                    .contents
+                    .first()
+                    .filter(|c| c.format_override_flags & CONTENT_TEXT_HEIGHT != 0)
+                    .map(|c| c.text_height)
+                    .filter(|h| h.is_finite() && *h > 0.0);
+                if let Some(h) = content_height {
+                    // CADCraft reads only the style's height (group 140), so carry it there.
+                    cell.style.get_or_insert_with(acadrust::entities::table::CellStyle::new).text_height = h;
+                    continue;
+                }
+                // A style overrides through its property flags or, in newer files, its override
+                // flags; anything else is the writer's default and is cleared.
+                if let Some(style) = cell.style.as_mut()
+                    && !style.property_flags.contains(CellStylePropertyFlags::TEXT_HEIGHT)
+                    && style.override_flags & CellStylePropertyFlags::TEXT_HEIGHT.bits() as i32 == 0
+                {
+                    style.text_height = 0.0;
+                }
+            }
+        }
+    }
+
+    /// The fix-ups made to a document after the DWG read, returning how many orphaned DGN
+    /// components were dropped. The document comes from a third-party reader and is hostile.
+    fn post_process(doc: &mut acadrust::CadDocument) -> usize {
+        super::fail_in_test("post_process");
+        current_style_names(doc);
+        table_merges(doc);
+        table_cell_heights(doc);
+        table_style_rows(doc, false);
+        keep_sort_handles(doc);
+        drop_orphaned_dgn_components(doc)
+    }
+
+    /// Runs `f`, turning a panic into an error (the reader and writer are guarded the same way).
+    fn guarded<R>(f: impl FnOnce() -> R + std::panic::UnwindSafe) -> Result<R, ()> {
+        std::panic::catch_unwind(f).map_err(|_| ())
+    }
+
+    /// [`table_merges`] visiting at most `budget` cells in all; a range that would pass it is
+    /// left unmerged. Returns the cells visited.
+    fn table_merges_within(doc: &mut acadrust::CadDocument, budget: usize) -> usize {
+        let mut left = budget;
         for e in doc.entities_mut() {
             let acadrust::entities::EntityType::Table(t) = e else { continue };
             if t.merged_ranges.is_empty() || t.rows.iter().flat_map(|r| &r.cells).any(|c| c.merge_width > 1 || c.merge_height > 1) {
@@ -252,6 +409,11 @@ mod native {
                 if r.top_row > bottom || r.left_col > right || rows == 0 || cols == 0 || (r.top_row, r.left_col) == (bottom, right) {
                     continue;
                 }
+                let area = (bottom - r.top_row + 1).saturating_mul(right - r.left_col + 1);
+                if area > left {
+                    continue;
+                }
+                left -= area;
                 let span = |n: usize| i32::try_from(n + 1).unwrap_or(i32::MAX);
                 for (ri, row) in t.rows.iter_mut().enumerate().take(bottom + 1).skip(r.top_row) {
                     for (ci, cell) in row.cells.iter_mut().enumerate().take(right + 1).skip(r.left_col) {
@@ -263,6 +425,28 @@ mod native {
                 }
             }
         }
+        budget - left
+    }
+
+    /// Draw-order tables (SORTENTSTABLE) keep the sort handles the file gave them. acadrust's DXF
+    /// writer renumbers them past every entity handle, but an entity left out of a table sorts by
+    /// its own handle, so after renumbering it would draw below every listed entity (#2410). Giving
+    /// the table its codes verbatim makes the writer emit them unchanged.
+    fn keep_sort_handles(doc: &mut acadrust::CadDocument) {
+        use acadrust::objects::ObjectType;
+        let version = doc.version;
+        for o in doc.objects.values_mut() {
+            let ObjectType::SortEntitiesTable(t) = o else { continue };
+            let hex = |h: acadrust::types::Handle| format!("{:X}", h.value());
+            let mut codes =
+                vec![(5, hex(t.handle)), (330, hex(t.owner_handle)), (100, "AcDbSortentsTable".to_string()), (330, hex(t.block_owner_handle))];
+            for e in t.entries() {
+                codes.push((331, hex(e.entity_handle)));
+                codes.push((5, hex(e.sort_handle)));
+            }
+            t.raw_dxf_codes = Some(codes);
+            t.raw_dxf_version = Some(version);
+        }
     }
 
     /// Table styles' title and header suppression between the two places acadrust 0.6.3 keeps
@@ -293,7 +477,7 @@ mod native {
     /// The DWG dimension flags byte. Its bit 1 is DXF group 70's bit 32 (ODA DWG specification,
     /// common dimension data), which acadrust keeps no copy of from DXF: it is set here as
     /// CADCraft's DXF writer always sets it (#1094). Bit 0, the opposite of group 70's bit 128,
-    /// acadrust 0.6.5 reads and writes itself.
+    /// acadrust 0.6.6 reads and writes itself.
     fn dimension_flags(doc: &mut acadrust::CadDocument) {
         for e in doc.entities_mut() {
             let acadrust::entities::EntityType::Dimension(d) = e else { continue };
@@ -360,15 +544,22 @@ mod native {
     /// Leave out what acadrust can't write as this DWG version: other programs' custom entities
     /// and objects without raw DWG data of that version. acadrust 0.6.4 refuses the whole file
     /// for one of them (0.6.3 left them out); CADCraft already tells the user which entity types
-    /// a DWG doesn't keep (`not_saved`), so the rest of the drawing is written. Returns how many.
-    fn drop_unwritable(doc: &mut acadrust::CadDocument) -> usize {
+    /// a DWG doesn't keep (`not_saved`), so the rest of the drawing is written. Returns how many
+    /// records of each DXF type were left out, so a save can say so.
+    fn drop_unwritable(doc: &mut acadrust::CadDocument) -> super::Unwritten {
         let version = doc.version;
+        let mut dropped = super::Unwritten::new();
+        let mut count = |name: &str| {
+            let n = dropped.entry(name.trim().to_ascii_uppercase()).or_insert(0);
+            *n = n.saturating_add(1);
+        };
         let unwritable: Vec<acadrust::Handle> = doc
             .entities()
             .filter_map(|e| match e {
                 acadrust::entities::EntityType::Unknown(u)
                     if u.raw_dwg_data.is_none() || u.dwg_source_version.is_some_and(|v| v != version) || version == acadrust::DxfVersion::AC1009 =>
                 {
+                    count(&u.dxf_name);
                     Some(u.common.handle)
                 }
                 _ => None,
@@ -381,9 +572,10 @@ mod native {
             .objects
             .iter()
             .filter_map(|(h, o)| match o {
-                acadrust::objects::ObjectType::Unknown { raw_dwg_data, raw_dwg_version, .. }
+                acadrust::objects::ObjectType::Unknown { type_name, raw_dwg_data, raw_dwg_version, .. }
                     if raw_dwg_data.is_none() || raw_dwg_version.is_some_and(|v| v != version) || version == acadrust::DxfVersion::AC1009 =>
                 {
+                    count(type_name);
                     Some(*h)
                 }
                 _ => None,
@@ -392,7 +584,7 @@ mod native {
         for h in &objects {
             doc.objects.remove(h);
         }
-        unwritable.len() + objects.len()
+        dropped
     }
 
     /// Header variables the DWG reader fills in but acadrust's DXF writer (0.6.3) leaves out of
@@ -460,12 +652,19 @@ mod native {
     /// Convert DXF bytes into a DWG file of the DXF's version, and at least AutoCAD 2004
     /// (AC1018).
     pub fn dxf_to_dwg(dxf: &[u8]) -> Result<Vec<u8>, String> {
-        convert(dxf, None)
+        convert(dxf, None).map(|(dwg, _)| dwg)
     }
 
     /// Convert DXF bytes into a DWG file of `version`, a code from [`super::VERSIONS`] ("AC1032"),
     /// whatever version the DXF declares.
     pub fn dxf_to_dwg_as(dxf: &[u8], version: &str) -> Result<Vec<u8>, String> {
+        dxf_to_dwg_noted(dxf, version).map(|(dwg, _)| dwg)
+    }
+
+    /// [`dxf_to_dwg_as`], also returning what the DWG writer left out: how many records of each
+    /// DXF type it can't write (other programs' custom entities and objects that the DWG reader
+    /// didn't read from a DWG of this version), empty when the DWG keeps everything.
+    pub fn dxf_to_dwg_noted(dxf: &[u8], version: &str) -> Result<(Vec<u8>, super::Unwritten), String> {
         let v = match version.trim().to_ascii_uppercase().as_str() {
             "AC1015" => acadrust::DxfVersion::AC1015,
             "AC1018" => acadrust::DxfVersion::AC1018,
@@ -512,7 +711,18 @@ mod native {
         }
     }
 
-    fn convert(dxf: &[u8], version: Option<acadrust::DxfVersion>) -> Result<Vec<u8>, String> {
+    /// The current layer (`$CLAYER`) by its name, the same way as [`current_dimstyle`]: a DWG
+    /// stores the handle of the layer, and the one read with the DXF needn't be the layer's in
+    /// the document, so the drawing reopened with layer "0" current (#2252).
+    fn current_layer(doc: &mut acadrust::CadDocument) {
+        let name = doc.header.current_layer_name.clone();
+        // The table's own lookup compares Unicode case-insensitively ("Survey_Ä" = "Survey_ä").
+        if let Some(layer) = doc.layers.get(&name) {
+            doc.header.current_layer_handle = layer.handle;
+        }
+    }
+
+    fn convert(dxf: &[u8], version: Option<acadrust::DxfVersion>) -> Result<(Vec<u8>, super::Unwritten), String> {
         // Reject a pathologically large DXF before handing it to the third-party decoder, which
         // allocates tables and section buffers from the input's declared sizes and cannot be
         // interrupted once it starts (CWE-789). This bounds the large-input variant; the decoder
@@ -536,16 +746,24 @@ mod native {
             None if doc.version < MIN_DWG_VERSION => doc.version = MIN_DWG_VERSION,
             None => {}
         }
-        other_layout_owners(&mut doc);
-        table_style_rows(&mut doc, true);
-        dimension_flags(&mut doc);
-        drop_unwritable(&mut doc);
-        current_dimstyle(&mut doc);
-        add_variable_dictionary(&mut doc);
-        current_text_style(&mut doc);
-        std::panic::catch_unwind(AssertUnwindSafe(|| acadrust::DwgWriter::write_to_vec(&doc)))
+        // The fix-ups run on the third-party reader's document, so a panic in one is an error, not a crash.
+        let unwritten = guarded(AssertUnwindSafe(|| {
+            super::fail_in_test("convert");
+            other_layout_owners(&mut doc);
+            table_style_rows(&mut doc, true);
+            dimension_flags(&mut doc);
+            let unwritten = drop_unwritable(&mut doc);
+            current_dimstyle(&mut doc);
+            add_variable_dictionary(&mut doc);
+            current_text_style(&mut doc);
+            current_layer(&mut doc);
+            unwritten
+        }))
+        .map_err(|_| "the DXF to DWG conversion failed on this file".to_string())?;
+        let dwg = std::panic::catch_unwind(AssertUnwindSafe(|| acadrust::DwgWriter::write_to_vec(&doc)))
             .map_err(|_| "the DWG writer failed on this drawing".to_string())?
-            .map_err(|e| format!("DWG write: {e}"))
+            .map_err(|e| format!("DWG write: {e}"))?;
+        Ok((dwg, unwritten))
     }
 
     /// AutoCAD's entry name for the drawing variables dictionary (the DXF Reference calls it the
@@ -639,43 +857,198 @@ mod native {
             }
         }
     }
+
+    #[cfg(test)]
+    mod post_tests {
+        use super::*;
+        use acadrust::entities::{CellRange, EntityType, Table};
+
+        fn doc_with_table(rows: usize, cols: usize, ranges: usize) -> acadrust::CadDocument {
+            let mut t = Table::new(acadrust::types::Vector3::new(0.0, 0.0, 0.0), rows, cols);
+            t.merged_ranges = (0..ranges).map(|_| CellRange::new(0, 0, rows - 1, cols - 1)).collect();
+            let mut doc = acadrust::CadDocument::new();
+            assert!(doc.add_entity(EntityType::Table(Box::new(t))).is_ok());
+            doc
+        }
+
+        /// Overlapping whole-table ranges can't make the merge pass visit more than its budget (#1934).
+        #[test]
+        fn merge_work_is_bounded_by_the_cell_budget() {
+            let mut doc = doc_with_table(10, 10, 50);
+            assert_eq!(table_merges_within(&mut doc, 250), 200, "two whole-table ranges fit, the rest are skipped");
+            let mut doc = doc_with_table(10, 10, 1);
+            assert_eq!(table_merges_within(&mut doc, usize::MAX), 100);
+        }
+
+        /// A height marked only in the style's override flags (as newer files store it) is kept,
+        /// and the same height with no flag at all is cleared (review on #2588). Tested on the
+        /// read document because acadrust's DWG writer doesn't write the override flags.
+        #[test]
+        fn a_style_override_flag_keeps_the_cell_height() {
+            use acadrust::entities::table::{CellStyle, CellStylePropertyFlags};
+            let height = |override_flags: i32| {
+                let mut doc = doc_with_table(1, 1, 0);
+                for e in doc.entities_mut() {
+                    if let EntityType::Table(t) = e {
+                        for cell in t.rows.iter_mut().flat_map(|r| r.cells.iter_mut()) {
+                            let mut s = CellStyle::new();
+                            s.text_height = 0.5;
+                            s.override_flags = override_flags;
+                            cell.style = Some(s);
+                        }
+                    }
+                }
+                table_cell_heights(&mut doc);
+                doc.entities().find_map(|e| match e {
+                    EntityType::Table(t) => t.rows.first()?.cells.first()?.style.as_ref().map(|s| s.text_height),
+                    _ => None,
+                })
+            };
+            assert_eq!(height(CellStylePropertyFlags::TEXT_HEIGHT.bits() as i32), Some(0.5));
+            assert_eq!(height(0), Some(0.0));
+        }
+
+        /// A panic in the post-read fix-ups is an error, not a crash (#1934).
+        #[test]
+        fn a_panic_in_post_processing_is_an_error() {
+            #[allow(clippy::panic)]
+            let r = guarded(AssertUnwindSafe(|| -> usize { panic!("boom") }));
+            assert!(r.is_err());
+            assert_eq!(guarded(|| 3), Ok(3));
+        }
+    }
 }
 
-#[cfg(not(target_arch = "wasm32"))]
-pub use native::{dwg_to_dxf, dwg_to_dxf_noted, dwg_to_dxf_with, dxf_to_dwg, dxf_to_dwg_as};
+#[cfg(not(no_dwg_bridge))]
+pub use native::{dwg_to_dxf, dwg_to_dxf_noted, dwg_to_dxf_with, dxf_to_dwg, dxf_to_dwg_as, dxf_to_dwg_noted};
+
+/// What saving as DWG left out: how many records of each DXF type (upper case) the DWG writer
+/// can't write.
+pub type Unwritten = std::collections::BTreeMap<String, usize>;
+
+// Test-only: the stage ("post_process" or "convert") whose guard the current test checks. The
+// stage then panics on entry, so a test through the public API shows whether it is guarded.
+#[cfg(all(test, not(no_dwg_bridge)))]
+thread_local! {
+    static PANIC_IN: std::cell::Cell<Option<&'static str>> = const { std::cell::Cell::new(None) };
+}
+
+/// Panics when a test asked for `stage` to fail (see [`PANIC_IN`]); does nothing otherwise.
+#[cfg(not(no_dwg_bridge))]
+#[allow(clippy::panic)]
+fn fail_in_test(_stage: &str) {
+    #[cfg(test)]
+    if PANIC_IN.with(|p| p.get()) == Some(_stage) {
+        panic!("test-forced panic in {_stage}");
+    }
+}
 
 /// The error for a DWG version CADCraft can't write.
-#[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+#[cfg_attr(no_dwg_bridge, allow(dead_code))]
 fn unsupported(version: &str) -> String {
     let list: Vec<&str> = VERSIONS.iter().map(|(_, year)| *year).collect();
     format!("DWG version `{version}` can't be written (CADCraft writes {})", list.join(", "))
 }
 
-#[cfg(target_arch = "wasm32")]
+/// Which build has no DWG bridge, for the stubs' errors.
+#[cfg(no_dwg_bridge)]
+const NO_BRIDGE_BUILD: &str = if cfg!(target_arch = "wasm32") { "web" } else { "FreeBSD aarch64" };
+
+/// There's no worker without a bridge.
+#[cfg(no_dwg_bridge)]
+pub const WORKER_ARG: &str = "--dwg-worker";
+#[cfg(no_dwg_bridge)]
+pub fn serve_if_asked() -> Option<i32> {
+    None
+}
+#[cfg(no_dwg_bridge)]
+pub fn use_own_worker() {}
+#[cfg(no_dwg_bridge)]
+pub fn decode(bytes: &[u8], limits: Limits) -> Result<(Vec<u8>, Vec<String>), String> {
+    dwg_to_dxf_noted(bytes, limits)
+}
+#[cfg(no_dwg_bridge)]
+pub fn encode_as(dxf: &[u8], version: &str) -> Result<Vec<u8>, String> {
+    dxf_to_dwg_as(dxf, version)
+}
+#[cfg(no_dwg_bridge)]
+pub fn encode_noted(dxf: &[u8], version: &str) -> Result<(Vec<u8>, Unwritten), String> {
+    dxf_to_dwg_noted(dxf, version)
+}
+
+#[cfg(no_dwg_bridge)]
 pub fn dwg_to_dxf(_bytes: &[u8]) -> Result<Vec<u8>, String> {
-    Err("DWG files can't be opened in the web build yet; save as DXF".into())
+    Err(format!("DWG files can't be opened in the {NO_BRIDGE_BUILD} build yet; save as DXF"))
 }
-#[cfg(target_arch = "wasm32")]
+#[cfg(no_dwg_bridge)]
 pub fn dwg_to_dxf_noted(_bytes: &[u8], _limits: Limits) -> Result<(Vec<u8>, Vec<String>), String> {
-    Err("DWG files can't be opened in the web build yet; save as DXF".into())
+    Err(format!("DWG files can't be opened in the {NO_BRIDGE_BUILD} build yet; save as DXF"))
 }
-#[cfg(target_arch = "wasm32")]
+#[cfg(no_dwg_bridge)]
 pub fn dwg_to_dxf_with(_bytes: &[u8], _limits: Limits) -> Result<Vec<u8>, String> {
-    Err("DWG files can't be opened in the web build yet; save as DXF".into())
+    Err(format!("DWG files can't be opened in the {NO_BRIDGE_BUILD} build yet; save as DXF"))
 }
-#[cfg(target_arch = "wasm32")]
+#[cfg(no_dwg_bridge)]
 pub fn dxf_to_dwg(_dxf: &[u8]) -> Result<Vec<u8>, String> {
-    Err("DWG files can't be written in the web build yet; save as DXF".into())
+    Err(format!("DWG files can't be written in the {NO_BRIDGE_BUILD} build yet; save as DXF"))
 }
-#[cfg(target_arch = "wasm32")]
+#[cfg(no_dwg_bridge)]
 pub fn dxf_to_dwg_as(_dxf: &[u8], _version: &str) -> Result<Vec<u8>, String> {
-    Err("DWG files can't be written in the web build yet; save as DXF".into())
+    Err(format!("DWG files can't be written in the {NO_BRIDGE_BUILD} build yet; save as DXF"))
+}
+#[cfg(no_dwg_bridge)]
+pub fn dxf_to_dwg_noted(_dxf: &[u8], _version: &str) -> Result<(Vec<u8>, Unwritten), String> {
+    Err(format!("DWG files can't be written in the {NO_BRIDGE_BUILD} build yet; save as DXF"))
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    /// The DXF of an empty drawing, enough for the bridge to make a small DWG.
+    #[cfg(not(no_dwg_bridge))]
+    const MINIMAL_DXF: &str = "  0\nSECTION\n  2\nHEADER\n  9\n$ACADVER\n  1\nAC1032\n  0\nENDSEC\n  0\nEOF\n";
+
+    /// Makes `stage` panic on the current thread until dropped.
+    #[cfg(not(no_dwg_bridge))]
+    struct PanicIn;
+
+    #[cfg(not(no_dwg_bridge))]
+    impl PanicIn {
+        fn at(stage: &'static str) -> Self {
+            PANIC_IN.with(|p| p.set(Some(stage)));
+            Self
+        }
+    }
+
+    #[cfg(not(no_dwg_bridge))]
+    impl Drop for PanicIn {
+        fn drop(&mut self) {
+            PANIC_IN.with(|p| p.set(None));
+        }
+    }
+
+    /// The public read reports a panic in the post-read fix-ups as an error: this fails if the
+    /// `guarded` call around `post_process` is taken out (#2402).
+    #[cfg(not(no_dwg_bridge))]
+    #[test]
+    fn reading_a_dwg_survives_a_panic_in_post_processing() {
+        let dwg = dxf_to_dwg(MINIMAL_DXF.as_bytes()).unwrap();
+        assert!(dwg_to_dxf(&dwg).is_ok(), "the DWG reads without the forced panic");
+        let _panic = PanicIn::at("post_process");
+        let err = dwg_to_dxf(&dwg).unwrap_err();
+        assert!(err.contains("the DWG post-processing failed on this file"), "{err}");
+    }
+
+    /// The DXF to DWG conversion reports a panic in its fix-ups as an error, not a crash (#2402).
+    #[cfg(not(no_dwg_bridge))]
+    #[test]
+    fn converting_to_dwg_survives_a_panic_in_the_fix_ups() {
+        let _panic = PanicIn::at("convert");
+        let err = dxf_to_dwg(MINIMAL_DXF.as_bytes()).unwrap_err();
+        assert!(err.contains("the DXF to DWG conversion failed on this file"), "{err}");
+    }
+
     #[test]
     fn detects_magic() {
         assert!(is_dwg(b"AC1032\0\0\0\0"));
@@ -685,7 +1058,7 @@ mod tests {
 
