Route MCP protocol through shared libraries

**What**

Typing a command with the Greek keyboard layout active (ΛΙΝΕ for LINE, ΜΙΡΡΟΡ for MIRROR) now works like typing the Latin name, in four places: starting a command, answering a prompt keyword (ΘΝΔΟ = Undo), the selection words at "Select objects" (ΑΛΛ = ALL), and command-line AutoComplete. The layout puts each Greek letter on the key of the Latin letter it sounds like (θ on U, ψ on C, ω on V, Q types `;`, W the final sigma), so `keyboard::latin_keys` maps letter by letter and ignores accents, including a combining tonos or dialytika straight after its letter. It returns `None` for a word with no Greek letter, so Latin input is never touched. ASCII characters in a Greek word are kept, in lower case (the dash of `-ΛΑΥΕΡ`), and a word with any other character is not read as Latin keys.

A command the interface handles itself answers to its Greek-typed name too: ΨΛΟΣΕ asks about unsaved changes as CLOSE does, `;ΣΑΩΕ` opens the Save picker for a drawing without a file, ΛΑΥΕΡ opens the Layers dialog.

What keeps existing behaviour:
- A word that is already a command, alias or LISP function keeps its own meaning, as typed or in another case or accent (a Greek `(defun c:ΛΙΝΕ …)` runs as itself, also when typed λινε).
- A keyword a prompt offers in its own Greek spelling (a LISP program's list) wins over its Latin reading, with Greek case folded.
- A selection word wins over a keyword on the same key, as it does for Latin typing: at COUNT's "Select object to count or [List/Spaces]", Λ is Last, like L.
- A name that exists wins over the keyword or selection word its keys spell: an existing block at BEDIT's "block name or select" and at BLOCKREPLACE's two name prompts (a block called Μ opens at BEDIT, it is not Multiple), and a loaded hatch pattern at HATCH's pattern prompt (a pattern called ΣΟΛΙΔ is that pattern, not Solid). The name is found in any case or accent and the command gets it as stored.
- Only the lookup reads the Greek keys: text that is no selection word reaches the command as typed (a Greek block name at BEDIT's "block name or select"), and an unknown Greek command is reported as typed.

Known and accepted:
- At a prompt that takes a name and offers a keyword, a Greek word whose keys spell the keyword is the keyword while no block has that name (Σ is Select at BLOCKREPLACE), as the Latin `S` is there.
- Two aliases whose Greek names differ only in case or accent can both exist (the alias editor folds ASCII only). Each runs when typed as stored; another spelling of the word runs the first of them in the store's order.
- Object snap overrides and the other point modifiers (END, FROM, M2P, TT, TK, `.X`) are not read from Greek-layout typing. They need the Latin layout, as before.
- Calls by command id are unchanged: a `cmd {json}` line and `execute` (control channel, MCP) do not read a Greek-typed name.
- In a script a line that starts with `;` is still a comment, so a line `;ΣΑΩΕ` there is not QSAVE.

Also adds 46 `el.tsv` rows for strings that were in the source but missing from the catalog when the rows were written (alias editor, save-on-close and units dialogs, a few menu and command labels). On this head the i18n report lists 39 strings that fall back to English for `el` (mostly keyboard shortcuts, right-click customization and alias import); they are not in this PR. Four command labels keep the English name in parentheses, like the rest of the catalog. The `el.tsv` row of `ATTRIBUTION.md` credits these rows (AI-assisted, read by the contributor, a native Greek speaker), and `contributors/people.toml` has the author's entry.

**Tests**
- `keyboard::tests`: the mapping, non-Greek words left alone, combining marks only straight after a Greek letter, one Greek word in any case, accent or final sigma, a character the layout does not type is no spelling of a Greek letter (the micro sign is not μ), 100 000-letter and malformed input do not panic
- `engine/tests/it/greek_keyboard.rs`: ΛΙΝΕ draws a line (lower case and accents too), `;ΣΑΩΕ`, an unknown Greek word is reported as typed, the selection word ΑΛΛ, Λ, λ and ΛΑΣΤ at COUNT's prompt count like L (Last, not the List option), keywords at MIRROR's prompt (Ν is read as No and keeps the sources, Υ erases them), a Greek LISP command runs as itself and in any case or accent, a Greek block name at BEDIT reaches the command as typed, a block called Μ opens at BEDIT (in either case), a block called Σ at BLOCKREPLACE, a loaded pattern called ΣΟΛΙΔ at HATCH's pattern prompt (upper case, lower case, accented)
- `engine/tests/greek_keyboard_aliases.rs` (its own binary, the alias store is process-global): a Greek alias keeps its meaning, as typed and in any case or accent; a word of 1 000 000 Greek letters is looked up among 5 000 Greek aliases within 5 s (170 s before the word was folded once per lookup)
- `prompt::tests`: a Greek keyword is matched as spelled, before its Latin reading
- `ui-egui`: ΨΛΟΣΕ asks before it closes a drawing with unsaved changes, and a LISP `c:ΨΛΟΣΕ` still runs as itself; ΛΑΥΕΡ (also λάυερ) opens the Layers dialog and `;ΣΑΩΕ` the Save picker; AutoComplete reads a Greek prefix as Latin keys, offers the Greek alias that Enter would run, and leaves a Greek word the drawing's LISP defines as typed
- Each fix after review landed with a test that failed before it.

**What ran** on e171e083, `cargo xtask ci` step by step: `cargo fmt --all -- --check` and `cargo clippy --workspace --all-targets -- -D warnings` clean; `cargo test --workspace --lib --bins --tests --no-fail-fast`: 3759 passed, 0 failed, 28 ignored; the doctest step (the workspace has no doctests), the i18n report, `cargo xtask assets`, `cargo xtask layers` and `cargo xtask wasm` passed. The same steps passed on e171e083 merged with main at e1d379ad, a local merge that is not pushed: 3761 passed, 0 failed, 28 ignored.

Main is merged in. The merge commit e3b3a2e0 had kept only this branch's side of `cmd/file.rs` and `cmd/file/pgp.rs`; e8a79d19 restores main's alias-persistence helpers and exports next to `greek_alias`, so those two files are main's again plus this PR's own lines.

**Docs (not edited here, per AGENTS.md)**: `docs/localization.md` "Greek (`el`) interface" and `docs/localization-parity.md` row "Greek | el" (its row count) could mention that commands typed with the Greek layout are accepted.

Nothing here is Autodesk-derived: the mapping is the standard Greek layout, written from the layout itself.

<!-- This is an auto-generated comment: release notes by coderabbit.ai -->

## Summary by CodeRabbit

* **New Features**
  * Greek keyboard-layout input is recognized as Latin keystrokes when entering commands, aliases, autocomplete prefixes, selection keywords, and prompt options.
  * Greek commands and aliases can be matched across case and accent variants. Existing commands, aliases, and matching block names take precedence over Greek-layout interpretations; unrecognized input retains its original text.
  * At prompts that accept either a block name or a selection keyword, Greek input is treated as a name when a matching block exists; otherwise, it can be interpreted as a selection keyword.
  * Greek-layout input can also match loaded or built-in hatch pattern names, which take precedence over prompt keyword interpretation.
  * In BLOCKREPLACE prompts, you can select a block reference to choose a block.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

.github/workflows/house-rules.yml

@@ -0,0 +1,28 @@
+name: House rules
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - AGENTS.md
+      - CLAUDE.md
+      - .github/workflows/house-rules.yml
+  pull_request:
+    paths:
+      - AGENTS.md
+      - CLAUDE.md
+      - .github/workflows/house-rules.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: house-rules-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  house-rules:
+    uses: storytold/craft-common-actions/.github/workflows/house-rules.yml@main
+    with:
+      rust: true

.github/workflows/nix.yml

@@ -23,39 +23,5 @@ jobs:
     uses: storytold/craft-common-actions/.github/workflows/nix.yml@main
 
   git-sources:
-    name: Git dependencies come from storytold
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Git dependencies come from storytold
-        run: |
-          set -euo pipefail
-          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
-          # Source replacement, patches and path overrides in cargo config never show up
-          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
-          # Cargo still reads the legacy .cargo/config.
-          python3 - <<'PY'
-          import os, sys, tomllib
-          for path in (".cargo/config", ".cargo/config.toml"):
-              if not os.path.exists(path):
-                  continue
-              config = tomllib.load(open(path, "rb"))
-              replaced = [name for name, source in config.get("source", {}).items()
-                          if isinstance(source, dict) and "replace-with" in source]
-              if replaced or "patch" in config or "paths" in config:
-                  print(f"{path} replaces, patches or overrides a source")
-                  sys.exit(1)
-          PY
-          # Fails when Cargo.lock is out of date with the manifests.
-          cargo metadata --locked --format-version 1 > /dev/null
-          python3 - <<'PY'
-          import sys, tomllib
-          lock = tomllib.load(open("Cargo.lock", "rb"))
-          bad = sorted({p["source"] for p in lock.get("package", [])
-                        if p.get("source", "").startswith("git+")
-                        and not p["source"].startswith("git+https://github.com/storytold/")})
-          if bad:
-              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
-              sys.exit(1)
-          PY
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/git-sources.yml@main

.github/workflows/packaging-lint.yml

@@ -27,6 +27,10 @@ jobs:
     name: Windows installation policy (no app build)
     runs-on: windows-latest
     steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false

.github/workflows/release.yml

@@ -1,6 +1,10 @@
 name: Release
 
 on:
+  # A nightly dry run on main: every release build except macOS, nothing signed or released
+  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
+  schedule:
+    - cron: "8 1 * * *"
   push:
     branches: [release]
   workflow_dispatch:
@@ -18,47 +22,15 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  git-sources:
-    name: Git dependencies come from storytold
-    runs-on: ubuntu-latest
+  # Regenerates contributors/contributors.json for the release commit; every build bundles it.
+  credits:
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Git dependencies come from storytold
-        run: |
-          set -euo pipefail
-          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
-          # Source replacement, patches and path overrides in cargo config never show up
-          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
-          # Cargo still reads the legacy .cargo/config.
-          python3 - <<'PY'
-          import os, sys, tomllib
-          for path in (".cargo/config", ".cargo/config.toml"):
-              if not os.path.exists(path):
-                  continue
-              config = tomllib.load(open(path, "rb"))
-              replaced = [name for name, source in config.get("source", {}).items()
-                          if isinstance(source, dict) and "replace-with" in source]
-              if replaced or "patch" in config or "paths" in config:
-                  print(f"{path} replaces, patches or overrides a source")
-                  sys.exit(1)
-          PY
-          # Fails when Cargo.lock is out of date with the manifests.
-          cargo metadata --locked --format-version 1 > /dev/null
-          python3 - <<'PY'
-          import sys, tomllib
-          lock = tomllib.load(open("Cargo.lock", "rb"))
-          bad = sorted({p["source"] for p in lock.get("package", [])
-                        if p.get("source", "").startswith("git+")
-                        and not p["source"].startswith("git+https://github.com/storytold/")})
-          if bad:
-              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
-              sys.exit(1)
-          PY
+      pull-requests: read
+    uses: storytold/craft-common-actions/.github/workflows/refresh-contributors.yml@main
 
   release:
-    needs: git-sources
+    needs: credits
     permissions:
       # The reusable release workflow tags and uploads the draft release.
       contents: write
@@ -66,10 +38,12 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
+      dry-run: ${{ github.event_name == 'schedule' }}
       app-name: cadcraft
       app-title: CADCraft
       craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
       version: ${{ inputs.version }}
+      contributors-artifact: ${{ needs.credits.outputs.artifact-name }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
       APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -85,3 +59,4 @@ jobs:
       AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
       AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
       AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
+      LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}

AGENTS.md

@@ -1,13 +1,62 @@
+<!-- craft-house-rules:start core source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=540e6cea75d12d0710c3dca89658328e81e508ecef102446ca5bb95b7c0b92bb -->
+## House rules
+
+These apply in every Craft repository. A later rule may be stricter, not weaker. The source is `standards/house-rules-core.md` in `storytold/craft-contrib`. Propose changes there, not in a copy.
+
+1. **A person is accountable.** Whoever runs an agent answers for what it opens and for its review comments.
+2. **Check, then claim.** Before writing code, read the issue comments, search pull requests for `#N` and the keywords, and check recent commits on `main`. Comment on the issue first. Release a claim you will not finish.
+3. **Verify, don't guess.** Open a definition before using it. Confirm the cause in the code, even when someone names a location.
+4. **Keep fixes narrow and tested.** Fix what the issue describes, where the bug is. Add a test that fails without the fix.
+5. **Review the diff before opening a pull request.** Identifiers exist as used, the test fails without the fix, nothing unrelated changed, and the description is true.
+6. **Look for a better pull request.** If another fixes the same thing, close yours when it is better or equal, and say why.
+7. **Report only what ran.** Say what you tested and what you could not run. Without a local build or test, say so and rely on CI before marking ready.
+8. **`main` changes through a pull request.** Do not push to it. Branch protection enforces this. There is no exception.
+9. **Stop and ask only about** licensing outside the allowlist, publishing, releases, a new remote, secrets, spending money, destructive git, and anything else hard to undo. Otherwise keep working. `plan/` is a gitignored notebook, not rules. Without it, do not ask for it and do not stop.
+10. **Keep secrets and personal details out** of the repository, logs and requests.
+11. **CI stays shared.** Workflows call `storytold/craft-common-actions`. Do not change CI in a feature or fix pull request. If CI cannot cover a change, open an issue there.
+12. **Guards say why.** A check that looks removable says what it prevents. Read that before changing it.
+13. **Instructions must be readable by everyone.** No notes about one machine, and no links to files a reader cannot open. `craftrules` is retired. Do not link to it.
+14. **Keep pull requests moving.** Concurrent pull requests are fine; unanswered actionable feedback is not. Respond in 7 days, a reminder at 14, closure eligible at 30, from when an actionable request waits on the author. Suggestions and unconfirmed bot findings do not start the clock. A fix, explanation or agreed plan resets it; unrelated activity does not. Waiting on a reviewer or maintainer pauses it and does not count against the author. A maintainer decides closure; it is never automatic. Reuse search results, do not poll, and stop at a rate limit.
+15. **No agent attribution.** A pull request does not say an agent wrote it. A repository rule may not require that.
+<!-- craft-house-rules:end -->
+<!-- craft-house-rules:start rust source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=387e0ccb4b49e567f60951d7d6fff7305054c89f43ad812b9993dc7c38528013 -->
+## Rust Craft repositories
+
+These apply to native Craft apps and to shared Rust libraries. Select them by repository type. A repository that merely contains some Rust does not take this block. Rules later in a repository's file may be stricter, but not weaker. The source is `standards/house-rules-rust.md` in [storytold/craft-contrib](https://github.com/storytold/craft-contrib).
+
+1. **Never crash.** Non-test code does not panic and has no `unsafe`, except where the repository file names an exception. Return errors, treat input as hostile, and bound recursion and allocations. New production crate roots copy the `deny` attribute from an existing crate: `clippy::unwrap_used`, `clippy::expect_used`, `clippy::panic`, `clippy::unimplemented`, `clippy::todo`, `clippy::unreachable`. Every crash fix comes with a test that panicked before the fix.
+2. **Clean room.** Learn from observed behaviour and public specifications. Do not copy another product's code, assets, strings or artwork. Check a dependency's licence before adding it.
+3. **Assets and fonts.** Every asset is original or suitably licensed, and is recorded in `ATTRIBUTION.md` in the same change. Font files live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), not in the app repository.
+4. **Rust only for native Craft apps.** No handwritten JavaScript or TypeScript, and no Tauri, Electron or webview shell, in those apps. Shared tooling follows its documented technical scope and maintainer-approved exceptions. Craft PR Review's existing Tauri and TypeScript UI is one such exception. It does not relax this rule for native apps. Preserve any existing web build.
+5. **Time goes through `chrono`.** Do not hand-roll calendar conversion. For dates beyond what `chrono` can represent, follow [standards/time.md](https://github.com/storytold/craft-contrib/blob/main/standards/time.md).
+6. **Contributor credits.** Add or edit only your own person's entry in `contributors/people.toml`, and only after asking them. Never guess a name or hand-edit `contributors.json`.
+
+## Licence allowlist
+
+Dependencies and assets use SPDX identifiers. An expression is allowed when every identifier is in this list. A repository may name a shorter list. It may not add an identifier here by editing its own copy of these rules.
+
+- `ISC`
+- `MIT`
+- `BSD-2-Clause`
+- `BSD-3-Clause`
+- `Apache-2.0`
+- `OFL-1.1`
+- `Ubuntu-font-1.0`
+- `Bitstream-Vera`
+- `CC0-1.0`
+- `CC-BY-4.0`
+- `CC-BY-SA-4.0`
+- `LicenseRef-Public-Domain`
+
+`LicenseRef-Storyteller-Trademark` is not in this list. It covers Storyteller brand marks only, where a repository already says so.
+<!-- craft-house-rules:end -->
+
 # CADCraft — instructions for agents
 
 CADCraft is a clean-room, open-source, pure-Rust computer-aided design and drafting application targeting Autodesk AutoCAD parity — and superiority (speed, openness, agent control). It runs natively on macOS, Windows, Linux and FreeBSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop-class), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).
 
 ## Start every session here
-1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. Behaviour reference: `plan/autocad/*` (`01-observed-ui.md` holds measured observations of the running reference app; `04-menu-tree.txt` the menu tree by name).
-2. Library decisions: `plan/adr/0001-geometry-libraries.md` (what we may depend on, what is rejected for licence reasons).
-3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask unless it lists the decision as the owner's.
-
-`plan/` is gitignored (local only).
+Read [`ROADMAP.md`](ROADMAP.md) and [`docs/gaps.md`](docs/gaps.md). `plan/` is an optional gitignored notebook (status, execution notes, `plan/autocad/*`). Do not ask for it and do not stop when it is absent. Licence choices stay inside the house-rules allowlist.
 
 ## Never crash
 People trust CADCraft with their drawings; a crash loses their work. **This outranks feature work.**
@@ -28,9 +77,8 @@ People trust CADCraft with their drawings; a crash loses their work. **This outr
 - **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form with defaults; only menu/toolbar invocation starts the interactive prompt sequence.
 - **Layering** is enforced by `cargo xtask layers`: L0 `geom`, `dxf` → L1 `color`, `doc` → L2 `fonts`, `render`, `constraints` → L3 `io` → L4 `engine` → L5 `ui-egui`, `mcp` → apps. Nothing below L5 depends on egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.**
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` / `app.start(id)` / `app.cmdline(text)`. Colours come from `theme::Tokens`.
-- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
-- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests, assets, layers, wasm). Commit after every feature arc that builds, and push to `main`.
+- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests, assets, layers, wasm). Commit after every feature arc that builds.
 
 ## Running and looking at the app
 - `cargo run --release -p cadcraft -- --sample --control PORT` (sample drawing + control channel). Pick a free port; other crafting apps use control ports too.

ATTRIBUTION.md

@@ -62,6 +62,7 @@ Generated-in-code assets are original and have no file to list:
 | Asset | Author | Source | Licence | Notes |
 |---|---|---|---|---|
 | `crates/ui-egui/src/i18n/uk.tsv` | @dmatviichuk | Original Ukrainian translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
+| `crates/ui-egui/src/i18n/pl.tsv` | @neronek22 (Echo Rozumu & Gadajło; AI-assisted) | Original Polish translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/de.tsv` | the CADCraft contributors | Original German translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/es.tsv` | @PedroGuille | Original Spanish translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/pt_br.tsv` | @WladmirJunior | Original Brazilian Portuguese translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
@@ -76,5 +77,6 @@ Generated-in-code assets are original and have no file to list:
 | `crates/ui-egui/src/i18n/ar.tsv` | @hasan-sdaif | Original Arabic translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/hu.tsv` | @Skaywalker | Original Hungarian translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied |
 | `crates/ui-egui/src/i18n/tr.tsv` | @ogzhnklvz (AI-assisted) | Original Turkish translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; written from the English strings, no other catalog used as a source; the running app reviewed by a native speaker |
-| `crates/ui-egui/src/i18n/el.tsv` | @Camthalion77 with ChatGPT (AI-assisted) | Original Greek translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; independent native proofreading pending |
+| `crates/ui-egui/src/i18n/el.tsv` | @Camthalion77 with ChatGPT (AI-assisted); 46 later rows: @V1dalTheAbidal with Claude Code (AI-assisted) | Original Greek translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; the 46 later rows were read by their contributor, a native Greek speaker; independent native proofreading of the whole file pending |
 | `crates/ui-egui/src/i18n/vi.tsv` | @2ez4gcx with Claude Code (AI-assisted) | Original Vietnamese translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; terminology chosen with a native speaker, full proofreading pending |
+| `crates/ui-egui/src/i18n/ka.tsv` | Davit Matchakhelidze (@devius), native speaker, with Claude Code | Original Georgian translations of CADCraft English strings | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) | No proprietary localization resources copied; written from the English strings, no other catalog used as a source; terminology and doubtful strings decided by a native Georgian speaker; no font assets added (the Georgian face comes from craft-fonts) |

CLAUDE.md

@@ -1,52 +1 @@
-# CADCraft — instructions for agents
-
-CADCraft is a clean-room, open-source, pure-Rust computer-aided design and drafting application targeting Autodesk AutoCAD parity — and superiority (speed, openness, agent control). It runs natively on macOS, Windows, Linux and FreeBSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop-class), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).
-
-## Start every session here
-1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. Behaviour reference: `plan/autocad/*` (`01-observed-ui.md` holds measured observations of the running reference app; `04-menu-tree.txt` the menu tree by name).
-2. Library decisions: `plan/adr/0001-geometry-libraries.md` (what we may depend on, what is rejected for licence reasons).
-3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask unless it lists the decision as the owner's.
-
-`plan/` is gitignored (local only).
-
-## Never crash
-People trust CADCraft with their drawings; a crash loses their work. **This outranks feature work.**
-- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
-- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or reports "not available yet"; it never panics.
-- **Input-derived numbers are hostile** (DXF/DWG files, command-line text, MCP/control params): `get()` not `[i]`, checked arithmetic, no NaN casts, cap input-sized allocations and loop counts.
-- **Bound recursion** (nested/cyclic block references: `MAX_BLOCK_DEPTH`).
-- **Last-resort guard:** `Session::execute` and every step of an interactive command (its factory, `begin`, input, `prompt`, `preview` and the passes after it; `crates/engine/src/guard.rs`) run under `catch_unwind`; an escaped panic restores the drawing and reports an error. It does nothing on wasm, where a panic aborts.
-- **Prove it:** every crash fix lands with a regression test (see `crates/engine/tests/panic_hunt.rs` and `hostile_dxf_does_not_panic` in `crates/io/src/tests.rs`).
-- Every workspace crate manifest carries `[lints] workspace = true` to inherit `[workspace.lints]`; every production crate root carries `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
-
-## Non-negotiables
-- **Clean-room.** AutoCAD is installed on the dev machine and may be *observed* black-box: run it, use its UI with synthetic drawings, take screenshots (by window id) stored only under `plan/autocad/screenshots/` (never committed). **Never** read, disassemble or copy anything inside the AutoCAD bundle (names/listings only); never copy Autodesk fonts (SHX), hatch patterns (`.pat`), linetypes (`.lin`), templates, CUI/PGP files, icons, artwork or help text; never commit files produced by AutoCAD. File formats come from public specifications (Autodesk's published DXF Reference, the Open Design Alliance's public DWG specification) and our own synthetic tests. Never copy or link GPL/LGPL/AGPL code (LibreDWG, LibreCAD, QCAD, FreeCAD's planegcs, SolveSpace, OpenCASCADE) — don't even read their sources.
-- **Assets — absolutely essential.** CADCraft contains **no Autodesk, Adobe or Avid iconography, images, fonts, patterns or artwork — ever.** Every icon is drawn in code (`crates/ui-egui/src/icons.rs`), every hatch pattern and linetype is our own definition (`crates/doc/src/library.rs`), the drafting font is our own (`crates/fonts/src/stroke.rs`). Any file asset must be original, public domain/CC0, OSI-licensed, or redistributable Creative Commons (or licensed open source by a contributor who made it), and **must have a row in `ATTRIBUTION.md`** with author, source and licence (`cargo xtask assets` enforces it). The only exception is the ArtCraft brand in `docs/brand/` (trademarks, `docs/brand/LICENSE-brand.txt`). Screenshots of Autodesk software are never committed. Breaking this rule is the most serious mistake you can make in this repo.
-- **Fonts live in [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts)**, never in this repo. It is an optional build input (`CRAFT_FONTS_DIR`, embedded by `crates/fonts/build.rs`), never a `Cargo.toml` dependency. Code and tests must work without it.
-- **Shared test corpora** live in separate repos (`storytold/<app>-corpus`); never commit large binary fixtures here.
-- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*` (`CommandSpec`: id = AutoCAD's command name in lower case, label, menu path, shortcut, aliases, params doc, `enabled`, JSON `run`, optional `interactive` prompt machine) + tests. UI-only commands live in `crates/ui-egui/src/menus.rs` (`UI_COMMANDS`). The command line, menus, toolbar, Tool Sets, scripts, CLI, control channel and MCP all reach the same commands.
-- **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form with defaults; only menu/toolbar invocation starts the interactive prompt sequence.
-- **Layering** is enforced by `cargo xtask layers`: L0 `geom`, `dxf` → L1 `color`, `doc` → L2 `fonts`, `render`, `constraints` → L3 `io` → L4 `engine` → L5 `ui-egui`, `mcp` → apps. Nothing below L5 depends on egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.**
-- **The UI is thin**: panels read engine state and act through `app.run(id, params)` / `app.start(id)` / `app.cmdline(text)`. Colours come from `theme::Tokens`.
-- **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
-- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests, assets, layers, wasm). Commit after every feature arc that builds, and push to `main`.
-
-## Running and looking at the app
-- `cargo run --release -p cadcraft -- --sample --control PORT` (sample drawing + control channel). Pick a free port; other crafting apps use control ports too.
-- Drive it with JSON lines on `127.0.0.1:PORT`:
-  - `{"id":1,"method":"cmdline.input","params":{"text":"circle 0,0 5"}}` — type at the command line exactly like a user (prompts, keywords, `@dx,dy`, `@d<a`, direct distance entry).
-  - `{"id":2,"method":"engine.execute","params":{"command":"line","params":{"points":[[0,0],[10,0]]}}}` — JSON form.
-  - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
-  - Methods: `crates/ui-egui/src/control.rs`; protocol doc: `docs/control-protocol.md`.
-- **For UI work, look at the result** (screenshot, read the PNG) and compare with `plan/autocad/screenshots/`. If no frame is presented (screen locked) use `ui.render` or `cadcraft-cli`.
-- Headless: `cadcraft-cli run --sample --script 'LINE 0,0 10,10\n' --export out.png`; `cadcraft-cli info file.dxf`; `cadcraft-cli mcp`.
-- Shell gotcha: `mv`/`cp` may be aliased interactive — use `/bin/mv -f` / `/bin/cp -f`.
-- Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).
-
-## Roadmap
-`ROADMAP.md` (committed) is the one-page summary: stage, parity numbers, estimates. The assessment is `docs/target-app-parity.md`, the work list `docs/gaps.md` (pick work from its top rows), milestones `docs/roadmap.md`, deep checklists `docs/geometry-parity.md`, `docs/ui-parity.md`, `docs/file-format-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. PRs don't edit these docs: name the affected rows in the PR description, and maintainers update the rows, status lines and revision history in batches, which keeps open PRs from conflicting. `cargo xtask parity` regenerates the menu-breadth checklist in `docs/parity-checklist.md`.
-
-## CI workflows
-- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
-- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
-- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
+@AGENTS.md

Cargo.lock

@@ -614,7 +614,7 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cadcraft"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -631,6 +631,7 @@ dependencies = [
  "log",
  "muda",
  "objc2-app-kit 0.3.2",
+ "pollster 1.0.1",
  "rfd",
  "ron",
  "serde_json",
@@ -644,7 +645,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-cli"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -660,14 +661,14 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-color"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-constraints"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-doc",
  "cadcraft-geom",
@@ -677,7 +678,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-doc"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-geom",
@@ -686,35 +687,19 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
-[[package]]
-name = "cadcraft-dwg"
-version = "0.17.0"
-dependencies = [
- "acadrust",
-]
-
-[[package]]
-name = "cadcraft-dxf"
-version = "0.17.0"
-dependencies = [
- "encoding_rs",
- "log",
- "thiserror 2.0.21",
-]
-
 [[package]]
 name = "cadcraft-engine"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-constraints",
  "cadcraft-doc",
- "cadcraft-dxf",
  "cadcraft-fonts",
  "cadcraft-geom",
  "cadcraft-io",
  "cadcraft-render",
  "craft-docpath",
+ "craft-dxf",
  "libc",
  "log",
  "rstar",
@@ -725,9 +710,11 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-fonts"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-geom",
+ "craft-dxf",
+ "encoding_rs",
  "harfrust 0.14.0",
  "icu_segmenter",
  "skrifa 0.48.0",
@@ -736,24 +723,25 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-geom"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-io"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "acadrust",
  "cadcraft-color",
  "cadcraft-doc",
- "cadcraft-dwg",
- "cadcraft-dxf",
  "cadcraft-fonts",
  "cadcraft-geom",
  "cadcraft-render",
+ "craft-dwg",
+ "craft-dxf",
  "craft-pdf",
+ "image",
  "miniz_oxide 0.9.1",
  "quick-xml 0.42.0",
  "serde",
@@ -764,20 +752,24 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-mcp"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
  "cadcraft-render",
  "clap",
+ "craft-jsonrpc",
+ "craft-mcp",
  "getrandom 0.4.3",
+ "libc",
  "log",
  "serde_json",
+ "tiny-skia",
 ]
 
 [[package]]
 name = "cadcraft-render"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
@@ -791,13 +783,14 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-ui-egui"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
  "cadcraft-engine",
  "cadcraft-fonts",
  "cadcraft-geom",
+ "cadcraft-io",
  "cadcraft-render",
  "chrono",
  "craft-ui",
@@ -805,6 +798,7 @@ dependencies = [
  "craft-window",
  "egui",
  "egui-wgpu",
+ "egui_extras",
  "egui_kittest",
  "image",
  "log",
@@ -817,13 +811,17 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-web"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "cadcraft-engine",
+ "cadcraft-fonts",
  "cadcraft-io",
  "cadcraft-ui-egui",
+ "craft-web-api",
+ "craft-web-host",
  "eframe",
  "egui",
+ "js-sys",
  "log",
  "serde_json",
  "wasm-bindgen",
@@ -1140,6 +1138,25 @@ name = "craft-docpath"
 version = "0.1.0"
 source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 
+[[package]]
+name = "craft-dwg"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=7bb6c90076a0177d01cc4c482e7fd8dc9f31a8bf#7bb6c90076a0177d01cc4c482e7fd8dc9f31a8bf"
+dependencies = [
+ "acadrust",
+ "log",
+]
+
+[[package]]
+name = "craft-dxf"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=006e4df225fca57e95ead0fb1f91920900798a99#006e4df225fca57e95ead0fb1f91920900798a99"
+dependencies = [
+ "encoding_rs",
+ "log",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
@@ -1168,6 +1185,23 @@ dependencies = [
  "writeable",
 ]
 
+[[package]]
+name = "craft-jsonrpc"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=2c9903ca1d892b5446acf3598d8b142f3e64842f#2c9903ca1d892b5446acf3598d8b142f3e64842f"
+dependencies = [
+ "serde_json",
+]
+
+[[package]]
+name = "craft-mcp"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=2c9903ca1d892b5446acf3598d8b142f3e64842f#2c9903ca1d892b5446acf3598d8b142f3e64842f"
+dependencies = [
+ "craft-jsonrpc",
+ "serde_json",
+]
+
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
@@ -1202,7 +1236,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
  "chrono",
  "dunce",
@@ -1212,6 +1246,7 @@ dependencies = [
  "image",
  "log",
  "plist",
+ "rustix 1.1.5",
  "semver",
  "serde",
  "serde_json",
@@ -1225,6 +1260,26 @@ dependencies = [
  "zip",
 ]
 
+[[package]]
+name = "craft-web-api"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=fd5e2feff6ea25bed371a99cc732b3968d621505#fd5e2feff6ea25bed371a99cc732b3968d621505"
+dependencies = [
+ "js-sys",
+ "serde_json",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+]
+
+[[package]]
+name = "craft-web-host"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=fd5e2feff6ea25bed371a99cc732b3968d621505#fd5e2feff6ea25bed371a99cc732b3968d621505"
+dependencies = [
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "craft-window"
 version = "0.1.0"
@@ -1509,6 +1564,19 @@ dependencies = [
  "winit",
 ]
 
+[[package]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+dependencies = [
+ "ahash",
+ "egui",
+ "enum-map",
+ "itertools",
+ "log",
+ "profiling",
+]
+
 [[package]]
 name = "egui_glow"
 version = "0.37.0"
@@ -1577,6 +1645,26 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
 
+[[package]]
+name = "enum-map"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
+dependencies = [
+ "enum-map-derive",
+]
+
+[[package]]
+name = "enum-map-derive"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -5928,7 +6016,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.17.0"
+version = "0.21.0"
 dependencies = [
  "chrono",
  "serde_json",
@@ -6161,7 +6249,6 @@ dependencies = [
  "nix 0.31.3",
  "typed-path",
  "windows-sys 0.61.2",
- "zopfli",
 ]
 
 [[package]]
@@ -6176,18 +6263,6 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
-[[package]]
-name = "zopfli"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aaf7fc5d30c28483d93805c4a5e12b05bbb52407fa67c5f8bd552374cd01fb11"
-dependencies = [
- "bumpalo",
- "crc32fast",
- "log",
- "simd-adler32",
-]
-
 [[package]]
 name = "zune-core"
 version = "0.5.3"
@@ -6243,23 +6318,3 @@ dependencies = [
  "syn 3.0.9",
  "winnow",
 ]
-
-[[patch.unused]]
-name = "egui_demo_lib"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
-
-[[patch.unused]]
-name = "egui_extras"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
-
-[[patch.unused]]
-name = "egui_inspection"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
-
-[[patch.unused]]
-name = "egui_system_font_provider"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 # default-members
 
 [workspace.package]
-version = "0.17.0"
+version = "0.21.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -13,8 +13,9 @@ repository = "https://github.com/storytold/cadcraft"
 [workspace.dependencies]
 # internal
 cadcraft-geom = { path = "crates/geom" }
-cadcraft-dxf = { path = "crates/dxf" }
-cadcraft-dwg = { path = "crates/dwg" }
+# DXF tags: the shared reader and writer (moved from crates/dxf; craft-libs#791).
+craft-dxf = { git = "https://github.com/storytold/craft-libs", rev = "006e4df225fca57e95ead0fb1f91920900798a99" }
+craft-dwg = { git = "https://github.com/storytold/craft-libs", rev = "7bb6c90076a0177d01cc4c482e7fd8dc9f31a8bf" }
 cadcraft-color = { path = "crates/color" }
 cadcraft-doc = { path = "crates/doc" }
 cadcraft-constraints = { path = "crates/constraints" }
@@ -24,6 +25,8 @@ cadcraft-io = { path = "crates/io" }
 cadcraft-engine = { path = "crates/engine" }
 cadcraft-ui-egui = { path = "crates/ui-egui" }
 cadcraft-mcp = { path = "crates/mcp" }
+craft-mcp = { git = "https://github.com/storytold/craft-libs", rev = "2c9903ca1d892b5446acf3598d8b142f3e64842f" }
+craft-jsonrpc = { git = "https://github.com/storytold/craft-libs", rev = "2c9903ca1d892b5446acf3598d8b142f3e64842f" }
 # Which paths stored in a drawing (xrefs, data links) may be opened.
 craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
 # PDF writing (krilla) for plots, and reading them back in tests. The root patches below pin
@@ -54,7 +57,7 @@ unicode-bidi = "0.3.18"
 # Line-break opportunities between Thai words for MTEXT word wrap (Thai writes no spaces between
 # words): UAX #14 with ICU4X's compiled-in LSTM word model (not its dictionaries).
 icu_segmenter = { version = "~2.3", default-features = false, features = ["compiled_data", "lstm"] }
-image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
+image = { version = "0.25", default-features = false, features = ["png", "jpeg", "bmp", "tiff"] }
 encoding_rs = "0.8.35"
 # XML for the SVG reader (streaming parser, no entity expansion beyond the five predefined ones)
 quick-xml = "0.42"
@@ -63,13 +66,15 @@ quick-xml = "0.42"
 craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["serde"] }
 craft-window = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["egui"] }
 egui = { version = "0.37", default-features = false, features = ["default_fonts", "monochrome_emoji_fonts"] }
+# Resizable table columns (About ▸ Contributors / Models); no image loaders.
+egui_extras = { version = "0.37", default-features = false }
 egui_kittest = "0.37"
 eframe = { version = "0.37", default-features = false }
 egui-wgpu = "0.37"
 # Monotonic time on native and web (performance.now on wasm).
 web-time = "1.1"
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", features = ["egui"] }
 rfd = "0.17"
 arboard = { version = "3.6", default-features = false }
 
@@ -116,8 +121,5 @@ egui-wgpu = { git = "https://github.com/storytold/egui.git", rev = "6d518fc79968
 egui_glow = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 egui_extras = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 egui_kittest = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
-egui_system_font_provider = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 eframe = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
-egui_demo_lib = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
-egui_inspection = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 winit = { git = "https://github.com/storytold/winit.git", rev = "a517b3846ee8457d84ee4975110bfda6797c44dc" }

README.md

@@ -118,7 +118,7 @@ numbers):
 | Layouts & plotting | Paper-space layouts, viewports (scale, lock, per-viewport layer freeze), MSPACE/PSPACE through viewports, page setups, PLOT and EXPORTPDF |
 | Parametric | Geometric and dimensional constraints, AUTOCONSTRAIN, PARAMETERS with expressions, conflict detection; constraints re-solve after every edit |
 | Grips | Hot grips with Space to cycle Stretch, Move, Rotate, Scale and Mirror |
-| Interface languages | English, Ukrainian (Українська), Brazilian Portuguese (Português (Brasil)), German (Deutsch), Spanish (Español), Czech (Čeština), Russian (Русский), French (Français), Simplified Chinese (简体中文, with an installed CJK font), Italian (Italiano), Korean (한국어, with an installed Hangul font), Swedish (Svenska), Arabic (العربية, with an installed Arabic font), Hungarian (Magyar) and Turkish (Türkçe), live switching and a remembered Auto/system-language choice; [details](docs/localization.md) |
+| Interface languages | English, Ukrainian (Українська), Brazilian Portuguese (Português (Brasil)), German (Deutsch), Spanish (Español), Czech (Čeština), Russian (Русский), French (Français), Simplified Chinese (简体中文, with an installed CJK font), Italian (Italiano), Korean (한국어, with an installed Hangul font), Swedish (Svenska), Arabic (العربية, with an installed Arabic font), Hungarian (Magyar), Turkish (Türkçe), Greek (Ελληνικά), Bosnian (Bosanski) and Georgian (ქართული), live switching and a remembered Auto/system-language choice; [details](docs/localization.md) |
 | Automation | MCP server, JSON control channel, `cadcraft-cli` (info, convert, run, commands, mcp) |
 
 ## Quick start

ROADMAP.md

@@ -2,16 +2,18 @@
 
 **Stage: pre-alpha** · next: alpha, ~2 points (38% → 40% ready for real work) and ~125–190 Opus 5.5 hours away (the four failing core workflows of the [alpha gate](docs/roadmap.md#alpha-gate))
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-21 · **Change:** trivial (progress log: proxy objects keep their class through a save, #1812; previously minor: HATCHEDIT boundary add/remove progress) · **Target:** Autodesk AutoCAD 2027
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (re-audit against main 41d9b5e95: language table, CI gate, open-PR count; previously: progress log: proxy objects keep their class through a save, #1812; previously minor: HATCHEDIT boundary add/remove progress) · **Target:** Autodesk AutoCAD 2027
 
 CADCraft targets full parity with AutoCAD (2D drafting first, then annotation, layouts and
 plotting, DWG, parametrics and 3D), plus what AutoCAD doesn't have: agent control over MCP, a
 scriptable CLI, a web build, Linux and FreeBSD builds, and a free licence.
 
 **Why pre-alpha:** four of AutoCAD's five core workflows fail the [alpha gate](docs/roadmap.md#alpha-gate).
-Precise drafting lacks object snap tracking and has stubbed TRIM/EXTEND/OFFSET options; blocks
-can't be edited in a block editor (REFEDIT edits them in place, xrefs not yet); plots ignore plot styles; and a DWG saved by
-CADCraft drops everything it doesn't model and has never been checked in
+Precise drafting still has approximate ellipse and spline intersections and a few stubbed prompt options
+(object snap tracking, TRIM/EXTEND/OFFSET options and typed snap overrides have landed); dynamic blocks can't be
+authored and xrefs can't be edited in place (the Block Editor, REFEDIT, dynamic block editing and XCLIP have landed);
+plots go only to PDF, PNG and SVG files (plot styles and the Plot dialog have landed); and a DWG saved by
+CADCraft drops what acadrust doesn't model and has never been checked in
 AutoCAD. Dimensioning passes. Ready for real work (≈ 38%) is also under the ~40% alpha bar. Beta
 is ≈ 600–930 h away.
 
@@ -19,7 +21,7 @@ is ≈ 600–930 h away.
 
 | Number | Value | Kind |
 |---|---|---|
-| Feature breadth (AutoCAD for Mac menu items with a live command) | **50%** (245 / 491; 2D menus only ≈ 65%) | measured ([parity-checklist.md](docs/parity-checklist.md) + UI-only commands) |
+| Feature breadth (AutoCAD for Mac menu items with a live command) | **50%** (245 / 491 at the 2026-10-10 re-measure, including UI-only commands; not re-measured since; the generated checklist counts engine commands only and now reads 298 / 491; 2D menus only ≈ 65%) | measured ([parity-checklist.md](docs/parity-checklist.md) + UI-only commands) |
 | Ready for real work | **≈ 38%** | estimated ([target-app-parity.md](docs/target-app-parity.md)) |
 | Mainstream practitioner (2D drafter) | **≈ 28%** (lower than the full number: file exchange, stability and interaction discounts multiply) | estimated ([target-app-parity.md](docs/target-app-parity.md#mainstream-practitioner)) |
 | Essentials user | **≈ 46%** | estimated ([target-app-parity.md](docs/target-app-parity.md#essentials-user)) |
@@ -80,40 +82,40 @@ Hours are Opus 5.5 agent wall-clock hours, calibrated on this repo's own build:
 
 ## Languages
 
-AutoCAD 2027 for Mac ships 8 interface languages; CADCraft ships English plus partial
-Ukrainian and German. Detail: [localization-parity.md](docs/localization-parity.md).
+AutoCAD 2027 for Mac ships 8 interface languages; CADCraft ships English plus eighteen catalogs
+(Ukrainian, Brazilian Portuguese, German, Spanish, Czech, Russian, French, Simplified Chinese, Italian, Korean, Swedish, Arabic, Greek, Hungarian, Turkish, Bosnian, Georgian and Vietnamese). Detail: [localization-parity.md](docs/localization-parity.md).
 
 | Language | Status | UI translated |
 |---|---|---:|
 | English | full | 100% |
-| Simplified Chinese | none | 0% |
-| Spanish | none | 0% |
+| Simplified Chinese | partial | 1,337 catalog rows |
+| Spanish | partial | 1,243 catalog rows |
 | Hindi | none | 0% |
-| Arabic | none | 0% |
-| French | none | 0% |
-| Portuguese | none | 0% |
+| Arabic | partial | 1,229 catalog rows |
+| French | partial | 1,004 catalog rows |
+| Portuguese (Brazilian) | partial | 1,243 catalog rows |
 | Indonesian | none | 0% |
 | Japanese | none | 0% |
-| Greek | complete current catalog | 1,330 current source keys; independent proofreading pending |
-| German | partial | ≈ 100% of the catalog (989 rows) |
-| Korean | none | 0% |
-| Vietnamese | none | 0% |
+| Greek | partial | 1,330 catalog rows; independent proofreading pending |
+| German | partial | 1,031 catalog rows |
+| Korean | partial | 1,235 catalog rows |
+| Vietnamese | partial | 1,460 catalog rows (2026-11-07); native review pending |
 
-Other languages shipped: Ukrainian and German (989 catalog rows each; Ukrainian landed with #36), Brazilian Portuguese, Spanish, Czech, Russian, French, Simplified Chinese and Italian (1,227 rows, 2026-10-12); engine messages stay English.
+Other languages shipped: Ukrainian (1,357 rows, the reference catalog, #36), Czech (1,215), Russian (1,005), Italian (1,352), Swedish (1,382), Hungarian (1,326) and Turkish (1,330), counted 2026-10-24; engine messages stay English. Every catalog but Ukrainian's has strings added since it landed that still fall back to English: 6 (Italian, Swedish) to 296 (French) per `cargo xtask i18n` ([localization-parity.md](docs/localization-parity.md)).
 
 ## Upcoming
 
 Ranked; detail and the full beta checklist in [docs/roadmap.md](docs/roadmap.md).
 
-1. Gate and land: fix fmt on main, run `cargo xtask ci` on every PR, land the 47 open PRs (15–25 h).
-2. Stop losing data on save; native MULTILEADER; save DWG/DXF at a chosen version (30–45 h).
+1. Gate and land: CI runs `cargo xtask ci` on every PR since #1987 (fmt on main is fixed); land the 450 open PRs (2026-10-24) (15–25 h).
+2. Stop losing data on save (DXF done, #528; native MULTILEADER, #459, and the save version, #421, done; through DWG, acadrust still drops some content) (30–45 h).
 3. Real-file DWG/DXF corpus and a black-box check in AutoCAD (10–15 h + owner).
-4. Precision input: object snap tracking, extension/parallel snaps, FROM/M2P/TK, snap overrides,
-   editable dynamic input (25–35 h).
-5. Unstub prompt options in TRIM/EXTEND, OFFSET, ROTATE, PLINE, SPLINE, MTEXT, MLEADER (15–25 h).
-6. Autosave, recovery, AUDIT, RECOVER (10–15 h).
+4. ~~Precision input: object snap tracking, extension/parallel snaps, FROM/M2P/TK, snap overrides,
+   editable dynamic input.~~ Done (#379, #441, #60, #519; `snap/tracking.rs`, `pointmod.rs`, `dyninput.rs`).
+5. ~~Unstub prompt options in TRIM/EXTEND, OFFSET, ROTATE, PLINE, SPLINE, MTEXT, MLEADER.~~ Done (#397, #408, #547); the stubs left are in gaps F1.
+6. ~~Autosave, recovery, AUDIT, RECOVER.~~ Done on the desktop (#406, #416); the web build has no autosave (gaps F4).
 7. Exact ellipse/spline geometry and correct polyline offsets (30–50 h).
-8. Xrefs, block editor, groups, then dynamic blocks (80–120 h).
+8. Xrefs, block editor, groups, then dynamic blocks (80–120 h): xrefs (#525), groups (#417), the Block Editor (#824, #833, #885), REFEDIT (#818), XCLIP and XCLIPFRAME (#2354) and dynamic block references (#838–#883) landed; left: dynamic-block authoring, editing an xref in place.
 