     /// A DXF with ROMANS as `$TEXTSTYLE` gives a DWG whose current text style is ROMANS, not
     /// Standard: the DXF names the style, and the handle read with it was Standard's (#1650).
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(not(no_dwg_bridge))]
     #[test]
     fn current_text_style_reaches_the_dwg() {
         let header = "  0\nSECTION\n  2\nHEADER\n  9\n$ACADVER\n  1\nAC1032\n  9\n$TEXTSTYLE\n  7\nROMANS\n  0\nENDSEC\n";
@@ -705,7 +1078,7 @@ mod tests {
         assert!(dwg_to_dxf(b"").is_err());
     }
 
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(not(no_dwg_bridge))]
     #[test]
     fn dxf_to_dwg_rejects_garbage_without_crashing() {
         // The DXF→DWG path runs the third-party reader inside catch_unwind and reports failures
@@ -715,7 +1088,7 @@ mod tests {
     }
 
     /// A DXF with one DIMENSION per (text, group 70, subclass, points) row.
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(not(no_dwg_bridge))]
     fn dims_dxf(dims: &[(&str, i64, &str, &[(i32, [f64; 2])])]) -> String {
         let mut s = String::from("  0\nSECTION\n  2\nHEADER\n  9\n$ACADVER\n  1\nAC1032\n  0\nENDSEC\n  0\nSECTION\n  2\nENTITIES\n");
         for (text, flags, sub, pts) in dims {
@@ -732,7 +1105,7 @@ mod tests {
     /// the text is at its default position), and bit 32 in bit 1 (ODA DWG specification, common
     /// dimension data). The bytes are read back raw, so a reader that inverts bit 0 the same way
     /// as the writer can't hide a wrong byte.
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(not(no_dwg_bridge))]
     #[test]
     fn dimension_text_position_flags_reach_the_dwg_as_autocad_reads_them() {
         let linear: &[(i32, [f64; 2])] = &[(13, [0.0, 0.0]), (14, [100.0, 0.0])];
@@ -779,7 +1152,7 @@ mod tests {
     }
 
     /// The handles a DXF text refers to or gives its records (groups 5, 105 and 330–369).
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(not(no_dwg_bridge))]
     fn dxf_handles(dxf: &str) -> std::collections::HashSet<u64> {
         let lines: Vec<&str> = dxf.lines().collect();
         lines
@@ -796,7 +1169,7 @@ mod tests {
     /// 1.2 GB DXF rendition over the limit, so it didn't open). They're left out with a note, and
     /// their dictionary entries with them; the definition and every component it reaches —
     /// through compound and point components, around a cycle — are kept.
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(not(no_dwg_bridge))]
     #[test]
     fn orphaned_dgn_line_style_components_are_left_out() {
         use acadrust::objects::*;
@@ -911,4 +1284,94 @@ mod tests {
         assert!(ls.contains(&"LSDEFINITION") && !ls.contains(&"LSINTERNALCOMPONENT"), "{ls:?}");
         assert_eq!(notes, ["DWG: 3 DGN line style components that no line style definition uses were left out"]);
     }
+
+    /// AutoCAD's DWG scale action (BLOCKSCALEACTION) ends with a byte after its three
+    /// connections that DXF doesn't carry. acadrust 0.6.4 neither read nor wrote it, so AutoCAD
+    /// read past the object and refused every DWG CADCraft wrote with a dynamic block that scales
+    /// ("Error Decrypting Data"); 0.6.5 added it and 0.6.6, which this uses, still keeps it (0.6.6 also
+    /// fixes multi-layout DWGs, #1463). The byte reaches the DWG, and a scale action
+    /// from DXF is written whole, with the byte AutoCAD writes (0).
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn scale_actions_keep_the_byte_autocad_reads_after_their_connections() {
+        use acadrust::objects::*;
+        let scale_action = |doc: &acadrust::CadDocument| {
+            doc.objects.values().find_map(|o| match o {
+                ObjectType::DynamicBlock(DynamicBlockObject { data: DynamicBlockData::ScaleAction(s), .. }) => Some(s.clone()),
+                _ => None,
+            })
+        };
+        let mut doc = acadrust::CadDocument::new();
+        let h = doc.allocate_handle();
+        let conn = |code, name: &str| BlockConnection { code, name: name.into() };
+        let mut action = DynamicBlockObject::new("BLOCKSCALEACTION", "AcDbBlockScaleAction");
+        action.handle = h;
+        action.owner = doc.header.named_objects_dict_handle;
+        let mut a = BlockBasePointAction::default();
+        a.action.action.element.name = "Scale".into();
+        a.action.connections = vec![conn(2, "UpdatedBaseX"), conn(2, "UpdatedBaseY")];
+        a.action.dependent = true;
+        a.connections = vec![conn(2, "Scale"), conn(2, "XScale"), conn(2, "YScale")];
+        a.dwg_tail_byte = 7;
+        action.data = DynamicBlockData::ScaleAction(a.clone());
+        doc.objects.insert(h, ObjectType::DynamicBlock(action));
+
+        let dwg = acadrust::DwgWriter::write_to_vec(&doc).unwrap();
+        let back = acadrust::DwgReader::from_stream(std::io::Cursor::new(dwg)).read().unwrap();
+        assert_eq!(scale_action(&back).map(|s| s.dwg_tail_byte), Some(7), "the byte isn't written");
+
+        let mut dxf = Vec::new();
+        acadrust::DxfWriter::new(&doc).write_to_writer(&mut dxf).unwrap();
+        for version in ["AC1018", "AC1032"] {
+            let dwg = dxf_to_dwg_as(&dxf, version).unwrap();
+            let back = acadrust::DwgReader::from_stream(std::io::Cursor::new(dwg)).read().unwrap();
+            let read = scale_action(&back).unwrap_or_else(|| panic!("{version}: the scale action wasn't written"));
+            assert_eq!(read.connections, a.connections, "{version}");
+            assert_eq!(read.action.connections, a.action.connections, "{version}");
+            assert_eq!(read.dwg_tail_byte, 0, "{version}");
+        }
+    }
+
+    /// Saving says what the DWG writer left out, per type: entities of types acadrust's DXF
+    /// reader doesn't model (another program's custom entity) can't be written; a drawing the DWG
+    /// keeps whole reports nothing.
+    #[cfg(not(no_dwg_bridge))]
+    #[test]
+    fn saving_lists_the_types_the_dwg_writer_leaves_out() {
+        let line = "  0\nLINE\n  8\n0\n100\nAcDbEntity\n100\nAcDbLine\n 10\n0.0\n 20\n0.0\n 30\n0.0\n 11\n10.0\n 21\n0.0\n 31\n0.0\n";
+        let widget = "  0\nACME_WIDGET\n  8\n0\n100\nAcDbEntity\n100\nAcmeWidget\n 10\n1.0\n 20\n2.0\n 30\n0.0\n";
+        let dxf = |body: &str| {
+            format!("  0\nSECTION\n  2\nHEADER\n  9\n$ACADVER\n  1\nAC1032\n  0\nENDSEC\n  0\nSECTION\n  2\nENTITIES\n{body}  0\nENDSEC\n  0\nEOF\n")
+        };
+        for version in ["AC1015", "AC1018", "AC1032"] {
+            let (dwg, unwritten) = dxf_to_dwg_noted(dxf(&format!("{line}{widget}{widget}")).as_bytes(), version).unwrap();
+            assert!(is_dwg(&dwg), "{version}");
+            assert_eq!(unwritten, [("ACME_WIDGET".to_string(), 2)].into_iter().collect::<Unwritten>(), "{version}");
+        }
+        let (_, unwritten) = dxf_to_dwg_noted(dxf(line).as_bytes(), "AC1032").unwrap();
+        assert!(unwritten.is_empty(), "{unwritten:?}");
+    }
+
+    /// An OLE2FRAME, which CADCraft keeps as its DXF groups without modelling it, is written to
+    /// the DWG with its data: it isn't in the list of what the writer left out.
+    #[cfg(not(no_dwg_bridge))]
+    #[test]
+    fn ole_frames_are_written_with_their_data() {
+        let ole = "  0\nOLE2FRAME\n  8\n0\n100\nAcDbEntity\n100\nAcDbOle2Frame\n 70\n2\n 10\n1.0\n 20\n9.0\n 30\n0.0\n 11\n8.0\n 21\n2.0\n 31\n0.0\n 71\n2\n 72\n0\n 73\n1\n 90\n4\n310\nDEADBEEF\n  1\nOLE\n";
+        let dxf =
+            format!("  0\nSECTION\n  2\nHEADER\n  9\n$ACADVER\n  1\nAC1032\n  0\nENDSEC\n  0\nSECTION\n  2\nENTITIES\n{ole}  0\nENDSEC\n  0\nEOF\n");
+        for version in ["AC1015", "AC1018", "AC1032"] {
+            let (dwg, unwritten) = dxf_to_dwg_noted(dxf.as_bytes(), version).unwrap();
+            assert!(unwritten.is_empty(), "{version} {unwritten:?}");
+            let back = acadrust::DwgReader::from_stream(std::io::Cursor::new(dwg)).read().unwrap();
+            let frames: Vec<Vec<u8>> = back
+                .entities()
+                .filter_map(|e| match e {
+                    acadrust::entities::EntityType::Ole2Frame(o) => Some(o.encoded_payload()),
+                    _ => None,
+                })
+                .collect();
+            assert_eq!(frames, [vec![0xDE, 0xAD, 0xBE, 0xEF]], "{version}");
+        }
+    }
 }

crates/dwg/src/worker.rs

@@ -0,0 +1,333 @@
+//! The DWG reader and writer in a child process.
+//!
+//! An allocation failure or stack overflow in the third-party code ends the process it runs in, and
+//! `catch_unwind` can't stop that. So the app runs them in a copy of itself: [`use_own_worker`] says
+//! how to start one, and [`serve_if_asked`], first thing in `main`, turns the copy into a worker
+//! that reads one request from standard input and writes one reply to standard output. A file that
+//! kills the worker then costs that one open or save, and every other open drawing stays safe.
+//!
+//! Without a worker (libraries, tests, a build that can't start one) [`decode`] and [`encode_as`]
+//! run in the calling process, as they always did. There's no memory limit on the worker yet: that
+//! takes per-platform system calls, which `unsafe_code = "forbid"` keeps out of this crate.
+//!
+//! A reply comes from a process that just handled a possibly hostile file, so it is parsed as
+//! untrusted input.
+
+use std::ffi::OsString;
+use std::io::{Read, Write};
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+use std::sync::Mutex;
+use std::sync::mpsc::{RecvTimeoutError, channel};
+use std::time::Duration;
+
+use super::Limits;
+
+/// The argument that makes the app a worker.
+pub const WORKER_ARG: &str = "--dwg-worker";
+/// Bumped when the messages change: an app updated while running may start a newer copy.
+const PROTOCOL: u8 = 1;
+const DECODE: u8 = 1;
+const ENCODE: u8 = 2;
+const CRASH: u8 = 0xff;
+/// How long one file may take before the worker is stopped. It can't be interrupted otherwise.
+const TIMEOUT: Duration = Duration::from_secs(30 * 60);
+/// Most bytes accepted for what a reply carries besides the drawing.
+const MAX_NOTES_BYTES: u64 = 64 << 20;
+/// Most bytes accepted as a written DWG.
+const MAX_DWG_REPLY: u64 = 2 << 30;
+/// Most bytes one request holds: the largest input, whichever the direction, and its header.
+const MAX_REQUEST: u64 = (2 << 30) + 256;
+
+struct Worker {
+    program: PathBuf,
+    args: Vec<OsString>,
+}
+
+static WORKER: Mutex<Option<Worker>> = Mutex::new(None);
+
+/// Start `program args` as the worker from now on. `program` must call [`serve_if_asked`].
+pub fn use_worker(program: PathBuf, args: Vec<OsString>) {
+    if let Ok(mut w) = WORKER.lock() {
+        *w = Some(Worker { program, args });
+    }
+}
+
+/// Use a copy of this program as the worker, started with [`WORKER_ARG`]. If its path can't be
+/// found, the reader and writer stay in this process.
+pub fn use_own_worker() {
+    match std::env::current_exe() {
+        Ok(program) => use_worker(program, vec![WORKER_ARG.into()]),
+        Err(e) => log::warn!("DWG worker: can't find this program: {e}"),
+    }
+}
+
+/// Serve one request and return the exit code if this process was started as a worker.
+pub fn serve_if_asked() -> Option<i32> {
+    (std::env::args_os().nth(1)? == WORKER_ARG).then(|| serve(std::io::stdin().lock(), std::io::stdout().lock()))
+}
+
+/// [`super::dwg_to_dxf_noted`] in the worker, when there is one.
+pub fn decode(bytes: &[u8], limits: Limits) -> Result<(Vec<u8>, Vec<String>), String> {
+    // Before starting a process, and so the same limit holds with or without one.
+    if bytes.len() > limits.max_dwg_bytes {
+        return super::dwg_to_dxf_noted(bytes, limits);
+    }
+    let reply_limit = (limits.max_dxf_bytes as u64).saturating_add(MAX_NOTES_BYTES);
+    match call(&request(DECODE, limits, ""), bytes, reply_limit, "reading this file") {
+        Some(reply) => reply?,
+        None => super::dwg_to_dxf_noted(bytes, limits),
+    }
+}
+
+/// [`super::dxf_to_dwg_as`] in the worker, when there is one.
+pub fn encode_as(dxf: &[u8], version: &str) -> Result<Vec<u8>, String> {
+    encode_noted(dxf, version).map(|(dwg, _)| dwg)
+}
+
+/// [`super::dxf_to_dwg_noted`] in the worker, when there is one. What the writer left out comes
+/// back as notes of `TYPE<tab>count`.
+pub fn encode_noted(dxf: &[u8], version: &str) -> Result<(Vec<u8>, super::Unwritten), String> {
+    if u8::try_from(version.len()).is_err() {
+        return Err(super::unsupported(version));
+    }
+    match call(&request(ENCODE, Limits::DEFAULT, version), dxf, MAX_DWG_REPLY, "writing this file") {
+        Some(reply) => reply?.map(|(dwg, notes)| (dwg, unwritten_from(&notes))),
+        None => super::dxf_to_dwg_noted(dxf, version),
+    }
+}
+
+fn unwritten_from(notes: &[String]) -> super::Unwritten {
+    notes.iter().filter_map(|n| n.split_once('\t')).filter_map(|(kind, n)| Some((kind.to_string(), n.parse::<usize>().ok()?))).fold(
+        super::Unwritten::new(),
+        |mut m, (kind, n)| {
+            *m.entry(kind).or_insert(0) = n;
+            m
+        },
+    )
+}
+
+/// Make the worker abort, as the third-party code can: what the tests prove isolation with.
+#[doc(hidden)]
+pub fn crash_worker_for_test() -> Result<(), String> {
+    call(&request(CRASH, Limits::DEFAULT, ""), &[], 1024, "testing").ok_or("no worker")??.map(|_| ())
+}
+
+fn request(op: u8, limits: Limits, version: &str) -> Vec<u8> {
+    let mut r = vec![PROTOCOL, op];
+    r.extend((limits.max_dwg_bytes as u64).to_le_bytes());
+    r.extend((limits.max_dxf_bytes as u64).to_le_bytes());
+    r.push(u8::try_from(version.len()).unwrap_or(0));
+    r.extend(version.as_bytes());
+    r
+}
+
+type Reply = Result<(Vec<u8>, Vec<String>), String>;
+
+/// Run one request in a worker. `None`: none could be started, so the caller does the work.
+/// `Err`: the worker went wrong, and `doing` says at what, for the user.
+fn call(header: &[u8], payload: &[u8], reply_limit: u64, doing: &str) -> Option<Result<Reply, String>> {
+    let mut command = {
+        let worker = WORKER.lock().ok()?;
+        let worker = worker.as_ref()?;
+        let mut c = Command::new(&worker.program);
+        c.args(&worker.args);
+        c
+    };
+    command.stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::null());
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+        const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+        command.creation_flags(CREATE_NO_WINDOW);
+    }
+    let mut child = match command.spawn() {
+        Ok(c) => c,
+        Err(e) => {
+            log::warn!("DWG worker: can't start it: {e}");
+            return None;
+        }
+    };
+    let (Some(mut to_child), Some(from_child)) = (child.stdin.take(), child.stdout.take()) else {
+        let _ = child.kill();
+        let _ = child.wait();
+        return None;
+    };
+    let received = std::thread::scope(|scope| {
+        // Written beside the read: a worker that replies before it has read everything, or dies,
+        // must block neither side. A failed write shows up as the reply going wrong.
+        scope.spawn(move || {
+            let _ = to_child.write_all(header).and_then(|()| to_child.write_all(payload));
+        });
+        let (tx, rx) = channel();
+        scope.spawn(move || {
+            let mut reply = Vec::new();
+            let read = from_child.take(reply_limit).read_to_end(&mut reply);
+            let _ = tx.send(read.map(|_| reply));
+        });
+        let received = rx.recv_timeout(TIMEOUT);
+        if matches!(received, Err(RecvTimeoutError::Timeout)) {
+            let _ = child.kill();
+        }
+        received
+    });
+    let status = child.wait();
+    let stopped = || format!("the DWG worker stopped while {doing}; nothing else is affected");
+    Some(match (received, status) {
+        (Err(RecvTimeoutError::Timeout), _) => Err(format!("{doing} took too long, so the DWG worker was stopped; nothing else is affected")),
+        (Ok(Ok(reply)), Ok(status)) if status.success() => parse_reply(reply).ok_or_else(stopped),
+        _ => Err(stopped()),
+    })
+}
+
+/// Take `n` bytes off the front of `b`.
+fn take<'a>(b: &mut &'a [u8], n: usize) -> Option<&'a [u8]> {
+    let (head, tail) = b.split_at_checked(n)?;
+    *b = tail;
+    Some(head)
+}
+
+fn take_u32(b: &mut &[u8]) -> Option<usize> {
+    let bytes: [u8; 4] = take(b, 4)?.try_into().ok()?;
+    usize::try_from(u32::from_le_bytes(bytes)).ok()
+}
+
+fn take_u64(b: &mut &[u8]) -> Option<u64> {
+    Some(u64::from_le_bytes(take(b, 8)?.try_into().ok()?))
+}
+
+/// A reply: 0, the note count, each note with its length, then the bytes with their length; or 1
+/// and a message. `None` when it isn't one, whole. Takes the reply, because the bytes can be most
+/// of the memory the app may use: they are kept, not copied.
+fn parse_reply(mut reply: Vec<u8>) -> Option<Reply> {
+    let total = reply.len();
+    let mut b = &reply[..];
+    match *take(&mut b, 1)?.first()? {
+        0 => {
+            let count = take_u32(&mut b)?;
+            let mut notes = Vec::new();
+            for _ in 0..count {
+                let n = take_u32(&mut b)?;
+                notes.push(String::from_utf8_lossy(take(&mut b, n)?).into_owned());
+            }
+            let n = usize::try_from(take_u64(&mut b)?).ok()?;
+            if b.len() != n {
+                return None;
+            }
+            reply.drain(..total - n);
+            Some(Ok((reply, notes)))
+        }
+        1 => Some(Err(String::from_utf8_lossy(b).into_owned())),
+        _ => None,
+    }
+}
+
+fn write_reply(out: &mut impl Write, reply: Reply) -> std::io::Result<()> {
+    match reply {
+        Ok((bytes, notes)) => {
+            out.write_all(&[0])?;
+            out.write_all(&u32::try_from(notes.len()).unwrap_or(0).to_le_bytes())?;
+            for note in &notes {
+                out.write_all(&u32::try_from(note.len()).unwrap_or(0).to_le_bytes())?;
+                if u32::try_from(note.len()).is_ok() {
+                    out.write_all(note.as_bytes())?;
+                }
+            }
+            out.write_all(&(bytes.len() as u64).to_le_bytes())?;
+            out.write_all(&bytes)?;
+        }
+        Err(e) => {
+            out.write_all(&[1])?;
+            out.write_all(e.as_bytes())?;
+        }
+    }
+    out.flush()
+}
+
+/// What a request asks for, or why it can't be served.
+fn handle(mut b: &[u8]) -> Reply {
+    let bad = || "the DWG worker got a request it can't read (a different CADCraft version?)".to_string();
+    if take(&mut b, 1).and_then(<[u8]>::first) != Some(&PROTOCOL) {
+        return Err(bad());
+    }
+    let op = take(&mut b, 1).and_then(<[u8]>::first).copied().ok_or_else(bad)?;
+    let max_dwg_bytes = take_u64(&mut b).and_then(|n| usize::try_from(n).ok()).ok_or_else(bad)?;
+    let max_dxf_bytes = take_u64(&mut b).and_then(|n| usize::try_from(n).ok()).ok_or_else(bad)?;
+    let version_len = take(&mut b, 1).and_then(<[u8]>::first).copied().ok_or_else(bad)?;
+    let version = take(&mut b, usize::from(version_len)).and_then(|v| std::str::from_utf8(v).ok()).ok_or_else(bad)?;
+    match op {
+        DECODE => super::dwg_to_dxf_noted(b, Limits { max_dwg_bytes, max_dxf_bytes }),
+        ENCODE => super::dxf_to_dwg_noted(b, version).map(|(dwg, left_out)| (dwg, left_out.iter().map(|(kind, n)| format!("{kind}\t{n}")).collect())),
+        CRASH => std::process::abort(),
+        _ => Err(bad()),
+    }
+}
+
+/// Serve the one request on `input`. The exit code is 0 unless the reply couldn't be sent.
+fn serve(input: impl Read, mut output: impl Write) -> i32 {
+    let mut request = Vec::new();
+    let reply = match input.take(MAX_REQUEST).read_to_end(&mut request) {
+        Ok(_) => handle(&request),
+        Err(e) => Err(format!("the DWG worker could not read its request: {e}")),
+    };
+    i32::from(write_reply(&mut output, reply).is_err())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn wire(reply: Reply) -> Vec<u8> {
+        let mut out = Vec::new();
+        write_reply(&mut out, reply).unwrap();
+        out
+    }
+
+    #[test]
+    fn what_the_writer_left_out_survives_the_reply() {
+        let notes = vec!["ACME_WIDGET\t2".to_string(), "not a count".to_string(), "X\tmany".to_string()];
+        assert_eq!(unwritten_from(&notes), [("ACME_WIDGET".to_string(), 2)].into_iter().collect());
+    }
+
+    #[test]
+    fn replies_round_trip() {
+        let ok: Reply = Ok((b"bytes".to_vec(), vec!["one".into(), "two é".into()]));
+        assert_eq!(parse_reply(wire(ok.clone())), Some(ok));
+        let failed: Reply = Err("DWG: no".into());
+        assert_eq!(parse_reply(wire(failed.clone())), Some(failed));
+    }
+
+    #[test]
+    fn a_reply_cut_short_or_made_up_is_refused() {
+        let whole = wire(Ok((b"bytes".to_vec(), vec!["note".into()])));
+        for n in 0..whole.len() {
+            assert_eq!(parse_reply(whole[..n].to_vec()), None, "cut at {n}");
+        }
+        assert_eq!(parse_reply(vec![7, 0, 0]), None);
+        // A note count far beyond what follows ends at the first missing note.
+        assert_eq!(parse_reply(vec![0, 0xff, 0xff, 0xff, 0xff]), None);
+        assert_eq!(parse_reply(vec![0, 1, 0, 0, 0, 0xff, 0xff, 0xff, 0xff]), None);
+    }
+
+    #[test]
+    fn a_request_it_cannot_read_is_an_error_not_a_crash() {
+        for request in [
+            &[][..],
+            &[PROTOCOL + 1, DECODE],
+            &[PROTOCOL],
+            &[PROTOCOL, DECODE, 1, 2, 3],
+            &[PROTOCOL, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+        ] {
+            assert!(handle(request).is_err(), "{request:?}");
+        }
+    }
+
+    #[test]
+    fn serving_reports_a_decode_failure_as_a_reply() {
+        let mut request = self::request(DECODE, Limits::DEFAULT, "");
+        request.extend(b"AC1032 not really a drawing");
+        let mut out = Vec::new();
+        assert_eq!(serve(&request[..], &mut out), 0);
+        assert!(matches!(parse_reply(out.clone()), Some(Err(_))), "{out:?}");
+    }
+}