 ## Progress log
 
@@ -136,6 +138,7 @@ Ranked; detail and the full beta checklist in [docs/roadmap.md](docs/roadmap.md)
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | minor | Re-audit against main 41d9b5e95: language table, CI gate and open-PR count re-checked against main 41d9b5e95 |
 | 2026-10-21 | trivial | Progress log: proxy objects keep their class through a save (#1812) |
 | 2026-10-14 | minor | Progress log: HATCHEDIT boundary add/remove |
 | 2026-10-12 | trivial | Progress log: closed-polyline TRIM (#726) |

SECURITY.md

@@ -0,0 +1,34 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please report it privately through [GitHub's private reporting](https://github.com/storytold/cadcraft/security/advisories/new), not in a public issue or pull request. Say which version you ran, on which platform, and how to reproduce it. A small sample file helps, as long as it holds nothing private.
+
+Maintainers read reports as they arrive, but there is no fixed response time yet.
+
+## Supported versions
+
+Only the latest release gets security fixes. CADCraft is pre-alpha and moves quickly, so please check that a problem still exists there before reporting it.
+
+## What counts
+
+CADCraft treats these as untrusted, and a way past these defences is a vulnerability:
+
+- **Drawing files.** Opening a DXF, DWG or other file must not run code, write outside the paths the user chose, or crash the app. Panics are bugs too, but memory exhaustion or a decoder abort on a crafted file is the more serious case.
+- **AutoLISP in a drawing's folder.** A drawing must not run code that the user didn't choose to load.
+- **The control channel.** It listens on loopback only and needs the session token from an owner-only file on every request. Another local account reaching it without that token is a vulnerability.
+- **Temporary and autosave files.** Autosave files are unsaved drawings: another account must not be able to read them or redirect a write through them.
+- **Updates.** A release must not be replaceable by someone other than the project.
+
+## Known limits
+
+These are known and being worked on, so they don't need a report:
+
+- Agents connected through MCP or the control channel can read and write any path the user can. There are no workspace roots yet.
+- A local process can make the control channel buffer up to 512 MiB before its token is checked. The total is capped, so this can slow the app but not exhaust memory without limit.
+- The DWG worker process has no memory limit of its own yet, so a crafted file can use a lot of memory before it stops. It ends that one open or save, not the app.
+- The web build has no autosave yet.
+
+## What stays on your machine
+
+Crash reports are written to the `crash-reports` folder in the settings folder and are never uploaded. They hold the version, the platform, the panic message and a stack trace, and a message can include a file path, so read a report before you attach it anywhere.

apps/cadcraft-cli/src/args.rs

@@ -81,6 +81,7 @@ pub(crate) enum Command {
     Mcp(McpArgs),
     Perf(PerfArgs),
     Sample(SampleArgs),
+    Roundtrip(RoundtripArgs),
 }
 
 /// Print a drawing's summary as JSON
@@ -308,6 +309,40 @@ fn perf_target(p: PathBuf) -> PerfTarget {
     }
 }
 
+/// Open each DXF/DWG, save it as DXF and DWG, reopen and compare; writes report.md and report.json
+///
+/// FOLDER defaults to $CADCRAFT_CORPUS_DIR. With CADCRAFT_CORPUS_STRICT=1 it fails when a file
+/// doesn't open, save or reopen, or loses records on save.
+#[derive(Args)]
+pub(crate) struct RoundtripArgs {
+    /// A drawing, or a folder of them
+    #[arg(value_name = "FILE|FOLDER")]
+    pub(crate) path: Option<PathBuf>,
+    /// Where the report goes (default: `report` beside the files)
+    #[arg(long, value_name = "DIR")]
+    pub(crate) out: Option<PathBuf>,
+    /// Keep the saved files, in `saved` under the report folder
+    #[arg(long)]
+    pub(crate) keep_saved: bool,
+    /// Save only in each file's own format
+    #[arg(long)]
+    pub(crate) same_format: bool,
+    /// Don't count what each file holds (faster; no "read lost" column)
+    #[arg(long)]
+    pub(crate) no_census: bool,
+    /// How far numbers may move and still count as equal
+    #[arg(long, value_name = "T", default_value_t = cadcraft_io::roundtrip::Options::default().abs_tol, value_parser = tolerance)]
+    pub(crate) tolerance: f64,
+}
+
+/// `--tolerance`: a finite number, 0 or more.
+fn tolerance(v: &str) -> Result<f64, ValueError> {
+    match v.parse::<f64>() {
+        Ok(t) if t.is_finite() && t >= 0.0 => Ok(t),
+        _ => Err(ValueError::Tolerance(v.to_string())),
+    }
+}
+
 /// Write a built-in sample drawing
 #[derive(Args)]
 pub(crate) struct SampleArgs {
@@ -360,6 +395,8 @@ pub(crate) enum ValueError {
     CmdId,
     #[error(transparent)]
     CmdJson(#[from] serde_json::Error),
+    #[error("expected a number of 0 or more, got `{0}`")]
+    Tolerance(String),
 }
 
 /// Why `parse` refuses flags clap accepted: clap prints it as a usage error (exit 2).

apps/cadcraft-cli/src/error.rs

@@ -1,5 +1,6 @@
 use crate::output::OutputError;
 use crate::perf::PerfError;
+use crate::roundtrip::RoundtripError;
 use crate::run::RunError;
 
 /// Why a subcommand failed: printed as `error: {e}`, exit 1.
@@ -19,6 +20,8 @@ pub(crate) enum CliError {
     Output(#[from] OutputError),
     #[error(transparent)]
     Perf(#[from] PerfError),
+    #[error(transparent)]
+    Roundtrip(#[from] RoundtripError),
     /// The engine and io crates take file names as text.
     #[error("{}: the file name is not valid Unicode", .0.display())]
     NotUnicode(std::path::PathBuf),

apps/cadcraft-cli/src/lib.rs

@@ -16,6 +16,7 @@ mod info;
 mod mcp;
 mod output;
 mod perf;
+mod roundtrip;
 mod run;
 mod sample;
 
@@ -32,6 +33,7 @@ use output::Streams;
 #[cfg(test)]
 use output::{export_window, model_views, write_atomic};
 use perf::perf;
+use roundtrip::roundtrip;
 use run::run_cmds;
 #[cfg(test)]
 use run::{fill_last, returned_handle};
@@ -43,6 +45,7 @@ fn install_io() {
         write: |d, name| cadcraft_io::write(d, name).map_err(|e| e.to_string()),
         plot: Some(|d, space, opts| cadcraft_io::plotter::plot(d, space, opts).map_err(|e| e.to_string())),
     });
+    cadcraft_engine::cmd::file::set_image_decoder(|b| cadcraft_io::raster::decode(b).map_err(|e| e.to_string()));
     cadcraft_engine::cmd::file::set_write_as(|d, name, o| {
         cadcraft_io::write_with(d, name, &cadcraft_io::SaveOptions { version: o.version, binary: o.binary }).map_err(|e| e.to_string())
     });
@@ -99,7 +102,7 @@ where
         Command::Run(a) => a.settings.apply(),
         Command::Mcp(a) => a.settings.apply(),
         Command::Sample(a) => a.settings.apply(),
-        Command::Info(_) | Command::Commands(_) | Command::Perf(_) => {}
+        Command::Info(_) | Command::Commands(_) | Command::Perf(_) | Command::Roundtrip(_) => {}
     }
     let mut io = Streams::new(out, err);
     let result = match &cli.command {
@@ -110,6 +113,7 @@ where
         Command::Mcp(a) => mcp(a),
         Command::Perf(a) => perf(a.target.as_ref(), &mut io),
         Command::Sample(a) => sample(a, &mut io),
+        Command::Roundtrip(a) => roundtrip(a, &mut io),
     };
     let mut code = 0;
     if let Err(e) = result {

apps/cadcraft-cli/src/main.rs

@@ -1,6 +1,11 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 fn main() {
+    // A copy of this program started to read or write a DWG file does only that.
+    if let Some(code) = cadcraft_io::dwg_worker::serve_if_asked() {
+        std::process::exit(code);
+    }
+    cadcraft_io::dwg_worker::use_own_worker();
     // `args_os`, not `args`: a non-Unicode argument (a Latin-1 file name on Linux) must be
     // reported as an error, not panic before anything is printed.
     let code = cadcraft_cli::run(std::env::args_os().skip(1), &mut std::io::stdout(), &mut std::io::stderr());

apps/cadcraft-cli/src/output.rs

@@ -162,19 +162,31 @@ pub(crate) fn export_framed(s: &Session, out: &Path, window: Option<Bounds2>, io
 /// as unknown objects, `Proxy` in `info`), or `None` when there are none.
 pub(crate) fn undrawn_message(d: &cadcraft_engine::doc::Drawing, path: &str) -> Option<String> {
     let mut types: std::collections::BTreeMap<&str, usize> = std::collections::BTreeMap::new();
+    let mut ole = 0usize;
     for e in d.model.iter() {
+        // An OLE2FRAME's frame outline is drawn, so it isn't an undrawn entity; its content is
+        // not, which gets a note of its own.
         if let cadcraft_engine::doc::EntityKind::Unknown(u) = &e.kind {
+            if u.is_ole_frame() && cadcraft_engine::doc::ole_frame(&u.tags).is_some() {
+                ole = ole.saturating_add(1);
+                continue;
+            }
             let n = types.entry(u.dxf_type.as_str()).or_insert(0);
             *n = n.saturating_add(1);
         }
     }
     let n = types.values().fold(0usize, |a, n| a.saturating_add(*n));
-    if n == 0 {
-        return None;
+    let mut lines = Vec::new();
+    if n > 0 {
+        let list: Vec<String> = types.iter().map(|(t, n)| format!("{t}: {n}")).collect();
+        let entities = if n == 1 { "entity" } else { "entities" };
+        lines.push(format!("{path}: {n} {entities} not drawn ({})", list.join(", ")));
     }
-    let list: Vec<String> = types.iter().map(|(t, n)| format!("{t}: {n}")).collect();
-    let entities = if n == 1 { "entity" } else { "entities" };
-    Some(format!("{path}: {n} {entities} not drawn ({})", list.join(", ")))
+    if ole > 0 {
+        let objects = if ole == 1 { "object" } else { "objects" };
+        lines.push(format!("{path}: {ole} OLE {objects} shown as the frame only (the OLE content is not drawn)"));
+    }
+    if lines.is_empty() { None } else { Some(lines.join("\n")) }
 }
 
 /// The reader's notes on what it left out of `path` (a damaged DWG's unreadable object records,

apps/cadcraft-cli/src/roundtrip.rs

@@ -0,0 +1,93 @@
+//! `roundtrip`: the corpus harness of `cadcraft_io::roundtrip::corpus` over a file or folder.
+
+use super::args::RoundtripArgs;
+use super::error::{CliError, Result};
+use super::output::Streams;
+
+/// Why `roundtrip` stopped.
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum RoundtripError {
+    #[error("roundtrip: give a FILE or FOLDER, or set CADCRAFT_CORPUS_DIR")]
+    NoPath,
+    #[error("roundtrip: no such file or folder: {}", .0.display())]
+    Missing(std::path::PathBuf),
+    #[error("roundtrip: no DXF or DWG files in {}", .0.display())]
+    Empty(std::path::PathBuf),
+    #[error("roundtrip: can't write the report to {}: {source}", .path.display())]
+    Report { path: std::path::PathBuf, source: std::io::Error },
+    #[error("roundtrip: {} strict failures:\n{}", .0.len(), .0.join("\n"))]
+    Strict(Vec<String>),
+}
+
+/// What the walk couldn't look at, so the report isn't taken for the whole corpus: said on
+/// stderr, and failures of a strict run.
+fn left_out(w: &cadcraft_io::roundtrip::corpus::Walk) -> Vec<String> {
+    let mut out: Vec<String> = w.unreadable.iter().map(|u| format!("not read: {u}")).collect();
+    if w.truncated {
+        out.push("left out: files or folders past the harness limits".to_string());
+    }
+    out
+}
+
+pub(crate) fn roundtrip(a: &RoundtripArgs, io: &mut Streams) -> Result {
+    use cadcraft_io::roundtrip::corpus;
+    let path = a.path.clone().or_else(|| std::env::var_os("CADCRAFT_CORPUS_DIR").map(Into::into)).ok_or(RoundtripError::NoPath)?;
+    let mut missed = Vec::new();
+    let (root, files, out) = if path.is_dir() {
+        let out = a.out.clone().unwrap_or_else(|| path.join("report"));
+        // The report folder, and the saved copies in it, are never read back as corpus files.
+        let walk = corpus::walk(&path, &[out.clone(), out.join("saved")]);
+        missed = left_out(&walk);
+        for m in &missed {
+            io.errln(format_args!("roundtrip: {m}"));
+        }
+        (path, walk.files, out)
+    } else if path.is_file() {
+        let root = path.parent().map(std::path::Path::to_path_buf).unwrap_or_default();
+        let out = a.out.clone().unwrap_or_else(|| root.join("report"));
+        (root, vec![path], out)
+    } else {
+        return Err(RoundtripError::Missing(path).into());
+    };
+    if files.is_empty() {
+        // A folder it couldn't read isn't an empty one.
+        return Err(if missed.is_empty() { RoundtripError::Empty(root) } else { RoundtripError::Strict(missed) }.into());
+    }
+    let mut opts = corpus::CorpusOptions { cross_format: !a.same_format, census: !a.no_census, ..Default::default() };
+    opts.compare.abs_tol = a.tolerance;
+    if a.keep_saved {
+        opts.keep_saved = Some(out.join("saved"));
+    }
+    let report = corpus::run(&root, &files, &opts, &mut |i, n, rel| eprintln!("[{}/{n}] {rel}", i + 1));
+    for f in &report.files {
+        let routes: Vec<String> = f
+            .routes
+            .iter()
+            .map(|r| match (&r.save_error, &r.reopen_error) {
+                (Some(_), _) => format!("{}: save failed", r.route),
+                (None, Some(_)) => format!("{}: reopen failed", r.route),
+                (None, None) => {
+                    let t = r.comparison.total();
+                    format!("{}: {} lost, {} added, {} changed", r.route, t.lost, t.added, t.changed)
+                }
+            })
+            .collect();
+        match &f.open_error {
+            Some(e) => io.outln(format_args!("{}: open failed: {e}", f.path)),
+            None => io.outln(format_args!("{}: opened; {}", f.path, routes.join("; "))),
+        }
+    }
+    let (md, json) = report.write(&out).map_err(|source| RoundtripError::Report { path: out.clone(), source })?;
+    io.outln(format_args!("report: {}", md.display()));
+    io.outln(format_args!("        {}", json.display()));
+    // CADCRAFT_CORPUS_STRICT=1: a file that doesn't open, save or reopen, or records a writer
+    // leaves out, fail the run (the report is written first).
+    if std::env::var("CADCRAFT_CORPUS_STRICT").is_ok_and(|v| v == "1") {
+        let mut failed = report.strict_failures();
+        failed.extend(missed);
+        if !failed.is_empty() {
+            return Err(CliError::from(RoundtripError::Strict(failed)));
+        }
+    }
+    Ok(())
+}

apps/cadcraft-cli/tests/dwg_worker.rs

@@ -0,0 +1,40 @@
+//! The DWG reader and writer run in a child process, so a decoder that dies ends one open or save,
+//! not the app. The worker setting is process-wide, so everything runs in one test.
+
+#![cfg(not(any(target_arch = "wasm32", all(target_os = "freebsd", target_arch = "aarch64"))))]
+
+use cadcraft_io::dwg_worker;
+
+#[test]
+fn a_real_worker_reads_and_writes_and_its_death_is_an_error_here() {
+    let drawing = cadcraft_engine::sample::bracket();
+    let in_process = cadcraft_io::write(&drawing, "a.dwg").unwrap();
+
+    dwg_worker::use_worker(env!("CARGO_BIN_EXE_cadcraft-cli").into(), vec![dwg_worker::WORKER_ARG.into()]);
+    let written = cadcraft_io::write(&drawing, "a.dwg").unwrap();
+    assert_eq!(written.get(..6), in_process.get(..6), "the same version of file");
+    let read = cadcraft_io::read(&written, "a.dwg").unwrap();
+    assert_eq!(read.model.len(), drawing.model.len());
+
+    // A drawing whose kept objects came from a 2018 file: the worker gets that version with the
+    // request and reads the bridge DXF as it, as this process does.
+    let mut kept = drawing.clone();
+    kept.foreign = std::sync::Arc::new(cadcraft_engine::doc::foreign::Foreign { version: Some("AC1032".into()), ..Default::default() });
+    let written = cadcraft_io::write(&kept, "a.dwg").unwrap();
+    assert_eq!(cadcraft_io::read(&written, "a.dwg").unwrap().model.len(), drawing.model.len());
+
+    // A decode error comes back as that error, not as the worker stopping.
+    let mut bad = in_process.clone();
+    bad.truncate(64);
+    let e = cadcraft_io::read(&bad, "a.dwg").unwrap_err().to_string();
+    assert!(!e.contains("worker"), "{e}");
+
+    // The worker aborts as the third-party code can. This process goes on.
+    let e = dwg_worker::crash_worker_for_test().unwrap_err();
+    assert!(e.contains("worker stopped"), "{e}");
+    assert!(cadcraft_io::read(&written, "a.dwg").is_ok(), "the next file gets a new worker");
+
+    // No worker to start: the work happens here, as without one.
+    dwg_worker::use_worker("no-such-program-here".into(), Vec::new());
+    assert!(cadcraft_io::read(&written, "a.dwg").is_ok());
+}

apps/cadcraft-cli/tests/it/undrawn_entities.rs

@@ -7,6 +7,25 @@ fn cli(args: &[&str]) -> Output {
     Command::new(env!("CARGO_BIN_EXE_cadcraft-cli")).args(args).output().unwrap()
 }
 
+/// A fresh scratch directory that is removed on drop, also when an assertion fails.
+struct Scratch(std::path::PathBuf);
+
+impl Scratch {
+    fn new(tag: &str) -> Self {
+        let dir = std::env::temp_dir().join(format!("cc-cli-{tag}-{}", std::process::id()));
+        // A directory left behind by an earlier run with the same process id must not leak in.
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir(&dir).expect("create scratch dir");
+        Scratch(dir)
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
 /// A line, two foreign REGIONs and a PDF underlay: the last three are kept as unknown entities.
 const PROXIES: &str = "0\nSECTION\n2\nENTITIES\n\
 0\nLINE\n8\n0\n10\n0\n20\n0\n11\n5\n21\n5\n\
@@ -17,8 +36,8 @@ const PROXIES: &str = "0\nSECTION\n2\nENTITIES\n\
 
 #[test]
 fn convert_to_an_image_warns_about_entities_it_cannot_draw() {
-    let dir = std::env::temp_dir().join(format!("cc-cli-undrawn-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
+    let scratch = Scratch::new("undrawn");
+    let dir = scratch.0.clone();
     let input = dir.join("proxies.dxf");
     std::fs::write(&input, PROXIES).unwrap();
     let input = input.to_str().unwrap();
@@ -49,5 +68,37 @@ fn convert_to_an_image_warns_about_entities_it_cannot_draw() {
     let out = cli(&["convert", sample.to_str().unwrap(), dir.join("sample.svg").to_str().unwrap()]);
     assert!(out.status.success());
     assert!(!String::from_utf8_lossy(&out.stderr).contains("not drawn"), "{}", String::from_utf8_lossy(&out.stderr));
-    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// An OLE2FRAME's frame outline is drawn, so an image export doesn't call it an undrawn entity (#2422); it
+/// says once that the OLE content inside the frame is not drawn (review on #2587).
+#[test]
+fn an_ole_frame_is_noted_as_frame_only() {
+    let scratch = Scratch::new("ole");
+    let dir = scratch.0.clone();
+    let input = dir.join("ole.dxf");
+    let ole = "0\nSECTION\n2\nENTITIES\n0\nOLE2FRAME\n8\n0\n100\nAcDbOle2Frame\n10\n0\n20\n0\n30\n0\n11\n5\n21\n-3\n31\n0\n0\nENDSEC\n0\nEOF\n";
+    std::fs::write(&input, ole).unwrap();
+    let out = cli(&["convert", input.to_str().unwrap(), dir.join("out.png").to_str().unwrap()]);
+    assert!(out.status.success());
+    let err = String::from_utf8_lossy(&out.stderr);
+    assert!(!err.contains("entity not drawn") && !err.contains("entities not drawn"), "{err}");
+    let notes: Vec<&str> = err.lines().filter(|l| l.contains("OLE")).collect();
+    assert_eq!(notes, [format!("{}: 1 OLE object shown as the frame only (the OLE content is not drawn)", input.display())], "{err}");
+}
+
+/// An OLE2FRAME without usable corners (here group 11/21 missing) has no outline to draw, so it is
+/// an undrawn entity, not "shown as the frame only" (review on #2587).
+#[test]
+fn an_ole_frame_without_corners_is_counted_as_not_drawn() {
+    let scratch = Scratch::new("ole-nocorner");
+    let dir = scratch.0.clone();
+    let input = dir.join("ole.dxf");
+    let ole = "0\nSECTION\n2\nENTITIES\n0\nOLE2FRAME\n8\n0\n100\nAcDbOle2Frame\n10\n0\n20\n0\n30\n0\n0\nENDSEC\n0\nEOF\n";
+    std::fs::write(&input, ole).unwrap();
+    let out = cli(&["convert", input.to_str().unwrap(), dir.join("out.png").to_str().unwrap()]);
+    assert!(out.status.success());
+    let err = String::from_utf8_lossy(&out.stderr);
+    assert!(err.contains(&format!("{}: 1 entity not drawn (OLE2FRAME: 1)", input.display())), "{err}");
+    assert!(!err.contains("frame only"), "{err}");
 }

apps/cadcraft-cli/tests/man_and_completions.rs

@@ -20,7 +20,7 @@ fn the_example_writes_the_files_the_packages_install() {
     let mut written: Vec<String> = std::fs::read_dir(&dir).unwrap().map(|e| e.unwrap().file_name().into_string().unwrap()).collect();
     written.sort();
     let completions = ["cadcraft-cli.bash", "_cadcraft-cli", "cadcraft-cli.fish", "cadcraft-cli.elv", "_cadcraft-cli.ps1"];
-    let subcommands = ["info", "convert", "run", "commands", "mcp", "perf", "sample"];
+    let subcommands = ["info", "convert", "run", "commands", "mcp", "perf", "sample", "roundtrip"];
     let mut expected: Vec<String> = completions.map(String::from).into();
     expected.push("cadcraft-cli.1".into());
     expected.extend(subcommands.iter().map(|s| format!("cadcraft-cli-{s}.1")));

apps/cadcraft-web/Cargo.toml

@@ -18,6 +18,11 @@ path = "src/main.rs"
 cadcraft-engine = { workspace = true }
 cadcraft-ui-egui = { workspace = true }
 cadcraft-io = { workspace = true }
+cadcraft-fonts = { workspace = true }
+# The host messages (storytold/craft-libs): one contract and one bridge for the web builds.
+# The page command API (storytold/craft-libs#413): window.cadcraft over the control channel.
+craft-web-api = { git = "https://github.com/storytold/craft-libs", rev = "fd5e2feff6ea25bed371a99cc732b3968d621505", version = "0.1.0" }
+craft-web-host = { git = "https://github.com/storytold/craft-libs", rev = "fd5e2feff6ea25bed371a99cc732b3968d621505", version = "0.1.0" }
 egui = { workspace = true }
 log = { workspace = true }
 serde_json = { workspace = true }
@@ -30,4 +35,5 @@ web-sys = { version = "0.3", features = ["HtmlInputElement", "FileList", "File"]
 eframe = { workspace = true, features = ["persistence", "wgpu", "accesskit"] }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "Location", "Navigator", "Blob", "BlobPropertyBag", "Url", "MessageEvent", "UrlSearchParams", "MediaQueryList"] }
+js-sys = "0.3"
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "Location", "Navigator", "Blob", "BlobPropertyBag", "Url", "MessageEvent", "UrlSearchParams", "MediaQueryList", "Event", "EventTarget", "CustomEvent", "CustomEventInit"] }

apps/cadcraft-web/src/api.rs

@@ -0,0 +1,61 @@
+//! `window.cadcraft`: the page command API (`craft-web-api`, storytold/craft-libs#413) over the app's
+//! own control channel, the one the desktop control server drives (`docs/control-protocol.md`).
+//!
+//! The crate owns the JavaScript side (`request`, `execute`, `commands`, `docInspect`, `uiInspect`,
+//! `screenshot`, as promises with a timeout). This module is CADCraft's part: a [`Request`] that
+//! queues a [`ControlRequest`] for the app, which answers it on its next frame, and waits for the
+//! reply. A call the page gave up on drops its [`PendingReply`], which cancels a request the app has
+//! not started, so the app skips it instead of running it late.
+
+use std::rc::Rc;
+use std::sync::mpsc::{Receiver, channel};
+
+use cadcraft_ui_egui::{ControlRequest, PendingReply};
+use craft_web_api::methods::Methods;
+use craft_web_api::page::{PageApi, Request};
+use serde_json::{Value, json};
+use wasm_bindgen_futures::JsFuture;
+
+/// The app id in `window.<app>`.
+const APP: &str = "cadcraft";
+
+/// How often a waiting call looks for the app's reply, in milliseconds (about a frame).
+const POLL_MS: i32 = 16;
+
+/// Put `window.cadcraft` on the page and return the queue the app drains each frame (hand it to
+/// `CadApp::with_control`). An existing `window.cadcraft` keeps the functions it already has.
+pub fn install(ctx: egui::Context) -> Receiver<ControlRequest> {
+    let (queue, requests) = channel::<ControlRequest>();
+    let request: Request = Rc::new(move |method, params| {
+        let (control, reply) = ControlRequest::new(method, params);
+        if queue.send(control).is_err() {
+            return Box::pin(async { json!({"ok": false, "error": "the app is not running"}) });
+        }
+        ctx.request_repaint();
+        Box::pin(wait(reply))
+    });
+    if let Err(e) = Rc::new(PageApi::new(APP, Methods::default(), request)).install() {
+        log::warn!("couldn't install window.{APP}: {e:?}");
+    }
+    requests
+}
+
+/// The app's reply, polled about once a frame. Dropping this future (the page's timeout) drops
+/// `reply`, which cancels the request if the app has not started it.
+async fn wait(reply: PendingReply) -> Value {
+    loop {
+        if let Some(reply) = reply.try_reply() {
+            return reply;
+        }
+        sleep(POLL_MS).await;
+    }
+}
+
+async fn sleep(ms: i32) {
+    let promise = js_sys::Promise::new(&mut |resolve, _| {
+        if let Some(window) = web_sys::window() {
+            let _ = window.set_timeout_with_callback_and_timeout_and_arguments_0(&resolve, ms);
+        }
+    });
+    let _ = JsFuture::from(promise).await;
+}

apps/cadcraft-web/src/host.rs

@@ -1,28 +1,37 @@
-//! The `postMessage` bridge to a same-origin parent page (`?host=parent`), for pages that embed
-//! CADCraft in an `<iframe>` (such as a Nextcloud app). Messages are plain objects with a `type`:
+//! Host modes: a page that runs CADCraft opens drawings in it and stores what it saves instead
+//! of the browser downloading. The messages and the two transports are `craft-web-host`'s
+//! (storytold/craft-libs), the same contract as the other Craft apps' bridges, with the
+//! `cadcraft:` prefix. This module is CADCraft's part of it.
 //!
-//! - `cadcraft:ready` (to the parent): `{ version }`, the app is listening; send a drawing now.
-//! - `cadcraft:open` (from the parent): `{ name, bytes }`, bytes an `ArrayBuffer` or
-//!   `Uint8Array`. It opens like a file picked with File › Open or dropped on the window.
-//! - `cadcraft:save` (to the parent): `{ name, bytes }` (a transferred `ArrayBuffer`) for every
-//!   file CADCraft would otherwise download (SAVE, SAVEAS, exports): it replaces the engine's
-//!   delivery hook. The parent stores the file and reports failures itself.
-//! - `cadcraft:dirty` (to the parent): `{ dirty }` whenever unsaved changes appear or go away.
-//! - `cadcraft:failed` (to the parent): `{ error }` when the app couldn't start.
+//! - `?host=parent` (an `<iframe>`, such as a Nextcloud app) talks to the same-origin parent over
+//!   `postMessage`; `data-host="page"` on the canvas (the page's own document, no iframe) uses
+//!   DOM `CustomEvent`s on the canvas instead. `?host=parent` wins when both are present. With no
+//!   parent, or a parent on another origin, there is no bridge: the normal app with downloads.
+//! - `cadcraft:ready` once the app is listening; send a drawing now. CADCraft reads bytes, so it
+//!   says `file: false` and a host sends `bytes`.
+//! - `cadcraft:open` (from the host): `{ name, bytes }`. It opens like a file picked with
+//!   File › Open or dropped on the window; an oversized drawing is refused before it is copied.
+//! - `cadcraft:save` (to the host): `{ name, saveAs, bytes }` for every file CADCraft would
+//!   otherwise download (SAVE, SAVEAS, exports): it replaces the engine's delivery hook. The host
+//!   stores the file and reports failures itself. CADCraft doesn't tell the host which saves
+//!   make a file the document, so `saveAs` is always `false`.
+//! - `cadcraft:dirty` whenever unsaved changes appear or go away, `cadcraft:failed` when the app
+//!   couldn't start.
 //!
-//! Only the parent window on the page's own origin is heard or answered. In host mode the app
-//! starts on the Start tab rather than an empty Drawing1, and the parent guards leaving the page.
+//! In both host modes the app starts on the Start tab rather than an empty Drawing1, and the
+//! host guards leaving the page.
 
-use std::cell::{Cell, RefCell};
+use std::cell::RefCell;
+use std::rc::Rc;
 
 use cadcraft_ui_egui::CadApp;
-use wasm_bindgen::JsCast as _;
-use wasm_bindgen::JsValue;
-use wasm_bindgen::closure::Closure;
-use web_sys::js_sys;
+use craft_web_host::web::{FileData, Host, Message};
 
-/// Longest file name taken from the parent page.
-const MAX_NAME_CHARS: usize = 255;
+/// The app id in the host messages (`cadcraft:ready`).
+const APP: &str = "cadcraft";
+
+/// The name a drawing gets when the host sent none (the crate says `document` for a blank name).
+const DEFAULT_NAME: &str = "Drawing.dxf";
 
 thread_local! {
     /// The bridge [`deliver`] posts through (the engine's hook is a plain `fn`).
@@ -31,25 +40,15 @@ thread_local! {
 
 #[derive(Clone)]
 pub struct Bridge {
-    window: web_sys::Window,
-    parent: web_sys::Window,
-    origin: String,
+    host: Rc<Host>,
 }
 
-/// The unsaved-changes state last reported to the parent.
-#[derive(Default)]
-pub struct DirtyReport(Cell<Option<bool>>);
-
 impl Bridge {
-    /// `None` when the page isn't framed (there is no parent to talk to).
-    pub fn new() -> Option<Self> {
-        let window = web_sys::window()?;
-        let parent = window.parent().ok().flatten()?;
-        if js_sys::Object::is(&parent, &window) {
-            return None;
-        }
-        let origin = window.location().origin().ok()?;
-        Some(Self { window, parent, origin })
+    /// The bridge for this page, or `None` when CADCraft isn't hosted: no `?host=parent` and no
+    /// `data-host="page"` on the canvas, an unframed `?host=parent` page (it stays the normal app
+    /// with downloads), or a parent on another origin.
+    pub fn connect(canvas: &web_sys::HtmlCanvasElement) -> Option<Self> {
+        Some(Self { host: Rc::new(Host::connect(APP, canvas)?) })
     }
 
     /// Make this the bridge [`deliver`] uses.
@@ -58,94 +57,55 @@ impl Bridge {
     }
 
     pub fn post_ready(&self) {
-        self.send(&[("type", "cadcraft:ready".into()), ("version", env!("CARGO_PKG_VERSION").into())]);
+        let _ = self.host.post_ready(env!("CARGO_PKG_VERSION"), false);
     }
 
     pub fn post_failed(&self, error: &str) {
-        self.send(&[("type", "cadcraft:failed".into()), ("error", error.into())]);
+        let _ = self.host.post_failed(error, None);
     }
 
-    /// Hear drawings from the parent; they arrive through the upload inbox.
+    /// Hear drawings from the host; they arrive through the upload inbox.
     pub fn listen(&self, inbox: crate::upload::Inbox) {
-        let parent = self.parent.clone();
-        let origin = self.origin.clone();
-        let on_message = Closure::<dyn FnMut(web_sys::MessageEvent)>::new(move |event: web_sys::MessageEvent| {
-            if event.origin() != origin || !event.source().is_some_and(|s| js_sys::Object::is(&s, &parent)) {
-                return;
+        self.host.listen(move |message| {
+            if let Message::Open { name, data } = message {
+                receive_open(&name, &data, &inbox);
             }
-            let data = event.data();
-            if string(&data, "type").as_deref() != Some("cadcraft:open") {
-                return;
-            }
-            let name = string(&data, "name")
-                .filter(|n| !n.trim().is_empty())
-                .map(|n| n.chars().take(MAX_NAME_CHARS).collect())
-                .unwrap_or_else(|| "Drawing.dxf".to_string());
-            // Refuse an oversized drawing before copying it into the app's memory.
-            let Some(array) = byte_array(&data) else { return };
-            if let Some(e) = CadApp::open_size_error(&name, u64::from(array.length())) {
-                inbox.refuse(e);
-                return;
-            }
-            inbox.receive(name, array.to_vec());
         });
-        if self.window.add_event_listener_with_callback("message", on_message.as_ref().unchecked_ref()).is_ok() {
-            // The listener lives as long as the page.
-            on_message.forget();
-        }
     }
 
-    /// After each logic callback (including a hidden tab's): tell the parent when unsaved changes
-    /// appear or go away. `DirtyReport` suppresses duplicates, so this is idempotent.
-    pub fn report_dirty(&self, app: &CadApp, reported: &DirtyReport) {
-        let dirty = app.session.docs.iter().any(|d| d.is_dirty());
-        if reported.0.get() != Some(dirty) && self.send(&[("type", "cadcraft:dirty".into()), ("dirty", dirty.into())]) {
-            reported.0.set(Some(dirty));
-        }
+    /// After each logic callback (including a hidden tab's): tell the host when unsaved changes
+    /// appear or go away. The crate does not repeat a state it already reported, so this is
+    /// idempotent.
+    pub fn report_dirty(&self, app: &CadApp) {
+        self.host.post_dirty(app.session.docs.iter().any(|d| d.is_dirty()));
     }
 
     fn post_save(&self, name: &str, bytes: &[u8]) -> Result<(), String> {
-        let buffer = js_sys::Uint8Array::from(bytes).buffer();
-        let message = message(&[("type", "cadcraft:save".into()), ("name", name.into()), ("bytes", buffer.clone().into())])
-            .ok_or_else(|| "couldn't build the message".to_string())?;
-        self.parent
-            .post_message_with_transfer(&message, &self.origin, &js_sys::Array::of1(&buffer))
-            .map_err(|e| e.as_string().unwrap_or_else(|| format!("{e:?}")))
-    }
-
-    /// Post a message to the parent; false if it couldn't be sent.
-    fn send(&self, fields: &[(&str, JsValue)]) -> bool {
-        message(fields).is_some_and(|m| self.parent.post_message(&m, &self.origin).is_ok())
+        self.host.post_save(name, bytes, None, false)
     }
 }
 
 /// The engine's delivery hook in host mode ([`cadcraft_engine::cmd::file::set_deliver`]): hand
-/// the file to the parent page. `Ok` once it was posted; the engine then counts a drawing as saved.
+/// the file to the host page. `Ok` once it was sent; the engine then counts a drawing as saved.
 pub fn deliver(name: &str, _mime: &str, bytes: &[u8]) -> Result<(), String> {
     let bridge = BRIDGE.with(|b| b.borrow().clone()).ok_or("the page that embeds CADCraft is gone")?;
     bridge.post_save(name, bytes)
 }
 
-fn message(fields: &[(&str, JsValue)]) -> Option<js_sys::Object> {
-    let m = js_sys::Object::new();
-    for (key, value) in fields {
-        js_sys::Reflect::set(&m, &JsValue::from_str(key), value).ok()?;
-    }
-    Some(m)
-}
-
-fn string(data: &JsValue, key: &str) -> Option<String> {
-    js_sys::Reflect::get(data, &JsValue::from_str(key)).ok()?.as_string()
-}
-
-/// `bytes` (an `ArrayBuffer` or `Uint8Array`) as a view, not yet copied.
-fn byte_array(data: &JsValue) -> Option<js_sys::Uint8Array> {
-    let bytes = js_sys::Reflect::get(data, &JsValue::from_str("bytes")).ok()?;
-    if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() {
-        Some(array.clone())
-    } else if bytes.is_instance_of::<js_sys::ArrayBuffer>() {
-        Some(js_sys::Uint8Array::new(&bytes))
-    } else {
-        None
+/// The `cadcraft:open` payload, `{ name, bytes }` where `bytes` holds a drawing: it opens like a
+/// file picked with File › Open or dropped on the window. The crate has cleaned the name (and cut
+/// it to 255 characters); a blank one comes as `document` and becomes `Drawing.dxf`. An oversized
+/// drawing is refused before it is copied.
+fn receive_open(name: &str, data: &FileData, inbox: &crate::upload::Inbox) {
+    let name = if name == "document" { DEFAULT_NAME } else { name }.to_string();
+    let FileData::Bytes(array) = data else {
+        inbox.refuse(format!("Open: {name} came as a File; CADCraft reads bytes"));
+        return;
+    };
+    // Refuse an oversized drawing before copying it into the app's memory (the data's own length).
+    if let Some(e) = CadApp::open_size_error(&name, data.size() as u64) {
+        inbox.refuse(e);
+        return;
     }
+    inbox.receive(name, array.to_vec());
 }

apps/cadcraft-web/src/main.rs

@@ -6,9 +6,12 @@
 //! with egui shapes instead of the GPU canvas, `?sample` opens the sample drawing. Saving downloads
 //! the drawing through the browser (`download.rs`). With `?host=parent` (inside an `<iframe>`), a
 //! same-origin parent page sends the drawing to open and stores what CADCraft saves instead
-//! (`host.rs`).
+//! (`host.rs`); a page can also host CADCraft in its own document (no iframe) with
+//! `data-host="page"` on the canvas, talking over DOM `CustomEvent`s on it (`host.rs`).
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+#[cfg(target_arch = "wasm32")]
+mod api;
 #[cfg(target_arch = "wasm32")]
 pub mod download;
 #[cfg(target_arch = "wasm32")]
@@ -27,16 +30,11 @@ mod web {
     const LOADING_ID: &str = "cadcraft_loading";
 
     /// The app, the files File > Open… and drag and drop read for it in the background, the
-    /// page embedding it (`?host=parent`), the browser's `prefers-reduced-motion` (it stays
+    /// host page (`?host=parent`, or `data-host="page"` on the canvas), the browser's
+    /// `prefers-reduced-motion` (it stays
     /// live, so View ▸ Accessibility ▸ Animation Effects ▸ Use System Setting follows a change),
     /// and the document title last written to the page.
-    struct Shell(
-        CadApp,
-        crate::upload::Inbox,
-        Option<(crate::host::Bridge, crate::host::DirtyReport)>,
-        Option<web_sys::MediaQueryList>,
-        Option<String>,
-    );
+    struct Shell(CadApp, crate::upload::Inbox, Option<crate::host::Bridge>, Option<web_sys::MediaQueryList>, Option<String>);
 
     impl eframe::App for Shell {
         /// Runs one frame: takes in files dropped on or picked for the page, drains the background
@@ -51,10 +49,10 @@ mod web {
             self.0.logic(ctx);
             let drawing = self.0.session.state().ok();
             crate::push_title(&mut self.4, drawing.map(|d| d.title.as_str()), drawing.is_some_and(|d| d.is_dirty()), set_page_title);
-            // `DirtyReport` suppresses duplicates, so reporting after every logic callback
+            // The crate suppresses duplicates, so reporting after every logic callback
             // (including a hidden tab's) is idempotent and keeps the parent's guard current.
-            if let Some((bridge, reported)) = &self.2 {
-                bridge.report_dirty(&self.0, reported);
+            if let Some(bridge) = &self.2 {
+                bridge.report_dirty(&self.0);
             }
         }
         /// Forward raw input to the web `CadApp` and capture Tab at the command line.
@@ -100,8 +98,10 @@ mod web {
         web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
     }
 
-    fn query_param(key: &str) -> Option<String> {
-        web_sys::UrlSearchParams::new_with_str(&query()).ok()?.get(key)
+    /// The app's canvas: the one element `index.html` and every embedding page must provide,
+    /// with the id the app looks up.
+    fn app_canvas() -> Option<web_sys::HtmlCanvasElement> {
+        web_sys::window()?.document()?.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok())
     }
 
     /// No file picker on the web: Save / Save As from the menu (and the close prompt) download the
@@ -119,6 +119,7 @@ mod web {
             write: |d, name| cadcraft_io::write(d, name).map_err(|e| e.to_string()),
             plot: Some(|d, space, opts| cadcraft_io::plotter::plot(d, space, opts).map_err(|e| e.to_string())),
         });
+        cadcraft_engine::cmd::file::set_image_decoder(|b| cadcraft_io::raster::decode(b).map_err(|e| e.to_string()));
         cadcraft_engine::cmd::file::set_write_as(|d, name, o| {
             cadcraft_io::write_with(d, name, &cadcraft_io::SaveOptions { version: o.version, binary: o.binary }).map_err(|e| e.to_string())
         });
@@ -127,10 +128,17 @@ mod web {
             groups: cadcraft_io::entity_groups,
             entity: cadcraft_io::entity_from_groups,
         });
+        let Some(canvas) = app_canvas() else {
+            log::error!("missing <canvas id=\"{CANVAS_ID}\">");
+            return;
+        };
         // `?host=parent`: a same-origin page framing CADCraft (such as a Nextcloud app) opens
-        // drawings in it and stores what it saves. Otherwise there is no file system here: saved
-        // files reach the user as browser downloads.
-        let bridge = if query_param("host").as_deref() == Some("parent") { crate::host::Bridge::new() } else { None };
+        // drawings in it and stores what it saves. Otherwise `data-host="page"` on the canvas
+        // opts in a page that runs CADCraft in its own document (no iframe) and talks over DOM
+        // `CustomEvent`s on the canvas (`host`). With neither, there is no file system here:
+        // saved files reach the user as browser downloads; an unframed `?host=parent` stays
+        // that normal app.
+        let bridge = crate::host::Bridge::connect(&canvas);
         match &bridge {
             Some(bridge) => {
                 bridge.install();
@@ -141,10 +149,6 @@ mod web {
         let app_bridge = bridge.clone();
         wasm_bindgen_futures::spawn_local(async move {
             let Some(document) = web_sys::window().and_then(|w| w.document()) else { return };
-            let Some(canvas) = document.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
-                log::error!("missing <canvas id=\"{CANVAS_ID}\">");
-                return;
-            };
             let mut options = eframe::WebOptions::default();
             if query().contains("webgl")
                 && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
@@ -156,9 +160,10 @@ mod web {
                     canvas,
                     options,
                     Box::new(move |cc| {
-                        // Embedded, the parent sends the drawing: start on the Start tab, not Drawing1.
+                        // Embedded, the host sends the drawing: start on the Start tab, not Drawing1.
                         let session = if app_bridge.is_some() { Session::empty() } else { Session::new() };
-                        let mut app = CadApp::new(session, services());
+                        let control = crate::api::install(cc.egui_ctx.clone());
+                        let mut app = CadApp::new(session, services()).with_control(control);
                         app.system_languages =
                             web_sys::window().map(|w| w.navigator().languages().iter().filter_map(|v| v.as_string()).collect()).unwrap_or_default();
                         if let Some(profile) = cc.storage.and_then(|s| s.get_string(cadcraft_ui_egui::options::PROFILE_KEY)) {
@@ -191,10 +196,9 @@ mod web {
                             picker.pick();
                             None
                         }));
-                        let host = app_bridge.map(|bridge| {
+                        let host = app_bridge.inspect(|bridge| {
                             bridge.listen(inbox.clone());
                             bridge.post_ready();
-                            (bridge, crate::host::DirtyReport::default())
                         });
                         let reduced_motion = web_sys::window().and_then(|w| w.match_media("(prefers-reduced-motion: reduce)").ok().flatten());
                         Ok(Box::new(Shell(app, inbox, host, reduced_motion, None)))

apps/cadcraft-web/src/upload.rs

@@ -2,6 +2,11 @@
 //! a path from, so the picker is a hidden `<input type="file">`; the chosen file (or one dropped on
 //! the page) is read in the background and handed to the app on its next frame, which opens it
 //! with OPEN `{data, name}` ([`CadApp::open_bytes`]).
+//!
+//! SHX fonts (text fonts, big fonts, shape files) chosen or dropped with a drawing are the web
+//! build's font folder: they are registered with the font table
+//! ([`cadcraft_fonts::shx::register`]) under their file name, so the styles and linetypes that
+//! name them draw with them, and the drawings are regenerated.
 
 use std::cell::Cell;
 use std::rc::Rc;
@@ -12,8 +17,14 @@ use web_sys::js_sys;
 
 /// The hidden file input (one at a time; a cancelled pick leaves it until the next one).
 const INPUT_ID: &str = "cadcraft_open_input";
-/// What the picker offers: the formats OPEN reads.
-const ACCEPT: &str = ".dxf,.dwg";
+/// What the picker offers: the formats OPEN reads, and the SHX fonts drawings name.
+const ACCEPT: &str = ".dxf,.dwg,.shx";
+
+/// Most files taken from one pick.
+const MAX_PICKED: u32 = 64;
+/// Most bytes being read at once, all files together: a large pick must not exhaust the page's
+/// memory (each file is copied once more into the app).
+const MAX_READING_BYTES: u64 = 512 << 20;
 
 /// A file read in the browser (name, contents), or why it couldn't be read.
 type Upload = Result<(String, Vec<u8>), String>;
@@ -22,12 +33,14 @@ type Upload = Result<(String, Vec<u8>), String>;
 #[derive(Clone)]
 pub struct Inbox {
     files: Rc<Cell<Vec<Upload>>>,
+    /// Bytes of the files being read now.
+    reading: Rc<Cell<u64>>,
     ctx: egui::Context,
 }
 
 impl Inbox {
     pub fn new(ctx: &egui::Context) -> Self {
-        Inbox { files: Rc::default(), ctx: ctx.clone() }
+        Inbox { files: Rc::default(), reading: Rc::default(), ctx: ctx.clone() }
     }
 
     /// Show the browser's file picker and return at once. A chosen file arrives through
@@ -51,13 +64,23 @@ impl Inbox {
             .map_err(|_| "could not create a file input".to_string())?;
         input.set_type("file");
         input.set_accept(ACCEPT);
+        // A drawing and the fonts it uses can be chosen together.
+        input.set_multiple(true);
         input.set_id(INPUT_ID);
         input.set_attribute("style", "display:none").map_err(js_error)?;
         let (inbox, chosen) = (self.clone(), input.clone());
-        // Called once, when a file was chosen (browsers don't fire `change` on cancel).
+        // Called once, when files were chosen (browsers don't fire `change` on cancel).
         let on_change = wasm_bindgen::closure::Closure::once_into_js(move || {
-            if let Some(file) = chosen.files().and_then(|f| f.get(0)) {
-                inbox.read(file);
+            if let Some(files) = chosen.files() {
+                for i in 0..files.length().min(MAX_PICKED) {
+                    if let Some(file) = files.get(i) {
+                        inbox.read(file);
+                    }
+                }
+                let skipped: Vec<String> = (MAX_PICKED..files.length()).filter_map(|i| files.get(i)).map(|f| f.name()).collect();
+                if !skipped.is_empty() {
+                    inbox.push(Err(format!("Open: at most {MAX_PICKED} files at a time; not opened: {}", skipped.join(", "))));
+                }
             }
             chosen.remove();
         });
@@ -87,12 +110,18 @@ impl Inbox {
         if let Some(e) = CadApp::open_size_error(&name, len) {
             return self.push(Err(e));
         }
+        let reading = self.reading.get();
+        if reading.saturating_add(len) > MAX_READING_BYTES {
+            return self.push(Err(format!("Open: {name} was not read: the files being read together are too large; open it on its own")));
+        }
+        self.reading.set(reading.saturating_add(len));
         let inbox = self.clone();
         wasm_bindgen_futures::spawn_local(async move {
             let r = match wasm_bindgen_futures::JsFuture::from(file.array_buffer()).await {
                 Ok(buf) => Ok((name, js_sys::Uint8Array::new(&buf).to_vec())),
                 Err(e) => Err(format!("Open: could not read {name}: {}", js_error(e))),
             };
+            inbox.reading.set(inbox.reading.get().saturating_sub(len));
             inbox.push(r);
         });
     }
@@ -118,9 +147,21 @@ impl Inbox {
         self.ctx.request_repaint();
     }
 
-    /// Open what arrived since the last frame (or report why it couldn't be read).
+    /// Open what arrived since the last frame (or report why it couldn't be read). Fonts are
+    /// registered first, so drawings opened with them draw with them.
     pub fn drain(&self, app: &mut CadApp) {
-        for upload in self.files.take() {
+        let (fonts, files): (Vec<Upload>, Vec<Upload>) = self.files.take().into_iter().partition(|u| u.as_ref().is_ok_and(|(n, _)| is_shx(n)));
+        let mut registered = false;
+        for (name, bytes) in fonts.into_iter().flatten() {
+            match cadcraft_fonts::shx::register(&name, &bytes) {
+                Ok(()) => registered = true,
+                Err(e) => app.open_failed(format!("{name}: {e}")),
+            }
+        }
+        if registered {
+            let _ = app.run("regenall", serde_json::json!({}));
+        }
+        for upload in files {
             match upload {
                 Ok((name, bytes)) => app.open_bytes(&name, &bytes),
                 Err(e) => app.open_failed(e),
@@ -129,6 +170,11 @@ impl Inbox {
     }
 }
 
+/// Whether `name` is an SHX font or shape file.
+fn is_shx(name: &str) -> bool {
+    name.to_ascii_lowercase().ends_with(".shx")
+}
+
 fn js_error(e: wasm_bindgen::JsValue) -> String {
     e.as_string().unwrap_or_else(|| format!("{e:?}"))
 }

apps/cadcraft/Cargo.toml

@@ -55,7 +55,11 @@ muda = { version = "0.21", default-features = false }
 objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSWorkspace", "NSAccessibility"] }
 # The same winit eframe uses (the storytold fork, patched in the workspace): its opt-in that turns
 # AppKit's terminate (Cmd+Q, Dock Quit) into a close request, so unsaved changes are asked about.
-winit = { version = "0.30", default-features = false }
+# `rwh_06`: the window handle a file dialog shown as a sheet attaches to (src/sheet.rs).
+winit = { version = "0.30", default-features = false, features = ["rwh_06"] }
+# Waits for the answer of a file dialog shown as a sheet (src/sheet.rs). MIT OR Apache-2.0, already
+# in Cargo.lock through eframe.
+pollster = "1"
 