crates/dxf/src/codepage.rs

@@ -69,6 +69,42 @@ pub fn decode_code_page(bytes: &[u8], code_page: &str) -> Option<String> {
     decoder(code_page).map(|d| decode(bytes, d).into_owned())
 }
 
+/// The code page a pre-2007 file's text is written in, or `None` for pure ASCII with escapes:
+/// when CADCraft doesn't know `code_page`, and for `ASCII` (the reader takes such files as
+/// Windows-1252, but a writer must keep them ASCII) and `UTF8`/`UNICODE`, which no pre-2007
+/// reader expects.
+pub(crate) fn encoder(code_page: &str) -> Option<Decoder> {
+    if code_page.trim().eq_ignore_ascii_case("ASCII") {
+        return None;
+    }
+    decoder(code_page).filter(|d| !matches!(d, Decoder::Utf8))
+}
+
+/// Append the bytes of the non-ASCII character `c` in the code page `d`, and return true, when
+/// the code page has it; otherwise append nothing and return false (the caller escapes it).
+pub(crate) fn encode_char(c: char, d: Decoder, out: &mut Vec<u8>) -> bool {
+    let mut buf = [0; 4];
+    match d {
+        // Not a pre-2007 code page ([`encoder`] never gives it): escaped.
+        Decoder::Utf8 => return false,
+        Decoder::Encoding(e) => {
+            let (bytes, _, unmappable) = e.encode(c.encode_utf8(&mut buf));
+            // A code page byte that is ASCII would read back as another character, and a NUL,
+            // CR or LF would break the group, so only all-high-bit sequences or proper double-byte
+            // characters are kept (their trail byte may be ASCII, as in Shift-JIS).
+            if unmappable || bytes.is_empty() || !bytes.first().is_some_and(|b| *b >= 0x80) || bytes.iter().any(|b| matches!(b, 0 | b'\r' | b'\n')) {
+                return false;
+            }
+            out.extend_from_slice(&bytes);
+        }
+        Decoder::Table(t) => {
+            let Some(i) = t.iter().position(|&x| x == c).and_then(|i| u8::try_from(i).ok()) else { return false };
+            out.push(0x80 | i);
+        }
+    }
+    true
+}
+
 /// Decode bytes with a decoder. UTF-8 that isn't valid falls back to Windows-1252.
 pub(crate) fn decode(bytes: &[u8], d: Decoder) -> Cow<'_, str> {
     match d {

crates/dxf/src/lib.rs

@@ -8,6 +8,7 @@
 #![forbid(unsafe_code)]
 
 use std::fmt::Write as _;
+use std::io::Write as _;
 
 mod version;
 pub use version::Version;
@@ -22,8 +23,11 @@ pub enum DxfError {
     Eof,
     /// More group codes than [`MAX_TAGS`]: `tags` is the count found (or the count read when the
     /// limit was reached), `limit` the maximum.
-    #[error("drawing too large: {tags} DXF group codes, more than the {limit} CADCraft reads")]
+    #[error("drawing too large: {tags} DXF group codes, more than the {limit} CADCraft reads (set CADCRAFT_MAX_DXF_TAGS to read more)")]
     TooLarge { tags: usize, limit: usize },
+    /// The memory for `tags` group codes couldn't be had: an error, not the process ending.
+    #[error("not enough memory to read this drawing's {tags} DXF group codes")]
+    OutOfMemory { tags: usize },
 }
 
 pub type Result<T> = std::result::Result<T, DxfError>;
@@ -162,16 +166,32 @@ fn typed(code: i32, text: &str) -> Value {
 }
 
 const BINARY_SENTINEL: &[u8] = b"AutoCAD Binary DXF\r\n\x1a\0";
-/// Most group codes read from one file. A `Tag` takes 40 bytes plus its text, so this bounds the
-/// tag list to a few GB; real drawings stay far below (a 10 MB DWG is typically a few million).
-pub const MAX_TAGS: usize = 50_000_000;
+/// Most group codes read from one file by default. A `Tag` takes 40 bytes plus its text, so this
+/// bounds the tag list to about 4 GB plus text. 50 million rejected large DWGs that converted fine
+/// (a 172 MB drawing has 56 million, issue #1948). The file-size limits bound memory too: 512 MB
+/// for a DXF opened directly, 1 GB for a DWG's DXF rendition. Set `CADCRAFT_MAX_DXF_TAGS` to
+/// raise or lower it.
+pub const MAX_TAGS: usize = 100_000_000;
+
+/// Environment variable overriding [`MAX_TAGS`] (a positive integer).
+pub const MAX_TAGS_ENV: &str = "CADCRAFT_MAX_DXF_TAGS";
+
+/// The group-code limit in effect: [`MAX_TAGS_ENV`] when set to a positive integer, else
+/// [`MAX_TAGS`].
+pub fn max_tags() -> usize {
+    max_tags_from(std::env::var(MAX_TAGS_ENV).ok().as_deref())
+}
+
+fn max_tags_from(v: Option<&str>) -> usize {
+    v.and_then(|s| s.trim().replace('_', "").parse::<usize>().ok()).filter(|&n| n > 0).unwrap_or(MAX_TAGS)
+}
 
 mod codepage;
 pub use codepage::decode_code_page;
 
 /// Parse a DXF file (ASCII or binary).
 pub fn parse(bytes: &[u8]) -> Result<Vec<Tag>> {
-    parse_with_limit(bytes, MAX_TAGS)
+    parse_with_limit(bytes, max_tags())
 }
 
 /// [`parse`] with an explicit group-code limit. For ASCII DXF the limit is checked up front from
@@ -181,12 +201,24 @@ pub fn parse_with_limit(bytes: &[u8], max_tags: usize) -> Result<Vec<Tag>> {
     if let Some(body) = bytes.strip_prefix(BINARY_SENTINEL) {
         return parse_binary_with_limit(body, max_tags);
     }
-    // Every group code takes two lines (code, value).
-    let tags = bytes.iter().filter(|&&b| b == b'\n').count().div_ceil(2);
+    // Count nonblank group-code/value pairs, stopping at EOF just as the parser does.
+    let mut lines = bytes.split(|&b| b == b'\n');
+    let mut tags = 0;
+    while let Some(code) = lines.next() {
+        let code = code.trim_ascii();
+        if code.is_empty() {
+            continue;
+        }
+        let Some(value) = lines.next() else { break };
+        tags += 1;
+        if code == b"0" && value.trim_ascii() == b"EOF" {
+            break;
+        }
+    }
     if tags > max_tags {
         return Err(DxfError::TooLarge { tags, limit: max_tags });
     }
-    parse_ascii_with_limit(&codepage::decode_ascii_file(bytes), max_tags)
+    parse_ascii_counted(&codepage::decode_ascii_file(bytes), max_tags, tags)
 }
 
 /// The four hex digits of a `\U+XXXX` escape starting at `chars[i]`, if there is one.
@@ -258,13 +290,18 @@ fn unescape_unicode(s: &str) -> String {
 }
 
 pub fn parse_ascii(text: &str) -> Result<Vec<Tag>> {
-    parse_ascii_with_limit(text, MAX_TAGS)
+    parse_ascii_counted(text, max_tags(), 0)
 }
 
+/// [`parse_ascii`] of a file known to hold `expected` group codes. Their list is reserved first,
+/// with an allocation that can fail: where the system refuses that much memory, opening the file
+/// is an error instead of the end of the app. Growing the list instead could also briefly take
+/// half as much again.
 #[allow(clippy::while_let_loop)]
-fn parse_ascii_with_limit(text: &str, max_tags: usize) -> Result<Vec<Tag>> {
+fn parse_ascii_counted(text: &str, max_tags: usize, expected: usize) -> Result<Vec<Tag>> {
     let mut tags = Vec::new();
-    let mut lines = text.lines().enumerate();
+    tags.try_reserve_exact(expected.min(max_tags)).map_err(|_| DxfError::OutOfMemory { tags: expected })?;
+    let mut lines = text.strip_prefix('\u{feff}').unwrap_or(text).lines().enumerate();
     loop {
         let Some((ln, code_line)) = lines.next() else { break };
         let ct = code_line.trim();
@@ -344,7 +381,7 @@ impl<'a> Cur<'a> {
 
 /// Binary DXF (R13+: 2-byte group codes).
 pub fn parse_binary(b: &[u8]) -> Result<Vec<Tag>> {
-    parse_binary_with_limit(b, MAX_TAGS)
+    parse_binary_with_limit(b, max_tags())
 }
 
 fn parse_binary_with_limit(b: &[u8], max_tags: usize) -> Result<Vec<Tag>> {
@@ -409,17 +446,48 @@ pub fn write_ascii(tags: &[Tag]) -> String {
 /// characters as they are) or escaped as `\U+XXXX` (older versions, see [`write_ascii`]). Line
 /// breaks inside strings become spaces either way.
 pub fn write_ascii_as(tags: &[Tag], utf8: bool) -> String {
-    let mut out = String::with_capacity(tags.len() * 16);
+    let bytes = ascii(tags, if utf8 { Strings::Utf8 } else { Strings::Escaped(None) });
+    // Both forms are UTF-8 (the escaped one is ASCII).
+    String::from_utf8(bytes).unwrap_or_else(|e| String::from_utf8_lossy(e.as_bytes()).into_owned())
+}
+
+/// Write tags as pre-R2007 ASCII DXF with text in the code page `code_page` names (a
+/// `$DWGCODEPAGE` value such as `ANSI_1252`), as the DXF Reference describes for those versions:
+/// a character the code page has is written as its bytes, any other as a `\U+XXXX` escape. A
+/// code page CADCraft doesn't know, `ASCII`, and `UTF8`/`UNICODE` (not a pre-2007 code page)
+/// give [`write_ascii`]'s pure ASCII output. So does a file whose code page bytes happen to be
+/// valid UTF-8 (`СІ` in ANSI_1251 is D1 B2, U+0472), since readers, ours included, take an ASCII
+/// DXF that is valid UTF-8 as UTF-8.
+pub fn write_ascii_in(tags: &[Tag], code_page: &str) -> Vec<u8> {
+    let bytes = ascii(tags, Strings::Escaped(codepage::encoder(code_page)));
+    if !bytes.is_ascii() && std::str::from_utf8(&bytes).is_ok() {
+        return ascii(tags, Strings::Escaped(None));
+    }
+    bytes
+}
+
+/// How a writer stores string values.
+#[derive(Clone, Copy)]
+enum Strings {
+    /// As they are (R2007+).
+    Utf8,
+    /// ASCII as it is, other characters in this code page when it has them, otherwise as
+    /// `\U+XXXX` escapes (before R2007).
+    Escaped(Option<codepage::Decoder>),
+}
+
+fn ascii(tags: &[Tag], strings: Strings) -> Vec<u8> {
+    let mut out = Vec::with_capacity(tags.len() * 16);
     for t in tags {
         let _ = write!(out, "{:>3}\r\n", t.code);
         match &t.value {
-            Value::Str(s) => escape_unicode(s, utf8, &mut out),
-            Value::Real(r) => out.push_str(&format_real(*r)),
-            Value::Int(i) => out.push_str(&i.to_string()),
-            Value::Bool(b) => out.push_str(&i64::from(*b).to_string()),
-            Value::Hex(h) => out.push_str(h),
+            Value::Str(s) => push_string(s, strings, &mut out),
+            Value::Real(r) => out.extend_from_slice(format_real(*r).as_bytes()),
+            Value::Int(i) => out.extend_from_slice(i.to_string().as_bytes()),
+            Value::Bool(b) => out.extend_from_slice(i64::from(*b).to_string().as_bytes()),
+            Value::Hex(h) => out.extend_from_slice(h.as_bytes()),
         }
-        out.push_str("\r\n");
+        out.extend_from_slice(b"\r\n");
     }
     out
 }
@@ -432,6 +500,16 @@ pub fn write_ascii_as(tags: &[Tag], utf8: bool) -> String {
 /// in [`write_ascii`]. A tag's value is converted to its code's kind, so a number written as text
 /// is stored as a number; a code outside the 16-bit range is skipped.
 pub fn write_binary(tags: &[Tag], utf8: bool) -> Vec<u8> {
+    binary(tags, if utf8 { Strings::Utf8 } else { Strings::Escaped(None) })
+}
+
+/// Write tags as pre-R2007 binary DXF with text in the code page `code_page` names, as
+/// [`write_ascii_in`] does.
+pub fn write_binary_in(tags: &[Tag], code_page: &str) -> Vec<u8> {
+    binary(tags, Strings::Escaped(codepage::encoder(code_page)))
+}
+
+fn binary(tags: &[Tag], strings: Strings) -> Vec<u8> {
     let mut out = Vec::with_capacity(BINARY_SENTINEL.len() + tags.len() * 12);
     out.extend_from_slice(BINARY_SENTINEL);
     for t in tags {
@@ -444,9 +522,9 @@ pub fn write_binary(tags: &[Tag], utf8: bool) -> Vec<u8> {
                     Value::Str(s) => s.clone(),
                     v => v.as_str(),
                 };
-                let mut text = String::with_capacity(s.len());
-                escape_unicode(&s, utf8, &mut text);
-                out.extend(text.bytes().filter(|&b| b != 0));
+                let mut text = Vec::with_capacity(s.len());
+                push_string(&s, strings, &mut text);
+                out.extend(text.into_iter().filter(|&b| b != 0));
                 out.push(0);
             }
             Kind::Real => {
@@ -500,19 +578,27 @@ pub fn is_binary(bytes: &[u8]) -> bool {
     bytes.starts_with(BINARY_SENTINEL)
 }
 