 # Rust HID backends: no proprietary SDK or C HID library.
 [target.'cfg(target_os = "windows")'.dependencies]

apps/cadcraft/src/control_server.rs

@@ -250,17 +250,18 @@ fn parse_line(bytes: &[u8]) -> Line {
         Ok(v) => v,
         Err(e) => return Line::Reject(format!("bad JSON ({e}); expected one JSON request object per line; closing the connection")),
     };
-    let Some(obj) = msg.as_object() else {
+    let Value::Object(mut obj) = msg else {
         return Line::Reject("not a control request (expected a JSON object); closing the connection".into());
     };
-    let Some(method) = obj.get("method").and_then(Value::as_str) else {
+    let Some(Value::String(method)) = obj.remove("method") else {
         return Line::Reject("not a control request (missing string `method`); closing the connection".into());
     };
+    // Moved out of the parsed object, not cloned: `params` can be most of the line.
     Line::Request {
-        id: obj.get("id").cloned().unwrap_or(Value::Null),
-        method: method.to_string(),
-        params: obj.get("params").cloned().unwrap_or(json!({})),
-        token: obj.get("token").and_then(Value::as_str).map(str::to_string),
+        id: obj.remove("id").unwrap_or(Value::Null),
+        method,
+        params: obj.remove("params").unwrap_or(json!({})),
+        token: obj.remove("token").and_then(|t| if let Value::String(t) = t { Some(t) } else { None }),
     }
 }
 

apps/cadcraft/src/logging.rs

@@ -148,7 +148,20 @@ pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
 /// One formatted log line: `<timestamp> <LEVEL> [<thread>] <target>: <message>\n`.
 pub fn format_line(ts: &str, level: log::Level, thread: &str, target: &str, message: &str) -> String {
     let message = message.strip_suffix('\n').unwrap_or(message);
-    format!("{ts} {level:<5} [{thread}] {target}: {message}\n")
+    // A message can carry text from a file (a code page name, a path), so it must not be able to
+    // start what looks like another record: control characters other than tab and line feed are
+    // shown escaped, and every continuation line is indented, so only this function's own
+    // timestamp is ever at the start of a line.
+    let mut safe = String::with_capacity(message.len());
+    for c in message.chars() {
+        match c {
+            '\n' => safe.push_str("\n    "),
+            '\t' => safe.push('\t'),
+            c if c.is_control() => safe.extend(c.escape_default()),
+            c => safe.push(c),
+        }
+    }
+    format!("{ts} {level:<5} [{thread}] {target}: {safe}\n")
 }
 
 /// Where formatted lines go besides standard error: kept in memory until a file is attached,
@@ -441,8 +454,14 @@ mod tests {
             format_line("2026-10-08T07:59:17.728Z", log::Level::Warn, "main", "cadcraft", "app icon: invalid PNG signature"),
             "2026-10-08T07:59:17.728Z WARN  [main] cadcraft: app icon: invalid PNG signature\n"
         );
-        // A multi-line message keeps its lines; the record still ends in exactly one newline.
-        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\nb\n"));
+        // A multi-line message keeps its lines, indented so they can't pass for records; the
+        // record still ends in exactly one newline.
+        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\n    b\n"));
+        // Control characters in a message (from a file) can't forge a record.
+        let forged = format_line("t", log::Level::Warn, "w", "x", "page\r\n2026-01-01T00:00:00Z ERROR [main] x: fake\u{1b}[0m");
+        assert_eq!(forged.lines().count(), 2);
+        assert!(forged.lines().skip(1).all(|l| l.starts_with("    ")));
+        assert!(!forged.contains('\r') && !forged.contains('\u{1b}'));
     }
 
     #[test]

apps/cadcraft/src/main.rs

@@ -23,13 +23,15 @@ mod launch_args;
 mod logging;
 #[cfg(target_os = "macos")]
 mod native_menu;
+#[cfg(target_os = "macos")]
+mod sheet;
 mod spacemouse;
 mod system_animations;
 mod workspace;
 
 use cadcraft_engine::Session;
 use cadcraft_ui_egui::switch::Switch;
-use cadcraft_ui_egui::{CadApp, Services, i18n};
+use cadcraft_ui_egui::{CadApp, Pick, Services, i18n};
 
 struct App {
     cad: CadApp,
@@ -86,7 +88,7 @@ impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
         self.cad.system_animations = self.system_animations.current();
         // Consume control/open/screenshot queues and time-based autosave, including hidden ticks.
-        self.cad.logic(ctx);
+        self.cad.guarded_logic(ctx);
         // Host frame work runs here, once per frame, and so also on a hidden logic-only tick (which
         // never reaches `App::ui`): native menus stay current, the spacemouse still navigates and a
         // workspace changed while hidden is persisted. `current_pass_index()` is zero on the first
@@ -116,7 +118,7 @@ impl eframe::App for App {
         cadcraft_ui_egui::cmdline::capture_tab(ctx, raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.cad.ui(ui);
+        self.cad.guarded_ui(ui);
         #[cfg(target_os = "macos")]
         craft_window::title_bar::sync_movable(ui.ctx(), &mut self.movable);
     }
@@ -146,6 +148,7 @@ pub fn install_io() {
         write: |d, name| cadcraft_io::write(d, name).map_err(|e| e.to_string()),
         plot: Some(|d, space, opts| cadcraft_io::plotter::plot(d, space, opts).map_err(|e| e.to_string())),
     });
+    cadcraft_engine::cmd::file::set_image_decoder(|b| cadcraft_io::raster::decode(b).map_err(|e| e.to_string()));
     cadcraft_engine::cmd::file::set_write_as(|d, name, o| {
         cadcraft_io::write_with(d, name, &cadcraft_io::SaveOptions { version: o.version, binary: o.binary }).map_err(|e| e.to_string())
     });
@@ -158,28 +161,41 @@ pub fn install_io() {
 
 fn services() -> Services {
     Services {
-        pick_open: Some(Box::new(|| {
-            rfd::FileDialog::new()
-                .add_filter(i18n::t("Drawings (DWG, DXF)"), &["dwg", "dxf", "dwt"])
-                .add_filter(i18n::t("SVG drawings (SVG, SVGZ)"), &["svg", "svgz"])
-                .add_filter(i18n::t("All files"), &["*"])
-                .pick_file()
-                .map(|p| p.to_string_lossy().to_string())
-        })),
-        pick_save: Some(Box::new(|name: &str| {
-            filters_for_save(name)
-                .iter()
-                .fold(rfd::FileDialog::new().set_file_name(name), |d, (label, ext)| d.add_filter(i18n::t(label), &[*ext]))
-                .save_file()
-                .map(|p| p.to_string_lossy().to_string())
-        })),
+        pick_open: Some(Box::new(|| file_dialog(&Pick::Open).pick_file().map(|p| p.to_string_lossy().to_string()))),
+        pick_save: Some(Box::new(|name: &str| file_dialog(&Pick::Save(name.into())).save_file().map(|p| p.to_string_lossy().to_string()))),
+        // macOS shows the dialogs as sheets (`sheet::start_pick`), set once the window exists.
+        start_pick: None,
         // APPLOAD: AutoLISP routines only, starting where the last one was loaded from.
-        pick_lisp: Some(Box::new(|dir: &str| {
-            let dialog = rfd::FileDialog::new().add_filter(i18n::t("AutoLISP (LSP)"), &["lsp"]).add_filter(i18n::t("All files"), &["*"]);
-            let dialog = if dir.is_empty() { dialog } else { dialog.set_directory(dir) };
-            dialog.pick_file().map(|p| p.to_string_lossy().to_string())
-        })),
+        pick_lisp: Some(Box::new(|dir: &str| file_dialog(&Pick::Lisp(dir.into())).pick_file().map(|p| p.to_string_lossy().to_string()))),
         no_file_system: false,
+        pick_pgp: Some(Box::new(|dir: Option<&str>| {
+            file_dialog(&Pick::Pgp(dir.unwrap_or_default().into())).pick_file().map(|p| p.to_string_lossy().to_string())
+        })),
+    }
+}
+
+/// The file types `pick` offers: (label, extensions). Shared by the blocking dialogs and the
+/// macOS sheets.
+fn filters(pick: &Pick) -> Vec<(&'static str, Vec<&'static str>)> {
+    match pick {
+        Pick::Open => vec![
+            (i18n::t("Drawings (DWG, DXF)"), vec!["dwg", "dxf", "dwt"]),
+            (i18n::t("SVG drawings (SVG, SVGZ)"), vec!["svg", "svgz"]),
+            (i18n::t("All files"), vec!["*"]),
+        ],
+        Pick::Save(name) => filters_for_save(name).iter().map(|(label, ext)| (i18n::t(label), vec![*ext])).collect(),
+        Pick::Lisp(_) => vec![(i18n::t("AutoLISP (LSP)"), vec!["lsp"]), (i18n::t("All files"), vec!["*"])],
+        Pick::Pgp(_) => vec![(i18n::t("Alias files (PGP)"), vec!["pgp"])],
+    }
+}
+
+/// The blocking dialog for `pick` (Windows, Linux, FreeBSD).
+fn file_dialog(pick: &Pick) -> rfd::FileDialog {
+    let dialog = filters(pick).iter().fold(rfd::FileDialog::new(), |d, (label, exts)| d.add_filter(*label, exts));
+    match pick {
+        Pick::Save(name) => dialog.set_file_name(name),
+        Pick::Lisp(dir) | Pick::Pgp(dir) if !dir.is_empty() => dialog.set_directory(dir),
+        _ => dialog,
     }
 }
 
@@ -258,6 +274,11 @@ fn version_string() -> String {
 
 /// Parse CLI options (`--control`, `--sample`, files, `--version`), install logging and I/O hooks, build the services and app, and run eframe.
 fn main() -> eframe::Result {
+    // A copy of this program started to read or write a DWG file does only that.
+    if let Some(code) = cadcraft_io::dwg_worker::serve_if_asked() {
+        std::process::exit(code);
+    }
+    cadcraft_io::dwg_worker::use_own_worker();
     // First, so every start-up record is captured; see `logging`.
     let logger = logging::install();
     // The update helper relaunches this binary after a self-update; it runs and exits here.
@@ -289,6 +310,9 @@ fn main() -> eframe::Result {
     }
     install_io();
     cadcraft_engine::settings_dir::set(vars.config_dir.clone());
+    if let Some(dir) = &vars.config_dir {
+        cadcraft_ui_egui::fault::install_report_hook(dir.join(cadcraft_ui_egui::fault::REPORT_DIR));
+    }
     if let Some(name) = &vars.font_alt {
         cadcraft_engine::fonts::ttf::set_font_alt(name);
     }
@@ -344,6 +368,12 @@ fn main() -> eframe::Result {
         options,
         Box::new(move |cc| {
             let mut app = CadApp::new(Session::empty(), services());
+            // File dialogs are sheets on macOS: a modal loop inside the event handler crashes the
+            // app when the dialog is resized (#1527).
+            #[cfg(target_os = "macos")]
+            if let Some(window) = cc.winit_window().cloned() {
+                app.services.start_pick = Some(sheet::start_pick(window, cc.egui_ctx.clone()));
+            }
             let (workspace, restored, workspace_error) = workspace::Workspace::load(vars.config_dir.as_deref());
             if let Some(ui) = restored {
                 app.ui = ui;

apps/cadcraft/src/sheet.rs

@@ -0,0 +1,51 @@
+//! macOS file dialogs as sheets. Shown in line, or from a helper thread that rfd hands to the main
+//! thread's modal loop, a panel runs AppKit's modal event loop; resizing it sends window events
+//! back into winit's event handler and winit aborts the app (#1527). A sheet returns at once and
+//! the window keeps running; a thread of its own waits for the answer.
+
+use std::sync::Arc;
+
+use cadcraft_ui_egui::{Pick, StartPick};
+
+type Answer = std::pin::Pin<Box<dyn std::future::Future<Output = Option<String>> + Send>>;
+
+/// `Services::start_pick`: shows `pick` as a sheet on `window`; `ui` is woken when it answers.
+pub fn start_pick(window: Arc<winit::window::Window>, ui: egui::Context) -> StartPick {
+    Box::new(move |pick, done| {
+        let (sheet_tx, sheet_rx) = std::sync::mpsc::channel::<Answer>();
+        let ui = ui.clone();
+        // The thread first, so the answer of a sheet once shown always has somewhere to go. If it
+        // cannot start, `done` is dropped unanswered and the app says the dialog could not be
+        // shown.
+        let spawned = std::thread::Builder::new().name("file-dialog".into()).spawn(move || {
+            if let Ok(answer) = sheet_rx.recv() {
+                done(pollster::block_on(answer));
+                ui.request_repaint();
+            }
+        });
+        if let Err(e) = spawned {
+            log::warn!("file dialog: {e}");
+            return;
+        }
+        // rfd builds the panel and begins the sheet here, on the main thread (as it must).
+        let dialog =
+            crate::filters(&pick).iter().fold(rfd::AsyncFileDialog::new().set_parent(&*window), |d, (label, exts)| d.add_filter(*label, exts));
+        let path = |f: rfd::FileHandle| f.path().to_string_lossy().to_string();
+        let answer: Answer = match pick {
+            Pick::Save(name) => {
+                let picked = dialog.set_file_name(name).save_file();
+                Box::pin(async move { picked.await.map(path) })
+            }
+            Pick::Lisp(dir) | Pick::Pgp(dir) => {
+                let dialog = if dir.is_empty() { dialog } else { dialog.set_directory(dir) };
+                let picked = dialog.pick_file();
+                Box::pin(async move { picked.await.map(path) })
+            }
+            Pick::Open => {
+                let picked = dialog.pick_file();
+                Box::pin(async move { picked.await.map(path) })
+            }
+        };
+        let _ = sheet_tx.send(answer);
+    })
+}

contributors/people.toml

@@ -37,7 +37,9 @@ display_name = "Tasos Sangiotis"
 sync_github_name = false
 
 [people.vangel76]
-sync_github_name = true
+real_name = "Valentin Klein"
+display_name = "vangel76"
+sync_github_name = false
 
 [people.WladmirJunior]
 real_name = "Wladmir Júnior"
@@ -88,6 +90,10 @@ sync_github_name = false
 real_name = "Robert Lee"
 sync_github_name = true
 
+[people.assamaral]
+real_name = "assamaral"
+sync_github_name = false
+
 [people.2ez4gcx]
 real_name = "Doan Huynh Huu Khuong"
 display_name = "Doan Huynh Huu Khuong"
@@ -100,5 +106,18 @@ sync_github_name = true
 [people.GULERTOLGA]
 sync_github_name = true
 
+[people.Tyler-Chiriboga]
+real_name = "Tyler Chiriboga"
+sync_github_name = true
+
 [people.starise]
 real_name = "Andrea Brandi"
+
+[people.qinshah]
+sync_github_name = true
+
+[people.helenkwok]
+real_name = "Helen Kwok"
+
+[people.V1dalTheAbidal]
+sync_github_name = true

crates/constraints/src/auto.rs

@@ -232,6 +232,10 @@ pub fn infer_placed(d: &Drawing, placed: &[Handle], others: &[Handle], o: &Infer
     let mut extra = Vec::new();
     let mut on = Vec::new();
     for (rp, p) in g.points.iter().filter(|(r, _)| placed.contains(&r.handle)) {
+        // Nothing is added once the candidates are full, so the points left need no search.
+        if extra.len() + on.len() + out.len() >= MAX_CANDIDATES {
+            break;
+        }
         if out.iter().any(|c| c.kind == ConstraintKind::Coincident && c.refs.contains(rp)) {
             continue;
         }
@@ -267,20 +271,22 @@ pub fn infer_placed(d: &Drawing, placed: &[Handle], others: &[Handle], o: &Infer
     // Perpendicular lines meeting in a T (a perpendicular snap onto the middle of a line).
     let atol = if o.angle_tolerance.is_finite() { o.angle_tolerance.clamp(0.0, 45.0).to_radians() } else { 0.0 };
     let allow_per = o.types.is_empty() || o.types.iter().any(|t| t.eq_ignore_ascii_case(ConstraintKind::Perpendicular.name()));
-    for (r1, a1, b1) in g.lines.iter().filter(|(r, _, _)| placed.contains(&r.handle)) {
+    'per: for (r1, a1, b1) in g.lines.iter().filter(|(r, _, _)| allow_per && placed.contains(&r.handle)) {
         for (r2, a2, b2) in g.lines.iter().filter(|(r, _, _)| r.handle != r1.handle) {
+            // Full: nothing more can be added, so the pairs left need no geometry or duplicate search.
+            if out.len() + extra.len() + on.len() >= MAX_CANDIDATES {
+                break 'per;
+            }
             let (l1, l2) = (Line::new(*a1, *b1), Line::new(*a2, *b2));
             let touches = |l: &Line, p: Vec2| l.dist(p) <= tol && (0.0..=1.0).contains(&l.param_of(p));
             let tee = [*a1, *b1].iter().any(|p| touches(&l2, *p)) || [*a2, *b2].iter().any(|p| touches(&l1, *p));
             let ang = ang_between(*b1 - *a1, *b2 - *a2);
-            let dup = out.iter().any(|c| c.kind == ConstraintKind::Perpendicular && c.refs.contains(r1) && c.refs.contains(r2));
-            if allow_per
-                && tee
-                && !dup
+            // The duplicate search scans every candidate, so it comes after the cheap tests.
+            if tee
                 && (std::f64::consts::FRAC_PI_2 - ang).abs() <= atol
                 && l1.len() > tol
                 && l2.len() > tol
-                && out.len() < MAX_CANDIDATES
+                && !out.iter().any(|c| c.kind == ConstraintKind::Perpendicular && c.refs.contains(r1) && c.refs.contains(r2))
             {
                 out.push(Constraint { id: 0, kind: ConstraintKind::Perpendicular, refs: vec![*r1, *r2], name: String::new(), expr: String::new() });
             }

crates/constraints/src/dof.rs

@@ -138,7 +138,9 @@ pub fn dof(d: &Drawing, handles: &[Handle]) -> Result<DofReport, SolveError> {
     let cons: Vec<&Constraint> = d.constraints.iter().take(MAX_CONSTRAINTS).collect();
     let mut prep = Prep::new(crate::model::MAX_RIGID_WORK);
     let (comps, _) = build_with(d, &cons, &SolveOptions::default(), &mut prep)?;
-    let want = |h: Handle| handles.is_empty() || handles.contains(&h);
+    // The selection as a set, built once: a scan of the list per slot multiplied the two sizes.
+    let selected: HashSet<Handle> = handles.iter().copied().collect();
+    let want = |h: Handle| handles.is_empty() || selected.contains(&h);
     let mut objects = Vec::new();
     let mut seen = HashSet::new();
     let mut total = Some(0usize);

crates/constraints/src/expr.rs

@@ -284,7 +284,14 @@ impl Env {
     pub fn new() -> Self {
         Env::default()
     }
+    /// Add or replace a named expression. Text longer than [`MAX_LEN`] could never parse, so
+    /// only a bounded prefix of it is kept: it still fails (as too long), without the environment
+    /// holding or copying the whole text.
     pub fn insert(&mut self, name: &str, expr: &str) {
+        let expr = match expr.char_indices().map(|(i, _)| i).find(|i| *i > MAX_LEN) {
+            Some(end) => expr.get(..end).unwrap_or(expr),
+            None => expr,
+        };
         self.exprs.insert(name.to_string(), expr.to_string());
         self.cache.clear();
     }
@@ -309,8 +316,9 @@ impl Env {
         if stack.len() >= MAX_DEPTH {
             return Err(ExprError::TooDeep);
         }
-        let text = self.exprs.get(name).cloned().ok_or_else(|| ExprError::Unknown(name.to_string()))?;
-        let e = parse(&text)?;
+        // Parse the stored text in place: `parse` refuses an oversized expression before reading
+        // it, so a long imported expression referenced many times is never copied (CWE-400).
+        let e = parse(self.exprs.get(name).ok_or_else(|| ExprError::Unknown(name.to_string()))?)?;
         stack.push(name.to_string());
         let r = eval_at_depth(&e, &mut |n, depth| self.value_inner(n, stack, depth), depth);
         stack.pop();
@@ -400,6 +408,22 @@ mod tests {
             .unwrap();
     }
 
+    /// An oversized named expression is kept only as a bounded prefix and still fails, however
+    /// often it is referenced.
+    #[test]
+    fn oversized_named_expression_is_bounded_and_fails() {
+        let mut env = Env::new();
+        let long = format!("1+{}", "é".repeat(500_000));
+        env.insert("big", &long);
+        assert!(env.exprs.get("big").is_some_and(|t| t.len() > MAX_LEN && t.len() <= MAX_LEN + 4));
+        assert_eq!(env.value("big"), Err(ExprError::TooDeep));
+        for _ in 0..200 {
+            assert_eq!(env.eval("big"), Err(ExprError::TooDeep));
+        }
+        env.insert("ok", "1+1+1");
+        assert_eq!(env.value("ok"), Ok(3.0));
+    }
+
     #[test]
     fn rename_replaces_whole_names_only() {
         assert_eq!(rename("d1+d10*d1 / (d1_x+2e1)", "d1", "w"), "w+d10*w / (d1_x+2e1)");

crates/constraints/src/lib.rs

@@ -30,7 +30,7 @@ mod lm;
 mod model;
 mod residual;
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::{BTreeMap, HashMap, HashSet};
 
 use cadcraft_doc::{Constraint, ConstraintKind, Drawing, GeomRef, Handle};
 use cadcraft_geom::Vec2;
@@ -174,10 +174,26 @@ pub fn name_in_use(d: &Drawing, name: &str) -> bool {
     d.parametric.parameters.iter().any(|p| p.name == name) || d.constraints.iter().any(|c| c.name == name)
 }
 
+/// Highest numbered default name [`next_name`] tries.
+const MAX_NAME_SUFFIX: u32 = 100_000;
+
 /// Next free parameter name for a dimensional constraint kind (`d1`, `rad2`, `ang1`, …).
 pub fn next_name(d: &Drawing, kind: ConstraintKind) -> String {
     let prefix = kind.name_prefix();
-    (1..=100_000).map(|i| format!("{prefix}{i}")).find(|n| !name_in_use(d, n)).unwrap_or_else(|| format!("{prefix}_x"))
+    // Collect the suffixes in use in one pass, then take the first free one: checking every
+    // candidate against every name is quadratic in the number of names (CWE-407). Only a
+    // suffix spelled as `format!("{prefix}{i}")` spells it counts (`d07` does not take `d7`).
+    let taken: HashSet<u32> = d
+        .parametric
+        .parameters
+        .iter()
+        .map(|p| p.name.as_str())
+        .chain(d.constraints.iter().map(|c| c.name.as_str()))
+        .filter_map(|n| n.strip_prefix(prefix))
+        .filter(|s| !s.starts_with('0') && s.bytes().all(|b| b.is_ascii_digit()))
+        .filter_map(|s| s.parse::<u32>().ok())
+        .collect();
+    (1..=MAX_NAME_SUFFIX).find(|i| !taken.contains(i)).map_or_else(|| format!("{prefix}_x"), |i| format!("{prefix}{i}"))
 }
 
 /// Next free constraint id.

crates/constraints/src/model.rs

@@ -800,6 +800,7 @@ mod budget_tests {
             rows: 1,
             col_spacing: 0.0,
             row_spacing: 0.0,
+            clip: None,
         }
     }
 

crates/constraints/src/tests.rs

@@ -489,3 +489,30 @@ fn arc_solved_with_a_negative_radius_keeps_its_points() {
         }
     }
 }
+
+/// The default name is the first free numbered one, found in one pass over many names in use.
+#[test]
+fn next_name_skips_names_in_use() {
+    let mut d = Drawing::default();
+    assert_eq!(next_name(&d, ConstraintKind::Radius), "rad1");
+    for i in (1..=20_000).filter(|i| *i != 15_000) {
+        d.parametric.parameters.push(cadcraft_doc::Parameter { name: format!("d{i}"), expr: "1".into(), description: String::new() });
+    }
+    assert_eq!(next_name(&d, ConstraintKind::Distance(DistAxis::Aligned)), "d15000");
+    d.parametric.parameters.push(cadcraft_doc::Parameter { name: "d15000".into(), expr: "1".into(), description: String::new() });
+    assert_eq!(next_name(&d, ConstraintKind::Distance(DistAxis::Aligned)), "d20001");
+    // A differently spelled suffix does not occupy the plain name.
+    let mut d = Drawing::default();
+    for name in ["d01", "d+1", "d1x", "D1"] {
+        d.parametric.parameters.push(cadcraft_doc::Parameter { name: name.into(), expr: "1".into(), description: String::new() });
+    }
+    assert_eq!(next_name(&d, ConstraintKind::Distance(DistAxis::Aligned)), "d1");
+    d.constraints.push(Constraint {
+        id: 1,
+        kind: ConstraintKind::Distance(DistAxis::Aligned),
+        refs: Vec::new(),
+        name: "d1".into(),
+        expr: "1".into(),
+    });
+    assert_eq!(next_name(&d, ConstraintKind::Distance(DistAxis::Aligned)), "d2");
+}

crates/constraints/tests/dof.rs

@@ -302,6 +302,7 @@ fn block_reference_moves_rigidly() {
             rows: 1,
             col_spacing: 0.0,
             row_spacing: 0.0,
+            clip: None,
         }),
     );
     assert_eq!(obj_dof(&d, ins), Some(3));
@@ -343,6 +344,7 @@ fn hostile_new_geometry_never_panics() {
             rows: 1,
             col_spacing: 0.0,
             row_spacing: 0.0,
+            clip: None,
         }),
     );
     let l = line(&mut d, (0.0, 0.0), (0.0, 0.0));

crates/doc/src/array.rs

@@ -204,6 +204,23 @@ impl ArrayParams {
         self.replaced.iter().rev().find(|r| (r.i, r.j, r.level) == (i, j, level)).map_or(self.source.as_str(), |r| r.block.as_str())
     }
 
+    /// [`block_for`](Self::block_for) for many items: the replacements are indexed once (the last
+    /// entry for a place wins, as there), so each lookup is O(1) instead of a scan of `replaced`.
+    pub fn block_lookup<'a>(&'a self) -> impl Fn(u32, u32, u32) -> &'a str + 'a {
+        // Only places `items()` generates are indexed, so stray out-of-range records cost nothing.
+        let (cols, rows) = match &self.kind {
+            ArrayKind::Rect(r) => (r.cols, r.rows),
+            ArrayKind::Polar(p) => (p.items, p.rows),
+        };
+        let index: std::collections::HashMap<(u32, u32, u32), &str> = self
+            .replaced
+            .iter()
+            .filter(|r| r.i < cols && r.j < rows && r.level < self.levels)
+            .map(|r| ((r.i, r.j, r.level), r.block.as_str()))
+            .collect();
+        move |i, j, level| index.get(&(i, j, level)).copied().unwrap_or(self.source.as_str())
+    }
+
     /// The block references that make up the array block: one per item, on layer 0 with ByBlock
     /// properties so they take the array's. Handles are allocated from `d`. `None` when the
     /// parameters are not [valid](Self::is_valid).
@@ -217,9 +234,10 @@ impl ArrayParams {
             ..Common::default()
         };
         let mut out = Vec::with_capacity(items.len());
+        let block_for = self.block_lookup();
         for it in items {
             let ins = Insert {
-                block: self.block_for(it.i, it.j, it.level).to_string(),
+                block: block_for(it.i, it.j, it.level).to_string(),
                 insert: it.insert,
                 scale: Vec3::new(1.0, 1.0, 1.0),
                 rotation: it.rotation,
@@ -228,6 +246,7 @@ impl ArrayParams {
                 rows: 1,
                 col_spacing: 0.0,
                 row_spacing: 0.0,
+                clip: None,
             };
             out.push(Entity { handle: d.new_handle(), common: common.clone(), kind: EntityKind::Insert(ins) });
         }
@@ -300,6 +319,18 @@ mod tests {
         }
     }
 
+    #[test]
+    fn block_lookup_agrees_with_block_for_and_the_last_replacement_wins() {
+        let mut p = rect(3, 2);
+        let r = |i, j, level, b: &str| ReplacedItem { i, j, level, block: b.into() };
+        p.replaced = vec![r(1, 0, 0, "A"), r(1, 0, 0, "B"), r(2, 1, 1, "C")];
+        let look = p.block_lookup();
+        for (i, j, level) in [(0, 0, 0), (1, 0, 0), (2, 1, 1), (2, 1, 0)] {
+            assert_eq!(look(i, j, level), p.block_for(i, j, level));
+        }
+        assert_eq!((look(1, 0, 0), look(0, 0, 0)), ("B", "*U1"));
+    }
+
     #[test]
     fn rect_items_go_column_row_level() {
         let items = rect(3, 2).items().unwrap_or_default();

crates/doc/src/dynblock.rs

@@ -323,8 +323,9 @@ impl<'a> Cursor<'a> {
     }
 }
 
-/// The objects `xdict`'s `ACAD_ENHANCEDBLOCK` evaluation graph lists, when the dictionary has one.
-fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle) -> Option<Vec<&'a ForeignObject>> {
+/// `xdict`'s `ACAD_ENHANCEDBLOCK` evaluation graph object, when the dictionary has one. Only the
+/// dictionary's own tags are read, so asking whether a block is dynamic never walks the graph.
+fn evaluation_graph<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle) -> Option<&'a ForeignObject> {
     let dict = objects.get(&xdict)?;
     let mut graph = None;
     let mut tags = dict.tags.iter();
@@ -334,7 +335,12 @@ fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle
             break;
         }
     }
-    let graph = objects.get(&graph?).filter(|o| o.kind.eq_ignore_ascii_case("ACAD_EVALUATION_GRAPH"))?;
+    objects.get(&graph?).copied().filter(|o| o.kind.eq_ignore_ascii_case("ACAD_EVALUATION_GRAPH"))
+}
+
+/// The objects `xdict`'s `ACAD_ENHANCEDBLOCK` evaluation graph lists, when the dictionary has one.
+fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle) -> Option<Vec<&'a ForeignObject>> {
+    let graph = evaluation_graph(objects, xdict)?;
     let members = section(&sections(&graph.tags), "AcDbEvalGraph").iter().filter(|t| t.code == 360).filter_map(|t| Handle::parse_hex(&t.value));
     // Deduplicate member handles before resolving them: a graph can list the same member many
     // times, and parsing each occurrence into its own owned parameter multiplies a single large
@@ -343,13 +349,42 @@ fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle
     Some(members.take(MAX_NODES).filter(|h| seen.insert(*h)).filter_map(|h| objects.get(&h).copied()).collect())
 }
 
+/// The kept foreign objects of a drawing by handle. Building it walks every object, so a caller
+/// that asks about many blocks (listing them) builds it once and passes it to
+/// [`dynamic_block_in`] and [`is_dynamic_block_in`] instead of rebuilding it per block, which
+/// multiplies the block count by the object count (CWE-407).
+pub struct ObjectIndex<'a>(HashMap<Handle, &'a ForeignObject>);
+
+impl<'a> ObjectIndex<'a> {
+    pub fn new(d: &'a Drawing) -> Self {
+        ObjectIndex(d.foreign.objects.iter().map(|o| (o.handle, o)).collect())
+    }
+}
+
+/// The extension dictionary of block `name`'s record, if it has one.
+fn block_xdict(d: &Drawing, name: &str) -> Option<Handle> {
+    d.foreign.records.get(&("BLOCK_RECORD".to_string(), name.trim().to_ascii_uppercase()))?.xdict
+}
+
 /// The dynamic block data of block `name` (any case; `*Model_Space` for a drawing that is a
 /// block's own drawing), or `None` when it has none.
 pub fn dynamic_block(d: &Drawing, name: &str) -> Option<DynamicBlock> {
-    let xdict = d.foreign.records.get(&("BLOCK_RECORD".to_string(), name.trim().to_ascii_uppercase()))?.xdict?;
-    let objects: HashMap<Handle, &ForeignObject> = d.foreign.objects.iter().map(|o| (o.handle, o)).collect();
+    // A block without an extension dictionary is never dynamic: answer before indexing objects.
+    block_xdict(d, name)?;
+    dynamic_block_in(d, &ObjectIndex::new(d), name)
+}
+
+/// Whether block `name` is a dynamic block (has an evaluation graph), without reading its
+/// parameters and actions; `objects` is the drawing's [`ObjectIndex`].
+pub fn is_dynamic_block_in(d: &Drawing, objects: &ObjectIndex<'_>, name: &str) -> bool {
+    block_xdict(d, name).and_then(|x| evaluation_graph(&objects.0, x)).is_some()
+}
+
+/// [`dynamic_block`] with the drawing's [`ObjectIndex`] already built.
+pub fn dynamic_block_in(d: &Drawing, objects: &ObjectIndex<'_>, name: &str) -> Option<DynamicBlock> {
+    let xdict = block_xdict(d, name)?;
     let mut out = DynamicBlock::default();
-    for o in graph_members(&objects, xdict)? {
+    for o in graph_members(&objects.0, xdict)? {
         let secs = sections(&o.tags);
         let node = Cursor::new(section(&secs, "AcDbEvalExpr")).int(90);
         let element = Cursor::new(section(&secs, "AcDbBlockElement")).string(300);

crates/doc/src/dynblock/apply.rs

@@ -54,7 +54,11 @@ fn record_handle(d: &Drawing, name: &str) -> Option<Handle> {
 
 /// The object entry `key` of dictionary `dict` refers to.
 fn entry(d: &Drawing, dict: Handle, key: &str) -> Option<Handle> {
-    let o = d.foreign.objects.iter().find(|o| o.handle == dict)?;
+    dictionary_entry(d.foreign.objects.iter().find(|o| o.handle == dict)?, key)
+}
+
+/// The object entry `key` (any case) of dictionary object `o` names.
+fn dictionary_entry(o: &ForeignObject, key: &str) -> Option<Handle> {
     let mut tags = o.tags.iter();
     while let Some(t) = tags.next() {
         if t.code == 3 && t.value.eq_ignore_ascii_case(key) {
@@ -66,7 +70,11 @@ fn entry(d: &Drawing, dict: Handle, key: &str) -> Option<Handle> {
 
 /// Every entry of dictionary `dict`: (key, object).
 fn entries(d: &Drawing, dict: Handle) -> Vec<(String, Handle)> {
-    let Some(o) = d.foreign.objects.iter().find(|o| o.handle == dict) else { return Vec::new() };
+    d.foreign.objects.iter().find(|o| o.handle == dict).map(dictionary_entries).unwrap_or_default()
+}
+
+/// Every entry of dictionary object `o`: (key, object).
+fn dictionary_entries(o: &ForeignObject) -> Vec<(String, Handle)> {
     let mut out = Vec::new();
     let mut key: Option<&str> = None;
     for t in &o.tags {
@@ -666,6 +674,10 @@ fn apply(
 /// Associative hatches of block `b` whose loop is one closed polyline of the block take its
 /// outline again (it may have been stretched).
 fn refill_hatches(b: &mut Block) {
+    // Each loop gets its own copy of the outline, so many small loops on one big outline multiply it;
+    // past this many vertices in all, the remaining loops keep the outline they have.
+    const MAX_REFILLED_VERTICES: usize = 4_000_000;
+    let mut budget = MAX_REFILLED_VERTICES;
     let outlines: HashMap<Handle, Vec<cadcraft_geom::PolyVertex>> = b
         .entities
         .iter()
@@ -681,7 +693,9 @@ fn refill_hatches(b: &mut Block) {
                 for l in &mut hh.loops {
                     if let [s] = l.sources.as_slice()
                         && let Some(vs) = outlines.get(s)
+                        && let Some(left) = budget.checked_sub(vs.len())
                     {
+                        budget = left;
                         l.vertices.clone_from(vs);
                     }
                 }
@@ -692,19 +706,33 @@ fn refill_hatches(b: &mut Block) {
 
 /// The value records of the references to the dynamic block whose record is `def_record` (from
 /// any one of them, by graph id): AutoCAD's layout of each record, class ids included.
+///
+/// Each record is copied once at most: a key naming a record an earlier key already took is
+/// skipped. Records are copied per key (and copied again per key when a new reference's data is
+/// made), so a file listing one large record under many keys would otherwise multiply its size by
+/// the key count (CWE-400); AutoCAD gives every key its own record.
 fn templates(d: &Drawing, def_record: Handle) -> HashMap<String, Vec<RawTag>> {
     let objects: HashMap<Handle, &ForeignObject> = d.foreign.objects.iter().map(|o| (o.handle, o)).collect();
+    // Dictionary entries looked up through the index, not by scanning every object per
+    // dictionary (which is quadratic in the object count).
+    let entry = |dict: Handle, key: &str| objects.get(&dict).and_then(|o| dictionary_entry(o, key));
     let mut out: HashMap<String, Vec<RawTag>> = HashMap::new();
+    let mut taken: HashSet<Handle> = HashSet::new();
     for rep in d.foreign.objects.iter().filter(|o| o.kind.eq_ignore_ascii_case("DICTIONARY")) {
         // A representation dictionary whose data names this dynamic block.
-        let Some(rd) = entry(d, rep.handle, "AcDbRepData").and_then(|h| objects.get(&h)) else { continue };
+        let Some(rd) = dictionary_entry(rep, "AcDbRepData").and_then(|h| objects.get(&h)) else { continue };
         if !rd.tags.iter().any(|t| t.code == 340 && Handle::parse_hex(&t.value) == Some(def_record)) {
             continue;
         }
-        let Some(values) = entry(d, rep.handle, "AppDataCache").and_then(|c| entry(d, c, "ACAD_ENHANCEDBLOCKDATA")) else { continue };
-        for (k, h) in entries(d, values) {
+        let Some(values) = dictionary_entry(rep, "AppDataCache").and_then(|c| entry(c, "ACAD_ENHANCEDBLOCKDATA")) else { continue };
+        let Some(values) = objects.get(&values) else { continue };
+        for (k, h) in dictionary_entries(values) {
+            if out.contains_key(&k) || taken.contains(&h) {
+                continue;
+            }
             if let Some(x) = objects.get(&h).filter(|x| x.kind.eq_ignore_ascii_case("XRECORD")) {
-                out.entry(k).or_insert_with(|| x.tags.clone());
+                taken.insert(h);
+                out.insert(k, x.tags.clone());
             }
         }
     }
@@ -1044,4 +1072,23 @@ mod tests {
         assert_eq!(by_tag(&d, &def), vec![(10, Handle(1)), (20, Handle(2))]);
         assert_eq!(by_tag(&d, &anon), vec![(20, Handle(5)), (1_000_001, Handle(6))]);
     }
+
+    #[test]
+    fn a_value_record_listed_under_many_keys_is_copied_once() {
+        // One large XRECORD named by many keys of a reference's value dictionary: the templates
+        // keep one copy, not one per key.
+        let mut d = Drawing::new_imperial();
+        let (def_record, rep, rd, cache, values, record) = (Handle(0x10), Handle(0x20), Handle(0x21), Handle(0x22), Handle(0x23), Handle(0x24));
+        let keys: Vec<String> = (0..1000).map(|i| i.to_string()).collect();
+        let entries: Vec<(&str, Handle)> = keys.iter().map(|k| (k.as_str(), record)).collect();
+        let f = std::sync::Arc::make_mut(&mut d.foreign);
+        f.objects.push(dictionary(rep, Handle(1), &[("AcDbRepData", rd), ("AppDataCache", cache)]));
+        f.objects.push(ForeignObject { handle: rd, kind: "ACDB_BLOCKREPRESENTATION_DATA".into(), tags: vec![tag(340, def_record.hex())] });
+        f.objects.push(dictionary(cache, rep, &[("ACAD_ENHANCEDBLOCKDATA", values)]));
+        f.objects.push(dictionary(values, cache, &entries));
+        f.objects.push(ForeignObject { handle: record, kind: "XRECORD".into(), tags: (0..1000).map(|_| tag(1, "x")).collect() });
+        let t = templates(&d, def_record);
+        assert_eq!(t.len(), 1, "one record, one template");
+        assert_eq!(t.get("0").map(Vec::len), Some(1000));
+    }
 }

crates/doc/src/entity.rs

@@ -60,6 +60,13 @@ pub struct Unknown {
     pub tags: Vec<RawTag>,
 }
 
+impl Unknown {
+    /// Whether this is an OLE2FRAME (the type name is matched without regard to case).
+    pub fn is_ole_frame(&self) -> bool {
+        self.dxf_type.eq_ignore_ascii_case("OLE2FRAME")
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(tag = "type", rename_all = "camelCase")]
 pub enum EntityKind {
@@ -362,9 +369,13 @@ impl EntityKind {
                 i.scale.y *= s;
                 i.scale.z *= s;
                 i.rotation = cadcraft_geom::norm_angle(i.rotation + rot);
+                // Mirrored as AutoCAD 2024 mirrors a block reference: the X scale factor
+                // negated, the rotation 180 degrees plus twice the mirror line's angle less the
+                // old one, and a MINSERT grid's columns running the other way.
                 if mirror {
-                    i.scale.y = -i.scale.y;
-                    i.rotation = cadcraft_geom::norm_angle(rot - (i.rotation - rot));
+                    i.scale.x = -i.scale.x;
+                    i.rotation = cadcraft_geom::norm_angle(std::f64::consts::PI + rot - (i.rotation - rot));
+                    i.col_spacing = -i.col_spacing;
                 }
                 for a in &mut i.attribs {
                     transform_text(&mut a.text, m, s, rot, false);
@@ -465,6 +476,7 @@ impl EntityKind {
                 let a = if mirror { t.rotation() } else { t.rotation() + rot };
                 t.dir = Vec2::from_angle(cadcraft_geom::norm_angle(a)).to3(0.0);
             }
+            EntityKind::Unknown(u) if u.is_ole_frame() => crate::ole_frame_transform(&mut u.tags, m),
             EntityKind::Unknown(_) => {}
         }
     }

crates/doc/src/entity/block.rs

@@ -161,6 +161,25 @@ pub struct Insert {
     pub col_spacing: f64,
     #[serde(default)]
     pub row_spacing: f64,
+    /// XCLIP boundary of this reference (other references to the block are not clipped).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub clip: Option<crate::ClipBoundary>,
+}
+impl Default for Insert {
+    fn default() -> Self {
+        Insert {
+            block: String::new(),
+            insert: Vec3::ZERO,
+            scale: unit_scale(),
+            rotation: 0.0,
+            attribs: Vec::new(),
+            cols: 1,
+            rows: 1,
+            col_spacing: 0.0,
+            row_spacing: 0.0,
+            clip: None,
+        }
+    }
 }
 
 fn unit_scale() -> Vec3 {

crates/doc/src/entity/layout.rs

@@ -1,3 +1,5 @@
+use cadcraft_geom::Mat3;
+
 use super::common::Handle;
 use super::{Color, Deserialize, Serialize, Vec2, Vec3, standard, yes};
 
@@ -25,6 +27,39 @@ pub struct Viewport {
     /// Display on (MVIEW ON/OFF). An off viewport shows its border but no model space.
     #[serde(default = "yes")]
     pub on: bool,
+    /// The view twist (DVIEW TWist inside the viewport; DXF group 51): radians counterclockwise,
+    /// the model view seen through the viewport is turned on the sheet by it. 0 is untwisted.
+    #[serde(default, skip_serializing_if = "is_zero_twist")]
+    pub twist: f64,
+}
+fn is_zero_twist(v: &f64) -> bool {
+    *v == 0.0
+}
+impl Viewport {
+    /// The view twist, usable: 0 when it isn't finite.
+    pub fn view_twist(&self) -> f64 {
+        if self.twist.is_finite() { self.twist } else { 0.0 }
+    }
+    /// Paper units per model unit.
+    pub fn scale(&self) -> f64 {
+        self.height / self.view_height
+    }
+    /// Where model point `m` is on the sheet: `center + scale · R(twist)(m − view_center)`.
+    pub fn model_to_paper(&self, m: Vec2) -> Vec2 {
+        self.center.xy() + (m - self.view_center).rotate(self.view_twist()) * self.scale()
+    }
+    /// The model point at sheet point `p` (the inverse of [`Viewport::model_to_paper`]).
+    pub fn paper_to_model(&self, p: Vec2) -> Vec2 {
+        self.view_center + ((p - self.center.xy()) / self.scale()).rotate(-self.view_twist())
+    }
+    /// [`Viewport::model_to_paper`] as a matrix.
+    pub fn model_to_paper_matrix(&self) -> Mat3 {
+        let s = self.scale();
+        Mat3::translate(self.center.xy())
+            .then_before(Mat3::scale(s, s))
+            .then_before(Mat3::rotate(self.view_twist()))
+            .then_before(Mat3::translate(-self.view_center))
+    }
 }
 
 impl Default for Viewport {
@@ -41,6 +76,7 @@ impl Default for Viewport {
             layer_colors: Vec::new(),
             clip: None,
             on: true,
+            twist: 0.0,
         }
     }
 }
@@ -59,8 +95,9 @@ pub struct Image {
     /// The image definition's name (its key in the drawing's image dictionary).
     #[serde(default, skip_serializing_if = "String::is_empty")]
     pub name: String,
-    /// Clip boundary in pixel coordinates (origin at the top-left corner of the image, y down):
-    /// two opposite corners of a rectangle, or a polygon's vertices. Empty: the whole image.
+    /// Clip boundary in pixel coordinates (y down, counted from pixel centres: the centre of the
+    /// top-left pixel is the origin, so the whole image is -0.5 to size - 0.5): two opposite
+    /// corners of a rectangle, or a polygon's vertices. Empty: the whole image.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub clip: Vec<Vec2>,
     /// The clip boundary is applied.

crates/doc/src/entity/mline.rs

@@ -207,6 +207,41 @@ pub struct MLineGeometry {
     pub fill: Vec<Vec<Vec2>>,
 }
 