-/// Escape a string for a pre-R2007 DXF, whose text is in the `$DWGCODEPAGE` code page: ASCII
-/// stays as it is and every other character becomes `\U+XXXX` (a surrogate pair of escapes
-/// above U+FFFF), so the bytes are valid in any code page; with `utf8` they stay as they are.
-/// A backslash that would start a `\U+` or `\M+` sequence is written as `\U+005C` so the reader
-/// gives back the literal text. Line breaks become spaces.
-fn escape_unicode(s: &str, utf8: bool, out: &mut String) {
+/// A string value as `strings` stores it. Line breaks become spaces. Before R2007 the text is
+/// in the `$DWGCODEPAGE` code page: ASCII stays as it is, a character the code page has becomes
+/// its bytes, and every other one `\U+XXXX` (a surrogate pair of escapes above U+FFFF). Without
+/// a code page the result is ASCII, so it is valid in any code page. In every form a backslash
+/// that would start a `\U+` or `\M+` sequence is written as `\U+005C`, so the reader gives back
+/// the literal text (#2050). So is a double-byte character whose trail byte is 0x5C (`\`) in that
+/// place, such as Shift-JIS `表` or Big5 `許`: CADCraft decodes the code page before it looks for
+/// escapes, but a reader that looks first would take that byte and the `U+` after it for one.
+fn push_string(s: &str, strings: Strings, out: &mut Vec<u8>) {
     let chars: Vec<char> = s.chars().collect();
+    let escape_at = |j: usize| matches!(chars.get(j), Some('U' | 'M')) && chars.get(j + 1) == Some(&'+');
     for (i, &c) in chars.iter().enumerate() {
-        match c {
-            '\r' | '\n' => out.push(' '),
-            '\\' if matches!(chars.get(i + 1), Some('U' | 'M')) && chars.get(i + 2) == Some(&'+') => out.push_str("\\U+005C"),
-            c if utf8 || c.is_ascii() => out.push(c),
-            c => {
+        match (c, strings) {
+            ('\r' | '\n', _) => out.push(b' '),
+            ('\\', _) if escape_at(i + 1) => {
+                out.extend_from_slice(b"\\U+005C");
+            }
+            (c, Strings::Utf8) => out.extend_from_slice(c.encode_utf8(&mut [0; 4]).as_bytes()),
+            (c, _) if c.is_ascii() => out.extend_from_slice(c.encode_utf8(&mut [0; 4]).as_bytes()),
+            (c, Strings::Escaped(Some(d))) if code_page_bytes(c, d, escape_at(i + 1), out) => {}
+            (c, Strings::Escaped(_)) => {
                 let mut units = [0u16; 2];
                 for u in c.encode_utf16(&mut units) {
                     let _ = write!(out, "\\U+{u:04X}");
@@ -522,6 +608,20 @@ fn escape_unicode(s: &str, utf8: bool, out: &mut String) {
     }
 }
 
+/// `c` in the code page `d`, if it has it, unless it is a double-byte character whose trail byte
+/// is 0x5C and an escape's `U+` or `M+` follows (`before_escape`): see [`push_string`].
+fn code_page_bytes(c: char, d: codepage::Decoder, before_escape: bool, out: &mut Vec<u8>) -> bool {
+    let start = out.len();
+    if !codepage::encode_char(c, d, out) {
+        return false;
+    }
+    if before_escape && out.len() - start > 1 && out.last() == Some(&b'\\') {
+        out.truncate(start);
+        return false;
+    }
+    true
+}
+
 /// A section: `0 SECTION / 2 NAME ... 0 ENDSEC`.
 #[derive(Clone, Debug, Default)]
 pub struct Section {
@@ -581,6 +681,12 @@ mod tests {
         }
     }
 
+    #[test]
+    fn blank_lines_do_not_consume_group_code_limit() {
+        let tags = parse_with_limit(b"0\nEOF\n\n\n", 1).expect("one group code should fit a limit of one");
+        assert_eq!(tags, vec![Tag::s(0, "EOF")]);
+    }
+
     #[test]
     fn ascii_roundtrip() {
         let tags = vec![
@@ -695,3 +801,27 @@ mod tests {
         assert_eq!(parse(&b).unwrap()[0].str(), "图号");
     }
 }
+
+#[cfg(test)]
+mod limit_tests {
+    use super::*;
+
+    #[test]
+    fn tag_limit_defaults_and_env_override() {
+        assert_eq!(max_tags_from(None), MAX_TAGS);
+        assert_eq!(max_tags_from(Some("")), MAX_TAGS);
+        assert_eq!(max_tags_from(Some("0")), MAX_TAGS);
+        assert_eq!(max_tags_from(Some("abc")), MAX_TAGS);
+        assert_eq!(max_tags_from(Some(" 400_000_000 ")), 400_000_000);
+        // Issue #1948: the default must admit a DXF rendition well above 50 million group codes.
+        const { assert!(MAX_TAGS >= 100_000_000) };
+    }
+
+    #[test]
+    fn the_tag_list_is_reserved_once_and_a_refusal_is_an_error() {
+        let tags = parse_ascii_counted("0\nSECTION\n0\nENDSEC\n0\nEOF\n", MAX_TAGS, 3).unwrap();
+        assert_eq!((tags.len(), tags.capacity()), (3, 3));
+        let e = parse_ascii_counted("0\nEOF\n", usize::MAX, usize::MAX).unwrap_err();
+        assert!(matches!(e, DxfError::OutOfMemory { .. }), "{e}");
+    }
+}

crates/dxf/tests/ascii_bom.rs

@@ -0,0 +1,19 @@
+//! A UTF-8 byte order mark at the start of an ASCII DXF is skipped.
+
+const BODY: &str = "  0\r\nSECTION\r\n  2\r\nENTITIES\r\n  0\r\nENDSEC\r\n  0\r\nEOF\r\n";
+
+#[test]
+fn utf8_bom_bytes_are_skipped() {
+    let plain = cadcraft_dxf::parse(BODY.as_bytes()).expect("plain parses");
+    let mut bytes = vec![0xEF, 0xBB, 0xBF];
+    bytes.extend_from_slice(BODY.as_bytes());
+    let with_bom = cadcraft_dxf::parse(&bytes);
+    assert!(with_bom.is_ok(), "{with_bom:?}");
+    assert_eq!(with_bom.map(|t| t.len()).unwrap_or(0), plain.len());
+}
+
+#[test]
+fn bom_text_is_skipped() {
+    let text = format!("\u{feff}{BODY}");
+    assert!(cadcraft_dxf::parse_ascii(&text).is_ok());
+}

crates/dxf/tests/code_page_write.rs

@@ -0,0 +1,116 @@
+//! Pre-R2007 DXF text is written in the `$DWGCODEPAGE` code page: characters it has as their
+//! bytes, the others as `\U+XXXX` escapes; every form reads back to the same text.
+
+use cadcraft_dxf::{Tag, parse, write_ascii, write_ascii_in, write_binary_in};
+
+fn file(code_page: &str, text: &str) -> Vec<Tag> {
+    vec![
+        Tag::s(0, "SECTION"),
+        Tag::s(2, "HEADER"),
+        Tag::s(9, "$ACADVER"),
+        Tag::s(1, "AC1015"),
+        Tag::s(9, "$DWGCODEPAGE"),
+        Tag::s(3, code_page),
+        Tag::s(0, "ENDSEC"),
+        Tag::s(0, "SECTION"),
+        Tag::s(2, "ENTITIES"),
+        Tag::s(0, "TEXT"),
+        Tag::s(1, text),
+        Tag::s(0, "ENDSEC"),
+        Tag::s(0, "EOF"),
+    ]
+}
+
+fn contains(bytes: &[u8], part: &[u8]) -> bool {
+    bytes.windows(part.len()).any(|w| w == part)
+}
+
+#[test]
+fn text_is_written_in_the_code_page() {
+    // (code page, text, the bytes written for it)
+    let cases: [(&str, &str, &[u8]); 6] = [
+        ("ANSI_1252", "Ação € 图", b"A\xE7\xE3o \x80 \\U+56FE"),
+        ("ANSI_1251", "Слой é", b"\xD1\xEB\xEE\xE9 \\U+00E9"),
+        ("ANSI_932", "表図面 é", b"\x95\x5C\x90\x7D\x96\xCA \\U+00E9"),
+        ("DOS850", "Größe €", b"Gr\x94\xE1e \\U+20AC"),
+        ("ANSI_1252", "😀", b"\\U+D83D\\U+DE00"),
+        // A code page CADCraft doesn't know: everything non-ASCII is escaped.
+        ("ANSI_1361", "Ação", b"A\\U+00E7\\U+00E3o"),
+    ];
+    for (cp, text, raw) in cases {
+        let tags = file(cp, text);
+        for (bytes, what) in [(write_ascii_in(&tags, cp), "ASCII"), (write_binary_in(&tags, cp), "binary")] {
+            assert!(contains(&bytes, raw), "{cp} {what}: {:?}", String::from_utf8_lossy(&bytes));
+            assert_eq!(parse(&bytes).unwrap()[10].str(), text, "{cp} {what}");
+        }
+    }
+}
+
+/// Without a known code page, and for `ASCII`, `UTF8` and `UNICODE` headers, the output is what
+/// `write_ascii` writes (pure ASCII with escapes), line breaks included.
+#[test]
+fn unknown_ascii_and_utf8_code_pages_are_pure_ascii() {
+    for cp in ["EBCDIC", "ASCII", "ascii ", "UTF8", "UNICODE"] {
+        let tags = file(cp, "Ação\r\nfim");
+        let bytes = write_ascii_in(&tags, cp);
+        assert!(bytes.is_ascii(), "{cp}");
+        assert_eq!(bytes, write_ascii(&tags).into_bytes(), "{cp}");
+        assert!(contains(&bytes, b"A\\U+00E7\\U+00E3o  fim"), "{cp}");
+        assert!(write_binary_in(&tags, cp).iter().all(u8::is_ascii), "{cp} binary");
+    }
+}
+
+/// Code page bytes that happen to form valid UTF-8 (`СІ` in ANSI_1251 is D1 B2, which is U+0472
+/// in UTF-8) would be read back as UTF-8 from an ASCII file, so that file is written with
+/// escapes. Binary DXF reads strings by the header's code page and keeps the bytes.
+#[test]
+fn code_page_bytes_that_are_valid_utf8_are_escaped_in_ascii() {
+    let tags = file("ANSI_1251", "СІ");
+    let ascii = write_ascii_in(&tags, "ANSI_1251");
+    assert!(ascii.is_ascii(), "{:?}", String::from_utf8_lossy(&ascii));
+    assert!(contains(&ascii, b"\\U+0421\\U+0406"));
+    assert_eq!(parse(&ascii).unwrap()[10].str(), "СІ");
+    let binary = write_binary_in(&tags, "ANSI_1251");
+    assert!(contains(&binary, b"\xD1\xB2"));
+    assert_eq!(parse(&binary).unwrap()[10].str(), "СІ");
+    // Bytes that are not valid UTF-8 stay as they are.
+    assert!(contains(&write_ascii_in(&file("ANSI_1251", "Слой"), "ANSI_1251"), b"\xD1\xEB\xEE\xE9"));
+}
+
+/// A literal `\U+` or `\M+` in the text (#2050) reads back as written alongside code page bytes,
+/// in ASCII and binary, including an ASCII file that falls back to escapes because its bytes
+/// would read as UTF-8.
+#[test]
+fn literal_escapes_survive_code_page_text() {
+    for (cp, text) in
+        [("ANSI_1252", "Ação \\U+00E9 \\M+183A4F"), ("ANSI_1251", "Слой \\U+0041"), ("ANSI_1251", "СІ \\U+0041"), ("ANSI_932", "表 \\M+1")]
+    {
+        let tags = file(cp, text);
+        for (bytes, what) in [(write_ascii_in(&tags, cp), "ASCII"), (write_binary_in(&tags, cp), "binary")] {
+            assert!(contains(&bytes, b"\\U+005C"), "{cp} {what}: {:?}", String::from_utf8_lossy(&bytes));
+            assert_eq!(parse(&bytes).unwrap()[10].str(), text, "{cp} {what}");
+        }
+    }
+}
+
+/// Double-byte code pages whose trail byte can be 0x5C (`\\`): Shift-JIS `表` (95 5C) and `ソ`
+/// (83 5C), Big5 `許` (B3 5C), GBK `乗` (81 5C). Right before `U+` or `M+`, such a character is
+/// written as an escape, so even a reader that looks for escapes before it decodes the code page
+/// reads it right. Elsewhere it stays as its bytes. Both forms read back as written.
+#[test]
+fn a_trail_byte_backslash_never_starts_an_escape() {
+    let cases: [(&str, &str, &[u8], &[u8]); 4] = [
+        ("ANSI_932", "表U+0041 表示", b"\\U+8868U+0041 \x95\x5C\x8E\xA6", b"\x95\x5CU+"),
+        ("ANSI_932", "ソM+1A2B", b"\\U+30BDM+1A2B", b"\x83\x5CM+"),
+        ("ANSI_950", "許U+0041", b"\\U+8A31U+0041", b"\xB3\x5CU+"),
+        ("ANSI_936", "乗U+0041", b"\\U+4E57U+0041", b"\x81\x5CU+"),
+    ];
+    for (cp, text, written, never) in cases {
+        let tags = file(cp, text);
+        for (bytes, what) in [(write_ascii_in(&tags, cp), "ASCII"), (write_binary_in(&tags, cp), "binary")] {
+            assert!(contains(&bytes, written), "{cp} {what}: {:?}", String::from_utf8_lossy(&bytes));
+            assert!(!contains(&bytes, never), "{cp} {what}: a trail byte starts an escape");
+            assert_eq!(parse(&bytes).unwrap()[10].str(), text, "{cp} {what}");
+        }
+    }
+}

crates/dxf/tests/conformance.rs

@@ -0,0 +1,145 @@
+//! Small independent byte fixtures for DXF tag types, text encoding, framing and failures.
+//! Handwritten examples, not files from a CAD application or generated by our writer.
+//! Background on the tag model and file structure:
+//! https://ezdxf.readthedocs.io/en/stable/dxfinternals/dxftags.html
+//! https://ezdxf.readthedocs.io/en/stable/dxfinternals/filestructure.html
+//! ASCII spacing is our writer's documented convention; binary fixtures specify actual bytes.
+
+use cadcraft_dxf::{DxfError, Tag, Value, parse, parse_with_limit, write_ascii_as, write_binary};
+
+const SENTINEL: &[u8] = b"AutoCAD Binary DXF\r\n\x1a\0";
+
+fn fixtures() -> Vec<(Tag, &'static [u8], &'static [u8])> {
+    vec![
+        (Tag::s(1, " A "), b"  1\r\n A \r\n", b"\x01\0 A \0"),
+        (Tag::s(1, ""), b"  1\r\n\r\n", b"\x01\0\0"),
+        (Tag::s(105, "AB12"), b"105\r\nAB12\r\n", b"\x69\0AB12\0"),
+        (Tag::new(10, Value::Real(-3.25)), b" 10\r\n-3.25\r\n", b"\x0a\0\0\0\0\0\0\0\x0a\xc0"),
+        (Tag::i(70, -32768), b" 70\r\n-32768\r\n", b"\x46\0\0\x80"),
+        (Tag::i(90, -2147483648), b" 90\r\n-2147483648\r\n", b"\x5a\0\0\0\0\x80"),
+        (Tag::i(160, 9223372036854775807), b"160\r\n9223372036854775807\r\n", b"\xa0\0\xff\xff\xff\xff\xff\xff\xff\x7f"),
+        (Tag::new(290, Value::Bool(false)), b"290\r\n0\r\n", b"\x22\x01\0"),
+        (Tag::new(299, Value::Bool(true)), b"299\r\n1\r\n", b"\x2b\x01\x01"),
+        (Tag::new(310, Value::Hex("00FF80".into())), b"310\r\n00FF80\r\n", b"\x36\x01\x03\0\xff\x80"),
+        (Tag::new(1004, Value::Hex(String::new())), b"1004\r\n\r\n", b"\xec\x03\0"),
+        (Tag::i(1070, -2), b"1070\r\n-2\r\n", b"\x2e\x04\xfe\xff"),
+        (Tag::i(1071, 65536), b"1071\r\n65536\r\n", b"\x2f\x04\0\0\x01\0"),
+    ]
+}
+
+#[test]
+fn reads_independently_authored_ascii_and_binary_values() {
+    for (expected, ascii, binary) in fixtures() {
+        assert_eq!(parse(ascii).unwrap(), std::slice::from_ref(&expected), "ASCII code {}", expected.code);
+        let bytes = [SENTINEL, binary].concat();
+        assert_eq!(parse(&bytes).unwrap(), std::slice::from_ref(&expected), "binary code {}", expected.code);
+    }
+}
+
+#[test]
+fn writes_independently_specified_ascii_and_binary_bytes() {
+    for (tag, ascii, binary) in fixtures() {
+        for utf8 in [false, true] {
+            let tags = std::slice::from_ref(&tag);
+            assert_eq!(write_ascii_as(tags, utf8).as_bytes(), ascii, "ASCII code {}", tag.code);
+            assert_eq!(write_binary(tags, utf8), [SENTINEL, binary].concat(), "binary code {}", tag.code);
+        }
+    }
+}
+
+#[test]
+fn integer_code_ranges_have_independent_binary_widths() {
+    // Specification ranges and widths, never kind_of(): a shared reader/writer mistake
+    // can round-trip every boundary value while still using the wrong number of bytes.
+    let widths = [
+        (vec![60..=79, 170..=179, 270..=289, 370..=389, 400..=409, 1060..=1070], 2, i64::from(i16::MIN), i64::from(i16::MAX)),
+        (vec![90..=99, 420..=429, 440..=459, 1071..=1071], 4, i64::from(i32::MIN), i64::from(i32::MAX)),
+        (std::iter::once(160..=169).collect(), 8, i64::MIN, i64::MAX),
+    ];
+    for (ranges, width, min, max) in widths {
+        for code in ranges.into_iter().flatten() {
+            for value in [min, min + 1, -1, 0, 1, max - 1, max] {
+                // Binary DXF uses a little-endian 16-bit group code and a fixed-width,
+                // little-endian two's-complement integer. Encoding is version-independent.
+                let code_bytes = u16::try_from(code).unwrap().to_le_bytes();
+                let value_bytes = value.to_le_bytes();
+                let expected = [SENTINEL, &code_bytes, &value_bytes[..width]].concat();
+                let tags = [Tag::i(code, value)];
+                for utf8 in [false, true] {
+                    assert_eq!(write_binary(&tags, utf8), expected, "code={code} value={value} utf8={utf8}");
+                }
+                assert_eq!(parse(&expected).unwrap(), tags, "code={code} value={value}");
+            }
+        }
+    }
+}
+
+#[test]
+fn text_encoding_has_independent_wire_expectations() {
+    let tags = [Tag::s(1, "é😀")];
+    let escaped = b"\\U+00E9\\U+D83D\\U+DE00";
+    let utf8 = b"\xc3\xa9\xf0\x9f\x98\x80";
+    for (unicode, text) in [(false, escaped.as_slice()), (true, utf8.as_slice())] {
+        let ascii = [b"  1\r\n".as_slice(), text, b"\r\n"].concat();
+        let binary = [SENTINEL, b"\x01\0", text, b"\0"].concat();
+        assert_eq!(write_ascii_as(&tags, unicode).as_bytes(), ascii, "utf8={unicode}");
+        assert_eq!(write_binary(&tags, unicode), binary, "utf8={unicode}");
+        assert_eq!(parse(&ascii).unwrap(), tags);
+        assert_eq!(parse(&binary).unwrap(), tags);
+    }
+    // Pre-2007 code-page bytes are independent of the writer, which emits Unicode escapes.
+    let ascii = b"0\nSECTION\n2\nHEADER\n9\n$ACADVER\n1\nAC1015\n9\n$DWGCODEPAGE\n3\nANSI_1252\n0\nENDSEC\n1\n\x80\xe9\n0\nEOF\n";
+    let binary = [
+        SENTINEL,
+        b"\0\0SECTION\0\x02\0HEADER\0\x09\0$ACADVER\0\x01\0AC1015\0\x09\0$DWGCODEPAGE\0\x03\0ANSI_1252\0\0\0ENDSEC\0\x01\0\x80\xe9\0\0\0EOF\0",
+    ]
+    .concat();
+    for bytes in [ascii.as_slice(), binary.as_slice()] {
+        let tags = parse(bytes).unwrap();
+        assert_eq!(tags[7], Tag::s(1, "ێ"));
+    }
+}
+
+#[test]
+fn ascii_accepts_line_endings_padding_and_no_final_newline() {
+    let expected = [Tag::i(70, -7), Tag::s(1, "  text  "), Tag::s(0, "EOF")];
+    for newline in ["\n", "\r\n"] {
+        for final_newline in [false, true] {
+            let mut text = [" 70 ", " -7 ", "1", "  text  ", "0", "EOF"].join(newline);
+            if final_newline {
+                text.push_str(newline);
+            }
+            assert_eq!(parse(text.as_bytes()).unwrap(), expected, "newline={newline:?} final={final_newline}");
+        }
+    }
+}
+
+#[test]
+fn malformed_and_truncated_values_are_errors_not_panics() {
+    assert!(matches!(parse(b""), Err(DxfError::NotDxf)));
+    assert!(matches!(parse(b"oops\nvalue\n"), Err(DxfError::BadCode { line: 1, .. })));
+    assert!(matches!(parse(b"10\n"), Err(DxfError::Eof)));
+    assert!(matches!(parse(SENTINEL), Err(DxfError::NotDxf)));
+    for (_, _, binary) in fixtures() {
+        // Every cut inside the first record is an error, unlike cuts between complete records:
+        // the tag API deliberately accepts streams without an EOF record.
+        for cut in 1..binary.len() {
+            let bytes = [SENTINEL, &binary[..cut]].concat();
+            assert!(matches!(parse(&bytes), Err(DxfError::Eof)), "binary={binary:?} cut={cut}");
+        }
+    }
+}
+
+#[test]
+fn tag_limit_accepts_the_exact_boundary_and_rejects_one_less() {
+    let ascii = b"1\nA\n70\n-7\n0\nEOF\n";
+    let binary = [SENTINEL, b"\x01\0A\0\x46\0\xf9\xff\0\0EOF\0"].concat();
+    for bytes in [ascii.as_slice(), binary.as_slice()] {
+        for limit in 0..3 {
+            assert!(matches!(parse_with_limit(bytes, limit), Err(DxfError::TooLarge { limit: actual, .. }) if actual == limit));
+        }
+        for limit in [3, 4] {
+            assert_eq!(parse_with_limit(bytes, limit).unwrap(), [Tag::s(1, "A"), Tag::i(70, -7), Tag::s(0, "EOF")]);
+        }
+    }
+}