+/// For each segment direction in `dirs`, the first non-zero direction at or after it and the
+/// first at or before it, both wrapping around (`Vec2::X` when every direction is zero).
+///
+/// Two linear passes: searching from every segment separately is quadratic in a run of
+/// coincident vertices, which a hostile file can make as long as it likes (CWE-407).
+fn usable_directions(dirs: &[Vec2]) -> (Vec<Vec2>, Vec<Vec2>) {
+    let n = dirs.len();
+    let (Some(first), Some(last)) = (dirs.iter().position(|d| *d != Vec2::ZERO), dirs.iter().rposition(|d| *d != Vec2::ZERO)) else {
+        return (vec![Vec2::X; n], vec![Vec2::X; n]);
+    };
+    let (mut ahead, mut behind) = (vec![Vec2::X; n], vec![Vec2::X; n]);
+    // Walking backwards from the last usable direction, the latest one seen is the next ahead.
+    let mut cur = Vec2::X;
+    for k in 0..n {
+        let i = (last + n - k) % n;
+        if let Some(d) = dirs.get(i).filter(|d| **d != Vec2::ZERO) {
+            cur = *d;
+        }
+        if let Some(a) = ahead.get_mut(i) {
+            *a = cur;
+        }
+    }
+    // Walking forwards from the first usable direction, the latest one seen is the nearest behind.
+    for k in 0..n {
+        let i = (first + k) % n;
+        if let Some(d) = dirs.get(i).filter(|d| **d != Vec2::ZERO) {
+            cur = *d;
+        }
+        if let Some(b) = behind.get_mut(i) {
+            *b = cur;
+        }
+    }
+    (ahead, behind)
+}
+
 impl MLine {
     /// A multiline through `pts` in style `def`.
     pub fn new(def: &MLineStyle, pts: &[Vec2], closed: bool, just: MLineJust, scale: f64) -> MLine {
@@ -268,16 +303,11 @@ impl MLine {
         let dirs = self.directions();
         let n = self.vertices.len();
         let nseg = dirs.len();
-        // A degenerate segment takes its neighbour's direction.
-        let dir = |i: usize| -> Vec2 {
-            (0..nseg).map(|k| dirs.get((i + k) % nseg.max(1)).copied().unwrap_or_default()).find(|d| *d != Vec2::ZERO).unwrap_or(Vec2::X)
-        };
-        let dir_back = |i: usize| -> Vec2 {
-            (0..nseg)
-                .map(|k| dirs.get((i + nseg - k % nseg) % nseg.max(1)).copied().unwrap_or_default())
-                .find(|d| *d != Vec2::ZERO)
-                .unwrap_or(Vec2::X)
-        };
+        // A degenerate segment takes its neighbour's direction: the first usable one at or after
+        // it (`ahead`), or at or before it (`behind`), wrapping around.
+        let (ahead, behind) = usable_directions(&dirs);
+        let dir = |i: usize| -> Vec2 { ahead.get(i).copied().unwrap_or(Vec2::X) };
+        let dir_back = |i: usize| -> Vec2 { behind.get(i).copied().unwrap_or(Vec2::X) };
         let end = |d: Vec2, angle: f64| {
             let u = d.rotate(angle);
             let s = angle.sin();
@@ -426,3 +456,61 @@ impl crate::Drawing {
         self.mline_style(&name).or_else(|| self.mline_style(STANDARD_MLINE_STYLE)).cloned().unwrap_or_default()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The nearest usable directions found by searching from each segment, as miters did before.
+    fn searched(dirs: &[Vec2]) -> (Vec<Vec2>, Vec<Vec2>) {
+        let n = dirs.len();
+        let ahead = (0..n).map(|i| (0..n).filter_map(|k| dirs.get((i + k) % n).copied()).find(|d| *d != Vec2::ZERO).unwrap_or(Vec2::X));
+        let behind = (0..n).map(|i| (0..n).filter_map(|k| dirs.get((i + n - k) % n).copied()).find(|d| *d != Vec2::ZERO).unwrap_or(Vec2::X));
+        (ahead.collect(), behind.collect())
+    }
+
+    #[test]
+    fn usable_directions_match_a_search_from_each_segment() {
+        let (z, a, b, c) = (Vec2::ZERO, Vec2::Y, -Vec2::X, Vec2::new(0.6, 0.8));
+        for dirs in [
+            vec![],
+            vec![z],
+            vec![a],
+            vec![z, z, z],
+            vec![a, z, z, b],
+            vec![z, a, z, b, z],
+            vec![z, z, c],
+            vec![c, z, z],
+            vec![a, b, c],
+            vec![z, a, z, z, b, c, z],
+        ] {
+            assert_eq!(usable_directions(&dirs), searched(&dirs), "{dirs:?}");
+        }
+    }
+
+    #[test]
+    fn coincident_vertices_at_a_corner_take_the_corner_miter() {
+        // Every vertex of a run on one point mitres between the segment before the run and the one after.
+        let style = MLineStyle::default();
+        let corner = MLine::new(&style, &[Vec2::ZERO, Vec2::Y, Vec2::new(-1.0, 1.0)], false, MLineJust::Zero, 1.0);
+        let pts = [Vec2::ZERO, Vec2::Y, Vec2::Y, Vec2::Y, Vec2::new(-1.0, 1.0)];
+        let run = MLine::new(&style, &pts, false, MLineJust::Zero, 1.0);
+        let (expected, got) = (corner.miters(), run.miters());
+        assert_eq!(got.get(1..4), Some(&[expected[1]; 3][..]));
+        assert_eq!((got.first(), got.last()), (expected.first(), expected.last()));
+    }
+
+    #[test]
+    fn a_long_run_of_coincident_vertices_takes_linear_time() {
+        // 200 000 vertices on one point but the last: the miters must not search the run once per
+        // vertex (quadratic, minutes) to find the one usable direction.
+        let mut pts = vec![Vec2::ZERO; 200_000];
+        pts.push(Vec2::new(1.0, 0.0));
+        let m = MLine::new(&MLineStyle::default(), &pts, false, MLineJust::Zero, 1.0);
+        let t = std::time::Instant::now();
+        let miters = m.miters();
+        assert_eq!(miters.len(), pts.len());
+        assert!(miters.iter().all(|v| v.is_finite()));
+        assert!(t.elapsed() < std::time::Duration::from_secs(5), "{:?}", t.elapsed());
+    }
+}

crates/doc/src/entity/region.rs

@@ -9,6 +9,9 @@ use super::HatchLoop;
 /// Most loops one region has (hostile files and edits).
 pub const MAX_REGION_LOOPS: usize = 10_000;
 
+/// Most polygon edges [`Region::renest`] tests, over all its point-in-loop tests.
+pub const MAX_RENEST_EDGE_VISITS: usize = 50_000_000;
+
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
 pub struct Region {
     /// Closed loops with bulges; `outer` false for islands.
@@ -76,20 +79,49 @@ impl Region {
     }
 
     /// Set each loop's `outer` flag from how deeply other loops enclose it: an even depth is
-    /// an outer loop, odd an island.
-    pub fn renest(&mut self) {
+    /// an outer loop, odd an island. `false`, with the flags left as they were, when that takes
+    /// more than [`MAX_RENEST_EDGE_VISITS`] polygon edge tests.
+    #[must_use]
+    pub fn renest(&mut self) -> bool {
         let polys = self.tessellate(self.fine_tol());
-        let depth: Vec<usize> = polys
+        // A loop's probe can only be inside loops whose box holds it: test only those. A box with
+        // a non-finite corner says nothing (an edge through a non-finite point never counts, so
+        // such a polygon need not be closed), so its loop is always tested.
+        let boxes: Vec<Option<Bounds2>> = polys
             .iter()
-            .enumerate()
-            .map(|(i, l)| {
-                let Some(p) = probe(l) else { return 0 };
-                polys.iter().enumerate().filter(|(j, o)| *j != i && point_in_polygon(o, p)).count()
+            .map(|l| {
+                let b = Bounds2::from_points(l.iter().copied());
+                (l.iter().all(|p| p.is_finite()) && b.min.is_finite() && b.max.is_finite()).then_some(b)
             })
             .collect();
+        let mut visits = 0usize;
+        let mut depth = Vec::with_capacity(polys.len());
+        for (i, l) in polys.iter().enumerate() {
+            let Some(p) = probe(l) else {
+                depth.push(0);
+                continue;
+            };
+            let mut d = 0;
+            for (j, (o, b)) in polys.iter().zip(&boxes).enumerate() {
+                if j == i || b.is_some_and(|b| !b.contains(p)) {
+                    continue;
+                }
+                // Each loop against every other is loops x vertices: bounded so a region of many
+                // large nested loops cannot hold the thread (CWE-407).
+                visits = visits.saturating_add(o.len());
+                if visits > MAX_RENEST_EDGE_VISITS {
+                    return false;
+                }
+                if point_in_polygon(o, p) {
+                    d += 1;
+                }
+            }
+            depth.push(d);
+        }
         for (l, d) in self.loops.iter_mut().zip(depth) {
             l.outer = d % 2 == 0;
         }
+        true
     }
 
     /// Area, perimeter, bounding box, centroid and second moments (outer loops counted
@@ -128,3 +160,37 @@ fn probe(l: &[Vec2]) -> Option<Vec2> {
         (a.dist(b) > 1e-12).then(|| (a + b) * 0.5).filter(|m| m.is_finite())
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn square(c: f64, half: f64, n: usize, outer: bool) -> HatchLoop {
+        // `n` vertices along the bottom edge, then the other three corners.
+        let mut vertices: Vec<PolyVertex> =
+            (0..n).map(|k| PolyVertex::new(Vec2::new(c - half + 2.0 * half * k as f64 / n as f64, c - half))).collect();
+        vertices.extend([Vec2::new(c + half, c - half), Vec2::new(c + half, c + half), Vec2::new(c - half, c + half)].map(PolyVertex::new));
+        HatchLoop { vertices, outer, sources: Vec::new() }
+    }
+
+    #[test]
+    fn renest_sets_depth_parity_and_skips_loops_far_away() {
+        // Three nested squares, and one beside them.
+        let mut r =
+            Region { loops: vec![square(0.0, 3.0, 1, false), square(0.0, 2.0, 1, false), square(0.0, 1.0, 1, false), square(10.0, 1.0, 1, false)] };
+        assert!(r.renest());
+        assert_eq!(r.loops.iter().map(|l| l.outer).collect::<Vec<_>>(), [true, false, true, true]);
+    }
+
+    #[test]
+    fn renest_of_many_large_nested_loops_stops_at_its_budget() {
+        // Concentric loops of many vertices each: each probe is inside the box of every larger
+        // loop (about loops² / 2 pairs), so each of those tests is a full polygon scan.
+        let loops = 300;
+        let n = 3 * MAX_RENEST_EDGE_VISITS / (loops * loops);
+        let mut r = Region { loops: (0..loops).map(|i| square(0.0, 1.0 + i as f64, n, false)).collect() };
+        let before = r.clone();
+        assert!(!r.renest());
+        assert_eq!(r, before, "flags left as they were");
+    }
+}

crates/doc/src/extents.rs

@@ -9,6 +9,239 @@ use crate::{Drawing, Entity, EntityKind, LwPolyline, Prim};
 /// Nested block references deeper than this are ignored (cyclic or hostile files).
 pub const MAX_BLOCK_DEPTH: usize = 16;
 
+/// Positions in `tags` of the groups outside application-defined `102 {` .. `102 }` groups, whose
+/// codes are the application's own and not the entity's.
+fn outside_app(tags: &[crate::RawTag]) -> impl Iterator<Item = usize> + '_ {
+    let mut in_app = false;
+    tags.iter().enumerate().filter_map(move |(i, t)| {
+        if t.code == 102 {
+            in_app = t.value.starts_with('{');
+            None
+        } else {
+            (!in_app).then_some(i)
+        }
+    })
+}
+
+/// The positions of the frame's corner groups 10, 20, 11, 21 (in that order) and their values:
+/// the first of each outside application groups, found in one pass that stops at the last.
+fn ole_corner_groups(tags: &[crate::RawTag]) -> Option<[(usize, f64); 4]> {
+    let mut found: [Option<(usize, f64)>; 4] = [None; 4];
+    for i in outside_app(tags) {
+        let Some(t) = tags.get(i) else { continue };
+        let slot = match t.code {
+            10 => 0,
+            20 => 1,
+            11 => 2,
+            21 => 3,
+            _ => continue,
+        };
+        if let Some(f) = found.get_mut(slot).filter(|f| f.is_none()) {
+            *f = Some((i, t.value.trim().parse::<f64>().ok().filter(|v| v.is_finite())?));
+            if found.iter().all(Option::is_some) {
+                break;
+            }
+        }
+    }
+    let [Some(a), Some(b), Some(c), Some(d)] = found else { return None };
+    Some([a, b, c, d])
+}
+
+/// The closed outline of an OLE2FRAME from its upper-left (groups 10, 20) and lower-right
+/// (groups 11, 21) corners (DXF Reference, OLE2FRAME); `None` when either is missing or not finite.
+pub fn ole_frame(tags: &[crate::RawTag]) -> Option<[Vec2; 5]> {
+    let [(_, x1), (_, y1), (_, x2), (_, y2)] = ole_corner_groups(tags)?;
+    let (a, b) = (Vec2::new(x1, y1), Vec2::new(x2, y2));
+    Some([a, Vec2::new(b.x, a.y), b, Vec2::new(a.x, b.y), a])
+}
+
+/// The bytes of the OLE data before its corners: a 2-byte marker.
+const OLE_HEADER: usize = 2;
+/// The corners in the OLE data: four of x, y, z as little-endian doubles (upper left, upper right,
+/// lower right, lower left).
+const OLE_CORNERS: usize = 12;
+
+/// Replace the four corners at the start of the OLE data (the 310 groups' hex, in order) by `new`
+/// (upper left, upper right, lower right, lower left), keeping z and every group's length and
+/// letter case. Only the groups that cover the header are decoded and rewritten; the rest of the
+/// payload is not touched. Data that is not valid hex, too short, or whose corners are not the old
+/// `frame`'s is left alone.
+fn ole_data_transform(tags: &mut [crate::RawTag], new: [Vec2; 4], frame: [f64; 4]) {
+    const END: usize = OLE_HEADER + OLE_CORNERS * 8;
+    let mut bytes: Vec<u8> = Vec::with_capacity(END);
+    // The groups read, and how many leading bytes of each belong to the header.
+    let mut spans: Vec<(usize, usize)> = Vec::new();
+    for i in outside_app(tags).filter(|&i| tags.get(i).is_some_and(|t| t.code == 310)) {
+        if bytes.len() >= END {
+            break;
+        }
+        let Some(t) = tags.get(i) else { return };
+        let s = t.value.trim();
+        if s.len() % 2 != 0 || !s.is_ascii() {
+            return;
+        }
+        let take = (s.len() / 2).min(END - bytes.len());
+        for k in 0..take {
+            // `from_str_radix` also takes a sign, so each digit is checked first.
+            let Some(h) = s.get(2 * k..2 * k + 2).filter(|h| h.bytes().all(|b| b.is_ascii_hexdigit())) else { return };
+            let Ok(b) = u8::from_str_radix(h, 16) else { return };
+            bytes.push(b);
+        }
+        spans.push((i, take));
+    }
+    if bytes.len() < END {
+        return;
+    }
+    // Only data whose corners are this frame's corners (UL, UR, LR, LL) has the layout above; any
+    // other header is not ours to rewrite.
+    let [x1, y1, x2, y2] = frame;
+    let want = [(x1, y1), (x2, y1), (x2, y2), (x1, y2)];
+    // Two corners match within a fixed tolerance for ordinary coordinates (CORNER_EPS at most), or
+    // within a few ulps of the coordinate where that is larger, which is from about 1.1e9 up.
+    let near = |a: f64, b: f64| {
+        let m = a.abs().max(b.abs());
+        (a - b).abs() <= (1e-9 * m.max(1.0)).min(CORNER_EPS).max(4.0 * f64::EPSILON * m)
+    };
+    for (c, (wx, wy)) in want.iter().enumerate() {
+        let at = OLE_HEADER + c * 24;
+        let rd = |o: usize| bytes.get(o..o + 8).and_then(|s| <[u8; 8]>::try_from(s).ok()).map(f64::from_le_bytes);
+        let (Some(x), Some(y)) = (rd(at), rd(at + 8)) else { return };
+        if !(near(x, *wx) && near(y, *wy)) {
+            return;
+        }
+    }
+    for (c, p) in new.iter().enumerate() {
+        let at = OLE_HEADER + c * 24;
+        if let Some(s) = bytes.get_mut(at..at + 8) {
+            s.copy_from_slice(&p.x.to_le_bytes());
+        }
+        if let Some(s) = bytes.get_mut(at + 8..at + 16) {
+            s.copy_from_slice(&p.y.to_le_bytes());
+        }
+    }
+    let mut pos = 0;
+    for (i, n) in spans {
+        let (Some(t), Some(chunk)) = (tags.get_mut(i), bytes.get(pos..pos + n)) else { return };
+        // Leave any padding around the digits, and the digits after the header, as they were.
+        let start = t.value.len() - t.value.trim_start().len();
+        // Only the rewritten digits and a few after them, for the case of the nearest letter: a
+        // hostile 310 line can be as long as the file (the value is checked to be ASCII above).
+        let end = start.saturating_add(2 * n + 64).min(t.value.len());
+        let hex = recase(chunk, t.value.get(start..end).unwrap_or_default());
+        t.value.replace_range(start..start + 2 * n, &hex);
+        pos += n;
+    }
+}
+
+/// The hex of `chunk`, each digit in the case of the digit at the same place in `old`. A digit that
+/// was a number and becomes a letter takes the case of the nearest letter in `old`, upper when there
+/// is none, so bytes that did not change keep their exact text.
+fn recase(chunk: &[u8], old: &str) -> String {
+    let old = old.as_bytes();
+    // For each place, whether the letter nearest to it (the one at it, else the closest before or
+    // after; the one before on a tie) is lower case: one pass for the next letter at or after each
+    // place, one for the previous, then the nearer of the two.
+    let mut next: Vec<Option<(usize, bool)>> = vec![None; old.len()];
+    let mut seen: Option<(usize, bool)> = None;
+    for (i, c) in old.iter().enumerate().rev() {
+        if c.is_ascii_alphabetic() {
+            seen = Some((i, c.is_ascii_lowercase()));
+        }
+        if let Some(slot) = next.get_mut(i) {
+            *slot = seen;
+        }
+    }
+    let mut lower_at = vec![false; old.len()];
+    let mut prev: Option<(usize, bool)> = None;
+    for (i, c) in old.iter().enumerate() {
+        if c.is_ascii_alphabetic() {
+            prev = Some((i, c.is_ascii_lowercase()));
+        }
+        let after = next.get(i).copied().flatten();
+        let lower = match (prev, after) {
+            (Some((p, lp)), Some((q, lq))) => {
+                if i - p <= q - i {
+                    lp
+                } else {
+                    lq
+                }
+            }
+            (Some((_, l)), None) | (None, Some((_, l))) => l,
+            (None, None) => false,
+        };
+        if let Some(slot) = lower_at.get_mut(i) {
+            *slot = lower;
+        }
+    }
+    let mut out = String::with_capacity(chunk.len() * 2);
+    for (k, b) in chunk.iter().enumerate() {
+        for (j, d) in [b >> 4, b & 15].into_iter().enumerate() {
+            let digit = char::from_digit(d.into(), 16).unwrap_or('0');
+            out.push(if lower_at.get(2 * k + j).copied().unwrap_or(false) { digit } else { digit.to_ascii_uppercase() });
+        }
+    }
+    out
+}
+
+/// The fixed part of the tolerance when matching the corners in the OLE data to the frame's. The
+/// header holds the same f64 the frame groups print, so they agree to a few ulps. Up to about 1.1e9
+/// a fixed tolerance of at most this decides, so that distinct geometry does not match; above that,
+/// four ulps of the coordinate (`4 * EPSILON * |x|`) exceed it and decide instead.
+const CORNER_EPS: f64 = 1e-6;
+
+/// Transform an OLE2FRAME by `m`: its two corners are mapped through `m` (a DWG save writes the
+/// frame's position from these groups), and so are the corners at the start of its OLE data (310
+/// groups), which a reader of the saved file may trust instead. The frame stays axis aligned with
+/// its upper-left corner first. A matrix that keeps the axes or swaps them (a move, scale, mirror or
+/// quarter turn) gives the box of the two mapped corners. Any other turn would collapse that box
+/// (a square turned 45° maps its two corners level), so the frame's centre is mapped and its size
+/// kept, scaled by `m`'s, its sides swapped when the turn is nearer a quarter turn. Commands refuse
+/// a rotation or mirror (see [`ole_frame_accepts`]), but internal callers such as EXPLODE, REFEDIT
+/// and paste still apply them, and must leave a consistent frame. A frame with no usable corners is
+/// left alone.
+pub fn ole_frame_transform(tags: &mut [crate::RawTag], m: &cadcraft_geom::Mat3) {
+    let Some([(ix1, x1), (iy1, y1), (ix2, x2), (iy2, y2)]) = ole_corner_groups(tags) else { return };
+    let frame = [x1, y1, x2, y2];
+    let t = 1e-12 * (m.a.abs() + m.b.abs() + m.c.abs() + m.d.abs());
+    let axes_kept = (m.b.abs() <= t && m.c.abs() <= t) || (m.a.abs() <= t && m.d.abs() <= t);
+    let (a, b) = if axes_kept {
+        (m.apply(Vec2::new(x1, y1)), m.apply(Vec2::new(x2, y2)))
+    } else {
+        let center = m.apply(Vec2::new((x1 + x2) / 2.0, (y1 + y2) / 2.0));
+        // A plain turn keeps the size exactly; cos² + sin² can miss 1 by an ulp or two.
+        let s = (m.a * m.d - m.b * m.c).abs().sqrt();
+        let scale = if (s - 1.0).abs() < 1e-12 { 1.0 } else { s };
+        let (mut w, mut h) = ((x2 - x1).abs() * scale, (y2 - y1).abs() * scale);
+        // Where the frame's x axis goes: nearer to y than to x is nearer a quarter turn.
+        if m.b.abs() > m.a.abs() {
+            std::mem::swap(&mut w, &mut h);
+        }
+        (center - Vec2::new(w, h) / 2.0, center + Vec2::new(w, h) / 2.0)
+    };
+    if !(a.x.is_finite() && a.y.is_finite() && b.x.is_finite() && b.y.is_finite()) {
+        return;
+    }
+    let (lo, hi) = (Vec2::new(a.x.min(b.x), a.y.min(b.y)), Vec2::new(a.x.max(b.x), a.y.max(b.y)));
+    let (ul, lr) = (Vec2::new(lo.x, hi.y), Vec2::new(hi.x, lo.y));
+    for (i, v) in [(ix1, ul.x), (iy1, ul.y), (ix2, lr.x), (iy2, lr.y)] {
+        if let Some(t) = tags.get_mut(i) {
+            t.value = v.to_string();
+        }
+    }
+    ole_data_transform(tags, [ul, Vec2::new(lr.x, ul.y), lr, Vec2::new(ul.x, lr.y)], frame);
+}
+
+/// Whether `m` can move an OLE2FRAME: a translation (move, copy, stretch of the whole frame) or a
+/// uniform scale with a positive factor, which keep the frame axis aligned and its upper-left corner
+/// upper-left.
+pub fn ole_frame_accepts(m: &cadcraft_geom::Mat3) -> bool {
+    const T: f64 = 1e-12;
+    // The tolerance grows with the scale: a matrix built from two angles (ALIGN) leaves rounding noise
+    // in b and c of about `scale * 1e-16`.
+    let t = T * m.a.abs();
+    m.b.abs() < t && m.c.abs() < t && m.a > 0.0 && (m.a - m.d).abs() <= t
+}
+
 /// Bounds of a single-line TEXT / ATTDEF / ATTRIB of `len` characters, following its justification
 /// the same way the renderer places it (the stroke font is about 0.88 of the height per character).
 fn text_box(t: &crate::Text, len: usize) -> Bounds2 {
@@ -94,25 +327,48 @@ fn mtext_box(t: &crate::MText) -> Bounds2 {
 
 /// The box of what `e` draws (block contents on layers turned off left out).
 pub fn entity_bounds(d: &Drawing, e: &Entity, depth: usize) -> Bounds2 {
-    bounds_of(d, e, depth, false)
+    bounds_of(d, e, depth, false, &mut HashMap::new())
 }
 
 /// The box `e` takes in the drawing's extents: as [`entity_bounds`], but block contents on a layer
 /// turned off count, as AutoCAD 2024's ZOOM Extents counts them (a frozen layer's do not).
 pub fn extent_bounds(d: &Drawing, e: &Entity) -> Bounds2 {
-    bounds_of(d, e, 0, true)
+    bounds_of(d, e, 0, true, &mut HashMap::new())
 }
 
-fn bounds_of(d: &Drawing, e: &Entity, depth: usize, off_counts: bool) -> Bounds2 {
+/// The bounds of block contents measured so far, kept across the entities of one unchanged
+/// drawing. Measuring many entities with [`entity_bounds_cached`] or [`extent_bounds_cached`]
+/// and one cache measures each block definition once per depth for all of them; a fresh cache per
+/// entity would measure a block again for every reference to it, R references to a block of B
+/// entities costing R x B (CWE-407). Use a cache only while the drawing it measured is unchanged.
+#[derive(Default)]
+pub struct BlockBoundsCache<'a> {
+    /// By block name and depth, block contents on layers turned off left out ([`entity_bounds`]).
+    drawn: HashMap<(&'a str, usize), Bounds2>,
+    /// The same with those contents counted ([`extent_bounds`]).
+    extents: HashMap<(&'a str, usize), Bounds2>,
+}
+
+/// [`entity_bounds`] reusing the block bounds `cache` holds from earlier calls on drawing `d`.
+pub fn entity_bounds_cached<'a>(d: &'a Drawing, e: &Entity, depth: usize, cache: &mut BlockBoundsCache<'a>) -> Bounds2 {
+    bounds_of(d, e, depth, false, &mut cache.drawn)
+}
+
+/// [`extent_bounds`] reusing the block bounds `cache` holds from earlier calls on drawing `d`.
+pub fn extent_bounds_cached<'a>(d: &'a Drawing, e: &Entity, cache: &mut BlockBoundsCache<'a>) -> Bounds2 {
+    bounds_of(d, e, 0, true, &mut cache.extents)
+}
+
+fn bounds_of<'a>(d: &'a Drawing, e: &Entity, depth: usize, off_counts: bool, blocks: &mut HashMap<(&'a str, usize), Bounds2>) -> Bounds2 {
     // A top-level annotative object measures as it draws at the current annotation scale.
     if depth == 0 {
         match d.anno_draw(e) {
             crate::AnnoDraw::Plain => {}
             crate::AnnoDraw::Hidden => return Bounds2::EMPTY,
-            crate::AnnoDraw::Scaled(f) => return bounds_in(d, &crate::anno_scaled(e, f), 0, &mut HashMap::new(), off_counts),
+            crate::AnnoDraw::Scaled(f) => return bounds_in(d, &crate::anno_scaled(e, f), 0, blocks, off_counts),
         }
     }
-    bounds_in(d, e, depth, &mut HashMap::new(), off_counts)
+    bounds_in(d, e, depth, blocks, off_counts)
 }
 
 /// [`entity_bounds`] with the bounds of block contents (in block coordinates) already computed,
@@ -156,11 +412,23 @@ fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<
                     }
                 };
                 b = if inner.is_empty() { Bounds2::EMPTY } else { Bounds2::from_points(inner.corners().map(|c| m.apply(c))) };
+                // XCLIP: the reference app takes the boundary's box, also where it reaches past the
+                // block or misses it (an inverted clip can show anything, so it keeps the block's).
+                if let Some(c) = ins.clip.as_ref().filter(|c| c.active() && !c.inverted)
+                    && !b.is_empty()
+                {
+                    b = Bounds2::from_points(c.polygon().into_iter().map(|p| m.apply(p)));
+                }
                 if ins.cols > 1 || ins.rows > 1 {
-                    let off =
-                        Vec2::new(ins.col_spacing * f64::from(ins.cols.saturating_sub(1)), ins.row_spacing * f64::from(ins.rows.saturating_sub(1)))
-                            .rotate(ins.rotation);
-                    b = b.union(&Bounds2::from_points(b.corners().map(|c| c + off)));
+                    // The grid's four corner copies (as many as are drawn): turned, the far corner
+                    // alone misses the side ones.
+                    let (cols, rows) =
+                        (f64::from(ins.cols.clamp(1, 10_000).saturating_sub(1)), f64::from(ins.rows.clamp(1, 10_000).saturating_sub(1)));
+                    let one = b;
+                    for (c, r) in [(cols, 0.0), (0.0, rows), (cols, rows)] {
+                        let off = Vec2::new(ins.col_spacing * c, ins.row_spacing * r).rotate(ins.rotation);
+                        b = b.union(&Bounds2::from_points(one.corners().map(|p| p + off)));
+                    }
                 }
             }
             for a in &ins.attribs {
@@ -248,6 +516,8 @@ fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<
             Bounds2::from_points([o, o + u, o + v, o + u + v])
         }
         EntityKind::LwPolyline(p) => lwpolyline_bounds(p),
+        // An OLE object's content is not drawn, but its frame is, so the frame counts (#2422).
+        EntityKind::Unknown(u) if u.is_ole_frame() => ole_frame(&u.tags).map_or(Bounds2::EMPTY, Bounds2::from_points),
         kind => {
             let mut b = Bounds2::EMPTY;
             for p in kind.prims() {
@@ -442,4 +712,407 @@ mod tests {
         empty.text = Some(crate::MText { contents: " ".into(), ..mtext });
         assert!(bounds(EntityKind::MLeader(empty)).max.x < 26.0);
     }
+
+    /// An OLE2FRAME counts in the extents through its corner tags (#2422); a missing or
+    /// non-finite corner counts as nothing.
+    #[test]
+    fn ole_frame_counts_in_extents() {
+        let tag = |code: i32, value: &str| crate::RawTag { code, value: value.into() };
+        let frame = |tags: Vec<crate::RawTag>| EntityKind::Unknown(crate::Unknown { dxf_type: "OLE2FRAME".into(), tags });
+        let b = bounds(frame(vec![tag(10, "30"), tag(20, "-19"), tag(11, "35"), tag(21, "-22")]));
+        assert_eq!((b.min, b.max), (Vec2::new(30.0, -22.0), Vec2::new(35.0, -19.0)));
+        assert!(bounds(frame(vec![tag(10, "1"), tag(20, "2")])).is_empty(), "one corner is not a frame");
+        assert!(bounds(frame(vec![tag(10, "NaN"), tag(20, "0"), tag(11, "1"), tag(21, "inf")])).is_empty());
+        assert!(bounds(EntityKind::Unknown(crate::Unknown { dxf_type: "OTHER".into(), tags: vec![tag(10, "5"), tag(20, "5")] })).is_empty());
+    }
+
+    /// Groups 10/20 inside an application-defined `102 {...}` group belong to the application, not
+    /// to the frame: the real corners come after it (review on #2587).
+    #[test]
+    fn ole_frame_skips_application_groups() {
+        let tag = |code: i32, value: &str| crate::RawTag { code, value: value.into() };
+        let tags = vec![
+            tag(102, "{ACAD_REACTORS"),
+            tag(10, "900"),
+            tag(20, "900"),
+            tag(11, "901"),
+            tag(21, "901"),
+            tag(102, "}"),
+            tag(10, "30"),
+            tag(20, "-19"),
+            tag(11, "35"),
+            tag(21, "-22"),
+        ];
+        let q = ole_frame(&tags).expect("frame");
+        assert_eq!((q[0], q[2]), (Vec2::new(30.0, -19.0), Vec2::new(35.0, -22.0)));
+        assert!(ole_frame(&tags[..6]).is_none(), "corners only inside the group are not a frame");
+    }
+
+    #[test]
+    fn a_shared_block_cache_measures_as_a_fresh_one_for_each_entity() {
+        let line = |a: (f64, f64), b: (f64, f64), layer: &str| {
+            let mut e = Entity::new(crate::Handle(1), EntityKind::Line(crate::Line { a: Vec3::new(a.0, a.1, 0.0), b: Vec3::new(b.0, b.1, 0.0) }));
+            e.common.layer = layer.into();
+            e
+        };
+        let ins = |block: &str, at: f64| {
+            Entity::new(
+                crate::Handle(2),
+                EntityKind::Insert(crate::Insert {
+                    block: block.into(),
+                    insert: Vec3::new(at, at, 0.0),
+                    scale: Vec3::new(1.0, 1.0, 1.0),
+                    rotation: 0.0,
+                    attribs: Vec::new(),
+                    cols: 1,
+                    rows: 1,
+                    col_spacing: 0.0,
+                    row_spacing: 0.0,
+                    clip: None,
+                }),
+            )
+        };
+        let mut d = Drawing::new_imperial();
+        d.ensure_layer("OFF");
+        if let Some(l) = d.layer_mut("OFF") {
+            l.on = false;
+        }
+        // A block with a part on a layer turned off (left out when drawn, counted in extents),
+        // and a block that nests it.
+        let mut b = crate::Block::new("B");
+        b.entities.push(line((0.0, 0.0), (1.0, 1.0), "0"));
+        b.entities.push(line((0.0, 0.0), (5.0, 5.0), "OFF"));
+        d.blocks.insert("B".into(), std::sync::Arc::new(b));
+        let mut n = crate::Block::new("N");
+        n.entities.push(ins("B", 10.0));
+        d.blocks.insert("N".into(), std::sync::Arc::new(n));
+        let ents: Vec<Entity> = (0..50).map(|i| ins(if i % 2 == 0 { "B" } else { "N" }, f64::from(i))).collect();
+        // One cache for both kinds of measure, interleaved: neither may answer for the other.
+        let mut cache = BlockBoundsCache::default();
+        for e in &ents {
+            let (drawn, extents) = (entity_bounds_cached(&d, e, 0, &mut cache), extent_bounds_cached(&d, e, &mut cache));
+            let (want_drawn, want_extents) = (entity_bounds(&d, e, 0), extent_bounds(&d, e));
+            assert_eq!((drawn.min, drawn.max), (want_drawn.min, want_drawn.max));
+            assert_eq!((extents.min, extents.max), (want_extents.min, want_extents.max));
+            assert!(extents.width() > drawn.width());
+        }
+    }
+
+    /// A turned array of references reaches its side copies, not only the first and the last;
+    /// a hostile count measures only the copies that are drawn.
+    #[test]
+    fn a_rotated_array_counts_every_corner_copy() {
+        let mut d = Drawing::new_metric();
+        let mut b = crate::Block::new("B");
+        b.entities.push(Entity::new(crate::Handle(1), EntityKind::Line(crate::Line { a: Vec3::ZERO, b: Vec3::new(1.0, 0.0, 0.0) })));
+        d.blocks.insert("B".into(), std::sync::Arc::new(b));
+        let array = |cols: u32, rows: u32, rotation: f64| {
+            let ins = crate::Insert {
+                block: "B".into(),
+                scale: Vec3::new(1.0, 1.0, 1.0),
+                rotation,
+                cols,
+                rows,
+                col_spacing: 10.0,
+                row_spacing: 10.0,
+                ..crate::Insert::default()
+            };
+            Entity::new(crate::Handle(2), EntityKind::Insert(ins))
+        };
+        // Turned 45°: the copies sit at (0, 0), (7.07, 7.07), (-7.07, 7.07) and (0, 14.14).
+        let b = entity_bounds(&d, &array(2, 2, std::f64::consts::FRAC_PI_4), 0);
+        let side = 10.0 * std::f64::consts::FRAC_1_SQRT_2;
+        assert!((b.min.x + side).abs() < 1e-9 && b.max.x >= side, "{b:?}");
+        assert!((b.max.y - 2.0 * side - std::f64::consts::FRAC_1_SQRT_2).abs() < 1e-9, "{b:?}");
+        // The renderer draws at most 10,000 columns.
+        let b = entity_bounds(&d, &array(u32::MAX, 1, 0.0), 0);
+        assert!((b.max.x - (10.0 * 9_999.0 + 1.0)).abs() < 1e-6, "{b:?}");
+    }
+
+    /// An OLE2FRAME at large coordinates, with its OLE data header holding the frame's corners
+    /// shifted by `dx` in x.
+    fn big_frame(dx: f64) -> Vec<crate::RawTag> {
+        let (x1, y1, x2, y2) = (1e9, 1e9, 1e9 + 10.0, 1e9 + 5.0);
+        let mut blob = vec![1u8, 0];
+        for (x, y) in [(x1, y1), (x2, y1), (x2, y2), (x1, y2)] {
+            for v in [x + dx, y, 7.0] {
+                blob.extend_from_slice(&v.to_le_bytes());
+            }
+        }
+        let tag = |code: i32, value: String| crate::RawTag { code, value };
+        vec![
+            tag(10, x1.to_string()),
+            tag(20, y1.to_string()),
+            tag(11, x2.to_string()),
+            tag(21, y2.to_string()),
+            tag(310, blob.iter().map(|b| format!("{b:02X}")).collect()),
+        ]
+    }
+
+    /// The x of the first corner in the OLE data of a [`big_frame`].
+    fn data_x(tags: &[crate::RawTag]) -> f64 {
+        let hex = tags.last().map(|t| t.value.as_str()).unwrap_or_default();
+        let bytes: Vec<u8> = (0..hex.len() / 2).filter_map(|i| u8::from_str_radix(hex.get(2 * i..2 * i + 2)?, 16).ok()).collect();
+        bytes.get(2..10).and_then(|s| <[u8; 8]>::try_from(s).ok()).map(f64::from_le_bytes).unwrap_or(f64::NAN)
+    }
+
+    /// The match between the frame and the corners in its OLE data does not loosen with the
+    /// coordinate: half a unit off at 1e9 is not the frame, so the bytes stay as they are (review
+    /// on #2587).
+    #[test]
+    fn a_half_unit_offset_at_large_coordinates_is_not_the_frame() {
+        let mut tags = big_frame(0.5);
+        let before = tags.last().cloned();
+        ole_frame_transform(&mut tags, &cadcraft_geom::Mat3::translate(Vec2::new(1.0, 1.0)));
+        assert_eq!(tags.first().map(|t| t.value.as_str()), Some("1000000001"), "the frame tags move");
+        assert_eq!(tags.last().map(|t| &t.value), before.as_ref().map(|t| &t.value), "the 310 bytes stay identical");
+    }
+
+    #[test]
+    fn exact_corners_at_large_coordinates_still_move() {
+        let mut tags = big_frame(0.0);
+        ole_frame_transform(&mut tags, &cadcraft_geom::Mat3::translate(Vec2::new(1.0, 1.0)));
+        assert_eq!(data_x(&tags), 1e9 + 1.0);
+    }
+
+    /// A translation, and a uniform positive scale about any point, keep a frame axis aligned and
+    /// upper-left; a rotation, a mirror, a non-uniform or non-positive scale do not.
+    #[test]
+    fn ole_frame_accepts_translations_and_uniform_positive_scales_only() {
+        use cadcraft_geom::Mat3;
+        let p = Vec2::new(3.0, -4.0);
+        assert!(ole_frame_accepts(&Mat3::translate(p)));
+        assert!(ole_frame_accepts(&Mat3::scale_about(p, 2.5)));
+        assert!(ole_frame_accepts(&Mat3::scale_about(p, 1e-3)));
+        assert!(!ole_frame_accepts(&Mat3::scale(2.0, 3.0)));
+        assert!(!ole_frame_accepts(&Mat3::scale_about(p, -1.0)));
+        assert!(!ole_frame_accepts(&Mat3::scale_about(p, 0.0)));
+        assert!(!ole_frame_accepts(&Mat3::rotate_about(p, 0.5)));
+        assert!(!ole_frame_accepts(&Mat3::mirror(Vec2::new(0.0, 0.0), Vec2::new(1.0, 0.0))));
+    }
+    /// ALIGN with a scale builds its matrix from two angles that agree only to rounding, so a large
+    /// scale leaves a rotation part of about `scale * 1e-16`. That is a scale, not a turn: the
+    /// tolerance for it grows with the scale, while a real turn is still refused (review on #2587).
+    #[test]
+    fn ole_frame_accepts_a_large_scale_with_rounding_noise_in_its_rotation() {
+        use cadcraft_geom::Mat3;
+        let p = Vec2::new(3.0, -4.0);
+        let noisy = Mat3::scale_about(p, 1e6).then_before(Mat3::rotate_about(p, 2e-16));
+        assert!(noisy.b.abs() > 1e-12, "the setup must exceed an absolute tolerance: {}", noisy.b);
+        assert!(ole_frame_accepts(&noisy));
+        let turned = Mat3::scale_about(p, 1e6).then_before(Mat3::rotate_about(p, 1e-6));
+        assert!(!ole_frame_accepts(&turned));
+    }
+
+    /// The corners (x, y) in the OLE data header of a frame built by [`big_frame`]-style tags.
+    fn header_corners(tags: &[crate::RawTag]) -> Vec<(f64, f64)> {
+        let hex: String = tags.iter().filter(|t| t.code == 310).map(|t| t.value.as_str()).collect();
+        let bytes: Vec<u8> = (0..hex.len() / 2).filter_map(|i| u8::from_str_radix(hex.get(2 * i..2 * i + 2)?, 16).ok()).collect();
+        let f = |o: usize| bytes.get(o..o + 8).and_then(|s| <[u8; 8]>::try_from(s).ok()).map(f64::from_le_bytes).unwrap_or(f64::NAN);
+        (0..4).map(|c| (f(2 + c * 24), f(10 + c * 24))).collect()
+    }
+
+    fn small_frame() -> Vec<crate::RawTag> {
+        let mut blob = vec![1u8, 0];
+        for (x, y) in [(30.0f64, -19.0f64), (35.0, -19.0), (35.0, -22.0), (30.0, -22.0)] {
+            for v in [x, y, 7.0] {
+                blob.extend_from_slice(&v.to_le_bytes());
+            }
+        }
+        let tag = |code: i32, value: &str| crate::RawTag { code, value: value.into() };
+        vec![
+            tag(10, "30"),
+            tag(20, "-19"),
+            tag(11, "35"),
+            tag(21, "-22"),
+            crate::RawTag { code: 310, value: blob.iter().map(|b| format!("{b:02X}")).collect() },
+        ]
+    }
+
+    /// Internal callers (EXPLODE, REFEDIT, paste, array placement) transform a frame by any matrix.
+    /// It stays axis aligned: groups 10/20 are the upper-left of its box, 11/21 the lower-right,
+    /// and the OLE data holds the same box (review on #2587). A mirror keeps the axes, so the box
+    /// is that of the mapped corners; a 30° turn keeps the frame's own 5 x 3 about its turned
+    /// centre, where the corners' box would flatten it.
+    #[test]
+    fn a_rotated_frame_stays_axis_aligned_and_consistent() {
+        use cadcraft_geom::Mat3;
+        let rotate = Mat3::rotate_about(Vec2::new(1.0, 2.0), 30f64.to_radians());
+        let mirror = Mat3::mirror(Vec2::new(0.0, 0.0), Vec2::new(1.0, 0.0));
+        for (m, turned) in [(rotate, true), (mirror, false)] {
+            let mut tags = small_frame();
+            let mapped = if turned {
+                let c = m.apply(Vec2::new(32.5, -20.5));
+                [c - Vec2::new(2.5, 1.5), c + Vec2::new(2.5, 1.5)]
+            } else {
+                [m.apply(Vec2::new(30.0, -19.0)), m.apply(Vec2::new(35.0, -22.0))]
+            };
+            let (minx, maxx) = (mapped[0].x.min(mapped[1].x), mapped[0].x.max(mapped[1].x));
+            let (miny, maxy) = (mapped[0].y.min(mapped[1].y), mapped[0].y.max(mapped[1].y));
+            ole_frame_transform(&mut tags, &m);
+            let g = |code: i32| tags.iter().find(|t| t.code == code).and_then(|t| t.value.parse::<f64>().ok()).unwrap_or(f64::NAN);
+            assert_eq!((g(10), g(20), g(11), g(21)), (minx, maxy, maxx, miny));
+            assert_eq!(header_corners(&tags), vec![(minx, maxy), (maxx, maxy), (maxx, miny), (minx, miny)]);
+        }
+    }
+    /// `from_str_radix` accepts a leading sign, so "+A" must not count as a hex byte (review on
+    /// #2587): data with one is not valid and MOVE leaves its bytes alone.
+    #[test]
+    fn a_plus_sign_in_ole_data_is_not_hex() {
+        let mut tags = small_frame();
+        let hex = tags.last().map(|t| t.value.clone()).unwrap_or_default();
+        // The marker's first byte is 01: "+1" would decode to the same byte.
+        let signed = format!("+1{}", hex.get(2..).unwrap_or_default());
+        if let Some(t) = tags.last_mut() {
+            t.value = signed.clone();
+        }
+        ole_frame_transform(&mut tags, &cadcraft_geom::Mat3::translate(Vec2::new(10.0, 5.0)));
+        assert_eq!(tags.first().map(|t| t.value.as_str()), Some("40"), "the frame tags still move");
+        assert_eq!(tags.last().map(|t| t.value.as_str()), Some(signed.as_str()));
+    }
+
+    /// A payload of 1,000 groups of 127 bytes: only the group(s) holding the 98-byte header are
+    /// rewritten. Later groups stay as they were, even ones that are not valid hex or have padding
+    /// (the old code re-encoded the whole payload and gave up on any bad group).
+    #[test]
+    fn a_large_ole_payload_only_rewrites_its_leading_groups() {
+        let mut tags = small_frame();
+        let first = tags.pop().map(|t| t.value).unwrap_or_default();
+        let mut head = first.clone();
+        // Fill the first group up to 127 bytes.
+        head.push_str(&"ab".repeat(127 - first.len() / 2));
+        tags.push(crate::RawTag { code: 310, value: head });
+        for g in 1..1000 {
+            let value = match g {
+                2 => format!("  {}  ", "Ab".repeat(127)),
+                500 => "ZZ".repeat(127),
+                _ => "ab".repeat(127),
+            };
+            tags.push(crate::RawTag { code: 310, value });
+        }
+        let rest: Vec<String> = tags.iter().skip(5).map(|t| t.value.clone()).collect();
+        ole_frame_transform(&mut tags, &cadcraft_geom::Mat3::translate(Vec2::new(10.0, 5.0)));
+        assert_eq!(header_corners(&tags[..5]), vec![(40.0, -14.0), (45.0, -14.0), (45.0, -17.0), (40.0, -17.0)]);
+        let after: Vec<String> = tags.iter().skip(5).map(|t| t.value.clone()).collect();
+        assert_eq!(after, rest, "every group after the first is string-identical");
+        assert_eq!(tags.get(4).map(|t| t.value.len()), Some(254), "the first group keeps its length");
+    }
+
+    /// Above about 8.6e9 one ulp of an f64 is more than the fixed ceiling on the corner match, so a
+    /// text corner one ulp from the header double must still count as the same corner (review on
+    /// #2587).
+    #[test]
+    fn ole_frame_moves_at_2e10_with_a_one_ulp_text_corner() {
+        let mut tags = big_frame(0.0);
+        // Rebuild the frame at 2e10: the header keeps the exact corners, the text is one ulp off.
+        let (x1, y1, x2, y2) = (2e10f64, 2e10f64, 2e10 + 10.0, 2e10 + 5.0);
+        let mut blob = vec![1u8, 0];
+        for (x, y) in [(x1, y1), (x2, y1), (x2, y2), (x1, y2)] {
+            for v in [x, y, 7.0] {
+                blob.extend_from_slice(&v.to_le_bytes());
+            }
+        }
+        let text_x1 = f64::from_bits(x1.to_bits() + 1);
+        tags[0].value = text_x1.to_string();
+        tags[1].value = y1.to_string();
+        tags[2].value = x2.to_string();
+        tags[3].value = y2.to_string();
+        if let Some(t) = tags.last_mut() {
+            t.value = blob.iter().map(|b| format!("{b:02X}")).collect();
+        }
+        ole_frame_transform(&mut tags, &cadcraft_geom::Mat3::translate(Vec2::new(1e4, 1e4)));
+        assert_eq!(header_corners(&tags)[0].0, text_x1 + 1e4, "the header moved with the frame");
+    }
+
+    /// Below scale 1 the rotation bound is still relative to the scale: a small real turn at a tiny
+    /// scale is refused, and so is a non-uniform scale whose two factors differ by more than a
+    /// relative 1e-12 (review on #2587).
+    #[test]
+    fn ole_frame_refuses_a_small_turn_at_a_tiny_scale() {
+        use cadcraft_geom::Mat3;
+        let p = Vec2::new(3.0, -4.0);
+        let turned = Mat3::scale_about(p, 1e-9).then_before(Mat3::rotate_about(p, 0.05f64.to_radians()));
+        assert!(!ole_frame_accepts(&turned));
+        assert!(ole_frame_accepts(&Mat3::scale_about(p, 1e-9)));
+        assert!(!ole_frame_accepts(&Mat3::scale(1e-6, 1e-6 + 5e-13)));
+    }
+
+    /// Hex digits keep the case they had: bytes the transform does not change come back as the
+    /// identical text, also in a group that mixes upper and lower case (review on #2587).
+    #[test]
+    fn moving_an_ole_frame_keeps_each_hex_digits_case() {
+        let mut tags = small_frame();
+        let old = tags.last().map(|t| t.value.clone()).unwrap_or_default();
+        let mixed: String = old.chars().enumerate().map(|(i, c)| if i < 24 { c.to_ascii_lowercase() } else { c }).collect();
+        assert_ne!(mixed, old);
+        if let Some(t) = tags.last_mut() {
+            t.value = mixed.clone();
+        }
+        ole_frame_transform(&mut tags, &cadcraft_geom::Mat3::translate(Vec2::new(10.0, 5.0)));
+        let new = tags.last().map(|t| t.value.clone()).unwrap_or_default();
+        assert_eq!(new.len(), mixed.len());
+        let byte = |s: &str, i: usize| s.get(2 * i..2 * i + 2).and_then(|h| u8::from_str_radix(h, 16).ok());
+        let mut same = 0;
+        for i in 0..mixed.len() / 2 {
+            if byte(&mixed, i) == byte(&new, i) {
+                same += 1;
+                assert_eq!(mixed.get(2 * i..2 * i + 2), new.get(2 * i..2 * i + 2), "byte {i}");
+            }
+        }
+        assert!(same > 40, "most of the header is unchanged: {same}");
+        assert_eq!(header_corners(&tags)[0], (40.0, -14.0));
+    }
+
+    /// A frame from `(x1, y1)` (upper left) to `(x2, y2)` (lower right), its OLE header holding the
+    /// same corners.
+    fn frame_at(x1: f64, y1: f64, x2: f64, y2: f64) -> Vec<crate::RawTag> {
+        let mut blob = vec![1u8, 0];
+        for (x, y) in [(x1, y1), (x2, y1), (x2, y2), (x1, y2)] {
+            for v in [x, y, 0.0] {
+                blob.extend_from_slice(&v.to_le_bytes());
+            }
+        }
+        let tag = |code: i32, value: String| crate::RawTag { code, value };
+        vec![
+            tag(10, x1.to_string()),
+            tag(20, y1.to_string()),
+            tag(11, x2.to_string()),
+            tag(21, y2.to_string()),
+            tag(310, blob.iter().map(|b| format!("{b:02X}")).collect()),
+        ]
+    }
+
+    fn size(tags: &[crate::RawTag]) -> (f64, f64, Vec2) {
+        let o = ole_frame(tags).unwrap();
+        let b = Bounds2::from_points(o);
+        (b.width(), b.height(), b.center())
+    }
+
+    /// A frame turned by an angle that isn't a quarter turn keeps its size about its turned
+    /// centre instead of collapsing to the box of its two corners (a 10 x 10 square turned 45°
+    /// became 14.14 x 0), and the OLE header follows (#2587 review).
+    #[test]
+    fn a_frame_turned_off_the_axes_keeps_its_size() {
+        use cadcraft_geom::Mat3;
+        let close = |a: f64, b: f64| (a - b).abs() < 1e-9;
+        let mut tags = frame_at(0.0, 10.0, 10.0, 0.0);
+        ole_frame_transform(&mut tags, &Mat3::rotate(std::f64::consts::FRAC_PI_4));
+        let (w, h, c) = size(&tags);
+        assert!(close(w, 10.0) && close(h, 10.0), "{w} x {h}");
+        assert!(close(c.x, 0.0) && close(c.y, 50f64.sqrt()), "{c:?}");
+        let (ul, lr) = (header_corners(&tags)[0], header_corners(&tags)[2]);
+        assert!(close(ul.0, -5.0) && close(lr.1, 50f64.sqrt() - 5.0), "the header follows: {ul:?} {lr:?}");
+        // Nearer a quarter turn, the sides swap: a 10 wide, 4 tall frame turned 100° is 4 x 10.
+        let mut tags = frame_at(0.0, 4.0, 10.0, 0.0);
+        ole_frame_transform(&mut tags, &Mat3::rotate(100f64.to_radians()));
+        let (w, h, _) = size(&tags);
+        assert!(close(w, 4.0) && close(h, 10.0), "{w} x {h}");
+        // A turn and its inverse bring the frame back.
+        let mut tags = frame_at(2.0, 9.0, 7.0, 3.0);
+        let m = Mat3::rotate(0.3);
+        ole_frame_transform(&mut tags, &m);
+        ole_frame_transform(&mut tags, &m.inverse().unwrap());
+        let (w, h, c) = size(&tags);
+        assert!(close(w, 5.0) && close(h, 6.0) && close(c.x, 4.5) && close(c.y, 6.0), "{w} x {h} at {c:?}");
+    }
 }

crates/doc/src/foreign.rs

@@ -55,6 +55,8 @@ impl ForeignExtra {
 pub struct Foreign {
     /// CLASS records (groups after `0 CLASS`) of the kept objects' and entities' types.
     pub classes: Vec<Vec<RawTag>>,
+    /// Classes retain every source position, including duplicate names.
+    pub complete_class_table: bool,
     /// Kept objects, in file order.
     pub objects: Vec<ForeignObject>,
     /// Entries of the named object dictionary that CADCraft doesn't write itself: (key, object).
@@ -75,9 +77,19 @@ pub struct Foreign {
     /// surfaces, which from 2013 on those entities don't carry themselves: each `ACDSRECORD`
     /// names its entity with a 320 handle (see [`Foreign::data_store_entities`]).
     pub data_store: Vec<RawTag>,
+    /// The `$ACADVER` of the file all this was read from: its groups are in that version's form.
+    /// The drawing's own `$ACADVER` is the version it is saved as, which SAVEAS changes, so a
+    /// later save must not take it for this one (#2471).
+    pub version: Option<String>,
 }
 
 impl Foreign {
+    /// The class of the file's CLASSES a proxy's group 91 names (see [`class_number`]), if any.
+    /// Saving as DWG keeps a proxy with that class and leaves out one whose class it can't name.
+    pub fn proxy_class(&self, tags: &[RawTag]) -> Option<&str> {
+        class_index(class_number(tags.iter().map(|r| (r.code, r.value.as_str())))).and_then(|i| self.class_order.get(i)).map(String::as_str)
+    }
+
     pub fn is_empty(&self) -> bool {
         self.objects.is_empty()
             && self.dictionary.is_empty()
@@ -256,3 +268,29 @@ impl Foreign {
         }
     }
 }
+
+/// Where a proxy's class number is: its first group 91 outside the `102 {NAME` … `102 }` groups
+/// (an application's can hold a 91 of its own) and before any xdata.
+pub fn class_group<S: AsRef<str>>(groups: impl IntoIterator<Item = (i32, S)>) -> Option<usize> {
+    let mut in_group = false;
+    for (i, (code, value)) in groups.into_iter().enumerate() {
+        match code {
+            1000.. => return None,
+            102 => in_group = value.as_ref().trim().starts_with('{'),
+            91 if !in_group => return Some(i),
+            _ => {}
+        }
+    }
+    None
+}
+
+/// A proxy's class number (see [`class_group`]).
+pub fn class_number<S: AsRef<str>>(groups: impl IntoIterator<Item = (i32, S)> + Clone) -> Option<i64> {
+    let i = class_group(groups.clone())?;
+    groups.into_iter().nth(i).and_then(|(_, v)| v.as_ref().trim().parse().ok())
+}
+
+/// The place in CLASSES a class number names (500 is the first class).
+pub fn class_index(number: Option<i64>) -> Option<usize> {
+    usize::try_from(number?.checked_sub(500)?).ok()
+}

crates/doc/src/header.rs

@@ -90,6 +90,23 @@ impl Header {
             .filter(|p| p.is_finite() && if allow_zero { p.x >= 0.0 && p.y >= 0.0 } else { p.x > 0.0 && p.y > 0.0 })
             .unwrap_or(Vec2::new(0.5, 0.5))
     }
+    /// The model view the drawing was saved at: `$VIEWCTR` (centre) and `$VIEWSIZE` (height, in
+    /// drawing units), when both are present and usable. A DXF file keeps the pair in HEADER and
+    /// repeats it in the `*ACTIVE` VPORT record (12/22 and 40); a reader opens the drawing on it
+    /// rather than on the extents, so a drawing saved on one detail of a large sheet opens there.
+    pub fn saved_view(&self) -> Option<(Vec2, f64)> {
+        let center = self.point("VIEWCTR")?.xy();
+        let height = self.get("VIEWSIZE").and_then(HVal::as_f64)?;
+        (center.is_finite() && height.is_finite() && height > 1e-9).then_some((center, height))
+    }
+    /// Record the view the drawing is saved at (see [`Header::saved_view`]). A view that cannot
+    /// be shown is not recorded, so a usable stored view is never replaced by an unusable one.
+    pub fn set_saved_view(&mut self, center: Vec2, height: f64) {
+        if center.is_finite() && height.is_finite() && height > 1e-9 {
+            self.set("VIEWCTR", HVal::Point(center.to3(0.0)));
+            self.set_f64("VIEWSIZE", height);
+        }
+    }
     pub fn set_f64(&mut self, name: &str, v: f64) {
         self.set(name, HVal::Real(v));
     }

crates/doc/src/lib.rs

@@ -16,9 +16,11 @@ mod header;
 pub mod library;
 mod plotstyle;
 mod plotter;
+mod raster;
 mod refedit;
 mod store;
 mod tables;
+mod xclip;
 
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -27,15 +29,20 @@ pub use cadcraft_color as color;
 pub use cadcraft_geom as geom;
 pub use constraint::*;
 pub use entity::*;
-pub use extents::{MAX_BLOCK_DEPTH, entity_bounds, extent_bounds};
+pub use extents::{
+    BlockBoundsCache, MAX_BLOCK_DEPTH, entity_bounds, entity_bounds_cached, extent_bounds, extent_bounds_cached, ole_frame, ole_frame_accepts,
+    ole_frame_transform,
+};
 pub use format::Format;
 pub use gdt::*;
 pub use header::{HVal, Header};
 pub use plotstyle::*;
 pub use plotter::*;
+pub use raster::{Raster, Rasters};
 pub use refedit::{RefEdit, WorkItem};
 pub use store::EntityStore;
 pub use tables::*;
+pub use xclip::{ClipBoundary, MAX_CLIP_VERTICES};
 
 /// File data CADCraft doesn't model, kept for saving (#528).
 pub mod dynblock;
@@ -136,6 +143,8 @@ pub struct Drawing {
     /// for the Linux fonts of text styles, and each style keeps its own in CADCraft xdata, so the
     /// drawing reopens with it. Never set on an open drawing.
     pub portable_fonts: bool,
+    /// The pixels of the raster images that are loaded (IMAGE). Never written to a file.
+    pub rasters: Rasters,
 }
 
 impl Default for Drawing {
@@ -196,6 +205,7 @@ impl Drawing {
             refedit: None,
             skipped_records: BTreeMap::new(),
             portable_fonts: false,
+            rasters: Rasters::default(),
         }
     }
 
@@ -383,10 +393,13 @@ impl Drawing {
     /// Bounds of the entities in a space that count in its extents ([`Drawing::in_extents`]).
     pub fn extents(&self, space: &Space) -> cadcraft_geom::Bounds2 {
         let mut b = cadcraft_geom::Bounds2::EMPTY;
+        // One block-bounds cache for the whole space: every reference to a block reuses its
+        // measured contents instead of measuring the definition again.
+        let mut cache = BlockBoundsCache::default();
         if let Some(store) = self.space(space) {
             for e in store.iter() {
                 if self.in_extents(e) {
-                    b = b.union(&extent_bounds(self, e));
+                    b = b.union(&extent_bounds_cached(self, e, &mut cache));
                 }
             }
         }

crates/doc/src/raster.rs

@@ -0,0 +1,93 @@
+//! Decoded raster image pixels (IMAGE entities). The drawing keeps them for the session only:
+//! they are loaded from the image files after a drawing opens and are never written to a file.
+
+use std::collections::BTreeMap;
+use std::sync::Arc;
+
+/// The pixels of a raster image: 8-bit RGBA, not premultiplied, rows from the top.
+#[derive(Clone, PartialEq)]
+pub struct Raster {
+    width: u32,
+    height: u32,
+    rgba: Vec<u8>,
+    opaque: bool,
+}
+
+impl Raster {
+    /// `None` unless both sides are at least one pixel and `rgba` holds exactly four bytes per pixel.
+    pub fn new(width: u32, height: u32, rgba: Vec<u8>) -> Option<Raster> {
+        let pixels = usize::try_from(width).ok()?.checked_mul(usize::try_from(height).ok()?)?;
+        if pixels == 0 || rgba.len() != pixels.checked_mul(4)? {
+            return None;
+        }
+        let opaque = rgba.as_chunks::<4>().0.iter().all(|[_, _, _, alpha]| *alpha == u8::MAX);
+        Some(Raster { width, height, rgba, opaque })
+    }
+    pub fn width(&self) -> u32 {
+        self.width
+    }
+    pub fn height(&self) -> u32 {
+        self.height
+    }
+    /// Four bytes per pixel (red, green, blue, alpha), `width * height` pixels.
+    pub fn rgba(&self) -> &[u8] {
+        &self.rgba
+    }
+    /// No pixel is transparent.
+    pub fn opaque(&self) -> bool {
+        self.opaque
+    }
+    /// The pixel in column `x` of row `y` (from the top): red, green, blue, alpha.
+    pub fn pixel(&self, x: u32, y: u32) -> Option<[u8; 4]> {
+        if x >= self.width || y >= self.height {
+            return None;
+        }
+        let (x, y, width) = (usize::try_from(x).ok()?, usize::try_from(y).ok()?, usize::try_from(self.width).ok()?);
+        let pixels = self.rgba.as_chunks::<4>().0;
+        pixels.get(y.checked_mul(width)?.checked_add(x)?).copied()
+    }
+}
+
+impl std::fmt::Debug for Raster {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "Raster({}x{})", self.width, self.height)
+    }
+}
+
+/// The loaded pixels of a drawing's raster images, by image file path ([`crate::Image::path`]).
+/// Session data: two drawings are equal whatever images they have loaded, and copying a drawing
+/// (undo) shares the pixels.
+#[derive(Clone, Default)]
+pub struct Rasters(Arc<BTreeMap<String, Arc<Raster>>>);
+
+impl Rasters {
+    pub fn get(&self, path: &str) -> Option<&Arc<Raster>> {
+        self.0.get(path)
+    }
+    pub fn insert(&mut self, path: &str, raster: Arc<Raster>) {
+        Arc::make_mut(&mut self.0).insert(path.to_string(), raster);
+    }
+    pub fn remove(&mut self, path: &str) {
+        if self.0.contains_key(path) {
+            Arc::make_mut(&mut self.0).remove(path);
+        }
+    }
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+}
+
+impl PartialEq for Rasters {
+    fn eq(&self, _: &Rasters) -> bool {
+        true
+    }
+}
+
+impl std::fmt::Debug for Rasters {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "Rasters({})", self.0.len())
+    }
+}

crates/doc/src/tables.rs

@@ -486,16 +486,24 @@ impl DimStyle {
 
     /// Set fields from a JSON object of field or DIM* variable names (numbers, booleans as
     /// 0/1, colours as ACI numbers or names). Returns the names that were not recognised or
-    /// had unusable values.
+    /// had unusable values. When several spellings name one field, the last one wins and the
+    /// superseded ones are not validated.
     pub fn apply_fields(&mut self, src: &serde_json::Map<String, serde_json::Value>) -> Vec<String> {
         use serde_json::Value;
         let mut rejected = Vec::new();
         let Ok(mut cur) = serde_json::to_value(&*self) else { return src.keys().cloned().collect() };
+        // Spellings of one field (`DIMPOST`, `dimpost`, `textPrefix`…): only the last is applied, so
+        // the style is checked once per field, not once per spelling (each check copies its strings).
+        let last_spelling: std::collections::HashMap<&str, &String> =
+            src.keys().filter_map(|k| DimStyle::field_name(k).filter(|f| *f != "name").map(|f| (f, k))).collect();
         for (k, v) in src {
             let Some(field) = DimStyle::field_name(k).filter(|f| *f != "name") else {
                 rejected.push(k.clone());
                 continue;
             };
+            if last_spelling.get(field) != Some(&k) {
+                continue;
+            }
             let Some(obj) = cur.as_object_mut() else { break };
             let Some(old) = obj.get(field).cloned() else {
                 rejected.push(k.clone());
@@ -799,6 +807,13 @@ pub struct PageSetup {
     /// The layout's paper units are millimetres (plot paper units 1 in DXF) whatever the
     /// drawing's MEASUREMENT says; otherwise paper units follow MEASUREMENT (#1058).
     pub paper_mm: bool,
+    /// Paper size (DXF groups 44, 45) and plot rotation (group 73) as the file stored them.
+    /// Saving writes them back while they still describe `width_mm`, `height_mm` and
+    /// `landscape`, so each program's convention for media defined wider than tall survives a
+    /// round trip: AutoCAD stores a portrait size and a quarter turn, ZWCAD the media's own size
+    /// and no turn (#1463). `None` for page setups made in CADCraft.
+    #[serde(skip)]
+    pub file_paper: Option<(f64, f64, i64)>,
     /// The paper image origin (DXF groups 148/149, in plot paper units) as the file had it, so a
     /// save keeps where the sheet sits; `None` for a page CADCraft made, written as 0,0 (#2109).
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -824,6 +839,7 @@ impl Default for PageSetup {
             show_plot_styles: false,
             plot_transparency: false,
             paper_mm: false,
+            file_paper: None,
             image_origin: None,
         }
     }
@@ -863,7 +879,7 @@ pub struct NamedView {
     /// The layer state restored with the view (its layer snapshot).
     #[serde(default)]
     pub layer_state: Option<String>,
-    /// View twist (radians, counterclockwise); kept for files, not applied to the 2D display.
+    /// View twist (radians, counterclockwise); VIEW Restore applies it to the model space view.
     #[serde(default)]
     pub twist: f64,
     /// The layout a paper space view belongs to (`None`: a model space view; an empty name: a
@@ -884,6 +900,9 @@ pub struct VportTile {
     /// Width / height of the tile on screen when it was saved (0: unknown).
     #[serde(default)]
     pub aspect: f64,
+    /// The tile's view twist (radians, counterclockwise; DXF VPORT group 51 in degrees).
+    #[serde(default)]
+    pub twist: f64,
 }
 
 /// A model space viewport configuration (VPORTS): `*Active` is the one shown, other names are

crates/doc/src/tests.rs

@@ -189,6 +189,7 @@ fn inserts_of_missing_or_empty_blocks_do_not_stretch_extents() {
             rows: 1,
             col_spacing: 0.0,
             row_spacing: 0.0,
+            clip: None,
         })
     };
     d.blocks.insert("Empty".into(), std::sync::Arc::new(Block::new("Empty")));
@@ -242,6 +243,7 @@ fn visible_attributes_of_a_missing_block_still_count() {
                 rows: 1,
                 col_spacing: 0.0,
                 row_spacing: 0.0,
+                clip: None,
             }),
         )
     };
@@ -285,6 +287,7 @@ fn insert_bounds_with_cyclic_block_terminate() {
             rows: 1,
             col_spacing: 0.0,
             row_spacing: 0.0,
+            clip: None,
         }),
     ));
     b.entities.push(Entity::new(Handle(2), line((0.0, 0.0), (1.0, 1.0))));
@@ -303,6 +306,7 @@ fn insert_bounds_with_cyclic_block_terminate() {
                 rows: 1,
                 col_spacing: 0.0,
                 row_spacing: 0.0,
+                clip: None,
             }),
         )
         .unwrap();
@@ -420,6 +424,7 @@ fn plain_insert(block: &str) -> EntityKind {
         rows: 1,
         col_spacing: 0.0,
         row_spacing: 0.0,
+        clip: None,
     })
 }
 
@@ -709,3 +714,14 @@ fn space_names_its_tab() {
     assert_eq!(p.layout(), Some("Sheet A"));
     assert_eq!(p.tab_name(), "Sheet A");
 }
+
+/// Several spellings of one DIM field apply once, the last in the map's order, and none is rejected.
+#[test]
+fn dim_style_spellings_of_one_field_apply_once() {
+    let mut st = DimStyle::default();
+    let m = serde_json::json!({ "textHeight": 2.5, "TEXTHEIGHT": 3.5, "DIMTXT": 4.5 });
+    let m = m.as_object().unwrap();
+    let want = m.values().next_back().and_then(serde_json::Value::as_f64).unwrap();
+    assert!(st.apply_fields(m).is_empty());
+    assert_eq!(st.text_height, want);
+}

crates/doc/src/xclip.rs

@@ -0,0 +1,85 @@
+//! XCLIP: the clipping boundary of one block or xref reference.
+//!
+//! The boundary is kept in the referenced block's coordinates, so it moves, rotates and scales
+//! with its reference; the block definition and other references to it are untouched. In a file
+//! it is the reference's `ACAD_FILTER` / `SPATIAL` extension-dictionary entry (a SPATIAL_FILTER
+//! object, DXF Reference), read and written by the io crate.
+
+use cadcraft_geom::Vec2;
+use serde::{Deserialize, Serialize};
+
+/// Most boundary vertices a clip keeps (hostile files and parameters are capped to this).
+pub const MAX_CLIP_VERTICES: usize = 4096;
+
+/// A reference's clipping boundary.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ClipBoundary {
+    /// Vertices in the block's coordinates: two opposite corners for a rectangle, three or more
+    /// for a closed polygon (not repeating the first vertex).
+    pub points: Vec<Vec2>,
+    /// Whether clipping is on (XCLIP ON/OFF); an off boundary is kept but nothing is clipped.
+    #[serde(default = "on")]
+    pub enabled: bool,
+    /// Inverted clip: what is inside the boundary is hidden, what is outside shows.
+    #[serde(default)]
+    pub inverted: bool,
+}
+
+fn on() -> bool {
+    true
+}
+
+impl ClipBoundary {
+    /// A boundary from `points` (block coordinates), on and not inverted.
+    pub fn new(points: Vec<Vec2>) -> Self {
+        ClipBoundary { points, enabled: true, inverted: false }
+    }
+
+    /// The closed outline in block coordinates: a rectangle's four corners or the polygon's
+    /// vertices. Empty when the boundary has fewer than two vertices, more than
+    /// [`MAX_CLIP_VERTICES`] or a non-finite one.
+    pub fn polygon(&self) -> Vec<Vec2> {
+        if self.points.len() > MAX_CLIP_VERTICES || !self.points.iter().all(|p| p.is_finite()) {
+            return Vec::new();
+        }
+        match self.points.as_slice() {
+            [a, b] => vec![
+                Vec2::new(a.x.min(b.x), a.y.min(b.y)),
+                Vec2::new(a.x.max(b.x), a.y.min(b.y)),
+                Vec2::new(a.x.max(b.x), a.y.max(b.y)),
+                Vec2::new(a.x.min(b.x), a.y.max(b.y)),
+            ],
+            [_, _, _, ..] => self.points.clone(),
+            _ => Vec::new(),
+        }
+    }
+
+    /// Whether the boundary is a rectangle given by two corners.
+    pub fn is_rectangle(&self) -> bool {
+        self.points.len() == 2
+    }
+
+    /// Whether drawing the reference is clipped by it now (on, with a usable outline).
+    pub fn active(&self) -> bool {
+        self.enabled && self.polygon().len() >= 3
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rectangle_and_polygon_outlines() {
+        let r = ClipBoundary::new(vec![Vec2::new(2.0, 3.0), Vec2::new(0.0, 0.0)]);
+        assert_eq!(r.polygon(), vec![Vec2::new(0.0, 0.0), Vec2::new(2.0, 0.0), Vec2::new(2.0, 3.0), Vec2::new(0.0, 3.0)]);
+        assert!(r.active() && r.is_rectangle());
+        let bad = ClipBoundary::new(vec![Vec2::new(f64::NAN, 0.0), Vec2::new(1.0, 1.0)]);
+        assert!(bad.polygon().is_empty() && !bad.active());
+        let one = ClipBoundary::new(vec![Vec2::ZERO]);
+        assert!(!one.active());
+        let off = ClipBoundary { enabled: false, ..r };
+        assert!(!off.active());
+    }
+}

crates/dwg/Cargo.toml

@@ -1,16 +0,0 @@
-[package]
-name = "cadcraft-dwg"
-description = "CADCraft DWG bridge: converts DWG to and from DXF bytes using the acadrust crate (MPL-2.0, used unmodified)"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-
-[lints]
-workspace = true
-
-# The same targets as build.rs's `no_dwg_bridge` leave acadrust out: wasm32, and FreeBSD aarch64,
-# where acadrust 0.6.6 passes a `*const c_char` (u8 there) to its own `*const i8` sysctlbyname.
-# 0.6.7 and 0.6.8 fix that but read some damaged DWGs as empty with no note (tests.rs, #800).
-[target.'cfg(not(any(target_arch = "wasm32", all(target_os = "freebsd", target_arch = "aarch64"))))'.dependencies]
-# MPL-2.0: used as an unmodified dependency only (see plan/adr/0001 and NOTICE).
-acadrust = "0.6.6"

crates/dwg/build.rs

@@ -1,12 +0,0 @@
-//! Sets `no_dwg_bridge` on the targets built without acadrust (see Cargo.toml): the DWG functions
-//! there return an error that says to use DXF.
-
-fn main() {
-    println!("cargo:rerun-if-changed=build.rs");
-    println!("cargo::rustc-check-cfg=cfg(no_dwg_bridge)");
-    let arch = std::env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();
-    let os = std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
-    if arch == "wasm32" || (os == "freebsd" && arch == "aarch64") {
-        println!("cargo::rustc-cfg=no_dwg_bridge");
-    }
-}

crates/dxf/Cargo.toml

@@ -1,14 +0,0 @@
-[package]
-name = "cadcraft-dxf"
-description = "Standalone DXF tag reader/writer (ASCII and binary, pre-2007 code pages), from the published DXF reference"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-
-[lints]
-workspace = true
-
-[dependencies]
-thiserror = { workspace = true }
-log = { workspace = true }
-encoding_rs = { workspace = true }

crates/dxf/src/codepage.rs

@@ -1,330 +0,0 @@
-//! Text decoding for DXF files.
-//!
-//! R2007 (AC1021) and later DXF files are UTF-8. Older ones store text in the code page named by
-//! the `$DWGCODEPAGE` header variable (`ANSI_1252`, `ANSI_932`, `DOS850`, …); characters outside
-//! it are written as `\U+XXXX` (any character) or `\M+nXXXX` (a double-byte character of an East
-//! Asian code page) escapes, which [`crate::parse`] decodes after the bytes.
-//!
-//! The Windows, ISO and East Asian code pages are decoded with `encoding_rs`; DOS 437, 850 and
-//! 852 with the tables below (the upper halves of the IBM PC code pages; the lower halves are
-//! ASCII). Decoding never fails: a byte sequence that is invalid in the code page (a truncated
-//! double-byte character, an unassigned byte) becomes U+FFFD and the bytes after it decode
-//! normally, so line ends and the group structure survive.
-
-use std::borrow::Cow;
-
-use encoding_rs::Encoding;
-
-/// How the bytes of a code page become text.
-#[derive(Clone, Copy, Debug)]
-pub(crate) enum Decoder {
-    Utf8,
-    Encoding(&'static Encoding),
-    /// Single-byte DOS code page: ASCII, then these 128 characters for bytes 0x80–0xFF.
-    Table(&'static [char; 128]),
-}
-
-/// The decoder for a `$DWGCODEPAGE` value (case-insensitive), or `None` when CADCraft doesn't
-/// know the code page.
-pub(crate) fn decoder(code_page: &str) -> Option<Decoder> {
-    use encoding_rs as e;
-    let name = code_page.trim().to_ascii_uppercase().replace(['-', ' '], "_");
-    let enc = match name.as_str() {
-        "UTF8" | "UTF_8" | "UNICODE" => return Some(Decoder::Utf8),
-        "ASCII" | "ANSI_1252" | "ISO8859_1" | "ISO_8859_1" => e::WINDOWS_1252,
-        "ANSI_874" => e::WINDOWS_874,
-        "ANSI_932" | "DOS932" | "SHIFT_JIS" => e::SHIFT_JIS,
-        "ANSI_936" | "GB2312" | "GBK" => e::GBK,
-        "ANSI_949" | "KSC5601" | "KOREAN" => e::EUC_KR,
-        "ANSI_950" | "BIG5" => e::BIG5,
-        "ANSI_1250" => e::WINDOWS_1250,
-        "ANSI_1251" => e::WINDOWS_1251,
-        "ANSI_1253" => e::WINDOWS_1253,
-        "ANSI_1254" | "ISO8859_9" | "ISO_8859_9" => e::WINDOWS_1254,
-        "ANSI_1255" => e::WINDOWS_1255,
-        "ANSI_1256" => e::WINDOWS_1256,
-        "ANSI_1257" => e::WINDOWS_1257,
-        "ANSI_1258" => e::WINDOWS_1258,
-        "ISO8859_2" | "ISO_8859_2" => e::ISO_8859_2,
-        "ISO8859_3" | "ISO_8859_3" => e::ISO_8859_3,
-        "ISO8859_4" | "ISO_8859_4" => e::ISO_8859_4,
-        "ISO8859_5" | "ISO_8859_5" => e::ISO_8859_5,
-        "ISO8859_6" | "ISO_8859_6" => e::ISO_8859_6,
-        "ISO8859_7" | "ISO_8859_7" => e::ISO_8859_7,
-        "ISO8859_8" | "ISO_8859_8" => e::ISO_8859_8,
-        "DOS866" => e::IBM866,
-        "MACINTOSH" | "MAC_ROMAN" => e::MACINTOSH,
-        "DOS437" => return Some(Decoder::Table(&DOS437)),
-        "DOS850" => return Some(Decoder::Table(&DOS850)),
-        "DOS852" => return Some(Decoder::Table(&DOS852)),
-        _ => return None,
-    };
-    Some(Decoder::Encoding(enc))
-}
-
-/// Decode `bytes` from the code page `code_page` names (a `$DWGCODEPAGE` value such as
-/// `ANSI_1251`), or `None` when CADCraft doesn't know that code page. Invalid sequences become
-/// U+FFFD; escapes (`\U+XXXX`, `\M+nXXXX`) are left as they are.
-pub fn decode_code_page(bytes: &[u8], code_page: &str) -> Option<String> {
-    decoder(code_page).map(|d| decode(bytes, d).into_owned())
-}
-
-/// The code page a pre-2007 file's text is written in, or `None` for pure ASCII with escapes:
-/// when CADCraft doesn't know `code_page`, and for `ASCII` (the reader takes such files as
-/// Windows-1252, but a writer must keep them ASCII) and `UTF8`/`UNICODE`, which no pre-2007
-/// reader expects.
-pub(crate) fn encoder(code_page: &str) -> Option<Decoder> {
-    if code_page.trim().eq_ignore_ascii_case("ASCII") {
-        return None;
-    }
-    decoder(code_page).filter(|d| !matches!(d, Decoder::Utf8))
-}
-
-/// Append the bytes of the non-ASCII character `c` in the code page `d`, and return true, when
-/// the code page has it; otherwise append nothing and return false (the caller escapes it).
-pub(crate) fn encode_char(c: char, d: Decoder, out: &mut Vec<u8>) -> bool {
-    let mut buf = [0; 4];
-    match d {
-        // Not a pre-2007 code page ([`encoder`] never gives it): escaped.
-        Decoder::Utf8 => return false,
-        Decoder::Encoding(e) => {
-            let (bytes, _, unmappable) = e.encode(c.encode_utf8(&mut buf));
-            // A code page byte that is ASCII would read back as another character, and a NUL,
-            // CR or LF would break the group, so only all-high-bit sequences or proper double-byte
-            // characters are kept (their trail byte may be ASCII, as in Shift-JIS).
-            if unmappable || bytes.is_empty() || !bytes.first().is_some_and(|b| *b >= 0x80) || bytes.iter().any(|b| matches!(b, 0 | b'\r' | b'\n')) {
-                return false;
-            }
-            out.extend_from_slice(&bytes);
-        }
-        Decoder::Table(t) => {
-            let Some(i) = t.iter().position(|&x| x == c).and_then(|i| u8::try_from(i).ok()) else { return false };
-            out.push(0x80 | i);
-        }
-    }
-    true
-}
-
-/// Decode bytes with a decoder. UTF-8 that isn't valid falls back to Windows-1252.
-pub(crate) fn decode(bytes: &[u8], d: Decoder) -> Cow<'_, str> {
-    match d {
-        Decoder::Utf8 => match std::str::from_utf8(bytes) {
-            Ok(s) => Cow::Borrowed(s),
-            Err(_) => encoding_rs::WINDOWS_1252.decode_without_bom_handling(bytes).0,
-        },
-        Decoder::Encoding(e) => e.decode_without_bom_handling(bytes).0,
-        Decoder::Table(t) => match std::str::from_utf8(bytes) {
-            Ok(s) if s.is_ascii() => Cow::Borrowed(s),
-            _ => Cow::Owned(
-                bytes
-                    .iter()
-                    .map(|&b| if b.is_ascii() { char::from(b) } else { t.get(usize::from(b & 0x7F)).copied().unwrap_or('\u{FFFD}') })
-                    .collect(),
-            ),
-        },
-    }
-}
-
-/// The `$DWGCODEPAGE` value of an ASCII DXF file: the line two lines after a `$DWGCODEPAGE`
-/// line (the group code `3` between them), looked for in the HEADER section only (the scan stops
-/// at the first `ENDSEC`). Works on the raw bytes, before they are decoded.
-fn ascii_code_page(bytes: &[u8]) -> Option<&[u8]> {
-    let mut lines = bytes.split(|&b| b == b'\n').map(<[u8]>::trim_ascii);
-    while let Some(line) = lines.next() {
-        if line == b"ENDSEC" {
-            return None;
-        }
-        if line.eq_ignore_ascii_case(b"$DWGCODEPAGE") {
-            return match (lines.next(), lines.next()) {
-                (Some(b"3"), Some(value)) => Some(value),
-                _ => None,
-            };
-        }
-    }
-    None
-}
-
-/// Decode a whole ASCII DXF file. Valid UTF-8 is read as UTF-8: R2007+ files, pure-ASCII files,
-/// and older files from writers that ignored the code page. Anything else is decoded from the
-/// file's `$DWGCODEPAGE`, or from Windows-1252 (the usual `ANSI_1252`) when the header has none
-/// or names a code page CADCraft doesn't know, which is logged as a warning.
-pub(crate) fn decode_ascii_file(bytes: &[u8]) -> Cow<'_, str> {
-    if let Ok(s) = std::str::from_utf8(bytes) {
-        return Cow::Borrowed(s);
-    }
-    let d = match ascii_code_page(bytes) {
-        Some(name) => {
-            let name = String::from_utf8_lossy(name);
-            decoder(&name).unwrap_or_else(|| {
-                log::warn!("DXF: unknown code page `{name}`; reading the text as ANSI_1252");
-                Decoder::Utf8
-            })
-        }
-        None => Decoder::Utf8,
-    };
-    decode(bytes, d)
-}
-
-/// The text state of a binary DXF file, learnt from its header as the tags go by: `$ACADVER`
-/// (R2007+ strings are UTF-8) and `$DWGCODEPAGE` (the code page of older files). Both come
-/// first in the HEADER section and are ASCII, so every later string is decoded right.
-#[derive(Default)]
-pub(crate) struct BinaryText {
-    /// The header variable whose value comes next (after a group 9).
-    var: Option<HeaderVar>,
-    utf8: bool,
-    code_page: Option<Decoder>,
-}
-
-#[derive(Clone, Copy, PartialEq)]
-enum HeaderVar {
-    AcadVer,
-    CodePage,
-}
-
-impl BinaryText {
-    /// Decode one string value of group `code` and update the state from it. Strings of R2007+
-    /// files, and of files without a code page, are UTF-8 when valid (else Windows-1252); older
-    /// files' strings are in their code page.
-    pub(crate) fn string(&mut self, code: i32, raw: &[u8]) -> String {
-        let d = if self.utf8 { Decoder::Utf8 } else { self.code_page.unwrap_or(Decoder::Utf8) };
-        let s = decode(raw, d).into_owned();
-        match (code, self.var.take()) {
-            (9, _) => {
-                self.var = match s.trim() {
-                    "$ACADVER" => Some(HeaderVar::AcadVer),
-                    "$DWGCODEPAGE" => Some(HeaderVar::CodePage),
-                    _ => None,
-                }
-            }
-            (1, Some(HeaderVar::AcadVer)) => self.utf8 = is_utf8_version(&s),
-            (3, Some(HeaderVar::CodePage)) => {
-                self.code_page = decoder(&s);
-                if self.code_page.is_none() {
-                    log::warn!("DXF: unknown code page `{}`; reading the text as ANSI_1252", s.trim());
-                }
-            }
-            _ => {}
-        }
-        s
-    }
-}
-
-/// True for an `$ACADVER` of R2007 (AC1021) or later, whose text is UTF-8.
-fn is_utf8_version(acadver: &str) -> bool {
-    acadver.trim().strip_prefix("AC").and_then(|n| n.parse::<u32>().ok()).is_some_and(|n| n >= 1021)
-}
-
-/// The double-byte code page of a `\M+n` escape: 1 Japanese (Shift-JIS), 2 Traditional Chinese
-/// (Big5), 3 Korean (Wansung), 5 Simplified Chinese (GB 2312). 4 (Korean Johab) is not
-/// supported, so its escapes stay literal.
-pub(crate) fn mif_encoding(n: char) -> Option<&'static Encoding> {
-    match n {
-        '1' => Some(encoding_rs::SHIFT_JIS),
-        '2' => Some(encoding_rs::BIG5),
-        '3' => Some(encoding_rs::EUC_KR),
-        '5' => Some(encoding_rs::GBK),
-        _ => None,
-    }
-}
-
-// Generated from the IBM PC code page definitions (bytes 0x80–0xFF in order).
-const DOS437: [char; 128] = [
-    '\u{00C7}', '\u{00FC}', '\u{00E9}', '\u{00E2}', '\u{00E4}', '\u{00E0}', '\u{00E5}', '\u{00E7}', '\u{00EA}', '\u{00EB}', '\u{00E8}', '\u{00EF}',
-    '\u{00EE}', '\u{00EC}', '\u{00C4}', '\u{00C5}', '\u{00C9}', '\u{00E6}', '\u{00C6}', '\u{00F4}', '\u{00F6}', '\u{00F2}', '\u{00FB}', '\u{00F9}',
-    '\u{00FF}', '\u{00D6}', '\u{00DC}', '\u{00A2}', '\u{00A3}', '\u{00A5}', '\u{20A7}', '\u{0192}', '\u{00E1}', '\u{00ED}', '\u{00F3}', '\u{00FA}',
-    '\u{00F1}', '\u{00D1}', '\u{00AA}', '\u{00BA}', '\u{00BF}', '\u{2310}', '\u{00AC}', '\u{00BD}', '\u{00BC}', '\u{00A1}', '\u{00AB}', '\u{00BB}',
-    '\u{2591}', '\u{2592}', '\u{2593}', '\u{2502}', '\u{2524}', '\u{2561}', '\u{2562}', '\u{2556}', '\u{2555}', '\u{2563}', '\u{2551}', '\u{2557}',
-    '\u{255D}', '\u{255C}', '\u{255B}', '\u{2510}', '\u{2514}', '\u{2534}', '\u{252C}', '\u{251C}', '\u{2500}', '\u{253C}', '\u{255E}', '\u{255F}',
-    '\u{255A}', '\u{2554}', '\u{2569}', '\u{2566}', '\u{2560}', '\u{2550}', '\u{256C}', '\u{2567}', '\u{2568}', '\u{2564}', '\u{2565}', '\u{2559}',
-    '\u{2558}', '\u{2552}', '\u{2553}', '\u{256B}', '\u{256A}', '\u{2518}', '\u{250C}', '\u{2588}', '\u{2584}', '\u{258C}', '\u{2590}', '\u{2580}',
-    '\u{03B1}', '\u{00DF}', '\u{0393}', '\u{03C0}', '\u{03A3}', '\u{03C3}', '\u{00B5}', '\u{03C4}', '\u{03A6}', '\u{0398}', '\u{03A9}', '\u{03B4}',
-    '\u{221E}', '\u{03C6}', '\u{03B5}', '\u{2229}', '\u{2261}', '\u{00B1}', '\u{2265}', '\u{2264}', '\u{2320}', '\u{2321}', '\u{00F7}', '\u{2248}',
-    '\u{00B0}', '\u{2219}', '\u{00B7}', '\u{221A}', '\u{207F}', '\u{00B2}', '\u{25A0}', '\u{00A0}',
-];
-const DOS850: [char; 128] = [
-    '\u{00C7}', '\u{00FC}', '\u{00E9}', '\u{00E2}', '\u{00E4}', '\u{00E0}', '\u{00E5}', '\u{00E7}', '\u{00EA}', '\u{00EB}', '\u{00E8}', '\u{00EF}',
-    '\u{00EE}', '\u{00EC}', '\u{00C4}', '\u{00C5}', '\u{00C9}', '\u{00E6}', '\u{00C6}', '\u{00F4}', '\u{00F6}', '\u{00F2}', '\u{00FB}', '\u{00F9}',
-    '\u{00FF}', '\u{00D6}', '\u{00DC}', '\u{00F8}', '\u{00A3}', '\u{00D8}', '\u{00D7}', '\u{0192}', '\u{00E1}', '\u{00ED}', '\u{00F3}', '\u{00FA}',
-    '\u{00F1}', '\u{00D1}', '\u{00AA}', '\u{00BA}', '\u{00BF}', '\u{00AE}', '\u{00AC}', '\u{00BD}', '\u{00BC}', '\u{00A1}', '\u{00AB}', '\u{00BB}',
-    '\u{2591}', '\u{2592}', '\u{2593}', '\u{2502}', '\u{2524}', '\u{00C1}', '\u{00C2}', '\u{00C0}', '\u{00A9}', '\u{2563}', '\u{2551}', '\u{2557}',
-    '\u{255D}', '\u{00A2}', '\u{00A5}', '\u{2510}', '\u{2514}', '\u{2534}', '\u{252C}', '\u{251C}', '\u{2500}', '\u{253C}', '\u{00E3}', '\u{00C3}',
-    '\u{255A}', '\u{2554}', '\u{2569}', '\u{2566}', '\u{2560}', '\u{2550}', '\u{256C}', '\u{00A4}', '\u{00F0}', '\u{00D0}', '\u{00CA}', '\u{00CB}',
-    '\u{00C8}', '\u{0131}', '\u{00CD}', '\u{00CE}', '\u{00CF}', '\u{2518}', '\u{250C}', '\u{2588}', '\u{2584}', '\u{00A6}', '\u{00CC}', '\u{2580}',
-    '\u{00D3}', '\u{00DF}', '\u{00D4}', '\u{00D2}', '\u{00F5}', '\u{00D5}', '\u{00B5}', '\u{00FE}', '\u{00DE}', '\u{00DA}', '\u{00DB}', '\u{00D9}',
-    '\u{00FD}', '\u{00DD}', '\u{00AF}', '\u{00B4}', '\u{00AD}', '\u{00B1}', '\u{2017}', '\u{00BE}', '\u{00B6}', '\u{00A7}', '\u{00F7}', '\u{00B8}',
-    '\u{00B0}', '\u{00A8}', '\u{00B7}', '\u{00B9}', '\u{00B3}', '\u{00B2}', '\u{25A0}', '\u{00A0}',
-];
-const DOS852: [char; 128] = [
-    '\u{00C7}', '\u{00FC}', '\u{00E9}', '\u{00E2}', '\u{00E4}', '\u{016F}', '\u{0107}', '\u{00E7}', '\u{0142}', '\u{00EB}', '\u{0150}', '\u{0151}',
-    '\u{00EE}', '\u{0179}', '\u{00C4}', '\u{0106}', '\u{00C9}', '\u{0139}', '\u{013A}', '\u{00F4}', '\u{00F6}', '\u{013D}', '\u{013E}', '\u{015A}',
-    '\u{015B}', '\u{00D6}', '\u{00DC}', '\u{0164}', '\u{0165}', '\u{0141}', '\u{00D7}', '\u{010D}', '\u{00E1}', '\u{00ED}', '\u{00F3}', '\u{00FA}',
-    '\u{0104}', '\u{0105}', '\u{017D}', '\u{017E}', '\u{0118}', '\u{0119}', '\u{00AC}', '\u{017A}', '\u{010C}', '\u{015F}', '\u{00AB}', '\u{00BB}',
-    '\u{2591}', '\u{2592}', '\u{2593}', '\u{2502}', '\u{2524}', '\u{00C1}', '\u{00C2}', '\u{011A}', '\u{015E}', '\u{2563}', '\u{2551}', '\u{2557}',
-    '\u{255D}', '\u{017B}', '\u{017C}', '\u{2510}', '\u{2514}', '\u{2534}', '\u{252C}', '\u{251C}', '\u{2500}', '\u{253C}', '\u{0102}', '\u{0103}',
-    '\u{255A}', '\u{2554}', '\u{2569}', '\u{2566}', '\u{2560}', '\u{2550}', '\u{256C}', '\u{00A4}', '\u{0111}', '\u{0110}', '\u{010E}', '\u{00CB}',
-    '\u{010F}', '\u{0147}', '\u{00CD}', '\u{00CE}', '\u{011B}', '\u{2518}', '\u{250C}', '\u{2588}', '\u{2584}', '\u{0162}', '\u{016E}', '\u{2580}',
-    '\u{00D3}', '\u{00DF}', '\u{00D4}', '\u{0143}', '\u{0144}', '\u{0148}', '\u{0160}', '\u{0161}', '\u{0154}', '\u{00DA}', '\u{0155}', '\u{0170}',
-    '\u{00FD}', '\u{00DD}', '\u{0163}', '\u{00B4}', '\u{00AD}', '\u{02DD}', '\u{02DB}', '\u{02C7}', '\u{02D8}', '\u{00A7}', '\u{00F7}', '\u{00B8}',
-    '\u{00B0}', '\u{00A8}', '\u{02D9}', '\u{0171}', '\u{0158}', '\u{0159}', '\u{25A0}', '\u{00A0}',
-];
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn code_page_names() {
-        let d = |bytes: &[u8], cp: &str| decode_code_page(bytes, cp);
-        assert_eq!(d(b"\xCF\xF0\xE8\xE2\xE5\xF2", "ANSI_1251").as_deref(), Some("Привет"));
-        assert_eq!(d(b"\xCF\xF0\xE8\xE2\xE5\xF2", " ansi_1251 ").as_deref(), Some("Привет"));
-        assert_eq!(d(b"\x90\x7D\x96\xCA", "ANSI_932").as_deref(), Some("図面"));
-        assert_eq!(d(b"\xCD\xBC\xB2\xE3", "GB2312").as_deref(), Some("图层"));
-        assert_eq!(d(b"\xB9\xCF\xBC\x68", "BIG5").as_deref(), Some("圖層"));
-        assert_eq!(d(b"\xB5\xB5\xB8\xE9", "ANSI_949").as_deref(), Some("도면"));
-        assert_eq!(d(b"\xD3\xF7\xDD\xE4\xE9\xEF", "ANSI_1253").as_deref(), Some("Σχέδιο"));
-        assert_eq!(d(b"\xC0\xD2\xBE", "ANSI_874").as_deref(), Some("ภาพ"));
-        assert_eq!(d(b"\x80", "ANSI_1252").as_deref(), Some("€"));
-        // DOS 437 and 850 agree on letters but differ on 0x9B (¢ / ø).
-        assert_eq!(d(b"Gr\x94\xE1e \x9B", "DOS437").as_deref(), Some("Größe ¢"));
-        assert_eq!(d(b"Gr\x94\xE1e \x9B", "dos850").as_deref(), Some("Größe ø"));
-        assert_eq!(d(b"\xBD\xA2\x88w", "DOS852").as_deref(), Some("Żółw"));
-        assert_eq!(d(b"\x91\xAB\xAE\xA9", "DOS866").as_deref(), Some("Слой"));
-        assert_eq!(d("é".as_bytes(), "UTF8").as_deref(), Some("é"));
-        assert_eq!(d(b"x", "ANSI_1361"), None);
-        assert_eq!(d(b"x", "EBCDIC"), None);
-        assert_eq!(d(b"x", ""), None);
-    }
-
-    #[test]
-    fn invalid_sequences_become_replacement_characters() {
-        // A Shift-JIS lead byte cut off by the line end keeps the line end.
-        assert_eq!(decode_code_page(b"\x90\n1\n", "ANSI_932").as_deref(), Some("\u{FFFD}\n1\n"));
-        assert_eq!(decode_code_page(b"\x90", "ANSI_932").as_deref(), Some("\u{FFFD}"));
-        assert_eq!(decode_code_page(b"\xFF\xFF", "ANSI_936").as_deref(), Some("\u{FFFD}\u{FFFD}"));
-    }
-
-    #[test]
-    fn header_scan() {
-        let head = b"0\nSECTION\n2\nHEADER\n9\n$ACADVER\n1\nAC1015\n9\n$DWGCODEPAGE\n3\nANSI_1251\r\n0\nENDSEC\n";
-        assert_eq!(ascii_code_page(head), Some(&b"ANSI_1251"[..]));
-        // Only the HEADER section counts.
-        assert_eq!(ascii_code_page(b"0\nSECTION\n2\nHEADER\n0\nENDSEC\n9\n$DWGCODEPAGE\n3\nANSI_1251\n"), None);
-        // Wrong group code, or the file ends early.
-        assert_eq!(ascii_code_page(b"9\n$DWGCODEPAGE\n1\nANSI_1251\n"), None);
-        assert_eq!(ascii_code_page(b"9\n$DWGCODEPAGE\n3"), None);
-        assert!(is_utf8_version("AC1021") && is_utf8_version(" AC1032 "));
-        assert!(!is_utf8_version("AC1018") && !is_utf8_version("AC1009") && !is_utf8_version("garbage"));
-    }
-
-    #[test]
-    fn mif_escapes() {
-        let one = |s: &str| crate::parse(format!("1\n{s}\n0\nEOF\n").as_bytes()).unwrap()[0].str();
-        assert_eq!(one("\\M+5BCFE\\M+1907D\\M+2B9CF\\M+3B5B5!"), "件図圖도!");
-        assert_eq!(one("\\M+5BCFE\\U+0021"), "件!");
-        // Johab, unknown code pages, bad hex, short escapes and unassigned codes stay literal.
-        for s in ["\\M+4ABCD", "\\M+9BCFE", "\\M+5GGGG", "\\M+5BC", "\\M+", "\\M+50041", "\\M+5FFFF"] {
-            assert_eq!(one(s), s);
-        }
-    }
-}