crates/dxf/tests/hex_chunks.rs

@@ -0,0 +1,119 @@
+//! Hex payload conformance is distinct from binary framing capacity: DXF groups 310–319 and
+//! 1004 specify at most 127 payload bytes per chunk, even though a length byte represents 255.
+//! Inspect writer bytes without our parser; accept any compliant partition preserving payload,
+//! code and following-record framing. Oversized binary read fixtures test tolerance only.
+//! Pending writer regressions extend the chunk-size finding in issue #1025.
+//! Public DXF Reference, Group Codes in Numerical Order and Binary DXF Files:
+//! https://help.autodesk.com/cloudhelp/2025/ENU/AutoCAD-DXF/files/GUID-3F0380A5-1C15-464D-BC66-2C5F094BCFB9.htm
+//! https://help.autodesk.com/cloudhelp/2025/ENU/AutoCAD-DXF/files/GUID-FC1C3C69-DBC2-49E4-893A-000D6538C0FE.htm
+
+use cadcraft_dxf::{Tag, Value, parse, write_ascii_as, write_binary};
+
+const SENTINEL: &[u8] = b"AutoCAD Binary DXF\r\n\x1a\0";
+const FOLLOWING_BINARY: &[u8] = b"\x46\0\xf9\xff"; // group 70, signed i16 -7
+
+fn payload(length: usize) -> Vec<u8> {
+    (0..length).map(|index| u8::try_from(index * 37 % 256).unwrap()).collect()
+}
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02X}")).collect()
+}
+
+fn input(code: i32, bytes: &[u8]) -> [Tag; 2] {
+    [Tag::new(code, Value::Hex(hex(bytes))), Tag::i(70, -7)]
+}
+
+fn check_ascii(code: i32, bytes: &[u8], utf8: bool) {
+    let wire = write_ascii_as(&input(code, bytes), utf8);
+    let lines: Vec<_> = wire.lines().collect();
+    let (chunks, following) = lines.split_at(lines.len().checked_sub(2).unwrap());
+    assert_eq!(following[0].trim(), "70");
+    assert_eq!(following[1], "-7");
+    assert!(!chunks.is_empty(), "an empty payload must still have a tag");
+    let (records, remainder) = chunks.as_chunks::<2>();
+    assert!(remainder.is_empty(), "incomplete group/value pair");
+    let context = format!("ASCII code={code} bytes={} utf8={utf8}", bytes.len());
+    let mut back = Vec::new();
+    for record in records {
+        assert_eq!(record[0].trim().parse::<i32>().unwrap(), code, "{context}");
+        let text = record[1];
+        assert!(text.len() <= 254, "{context}: {} hex characters exceed 127 payload bytes", text.len());
+        assert!(text.bytes().all(|b| b.is_ascii_hexdigit()), "{context}: invalid hex");
+        let (pairs, remainder) = text.as_bytes().as_chunks::<2>();
+        assert!(remainder.is_empty(), "{context}: partial byte");
+        back.extend(pairs.iter().map(|pair| u8::from_str_radix(std::str::from_utf8(pair).unwrap(), 16).unwrap()));
+    }
+    assert_eq!(back, bytes, "{context}: complete payload and byte order");
+}
+
+fn check_binary(code: i32, bytes: &[u8], utf8: bool) {
+    let wire = write_binary(&input(code, bytes), utf8);
+    let mut chunks = wire.strip_prefix(SENTINEL).unwrap().strip_suffix(FOLLOWING_BINARY).unwrap();
+    assert!(!chunks.is_empty(), "an empty payload must still have a tag");
+    let context = format!("binary code={code} bytes={} utf8={utf8}", bytes.len());
+    let mut back = Vec::new();
+    while !chunks.is_empty() {
+        let (&[lo, hi, length], rest) = chunks.split_first_chunk::<3>().unwrap();
+        assert_eq!(i32::from(u16::from_le_bytes([lo, hi])), code, "{context}");
+        assert!(length <= 127, "{context}: {length} bytes exceed the documented group limit");
+        let (chunk, next) = rest.split_at(usize::from(length));
+        back.extend_from_slice(chunk);
+        chunks = next;
+    }
+    assert_eq!(back, bytes, "{context}: complete payload and byte order");
+}
+
+#[test]
+fn conforming_payloads_have_independent_ascii_and_binary_wire_checks() {
+    for code in (310..=319).chain([1004]) {
+        for length in [0, 1, 2, 126, 127] {
+            for utf8 in [false, true] {
+                let bytes = payload(length);
+                check_ascii(code, &bytes, utf8);
+                check_binary(code, &bytes, utf8);
+            }
+        }
+    }
+}
+
+#[test]
+fn binary_reader_tolerates_the_full_length_byte_domain() {
+    // This is deliberately permissive input, not an assertion that oversized chunks conform
+    // or that the writer should produce them. The following record catches framing mistakes.
+    for code in (310_u16..=319).chain([1004]) {
+        for length in 0..=u8::MAX {
+            let bytes = payload(usize::from(length));
+            let mut wire = SENTINEL.to_vec();
+            wire.extend_from_slice(&code.to_le_bytes());
+            wire.push(length);
+            wire.extend_from_slice(&bytes);
+            wire.extend_from_slice(FOLLOWING_BINARY);
+            assert_eq!(parse(&wire).unwrap(), input(i32::from(code), &bytes), "code={code} length={length}");
+        }
+    }
+}
+
+#[test]
+#[ignore = "Confirmed ASCII DXF writer nonconformance: hex payloads above 127 bytes are emitted as one oversized chunk"]
+fn ascii_writer_splits_large_payloads_into_conforming_chunks() {
+    for code in (310..=319).chain([1004]) {
+        for length in [128, 254, 255, 256, 1024] {
+            for utf8 in [false, true] {
+                check_ascii(code, &payload(length), utf8);
+            }
+        }
+    }
+}
+
+#[test]
+#[ignore = "Confirmed binary DXF writer nonconformance: 255-byte partitioning exceeds the documented 127-byte group limit"]
+fn binary_writer_splits_large_payloads_into_conforming_chunks() {
+    for code in (310..=319).chain([1004]) {
+        for length in [128, 254, 255, 256, 1024] {
+            for utf8 in [false, true] {
+                check_binary(code, &payload(length), utf8);
+            }
+        }
+    }
+}

crates/dxf/tests/roundtrip.rs

@@ -0,0 +1,148 @@
+//! Deterministic tag preservation through the public byte API, in both encodings and every
+//! supported version. Inputs have the group code's type and representable values; lossy
+//! coercions are not accepted as round-trip equality. Real values must retain their bits.
+
+use cadcraft_dxf::{Tag, Value, Version, is_binary, parse, write_ascii_as, write_binary};
+
+fn check(case: &str, body: &[Tag]) {
+    for version in Version::ALL {
+        let mut original = vec![
+            Tag::s(0, "SECTION"),
+            Tag::s(2, "HEADER"),
+            Tag::s(9, "$ACADVER"),
+            Tag::s(1, version.code()),
+            Tag::s(9, "$DWGCODEPAGE"),
+            Tag::s(3, "ANSI_1252"),
+            Tag::s(0, "ENDSEC"),
+            Tag::s(0, "SECTION"),
+            Tag::s(2, "ENTITIES"),
+        ];
+        original.extend_from_slice(body);
+        original.extend([Tag::s(0, "ENDSEC"), Tag::s(0, "EOF")]);
+        for binary in [false, true] {
+            let mut current = original.clone();
+            for pass in 1..=2 {
+                let context = format!("{case} · {version} · binary={binary} · pass={pass}");
+                let bytes = if binary { write_binary(&current, version.utf8()) } else { write_ascii_as(&current, version.utf8()).into_bytes() };
+                assert_eq!(is_binary(&bytes), binary, "{context}");
+                let back = parse(&bytes).unwrap_or_else(|e| panic!("{context}: {e}"));
+                assert_eq!(back.len(), original.len(), "{context}: tag count");
+                for (index, (expected, actual)) in original.iter().zip(&back).enumerate() {
+                    assert_eq!(actual, expected, "{context}: tag[{index}]");
+                    if let (Value::Real(a), Value::Real(b)) = (&expected.value, &actual.value) {
+                        assert_eq!(b.to_bits(), a.to_bits(), "{context}: tag[{index}] real bits");
+                    }
+                }
+                assert_eq!(back, current, "{context}: no additional changes on resave");
+                current = back;
+            }
+        }
+    }
+}
+
+#[test]
+fn integer_width_boundaries() {
+    // Explicit reference ranges, not obtained from the codec's kind_of().
+    let widths = [
+        (vec![60..=79, 170..=179, 270..=289, 370..=389, 400..=409, 1060..=1070], i64::from(i16::MIN), i64::from(i16::MAX)),
+        (vec![90..=99, 420..=429, 440..=459, 1071..=1071], i64::from(i32::MIN), i64::from(i32::MAX)),
+        (std::iter::once(160..=169).collect(), i64::MIN, i64::MAX),
+    ];
+    for (ranges, min, max) in widths {
+        for value in [min, min + 1, -1, 0, 1, max - 1, max] {
+            let tags: Vec<_> = ranges.iter().cloned().flatten().map(|code| Tag::i(code, value)).collect();
+            check(&format!("integer/{min}..{max}/{value}"), &tags);
+        }
+    }
+}
+
+#[test]
+fn finite_reals_keep_all_bits() {
+    let values = [
+        0.0,
+        -0.0,
+        f64::from_bits(1),
+        -f64::from_bits(1),
+        f64::MIN_POSITIVE,
+        f64::MIN_POSITIVE.next_down(),
+        0.1,
+        -3.25,
+        1.0_f64.next_down(),
+        1.0,
+        1.0_f64.next_up(),
+        1e-100,
+        -1e100,
+        f64::MAX,
+        f64::MIN,
+    ];
+    for value in values {
+        let tags: Vec<_> =
+            [10..=59, 110..=149, 210..=239, 460..=469, 1010..=1059].into_iter().flatten().map(|code| Tag::new(code, Value::Real(value))).collect();
+        check(&format!("real/{:016X}", value.to_bits()), &tags);
+    }
+}
+
+#[test]
+fn booleans() {
+    for value in [false, true] {
+        let tags: Vec<_> = (290..=299).map(|code| Tag::new(code, Value::Bool(value))).collect();
+        check(&format!("bool/{value}"), &tags);
+    }
+}
+
+#[test]
+fn strings_preserve_whitespace_unicode_and_literal_escapes() {
+    // No CR/LF or NUL: those are line/string delimiters, not losslessly writable payloads.
+    let values = [
+        ("empty", ""),
+        ("spaces", "  leading and trailing  "),
+        ("tabs", "\tindented\t"),
+        ("unicode", "Café Ø 图号 Україна 😀 e\u{301}"),
+        ("literal-escapes", r"\U+0041 \M+183A4 \U+D83D\U+DE00 \\U+005C \P %%c"),
+        ("malformed-escapes", r"\U+ \U+ZZZZ \U+D800 \U+DC00 \M+9FFFF"),
+    ];
+    for (case, value) in values {
+        let tags: Vec<_> =
+            [0..=9, 100..=100, 102..=102, 105..=105, 300..=309, 320..=369, 410..=419, 430..=439, 470..=479, 480..=481, 1000..=1003, 1005..=1005]
+                .into_iter()
+                .flatten()
+                .map(|code| Tag::s(code, value))
+                .collect();
+        check(case, &tags);
+    }
+    for length in [1, 254, 255, 256, 1024] {
+        check(&format!("string/length={length}"), &[Tag::s(1, "x".repeat(length))]);
+    }
+}
+
+#[test]
+fn hex_chunks_keep_bytes_and_order() {
+    // DXF groups 310–319 and 1004 permit 127 payload bytes per chunk. A binary length
+    // byte can represent more, but that is reader tolerance, not writer conformance.
+    // Larger payloads need chunk-size/reassembly checks rather than exact tag equality;
+    // see hex_chunks.rs for the independent wire checks and pending writer regressions.
+    for length in [0, 1, 2, 126, 127] {
+        let hex: String = (0..length).map(|i| format!("{:02X}", (i * 37) % 256)).collect();
+        let tags: Vec<_> = (310..=319).chain([1004]).map(|code| Tag::new(code, Value::Hex(hex.clone()))).collect();
+        check(&format!("hex/bytes={length}"), &tags);
+    }
+}
+
+#[test]
+fn mixed_values_and_repeated_codes_keep_order() {
+    check(
+        "mixed/repeated-codes",
+        &[
+            Tag::s(0, "TEST"),
+            Tag::f(10, 1.25),
+            Tag::s(1, "first"),
+            Tag::f(10, -2.5),
+            Tag::i(70, -7),
+            Tag::s(1, "second"),
+            Tag::new(290, Value::Bool(true)),
+            Tag::new(310, Value::Hex("00FF80".into())),
+            Tag::i(160, i64::MAX),
+            Tag::s(1, ""),
+        ],
+    );
+}

crates/engine/src/atomic_write.rs

@@ -30,19 +30,50 @@ const MAX_TRIES: u32 = 32;
 /// are written through the retained handle and flushed, and the temporary is then renamed over
 /// `path`. On any failure the temporary is removed and the original `path` is left untouched.
 pub fn write_atomic(path: &Path, bytes: &[u8]) -> io::Result<()> {
+    // A symlinked destination is resolved so the link stays a link and its target is replaced.
+    let resolved = resolve_symlink(path)?;
+    let path = resolved.as_deref().unwrap_or(path);
     let permissions = match std::fs::symlink_metadata(path) {
         Ok(meta) if meta.is_file() => Some(meta.permissions()),
         Ok(_) => None,
         Err(e) if e.kind() == io::ErrorKind::NotFound => None,
         Err(e) => return Err(e),
     };
+    write_atomic_with(path, permissions, |file| file.write_all(bytes))
+}
+
+/// The topmost folder missing above `path`: what [`write_atomic_making_folders`] will create.
+/// `None` when the file's folder exists, or when `path` itself exists (a dangling symlink's target
+/// folder is not ours to make).
+pub fn missing_folder(path: &Path) -> Option<PathBuf> {
+    if std::fs::symlink_metadata(path).is_ok() {
+        return None;
+    }
+    path.ancestors().skip(1).filter(|a| !a.as_os_str().is_empty()).take_while(|a| std::fs::symlink_metadata(a).is_err()).last().map(Path::to_path_buf)
+}
+
+/// [`write_atomic`] to a path the user named, first creating the folders missing above it: a
+/// mistyped folder costs less than a drawing that could not be written. The caller reports
+/// [`missing_folder`], asked before this call, so the new folder is never a surprise.
+pub fn write_atomic_making_folders(path: &Path, bytes: &[u8]) -> io::Result<()> {
+    if let Some(folder) = missing_folder(path) {
+        let dir = path.parent().unwrap_or(&folder);
+        std::fs::create_dir_all(dir).map_err(|e| io::Error::new(e.kind(), format!("the folder {} could not be created: {e}", dir.display())))?;
+    }
+    write_atomic(path, bytes)
+}
+
+/// [`write_atomic`] filling the temporary file through `fill` (streamed rather than one buffer),
+/// with `permissions` given to it from its creation (`None`: the usual creation mode). A symlink
+/// at `path` is replaced by the new file, never written through.
+pub fn write_atomic_with(path: &Path, permissions: Option<Permissions>, fill: impl FnOnce(&mut File) -> io::Result<()>) -> io::Result<()> {
     let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).map_or_else(|| PathBuf::from("."), Path::to_path_buf);
     let (mut file, tmp) = create_temp(&dir, permissions.as_ref())?;
     let write = (|| {
         if let Some(permissions) = permissions {
             file.set_permissions(permissions)?;
         }
-        file.write_all(bytes)?;
+        fill(&mut file)?;
         file.flush()?;
         file.sync_all()
     })();
@@ -55,9 +86,57 @@ pub fn write_atomic(path: &Path, bytes: &[u8]) -> io::Result<()> {
         let _ = std::fs::remove_file(&tmp);
         return Err(e);
     }
+    sync_dir(&dir);
     Ok(())
 }
 