crates/dxf/src/lib.rs

@@ -1,779 +0,0 @@
-//! A standalone DXF tag reader and writer.
-//!
-//! DXF is a sequence of (group code, value) pairs. This crate parses ASCII and binary DXF into a
-//! flat list of [`Tag`]s, splits them into sections and entities, and writes tags back. Mapping
-//! tags to a drawing model is left to the caller. Written from Autodesk's published DXF
-//! Reference; depends on nothing else in the workspace.
-#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
-#![forbid(unsafe_code)]
-
-use std::fmt::Write as _;
-use std::io::Write as _;
-
-mod version;
-pub use version::Version;
-
-#[derive(Debug, thiserror::Error)]
-pub enum DxfError {
-    #[error("not a DXF file")]
-    NotDxf,
-    #[error("line {line}: bad group code `{text}`")]
-    BadCode { line: usize, text: String },
-    #[error("unexpected end of file")]
-    Eof,
-    /// More group codes than [`MAX_TAGS`]: `tags` is the count found (or the count read when the
-    /// limit was reached), `limit` the maximum.
-    #[error("drawing too large: {tags} DXF group codes, more than the {limit} CADCraft reads")]
-    TooLarge { tags: usize, limit: usize },
-}
-
-pub type Result<T> = std::result::Result<T, DxfError>;
-
-/// A typed group value.
-#[derive(Clone, Debug, PartialEq)]
-pub enum Value {
-    Str(String),
-    Real(f64),
-    Int(i64),
-    Bool(bool),
-    /// Binary chunk (310–319, 1004) as hex text.
-    Hex(String),
-}
-
-impl Value {
-    pub fn as_str(&self) -> String {
-        match self {
-            Value::Str(s) | Value::Hex(s) => s.clone(),
-            Value::Real(r) => format_real(*r),
-            Value::Int(i) => i.to_string(),
-            Value::Bool(b) => i64::from(*b).to_string(),
-        }
-    }
-    pub fn as_f64(&self) -> f64 {
-        match self {
-            Value::Real(r) if r.is_finite() => *r,
-            Value::Int(i) => *i as f64,
-            Value::Str(s) => s.trim().parse::<f64>().ok().filter(|v| v.is_finite()).unwrap_or(0.0),
-            Value::Bool(b) => f64::from(u8::from(*b)),
-            _ => 0.0,
-        }
-    }
-    pub fn as_i64(&self) -> i64 {
-        match self {
-            Value::Int(i) => *i,
-            Value::Real(r) if r.is_finite() => *r as i64,
-            Value::Str(s) => s.trim().parse::<i64>().unwrap_or_else(|_| s.trim().parse::<f64>().map(|f| f as i64).unwrap_or(0)),
-            Value::Bool(b) => i64::from(*b),
-            _ => 0,
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct Tag {
-    pub code: i32,
-    pub value: Value,
-}
-
-impl Tag {
-    pub fn new(code: i32, value: Value) -> Self {
-        Tag { code, value }
-    }
-    pub fn s(code: i32, v: impl Into<String>) -> Self {
-        Tag { code, value: Value::Str(v.into()) }
-    }
-    pub fn f(code: i32, v: f64) -> Self {
-        Tag { code, value: Value::Real(if v.is_finite() { v } else { 0.0 }) }
-    }
-    pub fn i(code: i32, v: i64) -> Self {
-        Tag { code, value: Value::Int(v) }
-    }
-    pub fn str(&self) -> String {
-        self.value.as_str()
-    }
-    pub fn f64(&self) -> f64 {
-        self.value.as_f64()
-    }
-    pub fn i64(&self) -> i64 {
-        self.value.as_i64()
-    }
-}
-
-/// The value type for a group code (DXF Reference, "Group Code Value Types").
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Kind {
-    Str,
-    Real,
-    Int16,
-    Int32,
-    Int64,
-    Bool,
-    Hex,
-}
-
-pub fn kind_of(code: i32) -> Kind {
-    match code {
-        0..=9 => Kind::Str,
-        10..=59 => Kind::Real,
-        60..=79 => Kind::Int16,
-        90..=99 => Kind::Int32,
-        100..=109 => Kind::Str,
-        110..=149 => Kind::Real,
-        160..=169 => Kind::Int64,
-        170..=179 => Kind::Int16,
-        210..=239 => Kind::Real,
-        270..=289 => Kind::Int16,
-        290..=299 => Kind::Bool,
-        300..=309 => Kind::Str,
-        310..=319 => Kind::Hex,
-        320..=369 => Kind::Str,
-        370..=389 => Kind::Int16,
-        390..=399 => Kind::Str,
-        400..=409 => Kind::Int16,
-        410..=419 => Kind::Str,
-        420..=429 => Kind::Int32,
-        430..=439 => Kind::Str,
-        440..=449 => Kind::Int32,
-        450..=459 => Kind::Int32,
-        460..=469 => Kind::Real,
-        470..=479 => Kind::Str,
-        480..=481 => Kind::Str,
-        999 => Kind::Str,
-        1000..=1003 => Kind::Str,
-        1004 => Kind::Hex,
-        1005..=1009 => Kind::Str,
-        1010..=1059 => Kind::Real,
-        1060..=1070 => Kind::Int16,
-        1071 => Kind::Int32,
-        _ => Kind::Str,
-    }
-}
-
-fn typed(code: i32, text: &str) -> Value {
-    let t = text.trim();
-    match kind_of(code) {
-        Kind::Real => t.parse::<f64>().ok().filter(|v| v.is_finite()).map(Value::Real).unwrap_or(Value::Real(0.0)),
-        Kind::Int16 | Kind::Int32 | Kind::Int64 => {
-            t.parse::<i64>().map(Value::Int).unwrap_or_else(|_| Value::Int(t.parse::<f64>().map(|f| f as i64).unwrap_or(0)))
-        }
-        Kind::Bool => Value::Bool(t.parse::<i64>().unwrap_or(0) != 0),
-        Kind::Hex => Value::Hex(t.to_string()),
-        Kind::Str => Value::Str(text.trim_end_matches(['\r', '\n']).to_string()),
-    }
-}
-
-const BINARY_SENTINEL: &[u8] = b"AutoCAD Binary DXF\r\n\x1a\0";
-/// Most group codes read from one file. A `Tag` takes 40 bytes plus its text, so this bounds the
-/// tag list to a few GB; real drawings stay far below (a 10 MB DWG is typically a few million).
-pub const MAX_TAGS: usize = 50_000_000;
-
-mod codepage;
-pub use codepage::decode_code_page;
-
-/// Parse a DXF file (ASCII or binary).
-pub fn parse(bytes: &[u8]) -> Result<Vec<Tag>> {
-    parse_with_limit(bytes, MAX_TAGS)
-}
-
-/// [`parse`] with an explicit group-code limit. For ASCII DXF the limit is checked up front from
-/// the line count, before the text is decoded or any tag allocated, so an oversized file fails in
-/// milliseconds instead of after it has filled memory.
-pub fn parse_with_limit(bytes: &[u8], max_tags: usize) -> Result<Vec<Tag>> {
-    if let Some(body) = bytes.strip_prefix(BINARY_SENTINEL) {
-        return parse_binary_with_limit(body, max_tags);
-    }
-    // Count nonblank group-code/value pairs, stopping at EOF just as the parser does.
-    let mut lines = bytes.split(|&b| b == b'\n');
-    let mut tags = 0;
-    while let Some(code) = lines.next() {
-        let code = code.trim_ascii();
-        if code.is_empty() {
-            continue;
-        }
-        let Some(value) = lines.next() else { break };
-        tags += 1;
-        if code == b"0" && value.trim_ascii() == b"EOF" {
-            break;
-        }
-    }
-    if tags > max_tags {
-        return Err(DxfError::TooLarge { tags, limit: max_tags });
-    }
-    parse_ascii_with_limit(&codepage::decode_ascii_file(bytes), max_tags)
-}
-
-/// The four hex digits of a `\U+XXXX` escape starting at `chars[i]`, if there is one.
-fn escape_at(chars: &[char], i: usize) -> Option<u32> {
-    if chars.get(i) != Some(&'\\') || chars.get(i + 1) != Some(&'U') || chars.get(i + 2) != Some(&'+') {
-        return None;
-    }
-    let hex = chars.get(i + 3..i + 7)?;
-    if !hex.iter().all(char::is_ascii_hexdigit) {
-        return None;
-    }
-    hex.iter().try_fold(0u32, |acc, c| Some(acc * 16 + c.to_digit(16)?))
-}
-
-/// The character of a `\M+nXXXX` escape starting at `chars[i]`, if there is one: `n` names a
-/// double-byte code page and `XXXX` is the character's two bytes in hex.
-fn mif_escape_at(chars: &[char], i: usize) -> Option<char> {
-    if chars.get(i) != Some(&'\\') || chars.get(i + 1) != Some(&'M') || chars.get(i + 2) != Some(&'+') {
-        return None;
-    }
-    let enc = codepage::mif_encoding(*chars.get(i + 3)?)?;
-    let hex = chars.get(i + 4..i + 8)?;
-    if !hex.iter().all(char::is_ascii_hexdigit) {
-        return None;
-    }
-    let code = hex.iter().try_fold(0u16, |acc, c| Some(acc * 16 + u16::try_from(c.to_digit(16)?).ok()?))?;
-    let bytes = code.to_be_bytes();
-    let text = enc.decode_without_bom_handling_and_without_replacement(&bytes)?;
-    let mut it = text.chars();
-    it.next().filter(|_| it.next().is_none())
-}
-
-/// Unescape the `\U+XXXX` sequences pre-R2007 DXF uses for characters outside the file's code
-/// page (four hex digits, one UTF-16 code unit; characters above U+FFFF are a surrogate pair of
-/// escapes), and the `\M+nXXXX` sequences for double-byte East Asian characters. Malformed
-/// escapes, unpaired surrogates and unknown `\M+` code pages are kept as literal text.
-fn unescape_unicode(s: &str) -> String {
-    if !s.contains("\\U+") && !s.contains("\\M+") {
-        return s.to_string();
-    }
-    let mut out = String::with_capacity(s.len());
-    let chars: Vec<char> = s.chars().collect();
-    let mut i = 0;
-    while let Some(&c) = chars.get(i) {
-        if let Some(ch) = mif_escape_at(&chars, i) {
-            out.push(ch);
-            i += 8;
-            continue;
-        }
-        if let Some(unit) = escape_at(&chars, i) {
-            if let Some(ch) = char::from_u32(unit) {
-                out.push(ch);
-                i += 7;
-                continue;
-            }
-            if (0xD800..0xDC00).contains(&unit)
-                && let Some(low) = escape_at(&chars, i + 7).filter(|u| (0xDC00..0xE000).contains(u))
-                && let Some(ch) = char::from_u32(0x10000 + ((unit - 0xD800) << 10) + (low - 0xDC00))
-            {
-                out.push(ch);
-                i += 14;
-                continue;
-            }
-        }
-        out.push(c);
-        i += 1;
-    }
-    out
-}
-
-pub fn parse_ascii(text: &str) -> Result<Vec<Tag>> {
-    parse_ascii_with_limit(text, MAX_TAGS)
-}
-
-#[allow(clippy::while_let_loop)]
-fn parse_ascii_with_limit(text: &str, max_tags: usize) -> Result<Vec<Tag>> {
-    let mut tags = Vec::new();
-    let mut lines = text.strip_prefix('\u{feff}').unwrap_or(text).lines().enumerate();
-    loop {
-        let Some((ln, code_line)) = lines.next() else { break };
-        let ct = code_line.trim();
-        if ct.is_empty() {
-            continue;
-        }
-        let code: i32 = ct.parse().map_err(|_| DxfError::BadCode { line: ln + 1, text: ct.chars().take(40).collect() })?;
-        let Some((_, val)) = lines.next() else { return Err(DxfError::Eof) };
-        let v = typed(code, val);
-        let v = match v {
-            Value::Str(s) => Value::Str(unescape_unicode(&s)),
-            o => o,
-        };
-        tags.push(Tag { code, value: v });
-        if tags.len() > max_tags {
-            return Err(DxfError::TooLarge { tags: tags.len(), limit: max_tags });
-        }
-        if code == 0 && tags.last().is_some_and(|t| t.str() == "EOF") {
-            break;
-        }
-    }
-    if tags.is_empty() {
-        return Err(DxfError::NotDxf);
-    }
-    Ok(tags)
-}
-
-struct Cur<'a> {
-    b: &'a [u8],
-    p: usize,
-}
-
-impl<'a> Cur<'a> {
-    fn take(&mut self, n: usize) -> Result<&[u8]> {
-        let end = self.p.checked_add(n).ok_or(DxfError::Eof)?;
-        let s = self.b.get(self.p..end).ok_or(DxfError::Eof)?;
-        self.p = end;
-        Ok(s)
-    }
-    fn u8(&mut self) -> Result<u8> {
-        Ok(*self.take(1)?.first().ok_or(DxfError::Eof)?)
-    }
-    fn i16(&mut self) -> Result<i16> {
-        let s = self.take(2)?;
-        Ok(i16::from_le_bytes([s[0], s[1]]))
-    }
-    fn i32(&mut self) -> Result<i32> {
-        let s = self.take(4)?;
-        Ok(i32::from_le_bytes([s[0], s[1], s[2], s[3]]))
-    }
-    fn i64(&mut self) -> Result<i64> {
-        let s = self.take(8)?;
-        let mut a = [0u8; 8];
-        a.copy_from_slice(s);
-        Ok(i64::from_le_bytes(a))
-    }
-    fn f64(&mut self) -> Result<f64> {
-        let s = self.take(8)?;
-        let mut a = [0u8; 8];
-        a.copy_from_slice(s);
-        Ok(f64::from_le_bytes(a))
-    }
-    /// The bytes of a zero-terminated string (without the zero), decoded by the caller.
-    fn cstr(&mut self) -> Result<&'a [u8]> {
-        let start = self.p;
-        while self.p < self.b.len() && self.b.get(self.p) != Some(&0) {
-            self.p += 1;
-        }
-        let s = self.b.get(start..self.p).unwrap_or(&[]);
-        if self.p >= self.b.len() {
-            return Err(DxfError::Eof);
-        }
-        self.p += 1;
-        Ok(s)
-    }
-}
-
-/// Binary DXF (R13+: 2-byte group codes).
-pub fn parse_binary(b: &[u8]) -> Result<Vec<Tag>> {
-    parse_binary_with_limit(b, MAX_TAGS)
-}
-
-fn parse_binary_with_limit(b: &[u8], max_tags: usize) -> Result<Vec<Tag>> {
-    let mut c = Cur { b, p: 0 };
-    let mut text = codepage::BinaryText::default();
-    let mut tags = Vec::new();
-    while c.p < b.len() {
-        let mut code = i32::from(c.i16()?);
-        if code == 255 {
-            code = i32::from(c.i16()?);
-        }
-        let v = match kind_of(code) {
-            Kind::Str => Value::Str(unescape_unicode(&text.string(code, c.cstr()?))),
-            Kind::Real => Value::Real(c.f64()?),
-            Kind::Int16 => Value::Int(i64::from(c.i16()?)),
-            Kind::Int32 => Value::Int(i64::from(c.i32()?)),
-            Kind::Int64 => Value::Int(c.i64()?),
-            Kind::Bool => Value::Bool(c.u8()? != 0),
-            Kind::Hex => {
-                let n = usize::from(c.u8()?);
-                let bytes = c.take(n)?;
-                let mut s = String::with_capacity(n * 2);
-                for x in bytes {
-                    let _ = write!(s, "{x:02X}");
-                }
-                Value::Hex(s)
-            }
-        };
-        let eof = code == 0 && matches!(&v, Value::Str(s) if s == "EOF");
-        tags.push(Tag { code, value: v });
-        if tags.len() > max_tags {
-            return Err(DxfError::TooLarge { tags: tags.len(), limit: max_tags });
-        }
-        if eof {
-            break;
-        }
-    }
-    if tags.is_empty() {
-        return Err(DxfError::NotDxf);
-    }
-    Ok(tags)
-}
-
-/// Format a real the way DXF writers usually do (shortest round-trip, with a decimal point).
-pub fn format_real(v: f64) -> String {
-    if !v.is_finite() {
-        return "0.0".into();
-    }
-    let s = format!("{v}");
-    if s.contains('.') || s.contains('e') || s.contains("inf") || s.contains("NaN") { s } else { format!("{s}.0") }
-}
-
-/// Write tags as ASCII DXF (CRLF line ends, codes right-aligned to 3 as is conventional).
-///
-/// The output is pure ASCII: non-ASCII characters in strings are written as `\U+XXXX` escapes,
-/// the pre-R2007 convention, so it is correct whatever `$DWGCODEPAGE` the header declares.
-pub fn write_ascii(tags: &[Tag]) -> String {
-    write_ascii_as(tags, false)
-}
-
-/// Write tags as ASCII DXF with text in UTF-8 (`utf8`, the R2007+ convention: non-ASCII
-/// characters as they are) or escaped as `\U+XXXX` (older versions, see [`write_ascii`]). Line
-/// breaks inside strings become spaces either way.
-pub fn write_ascii_as(tags: &[Tag], utf8: bool) -> String {
-    let bytes = ascii(tags, if utf8 { Strings::Utf8 } else { Strings::Escaped(None) });
-    // Both forms are UTF-8 (the escaped one is ASCII).
-    String::from_utf8(bytes).unwrap_or_else(|e| String::from_utf8_lossy(e.as_bytes()).into_owned())
-}
-
-/// Write tags as pre-R2007 ASCII DXF with text in the code page `code_page` names (a
-/// `$DWGCODEPAGE` value such as `ANSI_1252`), as the DXF Reference describes for those versions:
-/// a character the code page has is written as its bytes, any other as a `\U+XXXX` escape. A
-/// code page CADCraft doesn't know, `ASCII`, and `UTF8`/`UNICODE` (not a pre-2007 code page)
-/// give [`write_ascii`]'s pure ASCII output. So does a file whose code page bytes happen to be
-/// valid UTF-8 (`СІ` in ANSI_1251 is D1 B2, U+0472), since readers, ours included, take an ASCII
-/// DXF that is valid UTF-8 as UTF-8.
-pub fn write_ascii_in(tags: &[Tag], code_page: &str) -> Vec<u8> {
-    let bytes = ascii(tags, Strings::Escaped(codepage::encoder(code_page)));
-    if !bytes.is_ascii() && std::str::from_utf8(&bytes).is_ok() {
-        return ascii(tags, Strings::Escaped(None));
-    }
-    bytes
-}
-
-/// How a writer stores string values.
-#[derive(Clone, Copy)]
-enum Strings {
-    /// As they are (R2007+).
-    Utf8,
-    /// ASCII as it is, other characters in this code page when it has them, otherwise as
-    /// `\U+XXXX` escapes (before R2007).
-    Escaped(Option<codepage::Decoder>),
-}
-
-fn ascii(tags: &[Tag], strings: Strings) -> Vec<u8> {
-    let mut out = Vec::with_capacity(tags.len() * 16);
-    for t in tags {
-        let _ = write!(out, "{:>3}\r\n", t.code);
-        match &t.value {
-            Value::Str(s) => push_string(s, strings, &mut out),
-            Value::Real(r) => out.extend_from_slice(format_real(*r).as_bytes()),
-            Value::Int(i) => out.extend_from_slice(i.to_string().as_bytes()),
-            Value::Bool(b) => out.extend_from_slice(i64::from(*b).to_string().as_bytes()),
-            Value::Hex(h) => out.extend_from_slice(h.as_bytes()),
-        }
-        out.extend_from_slice(b"\r\n");
-    }
-    out
-}
-
-/// Write tags as binary DXF (DXF Reference, "Binary DXF Files", R13+ layout): the sentinel,
-/// then per tag a 2-byte little-endian group code and the value in the binary form of the code's
-/// [`Kind`]: a zero-terminated string, an 8-byte real, a 2-, 4- or 8-byte integer, a 1-byte
-/// boolean, or a binary chunk (one length byte, then up to 255 bytes; longer data is split into
-/// several groups of the same code). Strings are UTF-8 when `utf8` (R2007+), otherwise escaped as
-/// in [`write_ascii`]. A tag's value is converted to its code's kind, so a number written as text
-/// is stored as a number; a code outside the 16-bit range is skipped.
-pub fn write_binary(tags: &[Tag], utf8: bool) -> Vec<u8> {
-    binary(tags, if utf8 { Strings::Utf8 } else { Strings::Escaped(None) })
-}
-
-/// Write tags as pre-R2007 binary DXF with text in the code page `code_page` names, as
-/// [`write_ascii_in`] does.
-pub fn write_binary_in(tags: &[Tag], code_page: &str) -> Vec<u8> {
-    binary(tags, Strings::Escaped(codepage::encoder(code_page)))
-}
-
-fn binary(tags: &[Tag], strings: Strings) -> Vec<u8> {
-    let mut out = Vec::with_capacity(BINARY_SENTINEL.len() + tags.len() * 12);
-    out.extend_from_slice(BINARY_SENTINEL);
-    for t in tags {
-        let Ok(code) = i16::try_from(t.code) else { continue };
-        let code_bytes = code.to_le_bytes();
-        match kind_of(t.code) {
-            Kind::Str => {
-                out.extend_from_slice(&code_bytes);
-                let s = match &t.value {
-                    Value::Str(s) => s.clone(),
-                    v => v.as_str(),
-                };
-                let mut text = Vec::with_capacity(s.len());
-                push_string(&s, strings, &mut text);
-                out.extend(text.into_iter().filter(|&b| b != 0));
-                out.push(0);
-            }
-            Kind::Real => {
-                out.extend_from_slice(&code_bytes);
-                out.extend_from_slice(&t.value.as_f64().to_le_bytes());
-            }
-            Kind::Int16 => {
-                out.extend_from_slice(&code_bytes);
-                let v = t.value.as_i64().clamp(i64::from(i16::MIN), i64::from(i16::MAX));
-                out.extend_from_slice(&i16::try_from(v).unwrap_or_default().to_le_bytes());
-            }
-            Kind::Int32 => {
-                out.extend_from_slice(&code_bytes);
-                let v = t.value.as_i64().clamp(i64::from(i32::MIN), i64::from(i32::MAX));
-                out.extend_from_slice(&i32::try_from(v).unwrap_or_default().to_le_bytes());
-            }
-            Kind::Int64 => {
-                out.extend_from_slice(&code_bytes);
-                out.extend_from_slice(&t.value.as_i64().to_le_bytes());
-            }
-            Kind::Bool => {
-                out.extend_from_slice(&code_bytes);
-                out.push(u8::from(t.value.as_i64() != 0));
-            }
-            Kind::Hex => {
-                let bytes = hex_bytes(&t.value.as_str());
-                // An empty chunk is still one group, as in ASCII.
-                let mut chunks: Vec<&[u8]> = bytes.chunks(255).collect();
-                if chunks.is_empty() {
-                    chunks.push(&[]);
-                }
-                for chunk in chunks {
-                    out.extend_from_slice(&code_bytes);
-                    out.push(u8::try_from(chunk.len()).unwrap_or(u8::MAX));
-                    out.extend_from_slice(chunk);
-                }
-            }
-        }
-    }
-    out
-}
-
-/// The bytes of hex text, two digits each; anything that isn't a pair of hex digits is skipped.
-fn hex_bytes(s: &str) -> Vec<u8> {
-    let digits: Vec<u8> = s.bytes().filter_map(|b| char::from(b).to_digit(16).and_then(|d| u8::try_from(d).ok())).collect();
-    digits.as_chunks::<2>().0.iter().map(|[hi, lo]| (hi << 4) | lo).collect()
-}
-
-/// Whether `bytes` are a binary DXF file (they start with the binary sentinel).
-pub fn is_binary(bytes: &[u8]) -> bool {
-    bytes.starts_with(BINARY_SENTINEL)
-}
-
-/// A string value as `strings` stores it. Line breaks become spaces. Before R2007 the text is
-/// in the `$DWGCODEPAGE` code page: ASCII stays as it is, a character the code page has becomes
-/// its bytes, and every other one `\U+XXXX` (a surrogate pair of escapes above U+FFFF). Without
-/// a code page the result is ASCII, so it is valid in any code page. In every form a backslash
-/// that would start a `\U+` or `\M+` sequence is written as `\U+005C`, so the reader gives back
-/// the literal text (#2050). So is a double-byte character whose trail byte is 0x5C (`\`) in that
-/// place, such as Shift-JIS `表` or Big5 `許`: CADCraft decodes the code page before it looks for
-/// escapes, but a reader that looks first would take that byte and the `U+` after it for one.
-fn push_string(s: &str, strings: Strings, out: &mut Vec<u8>) {
-    let chars: Vec<char> = s.chars().collect();
-    let escape_at = |j: usize| matches!(chars.get(j), Some('U' | 'M')) && chars.get(j + 1) == Some(&'+');
-    for (i, &c) in chars.iter().enumerate() {
-        match (c, strings) {
-            ('\r' | '\n', _) => out.push(b' '),
-            ('\\', _) if escape_at(i + 1) => {
-                out.extend_from_slice(b"\\U+005C");
-            }
-            (c, Strings::Utf8) => out.extend_from_slice(c.encode_utf8(&mut [0; 4]).as_bytes()),
-            (c, _) if c.is_ascii() => out.extend_from_slice(c.encode_utf8(&mut [0; 4]).as_bytes()),
-            (c, Strings::Escaped(Some(d))) if code_page_bytes(c, d, escape_at(i + 1), out) => {}
-            (c, Strings::Escaped(_)) => {
-                let mut units = [0u16; 2];
-                for u in c.encode_utf16(&mut units) {
-                    let _ = write!(out, "\\U+{u:04X}");
-                }
-            }
-        }
-    }
-}
-
-/// `c` in the code page `d`, if it has it, unless it is a double-byte character whose trail byte
-/// is 0x5C and an escape's `U+` or `M+` follows (`before_escape`): see [`push_string`].
-fn code_page_bytes(c: char, d: codepage::Decoder, before_escape: bool, out: &mut Vec<u8>) -> bool {
-    let start = out.len();
-    if !codepage::encode_char(c, d, out) {
-        return false;
-    }
-    if before_escape && out.len() - start > 1 && out.last() == Some(&b'\\') {
-        out.truncate(start);
-        return false;
-    }
-    true
-}
-
-/// A section: `0 SECTION / 2 NAME ... 0 ENDSEC`.
-#[derive(Clone, Debug, Default)]
-pub struct Section {
-    pub name: String,
-    pub tags: Vec<Tag>,
-}
-
-/// Split a tag stream into sections.
-pub fn sections(tags: &[Tag]) -> Vec<Section> {
-    let mut out = Vec::new();
-    let mut i = 0;
-    while i < tags.len() {
-        let is_sec = tags.get(i).is_some_and(|t| t.code == 0 && t.str() == "SECTION");
-        if is_sec {
-            let name = tags.get(i + 1).filter(|t| t.code == 2).map(Tag::str).unwrap_or_default();
-            let start = i + 2;
-            let mut j = start;
-            while j < tags.len() && !(tags.get(j).is_some_and(|t| t.code == 0 && t.str() == "ENDSEC")) {
-                j += 1;
-            }
-            out.push(Section { name, tags: tags.get(start..j).unwrap_or(&[]).to_vec() });
-            i = j + 1;
-        } else {
-            i += 1;
-        }
-    }
-    out
-}
-
-/// Split a run of tags into records starting at each code-0 tag: (type, tags after the 0).
-pub fn records(tags: &[Tag]) -> Vec<(String, Vec<Tag>)> {
-    let mut out: Vec<(String, Vec<Tag>)> = Vec::new();
-    for t in tags {
-        if t.code == 0 {
-            out.push((t.str(), Vec::new()));
-        } else if let Some(last) = out.last_mut() {
-            last.1.push(t.clone());
-        }
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn literal_escape_text_roundtrips() {
-        for utf8 in [false, true] {
-            for text in ["\\U+00E9", "\\M+183A4F", "a\\nb \\P", "\\\\U+00E9", "\\U+005C"] {
-                let tags = vec![Tag::s(8, text)];
-                let back = parse_ascii(&write_ascii_as(&tags, utf8)).unwrap();
-                assert_eq!(back, tags, "utf8={utf8} {text}");
-                let back = parse_binary(&write_binary(&tags, utf8)).unwrap();
-                assert_eq!(back[1..], tags[..], "binary utf8={utf8} {text}");
-            }
-        }
-    }
-
-    #[test]
-    fn blank_lines_do_not_consume_group_code_limit() {
-        let tags = parse_with_limit(b"0\nEOF\n\n\n", 1).expect("one group code should fit a limit of one");
-        assert_eq!(tags, vec![Tag::s(0, "EOF")]);
-    }
-
-    #[test]
-    fn ascii_roundtrip() {
-        let tags = vec![
-            Tag::s(0, "SECTION"),
-            Tag::s(2, "ENTITIES"),
-            Tag::s(0, "LINE"),
-            Tag::s(8, "0"),
-            Tag::f(10, 1.5),
-            Tag::f(20, 2.0),
-            Tag::i(62, 1),
-            Tag::s(0, "ENDSEC"),
-            Tag::s(0, "EOF"),
-        ];
-        let text = write_ascii(&tags);
-        let back = parse(text.as_bytes()).unwrap();
-        assert_eq!(back, tags);
-        let secs = sections(&back);
-        assert_eq!(secs.len(), 1);
-        assert_eq!(secs[0].name, "ENTITIES");
-        let recs = records(&secs[0].tags);
-        assert_eq!(recs[0].0, "LINE");
-        assert_eq!(recs[0].1.len(), 4);
-    }
-
-    #[test]
-    fn binary_parse() {
-        let mut b = BINARY_SENTINEL.to_vec();
-        let push_str = |b: &mut Vec<u8>, code: i16, s: &str| {
-            b.extend_from_slice(&code.to_le_bytes());
-            b.extend_from_slice(s.as_bytes());
-            b.push(0);
-        };
-        push_str(&mut b, 0, "LINE");
-        b.extend_from_slice(&10i16.to_le_bytes());
-        b.extend_from_slice(&3.25f64.to_le_bytes());
-        b.extend_from_slice(&62i16.to_le_bytes());
-        b.extend_from_slice(&5i16.to_le_bytes());
-        push_str(&mut b, 0, "EOF");
-        let tags = parse(&b).unwrap();
-        assert_eq!(tags[1], Tag::f(10, 3.25));
-        assert_eq!(tags[2], Tag::i(62, 5));
-    }
-
-    #[test]
-    fn malformed_inputs() {
-        assert!(parse(b"").is_err());
-        assert!(parse(b"abc\nxyz\n").is_err());
-        assert!(parse(b"0\n").is_err());
-        let mut b = BINARY_SENTINEL.to_vec();
-        b.extend_from_slice(&10i16.to_le_bytes());
-        b.extend_from_slice(&[1, 2, 3]);
-        assert!(parse(&b).is_err());
-        // Bad numbers become 0 rather than failing.
-        let t = parse(b"10\nnotanumber\n0\nEOF\n").unwrap();
-        assert_eq!(t[0].f64(), 0.0);
-    }
-
-    #[test]
-    fn unicode_escapes_and_latin1() {
-        let t = parse(b"1\nCaf\\U+00E9\n0\nEOF\n").unwrap();
-        assert_eq!(t[0].str(), "Café");
-        let t = parse(b"1\nCaf\xe9\n0\nEOF\n").unwrap();
-        assert_eq!(t[0].str(), "Café");
-    }
-
-    #[test]
-    fn surrogate_pair_escapes() {
-        let t = parse(b"1\n\\U+D83D\\U+DE00 \\u+56fe\\U+53f7\n0\nEOF\n").unwrap();
-        assert_eq!(t[0].str(), "😀 \\u+56fe号");
-    }
-
-    #[test]
-    fn hostile_escapes_stay_literal() {
-        for s in [
-            "\\U+",
-            "\\U",
-            "\\",
-            "a\\U+ZZZZ",
-            "\\U+12",
-            "\\U+D800",
-            "\\U+DC00",
-            "\\U+D800\\U+0041",
-            "\\U+D83D\\U+DE",
-            "\\U++123",
-            "\\U+-123",
-            "x\\U+12\u{e9}4",
-        ] {
-            let t = parse(format!("1\n{s}\n0\nEOF\n").as_bytes()).unwrap();
-            let expect = if s == "\\U+D800\\U+0041" { "\\U+D800A" } else { s };
-            assert_eq!(t[0].str(), expect, "{s:?}");
-        }
-    }
-
-    #[test]
-    fn writes_non_ascii_as_escapes() {
-        let tags = vec![Tag::s(1, "图号 Ä°ø 😀\r\nend"), Tag::s(1000, "Ø"), Tag::s(0, "EOF")];
-        let text = write_ascii(&tags);
-        assert!(text.is_ascii());
-        assert!(text.contains("\\U+56FE\\U+53F7 \\U+00C4\\U+00B0\\U+00F8 \\U+D83D\\U+DE00  end\r\n"));
-        let back = parse(text.as_bytes()).unwrap();
-        assert_eq!(back[0].str(), "图号 Ä°ø 😀  end");
-        assert_eq!(back[1].str(), "Ø");
-    }
-
-    #[test]
-    fn binary_strings_unescape() {
-        let mut b = BINARY_SENTINEL.to_vec();
-        b.extend_from_slice(&1i16.to_le_bytes());
-        b.extend_from_slice(b"\\U+56FE\\U+53F7\0");
-        b.extend_from_slice(&0i16.to_le_bytes());
-        b.extend_from_slice(b"EOF\0");
-        assert_eq!(parse(&b).unwrap()[0].str(), "图号");
-    }
-}

crates/dxf/src/version.rs

@@ -1,117 +0,0 @@
-//! The DXF/DWG file versions CADCraft writes (DXF Reference, HEADER `$ACADVER`).
-
-/// A file version CADCraft can save: the AutoCAD release that introduced the format. Each format
-/// also serves the releases after it (2018 is still AutoCAD's current format).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash)]
-pub enum Version {
-    /// AutoCAD 2000/2002 (AC1015).
-    R2000,
-    /// AutoCAD 2004–2006 (AC1018).
-    R2004,
-    /// AutoCAD 2007–2009 (AC1021): the first version whose DXF text is UTF-8.
-    R2007,
-    /// AutoCAD 2010–2012 (AC1024).
-    R2010,
-    /// AutoCAD 2013–2017 (AC1027).
-    R2013,
-    /// AutoCAD 2018 and later (AC1032), the default.
-    #[default]
-    R2018,
-}
-
-impl Version {
-    /// Every version, oldest first.
-    pub const ALL: [Version; 6] = [Version::R2000, Version::R2004, Version::R2007, Version::R2010, Version::R2013, Version::R2018];
-
-    /// The `$ACADVER` code ("AC1032").
-    pub fn code(self) -> &'static str {
-        match self {
-            Version::R2000 => "AC1015",
-            Version::R2004 => "AC1018",
-            Version::R2007 => "AC1021",
-            Version::R2010 => "AC1024",
-            Version::R2013 => "AC1027",
-            Version::R2018 => "AC1032",
-        }
-    }
-
-    /// The release year that names the version ("2018").
-    pub fn year(self) -> &'static str {
-        match self {
-            Version::R2000 => "2000",
-            Version::R2004 => "2004",
-            Version::R2007 => "2007",
-            Version::R2010 => "2010",
-            Version::R2013 => "2013",
-            Version::R2018 => "2018",
-        }
-    }
-
-    /// A version named by its year ("2018", "R2018") or its `$ACADVER` code ("AC1032"), any case.
-    pub fn parse(s: &str) -> Option<Version> {
-        let s = s.trim();
-        let year = s.strip_prefix(['R', 'r']).unwrap_or(s);
-        Version::ALL.into_iter().find(|v| v.year() == year || v.code().eq_ignore_ascii_case(s))
-    }
-
-    /// The version to save a file of `$ACADVER` `code` in: the same version when CADCraft writes
-    /// it, else the nearest one it does (R2000 for older files, 2018 for newer ones); `None` when
-    /// the code isn't a version code at all.
-    pub fn for_acadver(code: &str) -> Option<Version> {
-        let code = code.trim();
-        if let Some(v) = Version::ALL.into_iter().find(|v| v.code().eq_ignore_ascii_case(code)) {
-            return Some(v);
-        }
-        code.get(..2).filter(|p| p.eq_ignore_ascii_case("AC"))?;
-        let n = code.get(2..).filter(|d| d.bytes().all(|b| b.is_ascii_digit())).and_then(|d| d.parse::<u32>().ok())?;
-        Some(match n {
-            ..1018 => Version::R2000,
-            1018..1021 => Version::R2004,
-            1021..1024 => Version::R2007,
-            1024..1027 => Version::R2010,
-            1027..1032 => Version::R2013,
-            _ => Version::R2018,
-        })
-    }
-
-    /// Whether text in this version's DXF is UTF-8 (2007 and later). Older versions keep text in
-    /// the `$DWGCODEPAGE` code page, which CADCraft avoids by escaping non-ASCII as `\U+XXXX`.
-    pub fn utf8(self) -> bool {
-        self >= Version::R2007
-    }
-}
-
-impl std::fmt::Display for Version {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str(self.year())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parses_years_and_codes() {
-        assert_eq!(Version::parse("2018"), Some(Version::R2018));
-        assert_eq!(Version::parse(" r2004 "), Some(Version::R2004));
-        assert_eq!(Version::parse("ac1021"), Some(Version::R2007));
-        assert_eq!(Version::parse("2005"), None);
-        assert_eq!(Version::parse(""), None);
-        for v in Version::ALL {
-            assert_eq!(Version::parse(v.code()), Some(v));
-            assert_eq!(Version::parse(v.year()), Some(v));
-        }
-    }
-
-    #[test]
-    fn file_versions_map_to_the_nearest_writable_one() {
-        assert_eq!(Version::for_acadver("AC1009"), Some(Version::R2000));
-        assert_eq!(Version::for_acadver("AC1014"), Some(Version::R2000));
-        assert_eq!(Version::for_acadver("AC1024"), Some(Version::R2010));
-        assert_eq!(Version::for_acadver("AC1035"), Some(Version::R2018));
-        assert_eq!(Version::for_acadver("MC0.0"), None);
-        assert_eq!(Version::for_acadver("AC"), None);
-        assert_eq!(Version::for_acadver("AC99999999999999999999"), None);
-    }
-}

crates/dxf/tests/ascii_bom.rs

@@ -1,19 +0,0 @@
-//! A UTF-8 byte order mark at the start of an ASCII DXF is skipped.
-
-const BODY: &str = "  0\r\nSECTION\r\n  2\r\nENTITIES\r\n  0\r\nENDSEC\r\n  0\r\nEOF\r\n";
-
-#[test]
-fn utf8_bom_bytes_are_skipped() {
-    let plain = cadcraft_dxf::parse(BODY.as_bytes()).expect("plain parses");
-    let mut bytes = vec![0xEF, 0xBB, 0xBF];
-    bytes.extend_from_slice(BODY.as_bytes());
-    let with_bom = cadcraft_dxf::parse(&bytes);
-    assert!(with_bom.is_ok(), "{with_bom:?}");
-    assert_eq!(with_bom.map(|t| t.len()).unwrap_or(0), plain.len());
-}
-
-#[test]
-fn bom_text_is_skipped() {
-    let text = format!("\u{feff}{BODY}");
-    assert!(cadcraft_dxf::parse_ascii(&text).is_ok());
-}

crates/dxf/tests/binary_write.rs

@@ -1,75 +0,0 @@
-//! Binary DXF writing (#421): every value kind round-trips through `write_binary` and `parse`,
-//! and hostile binary input never panics.
-
-use cadcraft_dxf::{Tag, Value, is_binary, parse, write_ascii_as, write_binary};
-
-fn sample() -> Vec<Tag> {
-    vec![
-        Tag::s(0, "SECTION"),
-        Tag::s(2, "ENTITIES"),
-        Tag::s(0, "TEXT"),
-        Tag::s(5, "1F"),
-        Tag::f(10, -3.25),
-        Tag::i(62, 5),
-        Tag::i(90, 70_000),
-        Tag::i(160, 1 << 40),
-        Tag::new(290, Value::Bool(true)),
-        Tag::new(310, Value::Hex("00FFA5".into())),
-        Tag::s(1, "图号 Café 😀"),
-        Tag::i(1071, -2),
-        Tag::s(0, "ENDSEC"),
-        Tag::s(0, "EOF"),
-    ]
-}
-
-#[test]
-fn binary_roundtrips_every_value_kind() {
-    for utf8 in [false, true] {
-        let bytes = write_binary(&sample(), utf8);
-        assert!(is_binary(&bytes));
-        assert_eq!(parse(&bytes).unwrap(), sample(), "utf8 = {utf8}");
-    }
-    // Pre-2007 strings are escaped to ASCII, 2007+ ones are UTF-8.
-    let old = write_binary(&sample(), false);
-    assert!(old.windows(7).any(|w| w == b"\\U+56FE"));
-    let new = write_binary(&sample(), true);
-    assert!(new.windows("图号".len()).any(|w| w == "图号".as_bytes()));
-}
-
-#[test]
-fn binary_converts_values_to_their_codes_kind() {
-    // A number held as text at a numeric code, an out-of-range 16-bit value, a long chunk.
-    let long = "AB".repeat(300);
-    let tags = vec![Tag::s(70, "12"), Tag::i(62, 1 << 20), Tag::new(310, Value::Hex(long)), Tag::s(0, "EOF")];
-    let back = parse(&write_binary(&tags, true)).unwrap();
-    assert_eq!(back[0], Tag::i(70, 12));
-    assert_eq!(back[1], Tag::i(62, i64::from(i16::MAX)));
-    assert_eq!(back[2].code, 310);
-    assert_eq!(back[3].code, 310, "300 bytes are split into chunks of at most 255");
-    assert_eq!(back[2].str().len() + back[3].str().len(), 600);
-}
-
-#[test]
-fn utf8_ascii_keeps_text_and_drops_line_breaks() {
-    let text = write_ascii_as(&[Tag::s(1, "图号\r\nÄ"), Tag::s(0, "EOF")], true);
-    assert!(text.contains("图号  Ä\r\n"));
-    assert_eq!(parse(text.as_bytes()).unwrap()[0].str(), "图号  Ä");
-}
-
-#[test]
-fn hostile_binary_input_never_panics() {
-    let good = write_binary(&sample(), true);
-    // Every truncation, and every single-byte corruption of the body.
-    for n in 0..good.len() {
-        let _ = parse(good.get(..n).unwrap());
-    }
-    for i in 22..good.len() {
-        for b in [0u8, 0x7f, 0xff] {
-            let mut bad = good.clone();
-            bad[i] = b;
-            let _ = parse(&bad);
-        }
-    }
-    // A sentinel and nothing else is not a drawing.
-    assert!(parse(b"AutoCAD Binary DXF\r\n\x1a\0").is_err());
-}

crates/dxf/tests/code_page_write.rs

@@ -1,116 +0,0 @@
-//! Pre-R2007 DXF text is written in the `$DWGCODEPAGE` code page: characters it has as their
-//! bytes, the others as `\U+XXXX` escapes; every form reads back to the same text.
-
-use cadcraft_dxf::{Tag, parse, write_ascii, write_ascii_in, write_binary_in};
-
-fn file(code_page: &str, text: &str) -> Vec<Tag> {
-    vec![
-        Tag::s(0, "SECTION"),
-        Tag::s(2, "HEADER"),
-        Tag::s(9, "$ACADVER"),
-        Tag::s(1, "AC1015"),
-        Tag::s(9, "$DWGCODEPAGE"),
-        Tag::s(3, code_page),
-        Tag::s(0, "ENDSEC"),
-        Tag::s(0, "SECTION"),
-        Tag::s(2, "ENTITIES"),
-        Tag::s(0, "TEXT"),
-        Tag::s(1, text),
-        Tag::s(0, "ENDSEC"),
-        Tag::s(0, "EOF"),
-    ]
-}
-
-fn contains(bytes: &[u8], part: &[u8]) -> bool {
-    bytes.windows(part.len()).any(|w| w == part)
-}
-
-#[test]
-fn text_is_written_in_the_code_page() {
-    // (code page, text, the bytes written for it)
-    let cases: [(&str, &str, &[u8]); 6] = [
-        ("ANSI_1252", "Ação € 图", b"A\xE7\xE3o \x80 \\U+56FE"),
-        ("ANSI_1251", "Слой é", b"\xD1\xEB\xEE\xE9 \\U+00E9"),
-        ("ANSI_932", "表図面 é", b"\x95\x5C\x90\x7D\x96\xCA \\U+00E9"),
-        ("DOS850", "Größe €", b"Gr\x94\xE1e \\U+20AC"),
-        ("ANSI_1252", "😀", b"\\U+D83D\\U+DE00"),
-        // A code page CADCraft doesn't know: everything non-ASCII is escaped.
-        ("ANSI_1361", "Ação", b"A\\U+00E7\\U+00E3o"),
-    ];
-    for (cp, text, raw) in cases {
-        let tags = file(cp, text);
-        for (bytes, what) in [(write_ascii_in(&tags, cp), "ASCII"), (write_binary_in(&tags, cp), "binary")] {
-            assert!(contains(&bytes, raw), "{cp} {what}: {:?}", String::from_utf8_lossy(&bytes));
-            assert_eq!(parse(&bytes).unwrap()[10].str(), text, "{cp} {what}");
-        }
-    }
-}
-
-/// Without a known code page, and for `ASCII`, `UTF8` and `UNICODE` headers, the output is what
-/// `write_ascii` writes (pure ASCII with escapes), line breaks included.
-#[test]
-fn unknown_ascii_and_utf8_code_pages_are_pure_ascii() {
-    for cp in ["EBCDIC", "ASCII", "ascii ", "UTF8", "UNICODE"] {
-        let tags = file(cp, "Ação\r\nfim");
-        let bytes = write_ascii_in(&tags, cp);
-        assert!(bytes.is_ascii(), "{cp}");
-        assert_eq!(bytes, write_ascii(&tags).into_bytes(), "{cp}");
-        assert!(contains(&bytes, b"A\\U+00E7\\U+00E3o  fim"), "{cp}");
-        assert!(write_binary_in(&tags, cp).iter().all(u8::is_ascii), "{cp} binary");
-    }
-}
-
-/// Code page bytes that happen to form valid UTF-8 (`СІ` in ANSI_1251 is D1 B2, which is U+0472
-/// in UTF-8) would be read back as UTF-8 from an ASCII file, so that file is written with
-/// escapes. Binary DXF reads strings by the header's code page and keeps the bytes.
-#[test]
-fn code_page_bytes_that_are_valid_utf8_are_escaped_in_ascii() {
-    let tags = file("ANSI_1251", "СІ");
-    let ascii = write_ascii_in(&tags, "ANSI_1251");
-    assert!(ascii.is_ascii(), "{:?}", String::from_utf8_lossy(&ascii));
-    assert!(contains(&ascii, b"\\U+0421\\U+0406"));
-    assert_eq!(parse(&ascii).unwrap()[10].str(), "СІ");
-    let binary = write_binary_in(&tags, "ANSI_1251");
-    assert!(contains(&binary, b"\xD1\xB2"));
-    assert_eq!(parse(&binary).unwrap()[10].str(), "СІ");
-    // Bytes that are not valid UTF-8 stay as they are.
-    assert!(contains(&write_ascii_in(&file("ANSI_1251", "Слой"), "ANSI_1251"), b"\xD1\xEB\xEE\xE9"));
-}
-
-/// A literal `\U+` or `\M+` in the text (#2050) reads back as written alongside code page bytes,
-/// in ASCII and binary, including an ASCII file that falls back to escapes because its bytes
-/// would read as UTF-8.
-#[test]
-fn literal_escapes_survive_code_page_text() {
-    for (cp, text) in
-        [("ANSI_1252", "Ação \\U+00E9 \\M+183A4F"), ("ANSI_1251", "Слой \\U+0041"), ("ANSI_1251", "СІ \\U+0041"), ("ANSI_932", "表 \\M+1")]
-    {
-        let tags = file(cp, text);
-        for (bytes, what) in [(write_ascii_in(&tags, cp), "ASCII"), (write_binary_in(&tags, cp), "binary")] {
-            assert!(contains(&bytes, b"\\U+005C"), "{cp} {what}: {:?}", String::from_utf8_lossy(&bytes));
-            assert_eq!(parse(&bytes).unwrap()[10].str(), text, "{cp} {what}");
-        }
-    }
-}
-
-/// Double-byte code pages whose trail byte can be 0x5C (`\\`): Shift-JIS `表` (95 5C) and `ソ`
-/// (83 5C), Big5 `許` (B3 5C), GBK `乗` (81 5C). Right before `U+` or `M+`, such a character is
-/// written as an escape, so even a reader that looks for escapes before it decodes the code page
-/// reads it right. Elsewhere it stays as its bytes. Both forms read back as written.
-#[test]
-fn a_trail_byte_backslash_never_starts_an_escape() {
-    let cases: [(&str, &str, &[u8], &[u8]); 4] = [
-        ("ANSI_932", "表U+0041 表示", b"\\U+8868U+0041 \x95\x5C\x8E\xA6", b"\x95\x5CU+"),
-        ("ANSI_932", "ソM+1A2B", b"\\U+30BDM+1A2B", b"\x83\x5CM+"),
-        ("ANSI_950", "許U+0041", b"\\U+8A31U+0041", b"\xB3\x5CU+"),
-        ("ANSI_936", "乗U+0041", b"\\U+4E57U+0041", b"\x81\x5CU+"),
-    ];
-    for (cp, text, written, never) in cases {
-        let tags = file(cp, text);
-        for (bytes, what) in [(write_ascii_in(&tags, cp), "ASCII"), (write_binary_in(&tags, cp), "binary")] {
-            assert!(contains(&bytes, written), "{cp} {what}: {:?}", String::from_utf8_lossy(&bytes));
-            assert!(!contains(&bytes, never), "{cp} {what}: a trail byte starts an escape");
-            assert_eq!(parse(&bytes).unwrap()[10].str(), text, "{cp} {what}");
-        }
-    }
-}