+/// Flush `dir` so a rename just made in it survives a crash or power loss (POSIX records a
+/// rename in the directory, not in the file). Best effort: some file systems (network shares)
+/// refuse to sync a directory, and the file itself is already on disk.
+fn sync_dir(dir: &Path) {
+    #[cfg(unix)]
+    if let Ok(d) = File::open(dir) {
+        let _ = d.sync_all();
+    }
+    #[cfg(not(unix))]
+    let _ = dir;
+}
+
+/// Resolve `path` when it is a symlink, or return `None` if it is not one.
+///
+/// A dangling link (for example into an unavailable mount) cannot be canonicalized, so its target
+/// is followed by hand with `read_link`, joining relative targets onto the link's directory.
+fn resolve_symlink(path: &Path) -> io::Result<Option<PathBuf>> {
+    match std::fs::symlink_metadata(path) {
+        Ok(meta) if meta.file_type().is_symlink() => {}
+        _ => return Ok(None),
+    }
+    if let Ok(target) = std::fs::canonicalize(path) {
+        return Ok(Some(target));
+    }
+    let mut current = path.to_path_buf();
+    for _ in 0..40 {
+        let target = std::fs::read_link(&current)?;
+        current = if target.is_absolute() { target } else { current.parent().map_or(target.clone(), |p| p.join(&target)) };
+        match std::fs::symlink_metadata(&current) {
+            Ok(meta) if meta.file_type().is_symlink() => {}
+            Ok(_) => return finish_target(&current),
+            Err(e) if e.kind() == io::ErrorKind::NotFound => return finish_target(&current),
+            Err(e) => return Err(e),
+        }
+    }
+    Err(io::Error::new(io::ErrorKind::InvalidInput, "too many levels of symbolic links"))
+}
+
+/// Build the write path for a resolved, non-link (possibly missing) target.
+fn finish_target(current: &Path) -> io::Result<Option<PathBuf>> {
+    // The target's directory must exist; otherwise report the error rather than replacing the link.
+    let parent = current.parent().filter(|p| !p.as_os_str().is_empty()).map_or_else(|| PathBuf::from("."), Path::to_path_buf);
+    let parent = std::fs::canonicalize(parent)?;
+    let name = current.file_name().ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "symlink target has no file name"))?;
+    Ok(Some(parent.join(name)))
+}
+
 /// Create a fresh, exclusively-owned temporary file inside `dir`, returning its handle and path.
 ///
 /// `create_new(true)` opens with `O_CREAT | O_EXCL`, which refuses to follow or reuse an existing
@@ -101,6 +180,30 @@ fn create_exclusive(path: &Path, permissions: Option<&Permissions>) -> io::Resul
 mod tests {
     use super::*;
 
+    #[test]
+    fn creates_missing_parent_directories() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-mkdir-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        let dest = dir.join("new_folder").join("deeper").join("out.bin");
+        std::fs::create_dir_all(&dir).unwrap();
+        assert_eq!(missing_folder(&dest), Some(dir.join("new_folder")));
+        assert!(write_atomic(&dest, b"created").is_err(), "the plain writer never makes folders");
+        write_atomic_making_folders(&dest, b"created").unwrap();
+        assert_eq!(std::fs::read(&dest).unwrap(), b"created");
+        assert_eq!(missing_folder(&dest), None);
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn a_folder_that_cannot_be_made_is_named_in_the_error() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-nomk-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let blocker = dir.join("a_file");
+        std::fs::write(&blocker, b"x").unwrap();
+        let e = write_atomic_making_folders(&blocker.join("sub").join("out.bin"), b"new").unwrap_err();
+        assert!(e.to_string().contains("could not be created"), "{e}");
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
     #[test]
     fn replaces_contents_atomically() {
         let dir = std::env::temp_dir().join(format!("cadcraft-aw-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
@@ -116,6 +219,18 @@ mod tests {
         std::fs::remove_dir_all(&dir).ok();
     }
 
+    /// A write into a folder whose entries can be listed syncs that folder without failing, and
+    /// a folder that can't be opened (gone) is no error for the sync itself.
+    #[test]
+    fn the_folder_is_synced_after_the_rename() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-sync-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        write_atomic(&dir.join("a.bin"), b"x").unwrap();
+        assert_eq!(std::fs::read(dir.join("a.bin")).unwrap(), b"x");
+        sync_dir(&dir.join("missing"));
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
     #[cfg(unix)]
     #[test]
     fn does_not_follow_a_planted_temp_symlink() {
@@ -147,6 +262,54 @@ mod tests {
         assert_eq!(std::fs::read(&dest).unwrap(), b"private report");
         std::fs::remove_dir_all(dir).unwrap();
     }
+    #[cfg(unix)]
+    #[test]
+    fn symlinked_destination_updates_the_target() {
+        use std::os::unix::fs::{PermissionsExt, symlink};
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-link-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let real = dir.join("real.dxf");
+        let link = dir.join("link.dxf");
+        std::fs::write(&real, b"old").unwrap();
+        std::fs::set_permissions(&real, std::fs::Permissions::from_mode(0o600)).unwrap();
+        symlink(&real, &link).unwrap();
+        write_atomic(&link, b"new").unwrap();
+        assert!(std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink(), "symlink was replaced by a regular file");
+        assert_eq!(std::fs::read(&real).unwrap(), b"new");
+        assert_eq!(std::fs::metadata(&real).unwrap().permissions().mode() & 0o777, 0o600);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn dangling_symlink_destination_creates_the_target() {
+        use std::os::unix::fs::symlink;
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-dangle-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(dir.join("mnt")).unwrap();
+        let real = dir.join("mnt").join("real.dxf");
+        let link = dir.join("link.dxf");
+        symlink("mnt/real.dxf", &link).unwrap();
+        write_atomic(&link, b"new").unwrap();
+        assert!(std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink(), "symlink was replaced by a regular file");
+        assert_eq!(std::fs::read(&real).unwrap(), b"new");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn dangling_symlink_with_missing_parent_errors_and_keeps_the_link() {
+        use std::os::unix::fs::symlink;
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-nomnt-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let link = dir.join("link.dxf");
+        symlink("missing/real.dxf", &link).unwrap();
+        assert!(write_atomic(&link, b"new").is_err());
+        assert!(write_atomic_making_folders(&link, b"new").is_err());
+        assert!(!dir.join("missing").exists(), "a link's unavailable target folder must not be created");
+        assert!(std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink());
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
     #[cfg(unix)]
     #[test]
     fn private_temp_is_restricted_from_creation() {

crates/engine/src/audit.rs

@@ -234,9 +234,10 @@ fn tables(d: &mut Drawing, out: &mut Vec<Issue>) {
         missing("table style", "Standard", out);
         d.table_styles.insert(0, TableStyle::default());
     }
-    let linetypes: Vec<String> = d.linetypes.iter().map(|l| l.name.clone()).collect();
+    // Name sets built once: both tables come from the drawing, so a scan per reference is quadratic.
+    let linetypes: HashSet<String> = d.linetypes.iter().map(|l| l.name.to_ascii_lowercase()).collect();
     for l in &mut d.layers {
-        if !linetypes.iter().any(|n| n.eq_ignore_ascii_case(&l.linetype)) {
+        if !linetypes.contains(&l.linetype.to_ascii_lowercase()) {
             out.push(issue(
                 "missingLinetype",
                 "tables",
@@ -247,8 +248,8 @@ fn tables(d: &mut Drawing, out: &mut Vec<Issue>) {
             l.linetype = "Continuous".into();
         }
     }
-    let styles: Vec<String> = d.text_styles.iter().map(|s| s.name.clone()).collect();
-    let known = |n: &str| styles.iter().any(|s| s.eq_ignore_ascii_case(n));
+    let styles: HashSet<String> = d.text_styles.iter().map(|s| s.name.to_ascii_lowercase()).collect();
+    let known = |n: &str| styles.contains(&n.to_ascii_lowercase());
     for s in &mut d.dim_styles {
         if !known(&s.text_style) {
             out.push(issue(
@@ -460,17 +461,13 @@ fn references(d: &mut Drawing, out: &mut Vec<Issue>) {
                         m.style = "Standard".into();
                     }
                 }
-                EntityKind::Table(t) => {
-                    if !has_name(&d.table_styles, &t.style, |s| &s.name) {
-                        note("table style", &t.style);
-                        t.style = "Standard".into();
-                    }
+                EntityKind::Table(t) if !has_name(&d.table_styles, &t.style, |s| &s.name) => {
+                    note("table style", &t.style);
+                    t.style = "Standard".into();
                 }
-                EntityKind::Leader(l) => {
-                    if !ok_dim(d, &l.style) {
-                        note("dimension style", &l.style);
-                        l.style = "Standard".into();
-                    }
+                EntityKind::Leader(l) if !ok_dim(d, &l.style) => {
+                    note("dimension style", &l.style);
+                    l.style = "Standard".into();
                 }
                 EntityKind::Dimension(dim) => {
                     if !ok_dim(d, &dim.style) {

crates/engine/src/autosave.rs

@@ -4,15 +4,18 @@
 //! autosave is written as DXF to `<SAVEFILEPATH>/<drawing>_<instance>_<uid>.sv$`. The file goes
 //! away when the drawing is saved or closed and when the app exits normally, so a file left behind
 //! means the app (or the machine) went down; the next start offers it for recovery. A running app
-//! keeps a lock file (`<instance>.lock`) fresh, so another copy running at the same time doesn't
-//! offer its files. SAVEFILEPATH may be a folder other programs use too, so only names built from
-//! an instance id ([`is_instance_id`]) are ever read as ours or deleted.
+//! holds an operating-system lock on its lock file (`<instance>.lock`) and keeps the file fresh, so
+//! another copy running at the same time doesn't offer its files. The system drops the lock the
+//! moment a process ends, however it ended, so a relaunch after a crash can offer recovery at once.
+//! Where locks aren't available, and for lock files of older versions, a file not refreshed for
+//! [`STALE_LOCK_SECS`] counts as stopped. SAVEFILEPATH may be a folder other programs use too, so
+//! only names built from an instance id ([`is_instance_id`]) are ever read as ours or deleted.
 //!
 //! [`Autosaver::plan`] decides what to write and delete (no I/O, so it is testable); on the desktop
 //! [`Autosaver::tick`] carries it out, writing on a background thread. SAVETIME and SAVEFILEPATH
 //! are profile settings: process-wide, not saved in the drawing.
 
-use std::collections::{HashMap, HashSet};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::atomic::{AtomicU32, Ordering};
 use std::sync::{Arc, Mutex, Weak};
 
@@ -29,11 +32,27 @@ pub const DEFAULT_SAVETIME: u32 = 10;
 pub const MAX_SAVETIME: u32 = 600;
 /// A lock file not refreshed for this long belongs to an app that is no longer running.
 pub const STALE_LOCK_SECS: u64 = 5 * 60;
+/// How a lock file ends when its app holds the system lock on it, so a free lock proves the app
+/// stopped. Older versions write only the process id and never hold one.
+#[cfg(not(target_arch = "wasm32"))]
+const LOCK_HELD: &str = " held";
 /// How often a running app refreshes its lock file.
 #[cfg(not(target_arch = "wasm32"))]
 const HEARTBEAT_SECS: f64 = 60.0;
 
 static SAVETIME: AtomicU32 = AtomicU32::new(DEFAULT_SAVETIME);
+static ISAVEBAK: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(true);
+
+/// ISAVEBAK: whether saving over a drawing keeps the previous file as `<name>.bak` (on by
+/// default, as in AutoCAD). A profile setting like SAVETIME.
+pub fn isavebak() -> bool {
+    ISAVEBAK.load(Ordering::Relaxed)
+}
+
+/// Turn ISAVEBAK on or off.
+pub fn set_isavebak(on: bool) {
+    ISAVEBAK.store(on, Ordering::Relaxed);
+}
 static SAVEFILEPATH: Mutex<String> = Mutex::new(String::new());
 
 /// SAVETIME: minutes between autosaves; 0 turns autosave off.
@@ -59,10 +78,22 @@ pub fn set_savefilepath(path: &str) {
 
 /// The autosave file name for drawing `uid` titled `title`, written by app instance `instance`.
 pub fn file_name(title: &str, instance: &str, uid: u64) -> String {
-    let stem: String = title.chars().map(|c| if c.is_alphanumeric() || " .-_()".contains(c) { c } else { '-' }).take(80).collect();
+    // File systems limit a name to 255 bytes, so the stem gets what the suffix leaves, cut at a character boundary.
+    let suffix = format!("_{instance}_{uid}.{EXT}");
+    let budget = 255usize.saturating_sub(suffix.len());
+    let mut used = 0;
+    let stem: String = title
+        .chars()
+        .map(|c| if c.is_alphanumeric() || " .-_()".contains(c) { c } else { '-' })
+        .take(80)
+        .take_while(|c| {
+            used += c.len_utf8();
+            used <= budget
+        })
+        .collect();
     let stem = stem.trim().trim_matches('.');
     let stem = if stem.is_empty() { "Drawing" } else { stem };
-    format!("{stem}_{instance}_{uid}.{EXT}")
+    format!("{stem}{suffix}")
 }
 
 /// Whether `s` has the form of an app instance id (`<process id>-<start time in hex>`, see
@@ -125,13 +156,21 @@ pub struct Autosaver {
     docs: HashMap<u64, Tracked>,
     /// Drawings whose autosave is being written right now.
     busy: HashSet<u64>,
-    /// Writes in progress; each tells whether its file was written.
+    /// Why the last autosave of each drawing failed, until one succeeds or the drawing no longer
+    /// needs it. Ordered, so [`Autosaver::failure`] doesn't change between frames.
+    failed: BTreeMap<u64, String>,
+    /// Writes in progress; each ends with why its file wasn't written, if it wasn't.
     #[cfg(not(target_arch = "wasm32"))]
-    running: Vec<(u64, std::thread::JoinHandle<bool>)>,
+    running: Vec<(u64, std::thread::JoinHandle<std::result::Result<(), String>>)>,
     #[cfg(not(target_arch = "wasm32"))]
     start: std::time::Instant,
     #[cfg(not(target_arch = "wasm32"))]
     last_beat: Option<f64>,
+    /// This app's lock files: one per folder, because SAVEFILEPATH can change while files remain
+    /// in the old folder. Each with the file it holds open for the system lock, or `None` where
+    /// locks don't work and only the file's age counts.
+    #[cfg(not(target_arch = "wasm32"))]
+    locks: Vec<(std::path::PathBuf, Option<std::fs::File>)>,
 }
 
 impl Autosaver {
@@ -140,12 +179,15 @@ impl Autosaver {
             instance: instance.into(),
             docs: HashMap::new(),
             busy: HashSet::new(),
+            failed: BTreeMap::new(),
             #[cfg(not(target_arch = "wasm32"))]
             running: Vec::new(),
             #[cfg(not(target_arch = "wasm32"))]
             start: std::time::Instant::now(),
             #[cfg(not(target_arch = "wasm32"))]
             last_beat: None,
+            #[cfg(not(target_arch = "wasm32"))]
+            locks: Vec::new(),
         }
     }
 
@@ -163,6 +205,11 @@ impl Autosaver {
         self.docs.values().filter_map(|t| t.file.clone()).collect()
     }
 
+    /// The drawings with no up-to-date recovery copy and why, for the host to show the user.
+    pub fn failures(&self) -> impl Iterator<Item = (u64, &str)> {
+        self.failed.iter().map(|(uid, why)| (*uid, why.as_str()))
+    }
+
     /// What to do at `now` (seconds, any fixed origin) with SAVETIME `minutes` and autosave folder
     /// `dir`: write drawings changed `minutes` ago or earlier and not autosaved since, delete the
     /// files of drawings that were saved (no unsaved changes left) or closed.
@@ -196,6 +243,7 @@ impl Autosaver {
                     jobs.push(Job::Delete { path });
                 }
                 *t = Tracked::default();
+                self.failed.remove(&st.uid);
                 continue;
             }
             let same = |w: &Option<Weak<Drawing>>, d: &Arc<Drawing>| w.as_ref().is_some_and(|w| std::ptr::eq(w.as_ptr(), Arc::as_ptr(d)));
@@ -224,6 +272,8 @@ impl Autosaver {
             t.since = None;
             jobs.push(Job::Write { uid: st.uid, path, doc });
         }
+        let docs = &self.docs;
+        self.failed.retain(|uid, _| docs.contains_key(uid));
         jobs
     }
 
@@ -253,10 +303,15 @@ pub use native::*;
 
 #[cfg(not(target_arch = "wasm32"))]
 mod native {
+    use std::fs::{File, OpenOptions, TryLockError};
+    use std::io::{Read, Write};
     use std::path::Path;
     use std::time::{Duration, SystemTime};
 
-    use super::*;
+    use super::{
+        Autosaver, Drawing, HEARTBEAT_SECS, HashMap, Job, LOCK_HELD, Recoverable, STALE_LOCK_SECS, Session, is_instance_id, parse_file_name,
+        parse_lock_name, savefilepath, savetime,
+    };
 
     /// A new instance id: the process id and the start time.
     pub fn instance_id() -> String {
@@ -280,6 +335,28 @@ mod native {
         Some(SystemTime::now().duration_since(m).unwrap_or_default())
     }
 
+    /// Whether the app instance named by a lock file in `dir` may still be running: its system
+    /// lock answers at once, and the file's age decides when it can't (no lock support, a lock
+    /// file from an older version).
+    fn owner_alive(dir: &Path, instance: &str) -> bool {
+        let by_age = || instance_alive(lock_age(dir, instance));
+        let path = lock_path(dir, instance);
+        // Only a plain file is opened: opening a FIFO planted in a shared folder would block.
+        if !std::fs::symlink_metadata(&path).is_ok_and(|m| m.is_file()) {
+            return by_age();
+        }
+        let Ok(file) = File::open(&path) else { return by_age() };
+        match file.try_lock() {
+            Err(TryLockError::WouldBlock) => true,
+            Err(TryLockError::Error(_)) => by_age(),
+            Ok(()) => {
+                let mut text = String::new();
+                let held = file.take(64).read_to_string(&mut text).is_ok() && text.ends_with(LOCK_HELD);
+                !held && by_age()
+            }
+        }
+    }
+
     /// The autosave files in `dir` left behind by apps that are no longer running (never those of
     /// `own`, this app's instance), oldest first.
     pub fn recoverable(dir: &Path, own: &str) -> Vec<Recoverable> {
@@ -289,7 +366,7 @@ mod native {
         for e in entries.flatten().take(10_000) {
             let name = e.file_name().to_string_lossy().to_string();
             let Some((title, instance, _)) = parse_file_name(&name) else { continue };
-            if instance == own || *alive.entry(instance.to_string()).or_insert_with(|| instance_alive(lock_age(dir, instance))) {
+            if instance == own || *alive.entry(instance.to_string()).or_insert_with(|| owner_alive(dir, instance)) {
                 continue;
             }
             let Ok(meta) = e.metadata() else { continue };
@@ -331,7 +408,7 @@ mod native {
         for n in &names {
             let Some(instance) = parse_lock_name(n) else { continue };
             let has_files = names.iter().any(|f| parse_file_name(f).is_some_and(|(_, i, _)| i == instance));
-            if !has_files && !instance_alive(lock_age(dir, instance)) {
+            if !has_files && !owner_alive(dir, instance) {
                 let _ = std::fs::remove_file(dir.join(n));
             }
         }
@@ -389,24 +466,67 @@ mod native {
             writes
         }
 
+        /// Whether a background write hasn't finished yet. Its file can exist before it finishes
+        /// (the folder is synced after the rename), and until [`Autosaver::reap`] takes it in, the
+        /// drawing is left out of planning.
+        pub fn writing(&self) -> bool {
+            self.running.iter().any(|(_, h)| !h.is_finished())
+        }
+
+        /// Whether a write's result hasn't been taken in yet, finished or not: the host needs
+        /// another [`Autosaver::tick`] to learn whether it failed.
+        pub fn results_pending(&self) -> bool {
+            !self.running.is_empty()
+        }
+
         /// Take in the writes that have finished ([`Autosaver::tick`] does this first). A drawing
         /// whose write failed is no longer counted as autosaved: the next plan restarts its clock,
-        /// so it is tried again SAVETIME later even if it doesn't change.
+        /// so it is tried again SAVETIME later even if it doesn't change, and [`Autosaver::failure`]
+        /// says why until a write succeeds.
         pub fn reap(&mut self) {
             let (done, running) = std::mem::take(&mut self.running).into_iter().partition::<Vec<_>, _>(|(_, h)| h.is_finished());
             self.running = running;
             for (uid, h) in done {
-                self.busy.remove(&uid);
-                if !h.join().unwrap_or(false) {
-                    self.unwritten(uid);
-                }
+                self.settle(uid, h);
             }
         }
 
-        fn unwritten(&mut self, uid: u64) {
+        fn settle(&mut self, uid: u64, h: std::thread::JoinHandle<std::result::Result<(), String>>) {
+            self.busy.remove(&uid);
+            match h.join().unwrap_or_else(|_| Err("the autosave writer stopped unexpectedly".to_string())) {
+                Ok(()) => {
+                    self.failed.remove(&uid);
+                }
+                Err(e) => self.unwritten(uid, e),
+            }
+        }
+
+        /// Write every drawing with changes not yet autosaved and wait until it is done, because
+        /// the app has gone wrong and may not get another frame. Unlike [`Autosaver::save_now`]
+        /// this also runs when SAVETIME is 0: unsaved work comes before that preference. Returns
+        /// how many drawings were written.
+        pub fn emergency_save(&mut self, s: &Session) -> usize {
+            for (uid, h) in std::mem::take(&mut self.running) {
+                self.settle(uid, h);
+            }
+            let now = self.start.elapsed().as_secs_f64();
+            let dir = savefilepath();
+            let jobs = self.plan_with(s, now, savetime().max(1), &dir, true);
+            let uids: Vec<u64> = jobs.iter().filter_map(|j| if let Job::Write { uid, .. } = j { Some(*uid) } else { None }).collect();
+            self.perform(jobs);
+            self.last_beat = None;
+            self.heartbeat(&dir, now);
+            for (uid, h) in std::mem::take(&mut self.running) {
+                self.settle(uid, h);
+            }
+            uids.iter().filter(|uid| !self.failed.contains_key(uid)).count()
+        }
+
+        fn unwritten(&mut self, uid: u64, why: String) {
             if let Some(t) = self.docs.get_mut(&uid) {
                 t.written = None;
             }
+            self.failed.insert(uid, why);
         }
 
         /// Carry out jobs from [`Autosaver::plan`]: writes on a background thread, deletes now.
@@ -417,16 +537,17 @@ mod native {
                     Job::Write { uid, path, doc } => {
                         let Some(write) = crate::cmd::file::io().map(|h| h.write) else {
                             log::warn!("autosave: file formats are not available in this build");
+                            self.unwritten(uid, "file formats are not available in this build".to_string());
                             continue;
                         };
                         let spawned = std::thread::Builder::new().name("autosave".into()).spawn(move || match write_file(write, &doc, &path) {
                             Ok(()) => {
                                 log::info!("autosaved {path}");
-                                true
+                                Ok(())
                             }
                             Err(e) => {
                                 log::warn!("autosave {path}: {e}");
-                                false
+                                Err(format!("{path}: {e}"))
                             }
                         });
                         match spawned {
@@ -436,7 +557,7 @@ mod native {
                             }
                             Err(e) => {
                                 log::warn!("autosave: {e}");
-                                self.unwritten(uid);
+                                self.unwritten(uid, e.to_string());
                             }
                         }
                     }
@@ -451,12 +572,40 @@ mod native {
             }
             self.last_beat = Some(now);
             let dir = Path::new(dir);
-            let r = create_folder(dir).and_then(|()| std::fs::write(lock_path(dir, &self.instance), std::process::id().to_string()));
-            if let Err(e) = r {
+            if let Err(e) = create_folder(dir).and_then(|()| self.refresh_lock(&lock_path(dir, &self.instance))) {
                 log::warn!("autosave: lock file in {}: {e}", dir.display());
             }
         }
 
+        /// Refresh this app's lock files, and start one at `path` if there isn't one yet, taking
+        /// the system lock on it if it can. Without that lock the file still works by its age.
+        /// Only trouble at `path` is an error: an older folder may be gone by now.
+        fn refresh_lock(&mut self, path: &Path) -> std::io::Result<()> {
+            let id = std::process::id();
+            let mut current = None;
+            for (held, file) in &self.locks {
+                let refreshed = match file {
+                    Some(file) => file.set_modified(SystemTime::now()),
+                    None => std::fs::write(held, id.to_string()),
+                };
+                if held == path {
+                    current = Some(refreshed);
+                }
+            }
+            if let Some(refreshed) = current {
+                return refreshed;
+            }
+            let mut file = OpenOptions::new().write(true).create(true).truncate(false).open(path)?;
+            if file.try_lock().is_err() {
+                self.locks.push((path.to_path_buf(), None));
+                return std::fs::write(path, id.to_string());
+            }
+            file.set_len(0)?;
+            file.write_all(format!("{id}{LOCK_HELD}").as_bytes())?;
+            self.locks.push((path.to_path_buf(), Some(file)));
+            Ok(())
+        }
+
         /// The app is closing normally: finish writes in progress, then delete this app's autosave
         /// files and its lock file.
         pub fn shutdown(&mut self) {
@@ -468,6 +617,10 @@ mod native {
                 discard(&path);
             }
             self.docs.clear();
+            for (path, file) in self.locks.drain(..) {
+                drop(file);
+                let _ = std::fs::remove_file(path);
+            }
             let dir = savefilepath();
             if !dir.is_empty() && is_instance_id(&self.instance) {
                 let _ = std::fs::remove_file(lock_path(Path::new(&dir), &self.instance));
@@ -475,3 +628,20 @@ mod native {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn file_name_fits_255_bytes_for_multibyte_titles() {
+        let instance = "12345-abcdef0123456789";
+        for title in ["图".repeat(100), "😀".repeat(100), "aé图😀".repeat(40), "a".repeat(300)] {
+            let name = file_name(&title, instance, u64::MAX);
+            assert!(name.len() <= 255, "{} bytes", name.len());
+            let (t, i, u) = parse_file_name(&name).expect("round trips");
+            assert_eq!((i, u), (instance, u64::MAX));
+            assert!(!t.is_empty());
+        }
+    }
+}

crates/engine/src/blockedit.rs

@@ -144,6 +144,11 @@ impl BlockEdit {
         }
         let host = &self.host.doc;
         let mut d = editor.clone();
+        // When the block is saved under another name, the edited block keeps the drawing's
+        // description and block `name` gets the description changed in the editor.
+        if !name.eq_ignore_ascii_case(&self.name) {
+            keep_description(&mut d, host, &self.name);
+        }
         d.model = host.model.clone();
         d.layouts = host.layouts.clone();
         d.groups = host.groups.clone();
@@ -171,6 +176,21 @@ impl BlockEdit {
     }
 }
 
+/// Give block `name` of `d` the description `host` has for it, or, when `host` has no such block,
+/// drop the empty definition a description gives a block the editor started and never saved.
+fn keep_description(d: &mut Drawing, host: &Drawing, name: &str) {
+    match host.block(name) {
+        Some(h) => {
+            if let Some((_, b)) = d.blocks.iter_mut().find(|(k, _)| k.eq_ignore_ascii_case(name))
+                && b.description != h.description
+            {
+                Arc::make_mut(b).description = h.description.clone();
+            }
+        }
+        None => d.blocks.retain(|k, b| !(k.eq_ignore_ascii_case(name) && b.entities.is_empty())),
+    }
+}
+
 impl DocState {
     /// The drawing as a file saves it: outside the Block Editor's changes while it is open.
     pub fn drawing(&self) -> &Arc<Drawing> {
@@ -248,11 +268,12 @@ impl DocState {
     }
 
     /// Start editing in the Block Editor `be` (the drawing is already the editor's): a fresh
-    /// undo history, nothing selected, model space.
+    /// undo history, nothing selected, nothing for OOPS, model space.
     fn enter_block_editor(&mut self, be: BlockEdit) {
         self.undo.clear();
         self.redo.clear();
         self.undo_ctl = Default::default();
+        self.erased = Default::default();
         self.selection.clear();
         self.previous_selection.clear();
         self.space = cadcraft_doc::Space::Model;
@@ -272,6 +293,24 @@ impl DocState {
         let d = be.compose(&self.doc, &name)?;
         let original = d.block(&name).map(|b| b.entities.clone()).unwrap_or_default();
         let name = d.block(&name).map(|b| b.name.clone()).unwrap_or(name);
+        // When BSAVEAS saves the block under another name, the editor's drawing and each undo and
+        // redo step get the block as saved and the edited block as the drawing has it, so a later
+        // save and the description shown start from them after an undo too.
+        if !name.eq_ignore_ascii_case(&be.name)
+            && let Some(b) = d.block(&name).cloned()
+        {
+            let was = be.name.clone();
+            let reconcile = |doc: &mut Arc<Drawing>| {
+                let editor = Arc::make_mut(doc);
+                keep_description(editor, &d, &was);
+                editor.blocks.retain(|k, _| !k.eq_ignore_ascii_case(&name));
+                editor.blocks.insert(name.clone(), b.clone());
+            };
+            reconcile(&mut self.doc);
+            for step in self.undo.iter_mut().chain(self.redo.iter_mut()) {
+                reconcile(&mut step.doc);
+            }
+        }
         let editor = self.doc.clone();
         let Some(be) = &mut self.block_edit else { return Ok(()) };
         let before = be.host.doc.clone();
@@ -300,6 +339,7 @@ impl DocState {
         self.undo = host.undo;
         self.redo = host.redo;
         self.undo_ctl = host.undo_ctl;
+        self.erased = host.erased;
         // The drawing comes back with nothing selected; Previous is what was selected before.
         self.selection.clear();
         self.previous_selection = if host.selection.is_empty() { host.previous_selection } else { host.selection };

crates/engine/src/cmd.rs

@@ -22,9 +22,11 @@ mod inquiry;
 mod layer;
 mod layout;
 mod lisp;
+mod merge;
 mod mleader_content;
 mod mleader_edit;
 mod modify;
+pub(crate) use modify::Erased;
 mod modify2;
 mod mtext_opts;
 mod overkill;
@@ -33,6 +35,7 @@ pub mod plotters;
 mod props;
 pub use draw2::breakline::BreaklineOptions;
 pub use props::MatchProps;
+pub(crate) use props::UNIT_RANGES;
 pub(crate) use props::{current_color_value, set_current_color_value};
 mod qselect;
 mod selecttools;

crates/engine/src/cmd/annotate.rs

@@ -16,6 +16,7 @@ use crate::{Accept, EngineError, Input, Interactive, LeaderOrder, MLeaderOptions
 mod angular;
 mod common;
 mod edit;
+mod leader;
 mod linear;
 mod mleader;
 mod radial;
@@ -88,7 +89,10 @@ pub fn specs() -> Vec<CommandSpec> {
             .alias(&["mld"])
             .params("{points: [[arrow], ..., [landing]] ([location] with leaderType none), text?, leaderType?: straight|spline|none, block?: name, blockAttach?: center|insertion}")
             .interactive(|s| Ok(Box::new(MLeaderM::new(s)))),
-        CommandSpec::new("leader", "Leader", run_leader).alias(&["lead"]).params("{points: [[x,y]...], text?}"),
+        CommandSpec::new("leader", "Leader", run_leader)
+            .alias(&["lead"])
+            .params("{points: [[x,y]...], text?}")
+            .interactive(|_| Ok(Box::new(leader::LeaderM::default()))),
         CommandSpec::new("dimstyle.update", "Update", run_update)
             .menu(&["Dimension", "Update"])
             .params("{handles?}")

crates/engine/src/cmd/annotate/angular.rs

@@ -1,5 +1,8 @@
 use super::common::{DimText, add_dim, assoc_enabled, dim, hex_param, pick_at, segment_at, with_assoc};
-use super::*;
+use super::{
+    Accept, AssocSnap, DimAssoc, DimKind, EntityKind, Handle, Input, Interactive, Prompt, Result, Segment, Session, Step, Value, Vec2, bad, json,
+    point_req, targets, v3,
+};
 
 /// Two-line angular dimension (type 2) between two lines, attached to them.
 fn angular_from_lines(s: &Session, h1: Handle, h2: Handle, at: Vec2) -> Option<EntityKind> {

crates/engine/src/cmd/annotate/common.rs

@@ -1,4 +1,4 @@
-use super::*;
+use super::{Accept, DimAssoc, DimKind, Dimension, EntityKind, Handle, Input, Prompt, Result, Segment, Session, Value, Vec2, Vec3, v3};
 
 pub(super) fn style(s: &Session) -> String {
     s.doc().map(|d| d.header.str("DIMSTYLE", "Standard")).unwrap_or_else(|_| "Standard".into())
@@ -22,6 +22,7 @@ pub(super) fn dim(s: &Session, kind: DimKind, defpt: Vec2, p13: Vec2, p14: Vec2,
         overrides: s.doc().map(|d| d.dim_overrides()).unwrap_or_default(),
         assoc: Vec::new(),
         marks: Default::default(),
+        insertion_point: Vec3::ZERO,
     })
 }
 
@@ -48,6 +49,19 @@ pub(super) fn add_dim(s: &mut Session, k: EntityKind) -> Result<Handle> {
     {
         dm.assoc = crate::assoc::reassociate(s.doc()?, &s.space(), dm);
     }
+    // The measurement is what the DXF/DWG writer computes from the geometry (group 42); filling it
+    // in now means queries show it before the drawing is saved and reopened (#2421).
+    if let EntityKind::Dimension(dm) = &mut k
+        && let Ok(d) = s.doc()
+    {
+        let style = d.dim_style(&dm.style).cloned().unwrap_or_default();
+        let g = cadcraft_render::dimension_geometry(dm, &style, d.header.f64("DIMSCALE", 1.0));
+        dm.measurement = g.measurement;
+        // The text position the writer puts in group 11 when the user has not placed the text.
+        if !dm.user_text_pos {
+            dm.text_mid = g.text_pos.to3(0.0);
+        }
+    }
     let h = s.add_entity(k)?;
     s.last_dim = Some(h);
     Ok(h)
@@ -94,7 +108,7 @@ pub(super) fn hex_param(p: &Value, key: &str) -> Option<Handle> {
 
 pub(super) fn pick_at(s: &Session, p: Vec2) -> Option<Handle> {
     let ap = s.pixel_size() * s.settings.pickbox.max(1.0) * 1.5;
-    crate::select::pick(s.doc().ok()?, &s.space(), p, ap)
+    s.pick_object(&s.space(), p, ap).ok().flatten()
 }
 
 /// The straight or curved piece of `h` picked at `p`: a line, an arc, or the polyline segment nearest `p`.

crates/engine/src/cmd/annotate/edit.rs

@@ -1,5 +1,8 @@
 use super::common::{hex_param, style};
-use super::*;
+use super::{
+    Accept, DimKind, EntityKind, Handle, Input, Interactive, Prompt, Result, SelOutcome, SelectPhase, Session, Step, Value, Vec2, bad, json,
+    point_param, str_param, targets, v3,
+};
 
 pub(super) fn run_update(s: &mut Session, p: &Value) -> Result<Value> {
     let hs = targets(s, p)?;