crates/dxf/tests/conformance.rs

@@ -1,145 +0,0 @@
-//! Small independent byte fixtures for DXF tag types, text encoding, framing and failures.
-//! Handwritten examples, not files from a CAD application or generated by our writer.
-//! Background on the tag model and file structure:
-//! https://ezdxf.readthedocs.io/en/stable/dxfinternals/dxftags.html
-//! https://ezdxf.readthedocs.io/en/stable/dxfinternals/filestructure.html
-//! ASCII spacing is our writer's documented convention; binary fixtures specify actual bytes.
-
-use cadcraft_dxf::{DxfError, Tag, Value, parse, parse_with_limit, write_ascii_as, write_binary};
-
-const SENTINEL: &[u8] = b"AutoCAD Binary DXF\r\n\x1a\0";
-
-fn fixtures() -> Vec<(Tag, &'static [u8], &'static [u8])> {
-    vec![
-        (Tag::s(1, " A "), b"  1\r\n A \r\n", b"\x01\0 A \0"),
-        (Tag::s(1, ""), b"  1\r\n\r\n", b"\x01\0\0"),
-        (Tag::s(105, "AB12"), b"105\r\nAB12\r\n", b"\x69\0AB12\0"),
-        (Tag::new(10, Value::Real(-3.25)), b" 10\r\n-3.25\r\n", b"\x0a\0\0\0\0\0\0\0\x0a\xc0"),
-        (Tag::i(70, -32768), b" 70\r\n-32768\r\n", b"\x46\0\0\x80"),
-        (Tag::i(90, -2147483648), b" 90\r\n-2147483648\r\n", b"\x5a\0\0\0\0\x80"),
-        (Tag::i(160, 9223372036854775807), b"160\r\n9223372036854775807\r\n", b"\xa0\0\xff\xff\xff\xff\xff\xff\xff\x7f"),
-        (Tag::new(290, Value::Bool(false)), b"290\r\n0\r\n", b"\x22\x01\0"),
-        (Tag::new(299, Value::Bool(true)), b"299\r\n1\r\n", b"\x2b\x01\x01"),
-        (Tag::new(310, Value::Hex("00FF80".into())), b"310\r\n00FF80\r\n", b"\x36\x01\x03\0\xff\x80"),
-        (Tag::new(1004, Value::Hex(String::new())), b"1004\r\n\r\n", b"\xec\x03\0"),
-        (Tag::i(1070, -2), b"1070\r\n-2\r\n", b"\x2e\x04\xfe\xff"),
-        (Tag::i(1071, 65536), b"1071\r\n65536\r\n", b"\x2f\x04\0\0\x01\0"),
-    ]
-}
-
-#[test]
-fn reads_independently_authored_ascii_and_binary_values() {
-    for (expected, ascii, binary) in fixtures() {
-        assert_eq!(parse(ascii).unwrap(), std::slice::from_ref(&expected), "ASCII code {}", expected.code);
-        let bytes = [SENTINEL, binary].concat();
-        assert_eq!(parse(&bytes).unwrap(), std::slice::from_ref(&expected), "binary code {}", expected.code);
-    }
-}
-
-#[test]
-fn writes_independently_specified_ascii_and_binary_bytes() {
-    for (tag, ascii, binary) in fixtures() {
-        for utf8 in [false, true] {
-            let tags = std::slice::from_ref(&tag);
-            assert_eq!(write_ascii_as(tags, utf8).as_bytes(), ascii, "ASCII code {}", tag.code);
-            assert_eq!(write_binary(tags, utf8), [SENTINEL, binary].concat(), "binary code {}", tag.code);
-        }
-    }
-}
-
-#[test]
-fn integer_code_ranges_have_independent_binary_widths() {
-    // Specification ranges and widths, never kind_of(): a shared reader/writer mistake
-    // can round-trip every boundary value while still using the wrong number of bytes.
-    let widths = [
-        (vec![60..=79, 170..=179, 270..=289, 370..=389, 400..=409, 1060..=1070], 2, i64::from(i16::MIN), i64::from(i16::MAX)),
-        (vec![90..=99, 420..=429, 440..=459, 1071..=1071], 4, i64::from(i32::MIN), i64::from(i32::MAX)),
-        (std::iter::once(160..=169).collect(), 8, i64::MIN, i64::MAX),
-    ];
-    for (ranges, width, min, max) in widths {
-        for code in ranges.into_iter().flatten() {
-            for value in [min, min + 1, -1, 0, 1, max - 1, max] {
-                // Binary DXF uses a little-endian 16-bit group code and a fixed-width,
-                // little-endian two's-complement integer. Encoding is version-independent.
-                let code_bytes = u16::try_from(code).unwrap().to_le_bytes();
-                let value_bytes = value.to_le_bytes();
-                let expected = [SENTINEL, &code_bytes, &value_bytes[..width]].concat();
-                let tags = [Tag::i(code, value)];
-                for utf8 in [false, true] {
-                    assert_eq!(write_binary(&tags, utf8), expected, "code={code} value={value} utf8={utf8}");
-                }
-                assert_eq!(parse(&expected).unwrap(), tags, "code={code} value={value}");
-            }
-        }
-    }
-}
-
-#[test]
-fn text_encoding_has_independent_wire_expectations() {
-    let tags = [Tag::s(1, "é😀")];
-    let escaped = b"\\U+00E9\\U+D83D\\U+DE00";
-    let utf8 = b"\xc3\xa9\xf0\x9f\x98\x80";
-    for (unicode, text) in [(false, escaped.as_slice()), (true, utf8.as_slice())] {
-        let ascii = [b"  1\r\n".as_slice(), text, b"\r\n"].concat();
-        let binary = [SENTINEL, b"\x01\0", text, b"\0"].concat();
-        assert_eq!(write_ascii_as(&tags, unicode).as_bytes(), ascii, "utf8={unicode}");
-        assert_eq!(write_binary(&tags, unicode), binary, "utf8={unicode}");
-        assert_eq!(parse(&ascii).unwrap(), tags);
-        assert_eq!(parse(&binary).unwrap(), tags);
-    }
-    // Pre-2007 code-page bytes are independent of the writer, which emits Unicode escapes.
-    let ascii = b"0\nSECTION\n2\nHEADER\n9\n$ACADVER\n1\nAC1015\n9\n$DWGCODEPAGE\n3\nANSI_1252\n0\nENDSEC\n1\n\x80\xe9\n0\nEOF\n";
-    let binary = [
-        SENTINEL,
-        b"\0\0SECTION\0\x02\0HEADER\0\x09\0$ACADVER\0\x01\0AC1015\0\x09\0$DWGCODEPAGE\0\x03\0ANSI_1252\0\0\0ENDSEC\0\x01\0\x80\xe9\0\0\0EOF\0",
-    ]
-    .concat();
-    for bytes in [ascii.as_slice(), binary.as_slice()] {
-        let tags = parse(bytes).unwrap();
-        assert_eq!(tags[7], Tag::s(1, "ێ"));
-    }
-}
-
-#[test]
-fn ascii_accepts_line_endings_padding_and_no_final_newline() {
-    let expected = [Tag::i(70, -7), Tag::s(1, "  text  "), Tag::s(0, "EOF")];
-    for newline in ["\n", "\r\n"] {
-        for final_newline in [false, true] {
-            let mut text = [" 70 ", " -7 ", "1", "  text  ", "0", "EOF"].join(newline);
-            if final_newline {
-                text.push_str(newline);
-            }
-            assert_eq!(parse(text.as_bytes()).unwrap(), expected, "newline={newline:?} final={final_newline}");
-        }
-    }
-}
-
-#[test]
-fn malformed_and_truncated_values_are_errors_not_panics() {
-    assert!(matches!(parse(b""), Err(DxfError::NotDxf)));
-    assert!(matches!(parse(b"oops\nvalue\n"), Err(DxfError::BadCode { line: 1, .. })));
-    assert!(matches!(parse(b"10\n"), Err(DxfError::Eof)));
-    assert!(matches!(parse(SENTINEL), Err(DxfError::NotDxf)));
-    for (_, _, binary) in fixtures() {
-        // Every cut inside the first record is an error, unlike cuts between complete records:
-        // the tag API deliberately accepts streams without an EOF record.
-        for cut in 1..binary.len() {
-            let bytes = [SENTINEL, &binary[..cut]].concat();
-            assert!(matches!(parse(&bytes), Err(DxfError::Eof)), "binary={binary:?} cut={cut}");
-        }
-    }
-}
-
-#[test]
-fn tag_limit_accepts_the_exact_boundary_and_rejects_one_less() {
-    let ascii = b"1\nA\n70\n-7\n0\nEOF\n";
-    let binary = [SENTINEL, b"\x01\0A\0\x46\0\xf9\xff\0\0EOF\0"].concat();
-    for bytes in [ascii.as_slice(), binary.as_slice()] {
-        for limit in 0..3 {
-            assert!(matches!(parse_with_limit(bytes, limit), Err(DxfError::TooLarge { limit: actual, .. }) if actual == limit));
-        }
-        for limit in [3, 4] {
-            assert_eq!(parse_with_limit(bytes, limit).unwrap(), [Tag::s(1, "A"), Tag::i(70, -7), Tag::s(0, "EOF")]);
-        }
-    }
-}

crates/dxf/tests/hex_chunks.rs

@@ -1,119 +0,0 @@
-//! Hex payload conformance is distinct from binary framing capacity: DXF groups 310–319 and
-//! 1004 specify at most 127 payload bytes per chunk, even though a length byte represents 255.
-//! Inspect writer bytes without our parser; accept any compliant partition preserving payload,
-//! code and following-record framing. Oversized binary read fixtures test tolerance only.
-//! Pending writer regressions extend the chunk-size finding in issue #1025.
-//! Public DXF Reference, Group Codes in Numerical Order and Binary DXF Files:
-//! https://help.autodesk.com/cloudhelp/2025/ENU/AutoCAD-DXF/files/GUID-3F0380A5-1C15-464D-BC66-2C5F094BCFB9.htm
-//! https://help.autodesk.com/cloudhelp/2025/ENU/AutoCAD-DXF/files/GUID-FC1C3C69-DBC2-49E4-893A-000D6538C0FE.htm
-
-use cadcraft_dxf::{Tag, Value, parse, write_ascii_as, write_binary};
-
-const SENTINEL: &[u8] = b"AutoCAD Binary DXF\r\n\x1a\0";
-const FOLLOWING_BINARY: &[u8] = b"\x46\0\xf9\xff"; // group 70, signed i16 -7
-
-fn payload(length: usize) -> Vec<u8> {
-    (0..length).map(|index| u8::try_from(index * 37 % 256).unwrap()).collect()
-}
-
-fn hex(bytes: &[u8]) -> String {
-    bytes.iter().map(|byte| format!("{byte:02X}")).collect()
-}
-
-fn input(code: i32, bytes: &[u8]) -> [Tag; 2] {
-    [Tag::new(code, Value::Hex(hex(bytes))), Tag::i(70, -7)]
-}
-
-fn check_ascii(code: i32, bytes: &[u8], utf8: bool) {
-    let wire = write_ascii_as(&input(code, bytes), utf8);
-    let lines: Vec<_> = wire.lines().collect();
-    let (chunks, following) = lines.split_at(lines.len().checked_sub(2).unwrap());
-    assert_eq!(following[0].trim(), "70");
-    assert_eq!(following[1], "-7");
-    assert!(!chunks.is_empty(), "an empty payload must still have a tag");
-    let (records, remainder) = chunks.as_chunks::<2>();
-    assert!(remainder.is_empty(), "incomplete group/value pair");
-    let context = format!("ASCII code={code} bytes={} utf8={utf8}", bytes.len());
-    let mut back = Vec::new();
-    for record in records {
-        assert_eq!(record[0].trim().parse::<i32>().unwrap(), code, "{context}");
-        let text = record[1];
-        assert!(text.len() <= 254, "{context}: {} hex characters exceed 127 payload bytes", text.len());
-        assert!(text.bytes().all(|b| b.is_ascii_hexdigit()), "{context}: invalid hex");
-        let (pairs, remainder) = text.as_bytes().as_chunks::<2>();
-        assert!(remainder.is_empty(), "{context}: partial byte");
-        back.extend(pairs.iter().map(|pair| u8::from_str_radix(std::str::from_utf8(pair).unwrap(), 16).unwrap()));
-    }
-    assert_eq!(back, bytes, "{context}: complete payload and byte order");
-}
-
-fn check_binary(code: i32, bytes: &[u8], utf8: bool) {
-    let wire = write_binary(&input(code, bytes), utf8);
-    let mut chunks = wire.strip_prefix(SENTINEL).unwrap().strip_suffix(FOLLOWING_BINARY).unwrap();
-    assert!(!chunks.is_empty(), "an empty payload must still have a tag");
-    let context = format!("binary code={code} bytes={} utf8={utf8}", bytes.len());
-    let mut back = Vec::new();
-    while !chunks.is_empty() {
-        let (&[lo, hi, length], rest) = chunks.split_first_chunk::<3>().unwrap();
-        assert_eq!(i32::from(u16::from_le_bytes([lo, hi])), code, "{context}");
-        assert!(length <= 127, "{context}: {length} bytes exceed the documented group limit");
-        let (chunk, next) = rest.split_at(usize::from(length));
-        back.extend_from_slice(chunk);
-        chunks = next;
-    }
-    assert_eq!(back, bytes, "{context}: complete payload and byte order");
-}
-
-#[test]
-fn conforming_payloads_have_independent_ascii_and_binary_wire_checks() {
-    for code in (310..=319).chain([1004]) {
-        for length in [0, 1, 2, 126, 127] {
-            for utf8 in [false, true] {
-                let bytes = payload(length);
-                check_ascii(code, &bytes, utf8);
-                check_binary(code, &bytes, utf8);
-            }
-        }
-    }
-}
-
-#[test]
-fn binary_reader_tolerates_the_full_length_byte_domain() {
-    // This is deliberately permissive input, not an assertion that oversized chunks conform
-    // or that the writer should produce them. The following record catches framing mistakes.
-    for code in (310_u16..=319).chain([1004]) {
-        for length in 0..=u8::MAX {
-            let bytes = payload(usize::from(length));
-            let mut wire = SENTINEL.to_vec();
-            wire.extend_from_slice(&code.to_le_bytes());
-            wire.push(length);
-            wire.extend_from_slice(&bytes);
-            wire.extend_from_slice(FOLLOWING_BINARY);
-            assert_eq!(parse(&wire).unwrap(), input(i32::from(code), &bytes), "code={code} length={length}");
-        }
-    }
-}
-
-#[test]
-#[ignore = "Confirmed ASCII DXF writer nonconformance: hex payloads above 127 bytes are emitted as one oversized chunk"]
-fn ascii_writer_splits_large_payloads_into_conforming_chunks() {
-    for code in (310..=319).chain([1004]) {
-        for length in [128, 254, 255, 256, 1024] {
-            for utf8 in [false, true] {
-                check_ascii(code, &payload(length), utf8);
-            }
-        }
-    }
-}
-
-#[test]
-#[ignore = "Confirmed binary DXF writer nonconformance: 255-byte partitioning exceeds the documented 127-byte group limit"]
-fn binary_writer_splits_large_payloads_into_conforming_chunks() {
-    for code in (310..=319).chain([1004]) {
-        for length in [128, 254, 255, 256, 1024] {
-            for utf8 in [false, true] {
-                check_binary(code, &payload(length), utf8);
-            }
-        }
-    }
-}

crates/dxf/tests/roundtrip.rs

@@ -1,148 +0,0 @@
-//! Deterministic tag preservation through the public byte API, in both encodings and every
-//! supported version. Inputs have the group code's type and representable values; lossy
-//! coercions are not accepted as round-trip equality. Real values must retain their bits.
-
-use cadcraft_dxf::{Tag, Value, Version, is_binary, parse, write_ascii_as, write_binary};
-
-fn check(case: &str, body: &[Tag]) {
-    for version in Version::ALL {
-        let mut original = vec![
-            Tag::s(0, "SECTION"),
-            Tag::s(2, "HEADER"),
-            Tag::s(9, "$ACADVER"),
-            Tag::s(1, version.code()),
-            Tag::s(9, "$DWGCODEPAGE"),
-            Tag::s(3, "ANSI_1252"),
-            Tag::s(0, "ENDSEC"),
-            Tag::s(0, "SECTION"),
-            Tag::s(2, "ENTITIES"),
-        ];
-        original.extend_from_slice(body);
-        original.extend([Tag::s(0, "ENDSEC"), Tag::s(0, "EOF")]);
-        for binary in [false, true] {
-            let mut current = original.clone();
-            for pass in 1..=2 {
-                let context = format!("{case} · {version} · binary={binary} · pass={pass}");
-                let bytes = if binary { write_binary(&current, version.utf8()) } else { write_ascii_as(&current, version.utf8()).into_bytes() };
-                assert_eq!(is_binary(&bytes), binary, "{context}");
-                let back = parse(&bytes).unwrap_or_else(|e| panic!("{context}: {e}"));
-                assert_eq!(back.len(), original.len(), "{context}: tag count");
-                for (index, (expected, actual)) in original.iter().zip(&back).enumerate() {
-                    assert_eq!(actual, expected, "{context}: tag[{index}]");
-                    if let (Value::Real(a), Value::Real(b)) = (&expected.value, &actual.value) {
-                        assert_eq!(b.to_bits(), a.to_bits(), "{context}: tag[{index}] real bits");
-                    }
-                }
-                assert_eq!(back, current, "{context}: no additional changes on resave");
-                current = back;
-            }
-        }
-    }
-}
-
-#[test]
-fn integer_width_boundaries() {
-    // Explicit reference ranges, not obtained from the codec's kind_of().
-    let widths = [
-        (vec![60..=79, 170..=179, 270..=289, 370..=389, 400..=409, 1060..=1070], i64::from(i16::MIN), i64::from(i16::MAX)),
-        (vec![90..=99, 420..=429, 440..=459, 1071..=1071], i64::from(i32::MIN), i64::from(i32::MAX)),
-        (std::iter::once(160..=169).collect(), i64::MIN, i64::MAX),
-    ];
-    for (ranges, min, max) in widths {
-        for value in [min, min + 1, -1, 0, 1, max - 1, max] {
-            let tags: Vec<_> = ranges.iter().cloned().flatten().map(|code| Tag::i(code, value)).collect();
-            check(&format!("integer/{min}..{max}/{value}"), &tags);
-        }
-    }
-}
-
-#[test]
-fn finite_reals_keep_all_bits() {
-    let values = [
-        0.0,
-        -0.0,
-        f64::from_bits(1),
-        -f64::from_bits(1),
-        f64::MIN_POSITIVE,
-        f64::MIN_POSITIVE.next_down(),
-        0.1,
-        -3.25,
-        1.0_f64.next_down(),
-        1.0,
-        1.0_f64.next_up(),
-        1e-100,
-        -1e100,
-        f64::MAX,
-        f64::MIN,
-    ];
-    for value in values {
-        let tags: Vec<_> =
-            [10..=59, 110..=149, 210..=239, 460..=469, 1010..=1059].into_iter().flatten().map(|code| Tag::new(code, Value::Real(value))).collect();
-        check(&format!("real/{:016X}", value.to_bits()), &tags);
-    }
-}
-
-#[test]
-fn booleans() {
-    for value in [false, true] {
-        let tags: Vec<_> = (290..=299).map(|code| Tag::new(code, Value::Bool(value))).collect();
-        check(&format!("bool/{value}"), &tags);
-    }
-}
-
-#[test]
-fn strings_preserve_whitespace_unicode_and_literal_escapes() {
-    // No CR/LF or NUL: those are line/string delimiters, not losslessly writable payloads.
-    let values = [
-        ("empty", ""),
-        ("spaces", "  leading and trailing  "),
-        ("tabs", "\tindented\t"),
-        ("unicode", "Café Ø 图号 Україна 😀 e\u{301}"),
-        ("literal-escapes", r"\U+0041 \M+183A4 \U+D83D\U+DE00 \\U+005C \P %%c"),
-        ("malformed-escapes", r"\U+ \U+ZZZZ \U+D800 \U+DC00 \M+9FFFF"),
-    ];
-    for (case, value) in values {
-        let tags: Vec<_> =
-            [0..=9, 100..=100, 102..=102, 105..=105, 300..=309, 320..=369, 410..=419, 430..=439, 470..=479, 480..=481, 1000..=1003, 1005..=1005]
-                .into_iter()
-                .flatten()
-                .map(|code| Tag::s(code, value))
-                .collect();
-        check(case, &tags);
-    }
-    for length in [1, 254, 255, 256, 1024] {
-        check(&format!("string/length={length}"), &[Tag::s(1, "x".repeat(length))]);
-    }
-}
-
-#[test]
-fn hex_chunks_keep_bytes_and_order() {
-    // DXF groups 310–319 and 1004 permit 127 payload bytes per chunk. A binary length
-    // byte can represent more, but that is reader tolerance, not writer conformance.
-    // Larger payloads need chunk-size/reassembly checks rather than exact tag equality;
-    // see hex_chunks.rs for the independent wire checks and pending writer regressions.
-    for length in [0, 1, 2, 126, 127] {
-        let hex: String = (0..length).map(|i| format!("{:02X}", (i * 37) % 256)).collect();
-        let tags: Vec<_> = (310..=319).chain([1004]).map(|code| Tag::new(code, Value::Hex(hex.clone()))).collect();
-        check(&format!("hex/bytes={length}"), &tags);
-    }
-}
-
-#[test]
-fn mixed_values_and_repeated_codes_keep_order() {
-    check(
-        "mixed/repeated-codes",
-        &[
-            Tag::s(0, "TEST"),
-            Tag::f(10, 1.25),
-            Tag::s(1, "first"),
-            Tag::f(10, -2.5),
-            Tag::i(70, -7),
-            Tag::s(1, "second"),
-            Tag::new(290, Value::Bool(true)),
-            Tag::new(310, Value::Hex("00FF80".into())),
-            Tag::i(160, i64::MAX),
-            Tag::s(1, ""),
-        ],
-    );
-}

crates/engine/Cargo.toml

@@ -12,7 +12,7 @@ workspace = true
 cadcraft-geom = { workspace = true }
 cadcraft-color = { workspace = true }
 cadcraft-doc = { workspace = true }
-cadcraft-dxf = { workspace = true }
+craft-dxf = { workspace = true }
 cadcraft-constraints = { workspace = true }
 cadcraft-fonts = { workspace = true }
 cadcraft-render = { workspace = true }

crates/engine/src/assoc.rs

@@ -40,8 +40,12 @@ fn arc_geom(a: &cadcraft_doc::Arc) -> cadcraft_geom::Arc {
 
 /// Where a snap sits on an object now.
 pub fn snap_point(d: &Drawing, a: &DimAssoc) -> Option<Vec2> {
-    let e = d.entity(a.handle)?;
-    match (&e.kind, &a.snap) {
+    snap_on(d, &d.entity(a.handle)?.kind, &a.snap)
+}
+
+/// Where `snap` sits on an object of kind `kind` (an intersection finds its other line in `d`).
+fn snap_on(d: &Drawing, kind: &EntityKind, snap: &AssocSnap) -> Option<Vec2> {
+    match (kind, snap) {
         (EntityKind::Line(l), AssocSnap::Start) => Some(l.a.xy()),
         (EntityKind::Line(l), AssocSnap::End) => Some(l.b.xy()),
         (EntityKind::Line(l), AssocSnap::Mid) => Some(l.a.xy().mid(l.b.xy())),
@@ -88,6 +92,61 @@ fn candidates(kind: &EntityKind) -> Vec<(AssocSnap, Vec2)> {
     }
 }
 
+/// Whether two snaps are the same kind of object point: an endpoint or vertex, a centre, or a
+/// midpoint.
+fn same_kind(a: &AssocSnap, b: &AssocSnap) -> bool {
+    matches!(
+        (a, b),
+        (AssocSnap::Start | AssocSnap::End | AssocSnap::Vertex { .. }, AssocSnap::Start | AssocSnap::End | AssocSnap::Vertex { .. })
+            | (AssocSnap::Center, AssocSnap::Center)
+            | (AssocSnap::Mid, AssocSnap::Mid)
+    )
+}
+
+/// BREAK or TRIM reshaped the object `pieces[0]` (which was `old`) and added the other pieces:
+/// move the dimension attachments on it as AutoCAD 2024 does. An attachment whose point is still
+/// a point of the same kind on the object stays there (a closed polyline opened by BREAK numbers
+/// its vertices from the break); one whose point is on a new piece moves to that piece, so a
+/// dimension across a line broken in its middle stays where it was; any other is left as it was,
+/// so the dimension follows the object's new end when that end was cut off. Attachments at an
+/// angle on a circle or arc and at an intersection stay on the object. [`update`] moves the
+/// definition points after the command.
+pub fn follow_pieces(d: &mut Drawing, old: &EntityKind, pieces: &[Handle]) {
+    let Some(&h) = pieces.first() else { return };
+    let mut changes: Vec<(Handle, Vec<DimAssoc>)> = Vec::new();
+    for store in std::iter::once(&d.model).chain(d.layouts.iter().map(|l| &l.entities)) {
+        for e in store.iter() {
+            let EntityKind::Dimension(dm) = &e.kind else { continue };
+            if !dm.assoc.iter().any(|a| a.handle == h) {
+                continue;
+            }
+            let assoc: Vec<DimAssoc> = dm.assoc.iter().map(|a| on_piece(d, old, pieces, a).unwrap_or_else(|| a.clone())).collect();
+            if assoc != dm.assoc {
+                changes.push((e.handle, assoc));
+            }
+        }
+    }
+    for (dh, assoc) in changes {
+        let _ = d.modify_entity(dh, |e| {
+            if let EntityKind::Dimension(dm) = &mut e.kind {
+                dm.assoc = assoc;
+            }
+        });
+    }
+}
+
+/// The piece attachment `a` moves to when its object became `pieces` (see [`follow_pieces`]).
+fn on_piece(d: &Drawing, old: &EntityKind, pieces: &[Handle], a: &DimAssoc) -> Option<DimAssoc> {
+    if pieces.first() != Some(&a.handle) || matches!(a.snap, AssocSnap::OnCircle { .. } | AssocSnap::Intersection { .. }) {
+        return None;
+    }
+    let p = snap_on(d, old, &a.snap)?;
+    pieces.iter().find_map(|&ph| {
+        let (snap, _) = candidates(&d.entity(ph)?.kind).into_iter().find(|(s, q)| same_kind(&a.snap, s) && close(p, *q))?;
+        Some(DimAssoc { point: a.point.clone(), handle: ph, snap })
+    })
+}
+
 /// An object point exactly at `p` (an endpoint, vertex, centre or midpoint) to attach to.
 pub fn find_snap(d: &Drawing, space: &Space, p: Vec2) -> Option<(Handle, AssocSnap)> {
     if !p.is_finite() {
@@ -244,8 +303,10 @@ pub fn recompute(dm: &Dimension, prev: Option<&Dimension>, before: &Drawing, aft
     let was = prev.unwrap_or(dm);
     nd.assoc.retain(|a| {
         let Some(old) = def_point(was, &a.point) else { return false };
-        // Only follow if the point sat on the object before the change.
-        if let Some(prev) = snap_point(before, a)
+        // Only follow if the point sat on the object before the change, as attached then (BREAK
+        // and TRIM may have moved the attachment to a piece of the object since).
+        let held = was.assoc.iter().find(|o| o.point == a.point).unwrap_or(a);
+        if let Some(prev) = snap_point(before, held)
             && !close(prev, old.xy())
         {
             return false;
@@ -304,16 +365,20 @@ pub fn update(after: &mut Arc<Drawing>, before: &Drawing) -> usize {
                 if dm.assoc.is_empty() {
                     continue;
                 }
-                let touched = dm.assoc.iter().any(|a| {
-                    src_changed(before, d, a.handle) || matches!(a.snap, AssocSnap::Intersection { other } if src_changed(before, d, other))
-                });
-                if !touched {
-                    continue;
-                }
                 let prev = match before.entity(e.handle).map(|x| &x.kind) {
                     Some(EntityKind::Dimension(p)) => Some(p),
                     _ => None,
                 };
+                // Its objects changed, or the command moved an attachment (BREAK and TRIM move them
+                // to new pieces, which a later pick of the same TRIM may reshape again).
+                let touched = dm.assoc.iter().any(|a| {
+                    src_changed(before, d, a.handle)
+                        || matches!(a.snap, AssocSnap::Intersection { other } if src_changed(before, d, other))
+                        || prev.is_some_and(|p| !p.assoc.contains(a))
+                });
+                if !touched {
+                    continue;
+                }
                 let nd = recompute(dm, prev, before, d);
                 if nd != *dm {
                     changes.push((e.handle, nd));

crates/engine/src/atomic_write.rs

@@ -16,10 +16,31 @@ use std::fs::{File, OpenOptions, Permissions};
 use std::io::{self, Write};
 use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Arc, Mutex, OnceLock, Weak};
 
 /// Monotonic counter making temporary names unique within this process without a RNG dependency.
 static SEQ: AtomicU64 = AtomicU64::new(0);
 
+/// Locks held from destination metadata inspection through rename, so concurrent writes cannot
+/// combine permissions from one version of a path with the group of another.
+fn path_lock(path: &Path) -> Arc<Mutex<()>> {
+    static LOCKS: OnceLock<Mutex<std::collections::HashMap<PathBuf, Weak<Mutex<()>>>>> = OnceLock::new();
+    let absolute = if path.is_absolute() { path.to_path_buf() } else { std::env::current_dir().unwrap_or_default().join(path) };
+    let key = match (absolute.parent(), absolute.file_name()) {
+        (Some(parent), Some(name)) => std::fs::canonicalize(parent).unwrap_or_else(|_| parent.to_path_buf()).join(name),
+        _ => absolute,
+    };
+    let mut locks = LOCKS.get_or_init(|| Mutex::new(std::collections::HashMap::new())).lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    locks.retain(|_, lock| lock.strong_count() > 0);
+    if let Some(lock) = locks.get(&key).and_then(Weak::upgrade) {
+        lock
+    } else {
+        let lock = Arc::new(Mutex::new(()));
+        locks.insert(key, Arc::downgrade(&lock));
+        lock
+    }
+}
+
 /// How many fresh temporary names to try before giving up (each collision is another local race).
 const MAX_TRIES: u32 = 32;
 
@@ -33,13 +54,15 @@ pub fn write_atomic(path: &Path, bytes: &[u8]) -> io::Result<()> {
     // A symlinked destination is resolved so the link stays a link and its target is replaced.
     let resolved = resolve_symlink(path)?;
     let path = resolved.as_deref().unwrap_or(path);
+    let lock = path_lock(path);
+    let _guard = lock.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     let permissions = match std::fs::symlink_metadata(path) {
         Ok(meta) if meta.is_file() => Some(meta.permissions()),
         Ok(_) => None,
         Err(e) if e.kind() == io::ErrorKind::NotFound => None,
         Err(e) => return Err(e),
     };
-    write_atomic_with(path, permissions, |file| file.write_all(bytes))
+    write_atomic_with_locked(path, permissions, |file| file.write_all(bytes))
 }
 
 /// The topmost folder missing above `path`: what [`write_atomic_making_folders`] will create.
@@ -67,10 +90,30 @@ pub fn write_atomic_making_folders(path: &Path, bytes: &[u8]) -> io::Result<()>
 /// with `permissions` given to it from its creation (`None`: the usual creation mode). A symlink
 /// at `path` is replaced by the new file, never written through.
 pub fn write_atomic_with(path: &Path, permissions: Option<Permissions>, fill: impl FnOnce(&mut File) -> io::Result<()>) -> io::Result<()> {
+    let lock = path_lock(path);
+    let _guard = lock.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    write_atomic_with_locked(path, permissions, fill)
+}
+
+/// [`write_atomic_with`] with permissions derived under the same destination lock as the write.
+pub fn write_atomic_with_permissions(
+    path: &Path,
+    permissions: impl FnOnce() -> io::Result<Option<Permissions>>,
+    fill: impl FnOnce(&mut File) -> io::Result<()>,
+) -> io::Result<()> {
+    let lock = path_lock(path);
+    let _guard = lock.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let permissions = permissions()?;
+    write_atomic_with_locked(path, permissions, fill)
+}
+
+fn write_atomic_with_locked(path: &Path, permissions: Option<Permissions>, fill: impl FnOnce(&mut File) -> io::Result<()>) -> io::Result<()> {
     let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).map_or_else(|| PathBuf::from("."), Path::to_path_buf);
     let (mut file, tmp) = create_temp(&dir, permissions.as_ref())?;
     let write = (|| {
         if let Some(permissions) = permissions {
+            #[cfg(unix)]
+            let permissions = keep_group(&file, path, permissions);
             file.set_permissions(permissions)?;
         }
         fill(&mut file)?;
@@ -90,6 +133,20 @@ pub fn write_atomic_with(path: &Path, permissions: Option<Permissions>, fill: im
     Ok(())
 }
 
+/// `permissions` for the new file when `path` already exists: the group bits mean "this group" only
+/// if the file is still in the old file's group, so the group is restored first. When it can't be
+/// (the user is not a member of it), the group bits are dropped rather than handed to another group.
+#[cfg(unix)]
+fn keep_group(file: &File, path: &Path, permissions: Permissions) -> Permissions {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt, fchown};
+    let Ok(old) = std::fs::symlink_metadata(path) else { return permissions };
+    // A file already in the old group needs no change (and a restrictive syscall policy may refuse a no-op fchown).
+    if !old.is_file() || file.metadata().is_ok_and(|m| m.gid() == old.gid()) || fchown(file, None, Some(old.gid())).is_ok() {
+        return permissions;
+    }
+    Permissions::from_mode(permissions.mode() & !0o070)
+}
+
 /// Flush `dir` so a rename just made in it survives a crash or power loss (POSIX records a
 /// rename in the directory, not in the file). Best effort: some file systems (network shares)
 /// refuse to sync a directory, and the file itself is already on disk.
@@ -231,6 +288,33 @@ mod tests {
         std::fs::remove_dir_all(&dir).ok();
     }
 
+    /// The replacement keeps the old file's group (when the user is in another group, as `id -G`
+    /// says) together with its mode, so the group bits never name a different group.
+    #[cfg(unix)]
+    #[test]
+    fn keeps_the_group_and_mode_of_the_file_it_replaces() {
+        use std::os::unix::fs::{MetadataExt, PermissionsExt, chown};
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-grp-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let dest = dir.join("out.bin");
+        std::fs::write(&dest, b"old").unwrap();
+        std::fs::set_permissions(&dest, Permissions::from_mode(0o640)).unwrap();
+        let own = std::fs::metadata(&dest).unwrap().gid();
+        let other = std::process::Command::new("id")
+            .arg("-G")
+            .output()
+            .ok()
+            .and_then(|o| String::from_utf8_lossy(&o.stdout).split_whitespace().filter_map(|g| g.parse::<u32>().ok()).find(|g| *g != own));
+        if let Some(gid) = other {
+            chown(&dest, None, Some(gid)).unwrap();
+        }
+        let want = std::fs::metadata(&dest).unwrap();
+        write_atomic(&dest, b"new").unwrap();
+        let got = std::fs::metadata(&dest).unwrap();
+        assert_eq!((got.gid(), got.mode() & 0o777), (want.gid(), 0o640));
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
     #[cfg(unix)]
     #[test]
     fn does_not_follow_a_planted_temp_symlink() {

crates/engine/src/audit.rs

@@ -234,9 +234,10 @@ fn tables(d: &mut Drawing, out: &mut Vec<Issue>) {
         missing("table style", "Standard", out);
         d.table_styles.insert(0, TableStyle::default());
     }
-    let linetypes: Vec<String> = d.linetypes.iter().map(|l| l.name.clone()).collect();
+    // Name sets built once: both tables come from the drawing, so a scan per reference is quadratic.
+    let linetypes: HashSet<String> = d.linetypes.iter().map(|l| l.name.to_ascii_lowercase()).collect();
     for l in &mut d.layers {
-        if !linetypes.iter().any(|n| n.eq_ignore_ascii_case(&l.linetype)) {
+        if !linetypes.contains(&l.linetype.to_ascii_lowercase()) {
             out.push(issue(
                 "missingLinetype",
                 "tables",
@@ -247,8 +248,8 @@ fn tables(d: &mut Drawing, out: &mut Vec<Issue>) {
             l.linetype = "Continuous".into();
         }
     }
-    let styles: Vec<String> = d.text_styles.iter().map(|s| s.name.clone()).collect();
-    let known = |n: &str| styles.iter().any(|s| s.eq_ignore_ascii_case(n));
+    let styles: HashSet<String> = d.text_styles.iter().map(|s| s.name.to_ascii_lowercase()).collect();
+    let known = |n: &str| styles.contains(&n.to_ascii_lowercase());
     for s in &mut d.dim_styles {
         if !known(&s.text_style) {
             out.push(issue(

crates/engine/src/autosave.rs

@@ -166,9 +166,11 @@ pub struct Autosaver {
     start: std::time::Instant,
     #[cfg(not(target_arch = "wasm32"))]
     last_beat: Option<f64>,
-    /// The lock file this app holds the system lock on, open for as long as the lock is wanted.
+    /// This app's lock files: one per folder, because SAVEFILEPATH can change while files remain
+    /// in the old folder. Each with the file it holds open for the system lock, or `None` where
+    /// locks don't work and only the file's age counts.
     #[cfg(not(target_arch = "wasm32"))]
-    lock: Option<(std::path::PathBuf, std::fs::File)>,
+    locks: Vec<(std::path::PathBuf, Option<std::fs::File>)>,
 }
 
 impl Autosaver {
@@ -185,7 +187,7 @@ impl Autosaver {
             #[cfg(not(target_arch = "wasm32"))]
             last_beat: None,
             #[cfg(not(target_arch = "wasm32"))]
-            lock: None,
+            locks: Vec::new(),
         }
     }
 
@@ -203,9 +205,9 @@ impl Autosaver {
         self.docs.values().filter_map(|t| t.file.clone()).collect()
     }
 
-    /// Why a drawing currently has no up-to-date recovery copy, for the host to show the user.
-    pub fn failure(&self) -> Option<&str> {
-        self.failed.values().next().map(String::as_str)
+    /// The drawings with no up-to-date recovery copy and why, for the host to show the user.
+    pub fn failures(&self) -> impl Iterator<Item = (u64, &str)> {
+        self.failed.iter().map(|(uid, why)| (*uid, why.as_str()))
     }
 
     /// What to do at `now` (seconds, any fixed origin) with SAVETIME `minutes` and autosave folder
@@ -403,10 +405,11 @@ mod native {
     pub fn prune_locks(dir: &Path) {
         let Ok(entries) = std::fs::read_dir(dir) else { return };
         let names: Vec<String> = entries.flatten().take(10_000).map(|e| e.file_name().to_string_lossy().to_string()).collect();
+        // The instances that own autosave files, parsed once rather than once per lock file.
+        let with_files: std::collections::HashSet<&str> = names.iter().filter_map(|f| parse_file_name(f)).map(|(_, i, _)| i).collect();
         for n in &names {
             let Some(instance) = parse_lock_name(n) else { continue };
-            let has_files = names.iter().any(|f| parse_file_name(f).is_some_and(|(_, i, _)| i == instance));
-            if !has_files && !owner_alive(dir, instance) {
+            if !with_files.contains(instance) && !owner_alive(dir, instance) {
                 let _ = std::fs::remove_file(dir.join(n));
             }
         }
@@ -433,7 +436,22 @@ mod native {
         }
         // Create a fresh temporary file exclusively and rename it into place, so a planted
         // `<path>.tmp` symlink in a shared autosave directory cannot redirect the write (CWE-59).
-        crate::atomic_write::write_atomic(Path::new(path), &bytes).map_err(|e| e.to_string())
+        // The file holds unsaved work: owner-only from its creation, whatever the umask.
+        crate::atomic_write::write_atomic_with(Path::new(path), private_mode(), |f| f.write_all(&bytes)).map_err(|e| e.to_string())
+    }
+
+    /// Owner read/write only (`None` where file modes don't exist).
+    fn private_mode() -> Option<std::fs::Permissions> {
+        #[cfg(unix)]
+        return Some(std::os::unix::fs::PermissionsExt::from_mode(0o600));
+        #[cfg(not(unix))]
+        None
+    }
+
+    /// Write this app's lock file at `path` without following a link planted there: the file is
+    /// replaced (exclusive temporary file, then rename), never written through (CWE-59).
+    fn write_lock(path: &Path, id: u32) -> std::io::Result<()> {
+        crate::atomic_write::write_atomic_with(path, private_mode(), |f| f.write_all(id.to_string().as_bytes()))
     }
 
     impl Autosaver {
@@ -471,6 +489,12 @@ mod native {
             self.running.iter().any(|(_, h)| !h.is_finished())
         }
 
+        /// Whether a write's result hasn't been taken in yet, finished or not: the host needs
+        /// another [`Autosaver::tick`] to learn whether it failed.
+        pub fn results_pending(&self) -> bool {
+            !self.running.is_empty()
+        }
+
         /// Take in the writes that have finished ([`Autosaver::tick`] does this first). A drawing
         /// whose write failed is no longer counted as autosaved: the next plan restarts its clock,
         /// so it is tried again SAVETIME later even if it doesn't change, and [`Autosaver::failure`]
@@ -479,16 +503,41 @@ mod native {
             let (done, running) = std::mem::take(&mut self.running).into_iter().partition::<Vec<_>, _>(|(_, h)| h.is_finished());
             self.running = running;
             for (uid, h) in done {
-                self.busy.remove(&uid);
-                match h.join().unwrap_or_else(|_| Err("the autosave writer stopped unexpectedly".to_string())) {
-                    Ok(()) => {
-                        self.failed.remove(&uid);
-                    }
-                    Err(e) => self.unwritten(uid, e),
-                }
+                self.settle(uid, h);
             }
         }
 
+        fn settle(&mut self, uid: u64, h: std::thread::JoinHandle<std::result::Result<(), String>>) {
+            self.busy.remove(&uid);
+            match h.join().unwrap_or_else(|_| Err("the autosave writer stopped unexpectedly".to_string())) {
+                Ok(()) => {
+                    self.failed.remove(&uid);
+                }
+                Err(e) => self.unwritten(uid, e),
+            }
+        }
+
+        /// Write every drawing with changes not yet autosaved and wait until it is done, because
+        /// the app has gone wrong and may not get another frame. Unlike [`Autosaver::save_now`]
+        /// this also runs when SAVETIME is 0: unsaved work comes before that preference. Returns
+        /// how many drawings were written.
+        pub fn emergency_save(&mut self, s: &Session) -> usize {
+            for (uid, h) in std::mem::take(&mut self.running) {
+                self.settle(uid, h);
+            }
+            let now = self.start.elapsed().as_secs_f64();
+            let dir = savefilepath();
+            let jobs = self.plan_with(s, now, savetime().max(1), &dir, true);
+            let uids: Vec<u64> = jobs.iter().filter_map(|j| if let Job::Write { uid, .. } = j { Some(*uid) } else { None }).collect();
+            self.perform(jobs);
+            self.last_beat = None;
+            self.heartbeat(&dir, now);
+            for (uid, h) in std::mem::take(&mut self.running) {
+                self.settle(uid, h);
+            }
+            uids.iter().filter(|uid| !self.failed.contains_key(uid)).count()
+        }
+
         fn unwritten(&mut self, uid: u64, why: String) {
             if let Some(t) = self.docs.get_mut(&uid) {
                 t.written = None;
@@ -544,23 +593,44 @@ mod native {
             }
         }
 
-        /// Refresh the lock file at `path`, taking the system lock on it first if this app doesn't
-        /// hold it there yet. Without one the file still works by its age.
+        /// Refresh this app's lock files, and start one at `path` if there isn't one yet, taking
+        /// the system lock on it if it can. Without that lock the file still works by its age.
+        /// Only trouble at `path` is an error: an older folder may be gone by now.
         fn refresh_lock(&mut self, path: &Path) -> std::io::Result<()> {
-            if let Some((held, file)) = &self.lock
-                && held == path
-            {
-                return file.set_modified(SystemTime::now());
-            }
-            self.lock = None;
             let id = std::process::id();
-            let mut file = OpenOptions::new().write(true).create(true).truncate(false).open(path)?;
+            let mut current = None;
+            for (held, file) in &self.locks {
+                let refreshed = match file {
+                    Some(file) => file.set_modified(SystemTime::now()),
+                    None => write_lock(held, id),
+                };
+                if held == path {
+                    current = Some(refreshed);
+                }
+            }
+            if let Some(refreshed) = current {
+                return refreshed;
+            }
+            let mut options = OpenOptions::new();
+            options.write(true).create(true).truncate(false);
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::OpenOptionsExt;
+                // A symlink planted at the lock path must not be opened (and truncated) through,
+                // nor a FIFO wait for a reader.
+                options.custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK).mode(0o600);
+            }
+            let mut file = options.open(path)?;
+            if !file.metadata()?.is_file() {
+                return Err(std::io::Error::new(std::io::ErrorKind::InvalidInput, "the lock file is not a plain file"));
+            }
             if file.try_lock().is_err() {
-                return std::fs::write(path, id.to_string());
+                self.locks.push((path.to_path_buf(), None));
+                return write_lock(path, id);
             }
             file.set_len(0)?;
             file.write_all(format!("{id}{LOCK_HELD}").as_bytes())?;
-            self.lock = Some((path.to_path_buf(), file));
+            self.locks.push((path.to_path_buf(), Some(file)));
             Ok(())
         }
 
@@ -575,13 +645,40 @@ mod native {
                 discard(&path);
             }
             self.docs.clear();
-            self.lock = None;
+            for (path, file) in self.locks.drain(..) {
+                drop(file);
+                let _ = std::fs::remove_file(path);
+            }
             let dir = savefilepath();
             if !dir.is_empty() && is_instance_id(&self.instance) {
                 let _ = std::fs::remove_file(lock_path(Path::new(&dir), &self.instance));
             }
         }
     }
+
+    #[cfg(all(test, unix))]
+    mod tests {
+        use super::*;
+
+        /// A symlink planted at the lock path is neither opened through nor written through.
+        #[test]
+        fn lock_writes_do_not_follow_a_planted_link() {
+            let dir = std::env::temp_dir().join(format!("cadcraft-lock-link-{}", std::process::id()));
+            std::fs::create_dir_all(&dir).unwrap();
+            let victim = dir.join("victim.txt");
+            std::fs::write(&victim, b"precious").unwrap();
+            let link = dir.join("1-a.lock");
+            std::os::unix::fs::symlink(&victim, &link).unwrap();
+            let mut a = Autosaver::new("1-a");
+            assert!(a.refresh_lock(&link).is_err());
+            assert_eq!(std::fs::read(&victim).unwrap(), b"precious");
+            write_lock(&link, 42).unwrap();
+            assert_eq!(std::fs::read(&victim).unwrap(), b"precious");
+            assert!(!std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink());
+            assert_eq!(std::fs::read(&link).unwrap(), b"42");
+            std::fs::remove_dir_all(dir).unwrap();
+        }
+    }
 }
 
 #[cfg(test)]

crates/engine/src/blockedit.rs

@@ -144,10 +144,10 @@ impl BlockEdit {
         }
         let host = &self.host.doc;
         let mut d = editor.clone();
-        // When the block is saved under another name, the edited block keeps the drawing's
-        // description and block `name` gets the description changed in the editor.
+        // When saving a copy, the source keeps its last saved definition. The editor's own
+        // table entry can still be the one from before BSAVE; the copy gets the edited data.
         if !name.eq_ignore_ascii_case(&self.name) {
-            keep_description(&mut d, host, &self.name);
+            restore_saved_definition(&mut d, host, &self.name);
         }
         d.model = host.model.clone();
         d.layouts = host.layouts.clone();
@@ -176,16 +176,13 @@ impl BlockEdit {
     }
 }
 