crates/engine/src/cmd/annotate/leader.rs

@@ -0,0 +1,330 @@
+//! LEADER at the command line, as AutoCAD 2024 runs it (accoreconsole, synthetic drawings): the
+//! points, Format and Undo, then annotation text, no annotation, or a block.
+//!
+//! The leader takes a hook line, a horizontal last segment DIMASZ long, when its last segment is
+//! straight and more than 15° off horizontal and text follows it; the text sits DIMGAP past the
+//! leader's end, above it (DIMTAD on) or centred on it (DIMTAD 0), on the side the leader runs to.
+//! All sizes are scaled by DIMSCALE. The text and the leader are separate objects here: the
+//! drawing model has no link from a leader to its annotation.
+
+use super::common::style;
+use super::{Accept, EntityKind, Handle, Input, Interactive, MText, Prompt, Result, Session, Step, Vec2, v3};
+use crate::cmd::curves::KW;
+
+/// Where LEADER is in its prompts.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+enum Ask {
+    #[default]
+    Points,
+    Format,
+    FirstLine,
+    NextLine,
+    Option,
+    /// Copy: the text or multiline text to copy.
+    Copy,
+    BlockName,
+    BlockPoint,
+    BlockX,
+    BlockY,
+    BlockRotation,
+}
+
+#[derive(Default)]
+pub(super) struct LeaderM {
+    ask: Ask,
+    pts: Vec<Vec2>,
+    spline: bool,
+    no_arrow: bool,
+    lines: Vec<String>,
+    block: String,
+    block_at: Vec2,
+    block_scale: Vec2,
+}
+
+/// What follows the leader.
+enum Annotation {
+    Text(Vec<String>),
+    /// A copy of a text or multiline text: its contents, height, width and style.
+    Copy(MText),
+    None,
+    Block {
+        name: String,
+        at: Vec2,
+        scale: Vec2,
+        rotation: f64,
+    },
+}
+
+impl Interactive for LeaderM {
+    fn name(&self) -> &'static str {
+        "LEADER"
+    }
+    fn prompt(&self, _s: &Session) -> Prompt {
+        let last = self.pts.last().copied();
+        match self.ask {
+            Ask::Points => match self.pts.len() {
+                0 => Prompt::new("Specify leader start point", Accept::POINT),
+                1 => Prompt::new("Specify next point", Accept::POINT).base_opt(last),
+                _ => Prompt::new("Specify next point", Accept::POINT).kw(&["Annotation", "Format", "Undo"]).default("Annotation").base_opt(last),
+            },
+            Ask::Format => Prompt::new("Enter leader format option", KW).kw(&["Spline", "STraight", "Arrow", "None"]).default("Exit"),
+            // "or <options>": the default is the options, not a keyword list.
+            Ask::FirstLine => Prompt::new("Enter first line of annotation text or", Accept::TEXT).default("options"),
+            Ask::NextLine => Prompt::new("Enter next line of annotation text", Accept::TEXT),
+            Ask::Copy => Prompt::new("Select an object to copy", Accept::SELECT),
+            Ask::Option => Prompt::new("Enter an annotation option", KW).kw(&["Tolerance", "Copy", "Block", "None", "Mtext"]).default("Mtext"),
+            Ask::BlockName => Prompt::new("Enter block name", Accept::TEXT).kw(&["?"]),
+            Ask::BlockPoint => Prompt::new("Specify insertion point", Accept::POINT).kw(&["Basepoint", "Scale", "X", "Y", "Z", "Rotate"]),
+            Ask::BlockX => Prompt::new("Enter X scale factor, specify opposite corner", Accept::NUMBER).kw(&["Corner", "XYZ"]).default("1"),
+            Ask::BlockY => Prompt::new("Enter Y scale factor", Accept::NUMBER).default("use X scale factor"),
+            Ask::BlockRotation => Prompt::new("Specify rotation angle", Accept::NUMBER).default("0"),
+        }
+    }
+    fn input(&mut self, s: &mut Session, i: Input) -> Result<Step> {
+        match self.ask {
+            Ask::Points => match i {
+                Input::Point(p) => self.pts.push(p),
+                // Enter after one point: no leader.
+                Input::Enter if self.pts.len() < 2 => return Ok(Step::Done),
+                Input::Enter => self.ask = Ask::FirstLine,
+                Input::Keyword(k) => match k.as_str() {
+                    "Annotation" => self.ask = Ask::FirstLine,
+                    "Format" => self.ask = Ask::Format,
+                    _ => {
+                        self.pts.pop();
+                    }
+                },
+                _ => {}
+            },
+            Ask::Format => {
+                // Enter, or Exit typed, changes nothing; either way back to the points.
+                if let Input::Keyword(k) = &i {
+                    match k.as_str() {
+                        "Spline" => self.spline = true,
+                        "STraight" => self.spline = false,
+                        "Arrow" => self.no_arrow = false,
+                        _ => self.no_arrow = true,
+                    }
+                }
+                self.ask = Ask::Points;
+            }
+            Ask::FirstLine | Ask::NextLine => match i {
+                Input::Text(t) if !t.is_empty() => {
+                    self.lines.push(t);
+                    self.ask = Ask::NextLine;
+                }
+                _ if self.ask == Ask::NextLine => {
+                    let lines = std::mem::take(&mut self.lines);
+                    return self.finish(s, Annotation::Text(lines));
+                }
+                _ => self.ask = Ask::Option,
+            },
+            Ask::Option => match &i {
+                Input::Keyword(k) if k == "None" => return self.finish(s, Annotation::None),
+                Input::Keyword(k) if k == "Block" => self.ask = Ask::BlockName,
+                Input::Keyword(k) if k == "Copy" => self.ask = Ask::Copy,
+                Input::Text(_) => s.echo("Invalid option keyword."),
+                // Mtext (the default) and Tolerance open an editor or a dialog in AutoCAD; at the
+                // command line, as in accoreconsole, they come back to the first line.
+                _ => self.ask = Ask::FirstLine,
+            },
+            Ask::Copy => {
+                let picked = match &i {
+                    Input::Pick(hs) => hs.first().copied(),
+                    Input::Point(p) => crate::select::pick(s.doc()?, &s.state()?.edit_space(), *p, s.settings.pickbox.max(1.0) * s.pixel_size()),
+                    _ => None,
+                };
+                let text = picked.and_then(|h| s.doc().ok()?.entity(h).cloned()).and_then(|e| match &e.kind {
+                    EntityKind::Text(t) => Some(MText {
+                        insert: t.insert,
+                        height: t.height,
+                        width: 0.0,
+                        attach: 4,
+                        rotation: 0.0,
+                        style: t.style.clone(),
+                        contents: t.value.clone(),
+                        line_spacing: 1.0,
+                        line_spacing_exact: false,
+                        columns: None,
+                    }),
+                    EntityKind::MText(m) => Some(m.clone()),
+                    _ => None,
+                });
+                match text {
+                    Some(m) => return self.finish(s, Annotation::Copy(m)),
+                    None if picked.is_some() => s.echo("The object is not text."),
+                    None => {}
+                }
+            }
+            Ask::BlockName => {
+                let name = match i {
+                    Input::Text(t) => t.trim().to_string(),
+                    Input::Keyword(k) => k,
+                    _ => return Ok(Step::Continue),
+                };
+                if name == "?" {
+                    let names: Vec<String> = s.doc()?.blocks.values().filter(|b| !b.anonymous).map(|b| b.name.clone()).collect();
+                    s.echo(format!("Defined blocks: {}", if names.is_empty() { "(none)".into() } else { names.join(", ") }));
+                } else if s.doc()?.block(&name).is_none() {
+                    s.echo(format!("Block \"{name}\" not found."));
+                } else {
+                    self.block = name;
+                    self.ask = Ask::BlockPoint;
+                }
+            }
+            Ask::BlockPoint => match i {
+                Input::Point(p) => {
+                    self.block_at = p;
+                    self.ask = Ask::BlockX;
+                }
+                Input::Keyword(_) => s.echo("This option is not available here yet."),
+                _ => {}
+            },
+            Ask::BlockX => match scale(&i) {
+                Some(x) => {
+                    self.block_scale = Vec2::new(x, x);
+                    self.ask = Ask::BlockY;
+                }
+                None => s.echo("Requires a nonzero number."),
+            },
+            Ask::BlockY => {
+                match scale(&i) {
+                    Some(y) if !matches!(i, Input::Enter) => self.block_scale.y = y,
+                    Some(_) => {}
+                    None => {
+                        s.echo("Requires a nonzero number.");
+                        return Ok(Step::Continue);
+                    }
+                }
+                self.ask = Ask::BlockRotation;
+            }
+            Ask::BlockRotation => {
+                let rotation = match &i {
+                    Input::Enter => 0.0,
+                    Input::Text(t) => match s.angle_settings().direction(t) {
+                        Some(a) => a,
+                        None => {
+                            s.echo("Requires a valid angle.");
+                            return Ok(Step::Continue);
+                        }
+                    },
+                    _ => return Ok(Step::Continue),
+                };
+                let a = Annotation::Block { name: self.block.clone(), at: self.block_at, scale: self.block_scale, rotation };
+                return self.finish(s, a);
+            }
+        }
+        Ok(Step::Continue)
+    }
+}
+
+/// A scale factor typed, or 1 for Enter; `None` for zero or anything that isn't a number.
+fn scale(i: &Input) -> Option<f64> {
+    match i {
+        Input::Enter => Some(1.0),
+        Input::Text(t) => t.trim().parse::<f64>().ok().filter(|v| v.is_finite() && *v != 0.0),
+        _ => None,
+    }
+}
+
+impl LeaderM {
+    fn finish(&mut self, s: &mut Session, ann: Annotation) -> Result<Step> {
+        let pts = std::mem::take(&mut self.pts);
+        add_leader(s, &pts, self.spline, !self.no_arrow, ann)?;
+        Ok(Step::Done)
+    }
+}
+
+/// The dimension settings LEADER draws with, from the current dimension style and DIMSCALE.
+struct Sizes {
+    arrow: f64,
+    gap: f64,
+    text: f64,
+    above: bool,
+    text_style: String,
+}
+
+fn sizes(s: &Session) -> Sizes {
+    // The current style with the drawing's DIM* overrides (what SETVAR DIMTXT… sets).
+    let st = s.doc().ok().and_then(|d| d.dim_style(&style(s)).map(|st| st.with_overrides(&d.dim_overrides()))).unwrap_or_default();
+    let k = if st.scale > 0.0 { st.scale } else { 1.0 };
+    let text_style = if st.text_style.is_empty() { "Standard".to_string() } else { st.text_style.clone() };
+    Sizes { arrow: st.arrow_size * k, gap: st.text_gap.abs() * k, text: st.text_height * k, above: st.text_above != 0, text_style }
+}
+
+/// LEADER's JSON form: a straight leader with an arrow through `pts`, and `text` (lines split at
+/// `\n`) placed as the command line places it. The handles of the leader and its text.
+pub(super) fn json_leader(s: &mut Session, pts: &[Vec2], text: Option<&str>) -> Result<Vec<Handle>> {
+    let ann = match text {
+        Some(t) if !t.is_empty() => Annotation::Text(t.split('\n').map(str::to_string).collect()),
+        _ => Annotation::None,
+    };
+    add_leader(s, pts, false, true, ann)
+}
+
+/// Draw the leader through `pts` and its annotation, as AutoCAD 2024 places them; their handles.
+fn add_leader(s: &mut Session, pts: &[Vec2], spline: bool, arrow: bool, ann: Annotation) -> Result<Vec<Handle>> {
+    let (Some(&end), Some(&before)) = (pts.last(), pts.len().checked_sub(2).and_then(|i| pts.get(i))) else { return Ok(Vec::new()) };
+    let z = sizes(s);
+    // The side the leader runs to: right unless its last segment runs left.
+    let dir = if end.x < before.x { -1.0 } else { 1.0 };
+    let mut vertices = pts.to_vec();
+    if let Annotation::Text(_) | Annotation::Copy(_) = ann {
+        let d = end - before;
+        // A copied text is centred on its line, and with DIMTAD on that line is above the leader:
+        // the leader ends half the text height lower.
+        if let (Annotation::Copy(_), true, Some(last)) = (&ann, z.above, vertices.last_mut()) {
+            last.y -= z.text / 2.0;
+        }
+        let end = vertices.last().copied().unwrap_or(end);
+        // More than 15° off horizontal: a hook line DIMASZ long into the end.
+        if !spline && d.y.abs() > d.x.abs() * 15f64.to_radians().tan() {
+            let at = vertices.len() - 1;
+            vertices.insert(at, Vec2::new(end.x - dir * z.arrow, end.y));
+        }
+    }
+    let leader = s.add_entity(EntityKind::Leader(cadcraft_doc::Leader {
+        vertices: vertices.iter().map(|p| v3(*p)).collect(),
+        arrow,
+        spline,
+        style: style(s),
+    }))?;
+    let annotation = match ann {
+        Annotation::Text(lines) => {
+            let (attach, lift) = match (z.above, dir > 0.0) {
+                (true, true) => (7, z.gap),
+                (true, false) => (9, z.gap),
+                (false, true) => (4, 0.0),
+                (false, false) => (6, 0.0),
+            };
+            Some(s.add_entity(EntityKind::MText(MText {
+                insert: v3(end + Vec2::new(dir * z.gap, lift)),
+                height: z.text,
+                width: 0.0,
+                attach,
+                rotation: 0.0,
+                style: z.text_style,
+                contents: lines.join("\\P"),
+                line_spacing: 1.0,
+                line_spacing_exact: false,
+                columns: None,
+            }))?)
+        }
+        Annotation::Copy(m) => {
+            let lift = if z.above { z.gap } else { 0.0 };
+            let attach = if dir > 0.0 { 4 } else { 6 };
+            Some(s.add_entity(EntityKind::MText(MText { insert: v3(end + Vec2::new(dir * z.gap, lift)), attach, rotation: 0.0, ..m }))?)
+        }
+        Annotation::Block { name, at, scale, rotation } => {
+            match crate::cmd::blocks::insert_with(s, &name, at, scale, rotation, None, &serde_json::Map::new()) {
+                Ok(h) => Some(h),
+                Err(e) => {
+                    s.doc_mut()?.remove_entity(leader);
+                    return Err(e);
+                }
+            }
+        }
+        Annotation::None => None,
+    };
+    Ok(std::iter::once(leader).chain(annotation).collect())
+}

crates/engine/src/cmd/annotate/linear.rs

@@ -1,5 +1,8 @@
 use super::common::{DimText, add_dim, assoc_enabled, circle_of, dim, linear_kind, pick_at};
-use super::*;
+use super::{
+    Accept, DimKind, Dimension, EngineError, EntityKind, Handle, Input, Interactive, Prim, Prompt, Result, Segment, Session, Step, Value, Vec2, bad,
+    json, point_req, points_param, str_param, v3,
+};
 
 pub(super) fn run_linear(s: &mut Session, p: &Value) -> Result<Value> {
     let (a, b) = match p.get("object").and_then(|v| v.as_str().and_then(Handle::parse_hex).or_else(|| v.as_u64().map(Handle))) {

crates/engine/src/cmd/annotate/mleader.rs

@@ -1,5 +1,7 @@
-use super::common::style;
-use super::*;
+use super::{
+    Accept, EngineError, EntityKind, Input, Interactive, LeaderOrder, MLeader, MLeaderOptions, MText, Prompt, Result, Session, Step, Value, Vec2,
+    bad, json, points_param, str_param, v3,
+};
 
 /// A multileader from arrowhead to landing; `landing` false leaves out the landing line (dogleg).
 fn mleader_kind(s: &Session, pts: &[Vec2], text: &str, landing: bool) -> Option<EntityKind> {
@@ -54,33 +56,8 @@ pub(super) fn run_leader(s: &mut Session, p: &Value) -> Result<Value> {
     if pts.len() < 2 {
         return Err(bad("leader", "need 2+ points"));
     }
-    let st = style(s);
-    let h = s.add_entity(EntityKind::Leader(cadcraft_doc::Leader {
-        vertices: pts.iter().map(|q| v3(*q)).collect(),
-        arrow: true,
-        spline: false,
-        style: st,
-    }))?;
-    let mut out = vec![h.hex()];
-    if let (Some(t), Some(last)) = (str_param(p, "text"), pts.last()) {
-        let th = s.doc()?.dim_style(&style(s)).map(|d| d.text_height).unwrap_or(0.18);
-        out.push(
-            s.add_entity(EntityKind::MText(MText {
-                insert: v3(*last + Vec2::new(th * 0.5, th * 0.5)),
-                height: th,
-                width: 0.0,
-                attach: 4,
-                rotation: 0.0,
-                style: "Standard".into(),
-                contents: t.into(),
-                line_spacing: 1.0,
-                line_spacing_exact: false,
-                columns: None,
-            }))?
-            .hex(),
-        );
-    }
-    Ok(json!({ "handles": out }))
+    let hs = super::leader::json_leader(s, &pts, str_param(p, "text"))?;
+    Ok(json!({ "handles": hs.iter().map(|h| h.hex()).collect::<Vec<_>>() }))
 }
 
 /// The MLEADER Options prompt being answered.

crates/engine/src/cmd/annotate/radial.rs

@@ -1,5 +1,5 @@
 use super::common::{DimText, add_dim, circle_of, dim, pick_at, text_at};
-use super::*;
+use super::{Accept, DimKind, EntityKind, Input, Interactive, Prompt, Result, Session, Step, Value, Vec2, bad, json, point_param, targets};
 
 fn radial(s: &mut Session, p: &Value, diameter: bool) -> Result<Value> {
     let id = if diameter { "dimdiameter" } else { "dimradius" };

crates/engine/src/cmd/array.rs

@@ -1,4 +1,5 @@
-//! Array commands: ARRAY, ARRAYRECT and ARRAYPOLAR (ARRAYPATH lives in `modify2`).
+//! Array commands: ARRAY, ARRAYRECT, ARRAYPOLAR and the classic -ARRAY (ARRAYPATH lives in
+//! `modify2`).
 //!
 //! Arrays are associative by default (ARRAYASSOCIATIVITY): the source objects move into an
 //! anonymous source block and the array becomes one block reference to an anonymous array block
@@ -21,6 +22,7 @@ use super::{CommandSpec, bad, bool_or, f64_or, find_command, point_param, point_
 
 use crate::{Accept, EngineError, Input, Interactive, Prompt, Result, Session, Step};
 
+mod classic;
 mod edit;
 
 /// Most preview entities drawn while the array is edited.
@@ -48,6 +50,9 @@ pub fn specs() -> Vec<CommandSpec> {
                 "{handles?, center, count, angle? (degrees, default 360), rotate?: bool, rows? (1), rowSpacing?, rowElevation?, levels? (1), levelSpacing?, base? ([x, y], default the first object's centre), associative?: bool (default ARRAYASSOCIATIVITY, on)} → {handle (the array, when associative), created (copies)}",
             )
             .interactive(|_| Ok(Box::new(PolarM::default()))),
+        CommandSpec::new("-array", "Array", classic::run_classic)
+            .params("{handles?, type?: \"rectangular\" (default) | \"polar\", rows? (1), cols? (1), rowSpacing?, colSpacing?, center, count, angle? (degrees, default 360), rotate?: bool (default true), base? ([x, y], default the DXF group 10 point of the last object)} → {created}: separate copies, as the classic -ARRAY makes them")
+            .interactive(|_| Ok(Box::new(classic::ClassicM::default()))),
     ]
     .into_iter()
     .chain(edit::specs())
@@ -328,16 +333,19 @@ fn run_array(s: &mut Session, p: &Value) -> Result<Value> {
     (spec.run)(s, p)
 }
 
-/// A count parameter (at least 1).
-fn count_or(p: &Value, key: &str, default: u64) -> u64 {
-    p.get(key).and_then(Value::as_u64).unwrap_or(default).max(1)
+/// A count parameter (at least 1); a missing key gives the default, an invalid value is refused.
+fn count_or(cmd: &str, p: &Value, key: &str, default: u64) -> Result<u64> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(default),
+        Some(v) => v.as_u64().filter(|n| *n >= 1).ok_or_else(|| bad(cmd, format!("`{key}` must be a whole number of at least 1"))),
+    }
 }
 
 fn run_arrayrect(s: &mut Session, p: &Value) -> Result<Value> {
     let hs = targets(s, p)?;
-    let rows = count_or(p, "rows", 3);
-    let cols = count_or(p, "cols", 4);
-    let levels = count_or(p, "levels", 1);
+    let rows = count_or("arrayrect", p, "rows", 3)?;
+    let cols = count_or("arrayrect", p, "cols", 4)?;
+    let levels = count_or("arrayrect", p, "levels", 1)?;
     check_size(s, rows.saturating_mul(cols).saturating_mul(levels), hs.len())?;
     let kind = ArrayKind::Rect(RectArray {
         cols: count32(cols),
@@ -360,16 +368,20 @@ fn run_arrayrect(s: &mut Session, p: &Value) -> Result<Value> {
 fn run_arraypolar(s: &mut Session, p: &Value) -> Result<Value> {
     let hs = targets(s, p)?;
     let c = point_req("arraypolar", p, "center")?;
-    let n = count_or(p, "count", 6);
-    let rows = count_or(p, "rows", 1);
-    let levels = count_or(p, "levels", 1);
+    let n = count_or("arraypolar", p, "count", 6)?;
+    let rows = count_or("arraypolar", p, "rows", 1)?;
+    let levels = count_or("arraypolar", p, "levels", 1)?;
     check_size(s, n.saturating_mul(rows).saturating_mul(levels), hs.len())?;
     let base = point_param(p, "base").or_else(|| s.doc().ok().and_then(|d| first_center(d, &hs))).unwrap_or(c);
     let row_spacing = f64_or(p, "rowSpacing", 1.0);
+    let fill = f64_or(p, "angle", 360.0);
+    if !(fill.abs() >= 1e-9 && fill.abs() <= 360.0 + 1e-9) {
+        return Err(other("Requires a fill angle between -360 and 360 degrees (not 0)."));
+    }
     let kind = ArrayKind::Polar(PolarArray {
         center: c - base,
         items: count32(n),
-        fill: f64_or(p, "angle", 360.0),
+        fill: fill.clamp(-360.0, 360.0),
         rotate: bool_or(p, "rotate", true),
         rows: count32(rows),
         row_spacing,