-/// Give block `name` of `d` the description `host` has for it, or, when `host` has no such block,
-/// drop the empty definition a description gives a block the editor started and never saved.
-fn keep_description(d: &mut Drawing, host: &Drawing, name: &str) {
+/// Keep the source block's saved objects and metadata when the edited objects are saved as a copy.
+/// Without a saved source, drop the empty definition an editor description may have created.
+fn restore_saved_definition(d: &mut Drawing, host: &Drawing, name: &str) {
     match host.block(name) {
         Some(h) => {
-            if let Some((_, b)) = d.blocks.iter_mut().find(|(k, _)| k.eq_ignore_ascii_case(name))
-                && b.description != h.description
-            {
-                Arc::make_mut(b).description = h.description.clone();
-            }
+            let key = d.blocks.keys().find(|key| key.eq_ignore_ascii_case(name)).cloned().unwrap_or_else(|| h.name.clone());
+            d.blocks.insert(key, h.clone());
         }
         None => d.blocks.retain(|k, b| !(k.eq_ignore_ascii_case(name) && b.entities.is_empty())),
     }
@@ -302,7 +299,7 @@ impl DocState {
             let was = be.name.clone();
             let reconcile = |doc: &mut Arc<Drawing>| {
                 let editor = Arc::make_mut(doc);
-                keep_description(editor, &d, &was);
+                restore_saved_definition(editor, &d, &was);
                 editor.blocks.retain(|k, _| !k.eq_ignore_ascii_case(&name));
                 editor.blocks.insert(name.clone(), b.clone());
             };

crates/engine/src/cmd.rs

@@ -18,10 +18,12 @@ mod gripcmds;
 mod griphot;
 pub(crate) mod groups;
 pub(crate) mod hatch;
+mod image;
 mod inquiry;
 mod layer;
 mod layout;
 mod lisp;
+mod merge;
 mod mleader_content;
 mod mleader_edit;
 mod modify;
@@ -199,6 +201,7 @@ pub fn command_specs() -> &'static [CommandSpec] {
         v.extend(layer::specs());
         v.extend(layout::specs());
         v.extend(exchange::specs());
+        v.extend(image::specs());
         v.extend(props::specs());
         v.extend(inquiry::specs());
         v.extend(settings::specs());

crates/engine/src/cmd/array.rs

@@ -159,6 +159,7 @@ pub(crate) fn make_assoc(s: &mut Session, objs: &[Handle], base: Vec2, mut p: Ar
         rows: 1,
         col_spacing: 0.0,
         row_spacing: 0.0,
+        clip: None,
     }))
 }
 
@@ -177,14 +178,34 @@ fn create(s: &mut Session, objs: &[Handle], base: Vec2, p: ArrayParams, assoc: b
     Ok(json!({ "created": n }))
 }
 
+/// The most objects EXPLODE of one associative array makes from its source objects (ten times the
+/// default MAXARRAY).
+const MAX_EXPLODED_OBJECTS: usize = 1_000_000;
+
 /// EXPLODE of an associative array: every item becomes the objects of its block (the source
 /// objects, or a replacement block's reference), in world coordinates. `None` for other objects.
+///
+/// An array that would explode into more than [`MAX_EXPLODED_OBJECTS`] objects (items times the
+/// objects of the source block, which a file sets freely) is not expanded here: `None`, so EXPLODE
+/// takes the array block's own items.
 pub(crate) fn explode_array(d: &Drawing, e: &Entity) -> Option<Vec<Entity>> {
     let EntityKind::Insert(ins) = &e.kind else { return None };
     let p = d.array_params(e)?;
     let blk = d.block(&ins.block)?;
     let m = ins.transform(blk.base.xy());
-    let mut out = Vec::new();
+    // Count first: a hostile array must be refused before any entity is cloned.
+    let total = blk
+        .entities
+        .iter()
+        .map(|it| match &it.kind {
+            EntityKind::Insert(i) if i.block.eq_ignore_ascii_case(&p.source) => d.block(&i.block).map_or(1, |b| b.entities.len()),
+            _ => 1,
+        })
+        .fold(0usize, usize::saturating_add);
+    if total > MAX_EXPLODED_OBJECTS {
+        return None;
+    }
+    let mut out = Vec::with_capacity(total);
     for item in blk.entities.iter() {
         let item = placed(e, item, &m);
         let source = match &item.kind {
@@ -192,7 +213,9 @@ pub(crate) fn explode_array(d: &Drawing, e: &Entity) -> Option<Vec<Entity>> {
             _ => None,
         };
         match source {
-            Some((im, b)) => out.extend(b.entities.iter().map(|se| placed(&item, se, &im))),
+            Some((im, b)) => {
+                out.extend(b.entities.iter().map(|se| placed(&item, se, &im)));
+            }
             None => out.push(item),
         }
     }
@@ -247,9 +270,16 @@ fn max_count(s: &Session, others: u64, objs: usize) -> u64 {
 }
 
 fn copy_all(s: &mut Session, hs: &[Handle], mats: impl Iterator<Item = Mat3>) -> Result<usize> {
+    // Every copy is checked before the first is made: a refusal part way would leave the copies
+    // already added in the drawing (a failed command is not rolled back).
+    let mats: Vec<Mat3> = mats.collect();
+    // A matrix every frame accepts needs no look at the objects; otherwise they are looked at once.
+    if mats.iter().any(|m| !cadcraft_doc::ole_frame_accepts(m)) && super::modify::holds_ole_frame(s, hs, true)? {
+        return Err(super::modify::ole_refusal());
+    }
     let mut n = 0;
-    for m in mats {
-        n += transform_entities(s, hs, &m, true)?.len();
+    for m in &mats {
+        n += transform_entities(s, hs, m, true)?.len();
     }
     Ok(n)
 }

crates/engine/src/cmd/array/edit.rs

@@ -188,8 +188,9 @@ fn item_at(d: &Drawing, h: Handle, at: Vec2, tol: f64) -> Option<(u32, u32, u32)
     let mut best: Option<((u32, u32, u32), f64)> = None;
     // Each block's own extents, measured once.
     let mut extents: HashMap<String, (Vec2, Bounds2)> = HashMap::new();
+    let block_for = p.block_lookup();
     for it in p.items()? {
-        let name = p.block_for(it.i, it.j, it.level);
+        let name = block_for(it.i, it.j, it.level);
         let (base, local) = match extents.get(name) {
             Some(x) => *x,
             None => {

crates/engine/src/cmd/audit.rs

@@ -157,7 +157,7 @@ fn write_audit_log(_: &Session, _: &crate::audit::Report) {}
 
 #[cfg(not(target_arch = "wasm32"))]
 fn read_path(cmd: &str, path: &str) -> Result<Vec<u8>> {
-    std::fs::read(path).map_err(|e| bad(cmd, format!("{path}: {e}")))
+    crate::capped_read::read_capped(std::path::Path::new(path), file::MAX_DRAWING_BYTES).map_err(|e| bad(cmd, format!("{path}: {e}")))
 }
 
 #[cfg(target_arch = "wasm32")]

crates/engine/src/cmd/blocks.rs

@@ -25,6 +25,7 @@ mod dyngrip;
 mod extract;
 pub(crate) mod refedit;
 mod wblock;
+mod xclip;
 
 pub fn specs() -> Vec<CommandSpec> {
     vec![
@@ -43,6 +44,9 @@ pub fn specs() -> Vec<CommandSpec> {
             .alias(&["i", "-insert", "ddinsert"])
             .params("{name (\"*NAME\": exploded), file?: DXF/DWG path (defines or redefines block `name`, default the file name, from its model space; base point $INSBASE), at: [x,y], scale?: number | [x, y], rotation? (degrees), basePoint?: [x,y] (block coordinates), attribs?: {TAG: value}, explode?: bool}")
             .interactive(|_| Ok(Box::new(InsertM::default()))),
+        CommandSpec::new("minsert", "Multiple Insert", run_minsert)
+            .params("{name, file?: DXF/DWG path (as INSERT), at: [x,y], scale?: number | [x, y], rotation? (degrees), basePoint?: [x,y], attribs?: {TAG: value}, rows?: 1..32767 (default 1), columns?: 1..32767 (default 1), rowSpacing?, columnSpacing? (along the reference's own axes, not scaled with it)}")
+            .interactive(|_| Ok(Box::new(InsertM { minsert: true, ..InsertM::default() }))),
         CommandSpec::new("attdef", "Define Attributes...", run_attdef)
             .menu(&["Draw", "Block", "Define Attributes..."])
             .alias(&["att", "-attdef"])
@@ -89,6 +93,7 @@ pub fn specs() -> Vec<CommandSpec> {
     .chain(attribs::attdisp_menu_specs())
     .chain(xref::specs())
     .chain(refedit::specs())
+    .chain(xclip::specs())
     .chain(bedit::specs())
     .collect()
 }
@@ -225,6 +230,7 @@ fn insert_entity(blk: &Block, at: Vec2, scale: Vec3, rotation: f64, base: Option
         rows: 1,
         col_spacing: 0.0,
         row_spacing: 0.0,
+        clip: None,
     };
     if let Some(b) = base {
         let landed = ins.transform(blk.base.xy()).apply(b);
@@ -233,6 +239,33 @@ fn insert_entity(blk: &Block, at: Vec2, scale: Vec3, rotation: f64, base: Option
     ins
 }
 
+/// MINSERT's rectangular array of a block reference: rows and columns, and the distances between
+/// them along the reference's rotated axes (not scaled with it). One row and one column is a plain
+/// reference.
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct Grid {
+    rows: u32,
+    cols: u32,
+    row_spacing: f64,
+    col_spacing: f64,
+}
+
+impl Grid {
+    const ONE: Grid = Grid { rows: 1, cols: 1, row_spacing: 0.0, col_spacing: 0.0 };
+    /// The most rows or columns MINSERT takes, as AutoCAD 2024 asks for them.
+    const MAX: u32 = 32767;
+
+    /// A distance is kept only along an axis with more than one copy: AutoCAD 2024 asks for no
+    /// other and stores 0 for it (one row of three columns: 44 = 20, 45 = 0).
+    fn new(rows: u32, cols: u32, row_spacing: f64, col_spacing: f64) -> Grid {
+        Grid { rows, cols, row_spacing: if rows > 1 { row_spacing } else { 0.0 }, col_spacing: if cols > 1 { col_spacing } else { 0.0 } }
+    }
+
+    fn apply(self, ins: &mut Insert) {
+        (ins.rows, ins.cols, ins.row_spacing, ins.col_spacing) = (self.rows, self.cols, self.row_spacing, self.col_spacing);
+    }
+}
+
 /// [`insert`] with separate X/Y scale factors (Z as X) and an optional base point (see
 /// [`insert_entity`]).
 pub(crate) fn insert_with(
@@ -244,10 +277,12 @@ pub(crate) fn insert_with(
     base: Option<Vec2>,
     values: &serde_json::Map<String, Value>,
 ) -> Result<Handle> {
-    insert_scaled(s, name, at, Vec3::new(scale.x, scale.y, scale.x), rotation, base, values)
+    insert_scaled(s, name, at, Vec3::new(scale.x, scale.y, scale.x), rotation, base, values, Grid::ONE)
 }
 
-/// [`insert_with`] with a Z scale factor of its own.
+/// [`insert_with`] with a Z scale factor of its own, and MINSERT's grid. A grid has the one set
+/// of attributes (AutoCAD 2024 asks for their values once).
+#[allow(clippy::too_many_arguments)]
 fn insert_scaled(
     s: &mut Session,
     name: &str,
@@ -256,9 +291,11 @@ fn insert_scaled(
     rotation: f64,
     base: Option<Vec2>,
     values: &serde_json::Map<String, Value>,
+    grid: Grid,
 ) -> Result<Handle> {
     let blk = s.doc()?.block(name).cloned().ok_or_else(|| EngineError::Other(format!("Block \"{name}\" not found.")))?;
     let mut ins = insert_entity(&blk, at, scale, rotation, base);
+    grid.apply(&mut ins);
     let m = ins.transform(blk.base.xy());
     for e in blk.entities.iter() {
         if let EntityKind::AttDef(ad) = &e.kind {
@@ -310,24 +347,52 @@ fn run_block(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn run_insert(s: &mut Session, p: &Value) -> Result<Value> {
+    insert_json(s, p, "insert", Grid::ONE)
+}
+
+/// MINSERT's JSON form: INSERT's parameters and the grid.
+fn run_minsert(s: &mut Session, p: &Value) -> Result<Value> {
+    let count = |key: &str| -> Result<u32> {
+        match p.get(key) {
+            None | Some(Value::Null) => Ok(1),
+            Some(v) => v
+                .as_f64()
+                .filter(|n| n.fract() == 0.0 && *n >= 1.0 && *n <= f64::from(Grid::MAX))
+                .map(|n| n as u32)
+                .ok_or_else(|| bad("minsert", format!("`{key}` must be an integer between 1 and {}", Grid::MAX))),
+        }
+    };
+    // A distance given must be a number: `"15"` is refused, not taken as 0.
+    let spacing = |key: &str| -> Result<f64> {
+        match p.get(key) {
+            None | Some(Value::Null) => Ok(0.0),
+            Some(v) => v.as_f64().filter(|x| x.is_finite()).ok_or_else(|| bad("minsert", format!("`{key}` must be a number"))),
+        }
+    };
+    let grid = Grid::new(count("rows")?, count("columns")?, spacing("rowSpacing")?, spacing("columnSpacing")?);
+    insert_json(s, p, "minsert", grid)
+}
+
+/// INSERT's and MINSERT's JSON form.
+fn insert_json(s: &mut Session, p: &Value, cmd: &str, grid: Grid) -> Result<Value> {
     let p = &insert_file::json_params(s, p)?;
-    let name = str_param(p, "name").ok_or_else(|| bad("insert", "`name` is required"))?.to_string();
-    let at = point_req("insert", p, "at")?;
+    let name = str_param(p, "name").ok_or_else(|| bad(cmd, "`name` is required"))?.to_string();
+    let at = point_req(cmd, p, "at")?;
     // `scale`: one factor, or [x, y] for different X and Y scale factors.
     let scale = match p.get("scale") {
-        Some(v) if v.is_array() => point_value(v).ok_or_else(|| bad("insert", "`scale` must be a number or [x, y]"))?,
+        Some(v) if v.is_array() => point_value(v).ok_or_else(|| bad(cmd, "`scale` must be a number or [x, y]"))?,
         _ => {
             let f = f64_or(p, "scale", 1.0);
             Vec2::new(f, f)
         }
     };
     if scale.x == 0.0 || scale.y == 0.0 {
-        return Err(bad("insert", "scale cannot be 0"));
+        return Err(bad(cmd, "scale cannot be 0"));
     }
     let rot = f64_or(p, "rotation", 0.0).to_radians();
     let vals = p.get("attribs").and_then(Value::as_object).cloned().unwrap_or_default();
-    let h = insert_with(s, &name, at, scale, rot, point_param(p, "basePoint"), &vals)?;
-    if bool_or(p, "explode", false) {
+    let h = insert_scaled(s, &name, at, Vec3::new(scale.x, scale.y, scale.x), rot, point_param(p, "basePoint"), &vals, grid)?;
+    if cmd == "insert" && bool_or(p, "explode", false) {
         // The EXPLODE command body, not `execute`: INSERT records the one undo step.
         let explode = find_command("explode").ok_or_else(|| EngineError::UnknownCommand("explode".into()))?;
         return (explode.run)(s, &json!({ "handles": [h.hex()] }));
@@ -379,8 +444,11 @@ fn run_base(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn run_list(s: &mut Session, _p: &Value) -> Result<Value> {
     let d = s.doc()?;
+    // One object index for the whole listing: rebuilding it per block multiplies the block count
+    // by the drawing's kept object count (CWE-407).
+    let objects = cadcraft_doc::dynblock::ObjectIndex::new(d);
     let block = |b: &Block| {
-        let dynamic = cadcraft_doc::dynblock::dynamic_block(d, &b.name).is_some();
+        let dynamic = cadcraft_doc::dynblock::is_dynamic_block_in(d, &objects, &b.name);
         json!({"name": b.name, "entities": b.entities.len(), "base": [b.base.x, b.base.y], "description": b.description, "dynamic": dynamic})
     };
     Ok(json!({ "blocks": d.blocks.values().filter(|b| !b.anonymous).map(|b| block(b)).collect::<Vec<_>>() }))
@@ -557,6 +625,15 @@ enum InsStage {
     /// XYZ: the Z scale factor, after X and Y.
     ZScale,
     Rotation,
+    /// MINSERT: the number of rows, then of columns.
+    Rows,
+    Cols,
+    /// MINSERT: the distance between rows, or a unit cell's first corner.
+    RowSpacing,
+    /// MINSERT: the unit cell's opposite corner (its width between columns, its height between
+    /// rows).
+    Cell(Vec2),
+    ColSpacing,
     Attribs,
     /// A Verify attribute asked again.
     Verify,
@@ -589,6 +666,12 @@ struct InsertM {
     explode: bool,
     /// The file waiting for the Redefine answer.
     file: Option<insert_file::FileRef>,
+    /// MINSERT: after the rotation, the grid's rows and columns and the distances between them.
+    minsert: bool,
+    rows: Option<u32>,
+    cols: Option<u32>,
+    row_spacing: Option<f64>,
+    col_spacing: Option<f64>,
 }
 
 impl InsertM {
@@ -598,6 +681,8 @@ impl InsertM {
             if self.explode { InsStage::PresetScale } else { InsStage::XScale }
         } else if self.rotation.is_none() {
             InsStage::Rotation
+        } else if let Some(g) = self.grid_stage() {
+            g
         } else {
             InsStage::Attribs
         };
@@ -616,7 +701,7 @@ impl InsertM {
             && self.values.len() >= self.attdefs.len()
             && let (Some(n), Some(a), Some(sc), Some(r)) = (self.name.clone(), self.at, self.scale, self.rotation)
         {
-            let h = insert_scaled(s, &n, a, self.scale3(sc), r, self.base, &self.values)?;
+            let h = insert_scaled(s, &n, a, self.scale3(sc), r, self.base, &self.values, self.grid())?;
             if self.explode {
                 insert_file::explode_insert(s, h)?;
             }
@@ -625,6 +710,30 @@ impl InsertM {
         Ok(Step::Continue)
     }
 
+    /// MINSERT's next grid prompt, if any is left (as AutoCAD 2024 asks them): the rows, the
+    /// columns, then the distance between rows when there is more than one row and between
+    /// columns when there is more than one column. A unit cell gives both distances.
+    fn grid_stage(&self) -> Option<InsStage> {
+        if !self.minsert {
+            return None;
+        }
+        let (Some(rows), Some(cols)) = (self.rows, self.cols) else {
+            return Some(if self.rows.is_none() { InsStage::Rows } else { InsStage::Cols });
+        };
+        if rows > 1 && self.row_spacing.is_none() {
+            Some(InsStage::RowSpacing)
+        } else if cols > 1 && self.col_spacing.is_none() {
+            Some(InsStage::ColSpacing)
+        } else {
+            None
+        }
+    }
+
+    /// The grid answered so far (one copy for INSERT).
+    fn grid(&self) -> Grid {
+        Grid::new(self.rows.unwrap_or(1), self.cols.unwrap_or(1), self.row_spacing.unwrap_or(0.0), self.col_spacing.unwrap_or(0.0))
+    }
+
     /// The Verify attributes asked for.
     fn verifying(&self) -> Vec<&(String, String, String, bool)> {
         self.attdefs.iter().filter(|a| a.3).collect()
@@ -695,13 +804,18 @@ impl InsertM {
     }
 }
 
+/// A distance typed at MINSERT's grid prompts: any finite number, negative or 0 too.
+fn distance(t: &str) -> Result<f64> {
+    number(t).filter(|v| v.is_finite()).ok_or_else(|| EngineError::Other("Requires a distance.".into()))
+}
+
 fn nonzero(t: &str) -> Result<f64> {
     number(t).filter(|v| *v != 0.0).ok_or_else(|| EngineError::Other("Requires a non-zero number.".into()))
 }
 
 impl Interactive for InsertM {
     fn name(&self) -> &'static str {
-        "INSERT"
+        if self.minsert { "MINSERT" } else { "INSERT" }
     }
     fn prompt(&self, s: &Session) -> Prompt {
         let at = self.at.unwrap_or_default();
@@ -728,9 +842,16 @@ impl Interactive for InsertM {
             InsStage::YScale => Prompt::new("Enter Y scale factor", Accept::NUMBER).default("use X scale factor"),
             InsStage::ZScale => Prompt::new("Specify Z scale factor or", Accept::NUMBER).default("use X scale factor"),
             InsStage::Rotation => Prompt::new("Specify rotation angle", Accept::POINT_OR_NUMBER).default("0").base(at),
+            InsStage::Rows => Prompt::new("Enter number of rows (---)", Accept::NUMBER).default("1"),
+            InsStage::Cols => Prompt::new("Enter number of columns (|||)", Accept::NUMBER).default("1"),
+            InsStage::RowSpacing => Prompt::new("Enter distance between rows or specify unit cell (---)", Accept::POINT_OR_NUMBER),
+            InsStage::Cell(a) => Prompt::new("Specify opposite corner", Accept::POINT).corner(a),
+            InsStage::ColSpacing => Prompt::new("Specify distance between columns (|||)", Accept::NUMBER),
             InsStage::Attribs => {
                 let (_, prompt, default, _) = self.attdefs.get(self.values.len()).cloned().unwrap_or_default();
-                Prompt::new(if prompt.is_empty() { "Enter attribute value".into() } else { prompt }, Accept::TEXT).default(default)
+                let p = Prompt::new(if prompt.is_empty() { "Enter attribute value".into() } else { prompt }, Accept::TEXT);
+                // No default shown when there is none ("Value:", AutoCAD 2024), not "<>".
+                if default.is_empty() { p } else { p.default(default) }
             }
             InsStage::Verify => {
                 let (tag, prompt) = self.verifying().get(self.verified).map(|a| (a.0.clone(), a.1.clone())).unwrap_or_default();
@@ -752,9 +873,9 @@ impl Interactive for InsertM {
                     s.echo(format!("Defined blocks: {}", names.join(", ")));
                     return Ok(Step::Continue);
                 }
-                // `*name`: insert exploded.
-                self.explode = n.starts_with('*');
-                let n = n.strip_prefix('*').map_or(n.as_str(), str::trim).to_string();
+                // `*name`: insert exploded (INSERT only: a grid has no exploded form).
+                self.explode = !self.minsert && n.starts_with('*');
+                let n = if self.explode { n.strip_prefix('*').map_or(n.as_str(), str::trim).to_string() } else { n };
                 match insert_file::file_ref(s, &n) {
                     Some(f) if f.ask_redefine(s) => {
                         self.file = Some(f);
@@ -894,6 +1015,45 @@ impl Interactive for InsertM {
                 });
                 return self.advance(s);
             }
+            InsStage::Rows | InsStage::Cols => {
+                let n = match i {
+                    Input::Text(t) => t
+                        .trim()
+                        .parse::<f64>()
+                        .ok()
+                        .filter(|v| v.fract() == 0.0 && *v >= 1.0 && *v <= f64::from(Grid::MAX))
+                        .map(|v| v as u32)
+                        .ok_or_else(|| EngineError::Other(format!("Requires an integer between 1 and {}.", Grid::MAX)))?,
+                    Input::Enter => 1,
+                    _ => return Ok(Step::Continue),
+                };
+                if self.stage == InsStage::Rows {
+                    self.rows = Some(n);
+                } else {
+                    self.cols = Some(n);
+                }
+                return self.advance(s);
+            }
+            InsStage::RowSpacing => match i {
+                Input::Point(a) => self.stage = InsStage::Cell(a),
+                Input::Text(t) => {
+                    self.row_spacing = Some(distance(&t)?);
+                    return self.advance(s);
+                }
+                _ => {}
+            },
+            InsStage::Cell(a) => {
+                if let Input::Point(b) = i {
+                    (self.col_spacing, self.row_spacing) = (Some(b.x - a.x), Some(b.y - a.y));
+                    return self.advance(s);
+                }
+            }
+            InsStage::ColSpacing => {
+                if let Input::Text(t) = i {
+                    self.col_spacing = Some(distance(&t)?);
+                    return self.advance(s);
+                }
+            }
             InsStage::Attribs => {
                 let (tag, _, default, _) = self.attdefs.get(self.values.len()).cloned().unwrap_or_default();
                 let v = match i {
@@ -934,7 +1094,9 @@ impl Interactive for InsertM {
             _ => Vec2::new(1.0, 1.0),
         });
         let rot = self.rotation.unwrap_or(if self.stage == InsStage::Rotation { at.angle_to(c) } else { 0.0 });
-        vec![EntityKind::Insert(insert_entity(b, at, self.scale3(scale), rot, self.base))]
+        let mut ins = insert_entity(b, at, self.scale3(scale), rot, self.base);
+        self.grid().apply(&mut ins);
+        vec![EntityKind::Insert(ins)]
     }
 }
 

crates/engine/src/cmd/blocks/blockreplace.rs

@@ -15,7 +15,7 @@ use crate::{Accept, EngineError, Input, Interactive, Prompt, Result, Session, St
 
 pub(super) fn blockreplace_spec() -> CommandSpec {
     CommandSpec::new("blockreplace", "Replace Block...", run_blockreplace)
-        .menu(&["Tools", "Express Tools", "Replace Block..."])
+        .menu(&["Tools", "Additional Tools", "Replace Block..."])
         .alias(&["-blockreplace"])
         .params("{block (the block whose references are replaced), with (the replacement block), purge?: bool (default false: remove the replaced block's definition when nothing references it any more)} → {block, with, replaced, purged}")
         .interactive(|_| Ok(Box::new(BlockreplaceM::default())))
@@ -184,8 +184,10 @@ impl Interactive for BlockreplaceM {
     }
     fn prompt(&self, _s: &Session) -> Prompt {
         match self.stage {
-            Stage::Old => Prompt::new("Enter the name of the block to replace", Accept::TEXT).kw(&["?", "Select"]),
-            Stage::New => Prompt::new(format!("Enter the name of the replacement block for {}", self.old), Accept::TEXT).kw(&["?", "Select"]),
+            Stage::Old => Prompt::new("Enter the name of the block to replace", Accept::TEXT).kw(&["?", "Select"]).takes_block(),
+            Stage::New => {
+                Prompt::new(format!("Enter the name of the replacement block for {}", self.old), Accept::TEXT).kw(&["?", "Select"]).takes_block()
+            }
             Stage::Select => Prompt::new("Select a block reference", Accept::SELECT),
             Stage::Purge => Prompt::new(format!("Purge the unreferenced block definition {}?", self.old), KW).kw(&["Yes", "No"]).default("Yes"),
         }

crates/engine/src/cmd/blocks/burst.rs

@@ -12,7 +12,7 @@ use crate::{Result, Session};
 
 pub(super) fn burst_spec() -> CommandSpec {
     CommandSpec::new("burst", "Explode Attributes to Text", run_burst)
-        .menu(&["Tools", "Express Tools", "Explode Attributes to Text"])
+        .menu(&["Tools", "Additional Tools", "Explode Attributes to Text"])
         .params("{handles?} (block references; other objects are left alone) → {handles}")
         .interactive(|_| Ok(Box::new(SelectRun::new("burst", "BURST"))))
 }

crates/engine/src/cmd/blocks/extract.rs

@@ -2,9 +2,9 @@
 //! block name and values, or one row per reference with its handle, layer, position and
 //! rotation — returned, written to a CSV file and/or inserted as a table. Tags match in any case.
 
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, HashMap};
 
-use cadcraft_doc::{EntityKind, Insert};
+use cadcraft_doc::{Drawing, EntityKind, Insert};
 use cadcraft_geom::Vec2;
 use serde_json::{Value, json};
 
@@ -88,22 +88,75 @@ fn matches(spec: &str, text: &str) -> bool {
     spec.split(',').any(|p| wildcard(p.trim(), text))
 }
 
-/// The attribute values of `ins`: its own, then the constant ones of its block.
-fn values(d: &cadcraft_doc::Drawing, ins: &Insert) -> Vec<(String, String)> {
-    let mut v: Vec<(String, String)> = ins.attribs.iter().map(|a| (a.tag.to_ascii_uppercase(), a.text.value.clone())).collect();
-    if let Some(b) = d.block(&ins.block) {
-        for e in b.entities.iter() {
-            if let EntityKind::AttDef(a) = &e.kind
-                && a.constant
-                && !v.iter().any(|(t, _)| t.eq_ignore_ascii_case(&a.tag))
-            {
-                v.push((a.tag.to_ascii_uppercase(), a.text.value.clone()));
-            }
+/// The constant attribute values of a block definition whose tags are selected for output.
+fn constants(b: &cadcraft_doc::Block, selected: &[String]) -> Vec<(String, String)> {
+    let mut v: Vec<(String, String)> = Vec::new();
+    for e in b.entities.iter() {
+        if let EntityKind::AttDef(a) = &e.kind
+            && a.constant
+            && selected.iter().any(|tag| tag == &a.tag.to_ascii_uppercase())
+            && !v.iter().any(|(t, _)| t.eq_ignore_ascii_case(&a.tag))
+        {
+            v.push((a.tag.to_ascii_uppercase(), a.text.value.clone()));
         }
     }
     v
 }
 
+/// The attribute values of `ins` that `o.tags` selects: its own, then the constant ones of its
+/// block (`consts`, read once per block). Values no column shows are not copied.
+fn values(ins: &Insert, consts: &[(String, String)], selected: &[String]) -> Vec<(String, String)> {
+    let mut v: Vec<(String, String)> = ins
+        .attribs
+        .iter()
+        .map(|a| (a.tag.to_ascii_uppercase(), a))
+        .filter(|(t, _)| selected.contains(t))
+        .map(|(t, a)| (t, a.text.value.clone()))
+        .collect();
+    for (t, val) in consts {
+        if !v.iter().any(|(k, _)| k.eq_ignore_ascii_case(t)) {
+            v.push((t.clone(), val.clone()));
+        }
+    }
+    v
+}
+
+/// Select the output columns before copying any attribute text. A block definition can contain
+/// many large constants that do not survive the table's 190-column limit.
+fn selected_tags(ents: &[std::sync::Arc<cadcraft_doc::Entity>], d: &Drawing, o: &Options) -> Vec<String> {
+    let mut selected = Vec::new();
+    let mut add = |tag: &str| {
+        let tag = tag.to_ascii_uppercase();
+        if selected.len() < MAX_TAGS && matches(&o.tags, &tag) && !selected.contains(&tag) {
+            selected.push(tag);
+        }
+    };
+    let mut scanned = std::collections::HashSet::new();
+    for entity in ents {
+        let EntityKind::Insert(ins) = &entity.kind else { continue };
+        let anonymous = ins.block.starts_with('*') || d.block(&ins.block).is_some_and(|b| b.anonymous);
+        if anonymous || !matches(&o.blocks, &ins.block) {
+            continue;
+        }
+        for attribute in &ins.attribs {
+            add(&attribute.tag);
+        }
+        // A block's constants are read once, however many inserts reference it.
+        if scanned.insert(ins.block.as_str())
+            && let Some(block) = d.block(&ins.block)
+        {
+            for entity in block.entities.iter() {
+                if let EntityKind::AttDef(attribute) = &entity.kind
+                    && attribute.constant
+                {
+                    add(&attribute.tag);
+                }
+            }
+        }
+    }
+    selected
+}
+
 /// The block references to extract from: `handles` when given, else model space and the layouts.
 fn found(s: &Session, p: &Value, o: &Options) -> Result<Vec<Found>> {
     let d = s.doc()?;
@@ -112,7 +165,9 @@ fn found(s: &Session, p: &Value, o: &Options) -> Result<Vec<Found>> {
     } else {
         d.model.iter().chain(d.layouts.iter().flat_map(|l| l.entities.iter())).cloned().collect()
     };
+    let selected = selected_tags(&ents, d, o);
     let mut out = Vec::new();
+    let mut consts: HashMap<String, Vec<(String, String)>> = HashMap::new();
     for e in &ents {
         let EntityKind::Insert(ins) = &e.kind else { continue };
         let anonymous = ins.block.starts_with('*') || d.block(&ins.block).is_some_and(|b| b.anonymous);
@@ -121,12 +176,17 @@ fn found(s: &Session, p: &Value, o: &Options) -> Result<Vec<Found>> {
         }
         let block = d.block(&ins.block).map(|b| b.name.clone()).unwrap_or_else(|| ins.block.clone());
         out.push(Found {
-            block,
             handle: e.handle.hex(),
             layer: e.common.layer.clone(),
             at: ins.insert.xy(),
             rotation: ins.rotation.to_degrees(),
-            values: values(d, ins),
+            block: block.clone(),
+            values: values(
+                ins,
+                // Keyed by the resolved definition's exact name: `Part` and `PART` can both exist.
+                consts.entry(block.clone()).or_insert_with(|| d.block(&ins.block).map(|b| constants(b, &selected)).unwrap_or_default()),
+                &selected,
+            ),
         });
     }
     Ok(out)

crates/engine/src/cmd/blocks/insert_file.rs

@@ -6,7 +6,7 @@
 //! (names this drawing already has keep this drawing's definitions). The file is read through the
 //! host's io hooks like OPEN, so the engine stays I/O-agnostic.
 
-use std::collections::{BTreeMap, BTreeSet};
+use std::collections::BTreeMap;
 use std::sync::Arc;
 
 use cadcraft_doc::{Block, Drawing, Entity, EntityKind, Handle};
@@ -85,7 +85,8 @@ fn read_drawing(path: &str) -> Result<Drawing> {
 fn read_file(_path: &str) -> Result<Vec<u8>> {
     #[cfg(not(target_arch = "wasm32"))]
     {
-        std::fs::read(_path).map_err(|e| bad("insert", format!("{_path}: {e}")))
+        crate::capped_read::read_capped(std::path::Path::new(_path), crate::cmd::file::MAX_DRAWING_BYTES)
+            .map_err(|e| bad("insert", format!("{_path}: {e}")))
     }
     #[cfg(target_arch = "wasm32")]
     Err(bad("insert", "paths are not available on the web"))
@@ -102,7 +103,7 @@ fn define_from(s: &mut Session, src: &Drawing, name: &str) -> Result<String> {
     // Redefining keeps the existing definition's name (block names are case-insensitive).
     let name = d.blocks.keys().find(|k| k.eq_ignore_ascii_case(name)).cloned().unwrap_or_else(|| name.to_string());
     merge_tables(&mut d, src);
-    let renames = block_names(&d, src, &name);
+    let renames = crate::cmd::merge::block_renames(&d, src, Some(&name));
     for (from, to) in &renames {
         let Some(b) = src.blocks.get(from) else { continue };
         let mut nb = (**b).clone();
@@ -136,13 +137,7 @@ fn define_from(s: &mut Session, src: &Drawing, name: &str) -> Result<String> {
 /// Add the source's layers, linetypes and styles that this drawing doesn't have (a name that
 /// exists keeps this drawing's definition).
 fn merge_tables(d: &mut Drawing, src: &Drawing) {
-    fn merge<T: Clone>(ours: &mut Vec<T>, theirs: &[T], name: fn(&T) -> &str) {
-        for t in theirs {
-            if !ours.iter().any(|o| name(o).eq_ignore_ascii_case(name(t))) {
-                ours.push(t.clone());
-            }
-        }
-    }
+    use crate::cmd::merge::merge_named as merge;
     merge(&mut d.layers, &src.layers, |l| &l.name);
     merge(&mut d.linetypes, &src.linetypes, |l| &l.name);
     merge(&mut d.text_styles, &src.text_styles, |t| &t.name);
@@ -152,35 +147,6 @@ fn merge_tables(d: &mut Drawing, src: &Drawing) {
     merge(&mut d.mline_styles, &src.mline_styles, |t| &t.name);
 }
 
-/// Which source blocks to copy, and under which name: new names keep theirs, generated
-/// (anonymous `*…`) blocks that collide get a fresh generated name, and a named block this drawing
-/// already has (or the block being defined) keeps this drawing's definition (not copied).
-fn block_names(d: &Drawing, src: &Drawing, defining: &str) -> BTreeMap<String, String> {
-    let mut out = BTreeMap::new();
-    let mut taken: BTreeSet<String> = d.blocks.keys().map(|k| k.to_ascii_uppercase()).collect();
-    taken.insert(defining.to_ascii_uppercase());
-    for (name, b) in &src.blocks {
-        let upper = name.to_ascii_uppercase();
-        if upper.starts_with("*MODEL_SPACE") || upper.starts_with("*PAPER_SPACE") {
-            continue;
-        }
-        let to = if !taken.contains(&upper) {
-            name.clone()
-        } else if b.anonymous || name.starts_with('*') {
-            let prefix: String = name.chars().take_while(|c| !c.is_ascii_digit()).collect();
-            match (1..=1_000_000).map(|i| format!("{prefix}{i}")).find(|n| !taken.contains(&n.to_ascii_uppercase())) {
-                Some(n) => n,
-                None => continue,
-            }
-        } else {
-            continue;
-        };
-        taken.insert(to.to_ascii_uppercase());
-        out.insert(name.clone(), to);
-    }
-    out
-}
-
 /// A copy of a source entity for this drawing: a fresh handle, block references renamed, and
 /// links to other source objects (associative dimension points) dropped.
 fn adopt(d: &mut Drawing, src: &Drawing, e: &Entity, renames: &BTreeMap<String, String>) -> Entity {

crates/engine/src/cmd/blocks/xclip.rs

@@ -0,0 +1,484 @@
+//! XCLIP and XCLIPFRAME: clip block and xref references to a boundary.
+//!
+//! A boundary belongs to one reference ([`cadcraft_doc::Insert::clip`]), in the block's own
+//! coordinates, so it moves, rotates and scales with the reference and other references of the
+//! block stay whole. It is a rectangle, a polygon or the outline of a closed polyline, can hide
+//! what is inside instead of what is outside (Invert clip), and can be turned off, deleted or
+//! turned into a polyline. Clip depth (front and back clipping planes) has no meaning in a 2D
+//! drawing and is ignored. XCLIPFRAME says whether the boundary is drawn and plotted.
+
+use cadcraft_doc::{ClipBoundary, EntityKind, Handle, MAX_CLIP_VERTICES};
+use cadcraft_geom::{PolyVertex, Vec2};
+use serde_json::{Value, json};
+
+use super::super::machines::{SelOutcome, SelectPhase};
+use crate::cmd::{CommandSpec, bad, bool_or, has_doc, point_value, str_param, targets};
+use crate::{Accept, Input, Interactive, Prompt, Result, Session, Step};
+
+pub(super) fn specs() -> Vec<CommandSpec> {
+    vec![
+        CommandSpec::new("xclip", "Clip Xref", run)
+            .menu(&["Modify", "Clip", "Xref"])
+            .alias(&["xc"])
+            .params("{handles? | handle? (block or xref references, default the selection), option?: new|on|off|delete|polyline|clipdepth|query (default new with a boundary, else query), rectangle?: [[x,y],[x,y]] | points?: [[x,y],…] (3 to 4096, drawing coordinates) | polyline?: handle of a closed polyline, invert?: bool (hide what is inside)} → {handles, option} (query: {clips: [{handle, boundary, enabled, inverted}]}; polyline: {polylines})")
+            .enabled(has_doc)
+            .interactive(|_| Ok(Box::new(XclipM::default()))),
+        CommandSpec::new("xclipframe", "Xref Clip Frame", run_frame)
+            .params("{value?: 0 (frames hidden) | 1 (shown and plotted) | 2 (shown, not plotted; the default)} → {XCLIPFRAME}")
+            .enabled(has_doc)
+            .interactive(|_| Ok(Box::new(FrameM))),
+    ]
+}
+
+/// The block references among `hs` (other objects are ignored, as XCLIP's selection does).
+fn references(s: &Session, hs: &[Handle]) -> Vec<Handle> {
+    let Ok(d) = s.doc() else { return Vec::new() };
+    hs.iter().copied().filter(|h| d.entity(*h).is_some_and(|e| matches!(e.kind, EntityKind::Insert(_)))).collect()
+}
+
+/// A rectangle's two corners as a closed outline.
+fn rectangle(a: Vec2, b: Vec2) -> Vec<Vec2> {
+    vec![
+        Vec2::new(a.x.min(b.x), a.y.min(b.y)),
+        Vec2::new(a.x.max(b.x), a.y.min(b.y)),
+        Vec2::new(a.x.max(b.x), a.y.max(b.y)),
+        Vec2::new(a.x.min(b.x), a.y.max(b.y)),
+    ]
+}
+
+/// The boundary a JSON call gives, in drawing coordinates, and whether it is a rectangle.
+fn world_boundary(s: &Session, p: &Value) -> Result<(Vec<Vec2>, bool)> {
+    if let Some(r) = p.get("rectangle") {
+        let pts: Vec<Vec2> = r.as_array().map(|a| a.iter().filter_map(point_value).collect()).unwrap_or_default();
+        let [a, b] = pts.as_slice() else { return Err(bad("xclip", "`rectangle` needs two finite corners [[x,y],[x,y]]")) };
+        if (a.x - b.x).abs() <= 1e-12 || (a.y - b.y).abs() <= 1e-12 {
+            return Err(bad("xclip", "the clipping rectangle must have a width and a height"));
+        }
+        return Ok((vec![*a, *b], true));
+    }
+    if let Some(v) = p.get("polyline") {
+        let h = v
+            .as_str()
+            .and_then(Handle::parse_hex)
+            .or_else(|| v.as_u64().map(Handle))
+            .ok_or_else(|| bad("xclip", "`polyline` must be an object handle"))?;
+        let d = s.doc()?;
+        let e = d.entity(h).ok_or_else(|| bad("xclip", format!("no object {}", h.hex())))?;
+        let closed = matches!(&e.kind, EntityKind::LwPolyline(pl) if pl.closed) || matches!(&e.kind, EntityKind::Polyline3d(pl) if pl.closed);
+        if !closed {
+            return Err(bad("xclip", "select a closed polyline"));
+        }
+        let pts = cadcraft_render::clip::boundary_polygon(&e.kind).ok_or_else(|| bad("xclip", "the polyline does not enclose an area"))?;
+        return Ok((pts, false));
+    }
+    let pts = p.get("points").and_then(Value::as_array).ok_or_else(|| bad("xclip", "a boundary is required: `rectangle`, `points` or `polyline`"))?;
+    if !(3..=MAX_CLIP_VERTICES).contains(&pts.len()) {
+        return Err(bad("xclip", format!("a polygonal boundary needs 3 to {MAX_CLIP_VERTICES} points")));
+    }
+    let pts: Vec<Vec2> =
+        pts.iter().map(|v| point_value(v).ok_or_else(|| bad("xclip", "every boundary point must be a finite [x, y]"))).collect::<Result<_>>()?;
+    Ok((pts, false))
+}
+
+fn run(s: &mut Session, p: &Value) -> Result<Value> {
+    let hs = references(s, &targets(s, p)?);
+    if hs.is_empty() {
+        return Err(bad("xclip", "select block or xref references"));
+    }
+    let has_boundary = ["rectangle", "points", "polyline"].iter().any(|k| p.get(*k).is_some());
+    let option = str_param(p, "option").map(str::to_ascii_lowercase).unwrap_or_else(|| if has_boundary { "new".into() } else { "query".into() });
+    match option.as_str() {
+        "new" | "n" => {
+            let (world, rect) = world_boundary(s, p)?;
+            let outline = if rect { world.first().zip(world.get(1)).map(|(a, b)| rectangle(*a, *b)).unwrap_or_default() } else { world.clone() };
+            if cadcraft_render::clip::PolyClip::new(&outline).is_none() {
+                return Err(bad("xclip", "the clipping boundary encloses no area"));
+            }
+            let invert = bool_or(p, "invert", false);
+            let mut clips = Vec::with_capacity(hs.len());
+            {
+                let d = s.doc()?;
+                for h in &hs {
+                    let Some(EntityKind::Insert(ins)) = d.entity(*h).map(|e| &e.kind) else { continue };
+                    let base = d.block(&ins.block).map(|b| b.base.xy()).ok_or_else(|| bad("xclip", format!("block \"{}\" is missing", ins.block)))?;
+                    let inv = ins.transform(base).inverse().ok_or_else(|| bad("xclip", "a reference with a zero scale can't be clipped"))?;
+                    let points: Vec<Vec2> = world.iter().map(|q| inv.apply(*q)).collect();
+                    // A rotated or skewed reference sees the rectangle as a polygon.
+                    let r = ins.rotation.rem_euclid(std::f64::consts::FRAC_PI_2);
+                    let square = r < 1e-9 || std::f64::consts::FRAC_PI_2 - r < 1e-9;
+                    let points = if rect && !square { outline.iter().map(|q| inv.apply(*q)).collect() } else { points };
+                    clips.push((*h, ClipBoundary { points, enabled: true, inverted: invert }));
+                }
+            }
+            for (h, c) in clips {
+                set_clip(s, h, Some(c))?;
+            }
+        }
+        "on" | "off" => {
+            let on = option == "on";
+            // Every reference is checked before any changes: an error leaves the drawing as it was.
+            let d = s.doc()?;
+            if !hs.iter().all(|h| matches!(d.entity(*h).map(|e| &e.kind), Some(EntityKind::Insert(i)) if i.clip.is_some())) {
+                return Err(bad("xclip", "no clipping boundary on the selected reference"));
+            }
+            // Only the flag changes, once per reference (a selection may name one many times).
+            let mut seen = std::collections::HashSet::new();
+            for h in hs.iter().filter(|h| seen.insert(**h)) {
+                s.doc_mut()?
+                    .modify_entity(*h, |e| {
+                        if let EntityKind::Insert(i) = &mut e.kind
+                            && let Some(c) = &mut i.clip
+                        {
+                            c.enabled = on;
+                        }
+                    })
+                    .map_err(|e| bad("xclip", e.to_string()))?;
+            }
+        }
+        "delete" | "d" => {
+            for h in &hs {
+                set_clip(s, *h, None)?;
+            }
+        }
+        "polyline" | "p" | "generate" => {
+            let mut made = Vec::new();
+            for h in &hs {
+                let Some(world) = world_outline(s, *h) else { continue };
+                let vertices = world.into_iter().map(|p| PolyVertex { p, bulge: 0.0, start_width: 0.0, end_width: 0.0 }).collect();
+                let pl = cadcraft_doc::LwPolyline { vertices, closed: true, const_width: 0.0, elevation: 0.0, plinegen: false };
+                made.push(s.add_entity(EntityKind::LwPolyline(pl))?.hex());
+            }
+            if made.is_empty() {
+                return Err(bad("xclip", "no clipping boundary on the selected references"));
+            }
+            return Ok(json!({ "handles": hexes(&hs), "option": "polyline", "polylines": made }));
+        }
+        // Front and back clipping planes have no meaning in 2D: nothing changes.
+        "clipdepth" | "c" => return Ok(json!({ "handles": hexes(&hs), "option": "clipdepth", "ignored": true })),
+        "query" | "?" => {
+            let clips: Vec<Value> = hs
+                .iter()
+                .map(|h| {
+                    let c = clip_of(s, *h);
+                    json!({
+                        "handle": h.hex(),
+                        "boundary": world_outline(s, *h).map(|w| w.iter().map(|p| [p.x, p.y]).collect::<Vec<_>>()),
+                        "enabled": c.as_ref().is_some_and(|c| c.enabled),
+                        "inverted": c.as_ref().is_some_and(|c| c.inverted),
+                    })
+                })
+                .collect();
+            return Ok(json!({ "clips": clips }));
+        }
+        o => return Err(bad("xclip", format!("unknown option \"{o}\" (new, on, off, delete, polyline, clipdepth or query)"))),
+    }
+    Ok(json!({ "handles": hexes(&hs), "option": option }))
+}
+
+fn hexes(hs: &[Handle]) -> Vec<String> {
+    hs.iter().map(|h| h.hex()).collect()
+}
+
+fn clip_of(s: &Session, h: Handle) -> Option<ClipBoundary> {
+    match &s.doc().ok()?.entity(h)?.kind {
+        EntityKind::Insert(i) => i.clip.clone(),
+        _ => None,
+    }
+}
+
+/// Reference `h`'s boundary outline in drawing coordinates.
+fn world_outline(s: &Session, h: Handle) -> Option<Vec<Vec2>> {
+    let d = s.doc().ok()?;
+    let EntityKind::Insert(i) = &d.entity(h)?.kind else { return None };
+    let c = i.clip.as_ref()?;
+    let m = i.transform(d.block(&i.block)?.base.xy());
+    let poly = c.polygon();
+    (poly.len() >= 3).then(|| poly.into_iter().map(|p| m.apply(p)).collect())
+}
+
+fn set_clip(s: &mut Session, h: Handle, c: Option<ClipBoundary>) -> Result<()> {
+    s.doc_mut()?
+        .modify_entity(h, |e| {
+            if let EntityKind::Insert(i) = &mut e.kind {
+                i.clip = c;
+            }
+        })
+        .map_err(|e| bad("xclip", e.to_string()))
+}
+
+// ---------------- XCLIPFRAME ----------------
+
+fn run_frame(s: &mut Session, p: &Value) -> Result<Value> {
+    let v = match p.get("value").or_else(|| p.get("XCLIPFRAME")) {
+        None | Some(Value::Null) => return Ok(json!({ "XCLIPFRAME": s.doc()?.header.i64("XCLIPFRAME", 2) })),
+        Some(v) => v.as_i64().or_else(|| v.as_str().and_then(|t| t.trim().parse().ok())),
+    };
+    let v = v.filter(|v| (0..=2).contains(v)).ok_or_else(|| bad("xclipframe", "`value` must be 0, 1 or 2"))?;
+    s.doc_mut()?.header.set_i64("XCLIPFRAME", v);
+    Ok(json!({ "XCLIPFRAME": v }))
+}
+
+struct FrameM;
+
+impl Interactive for FrameM {
+    fn name(&self) -> &'static str {
+        "XCLIPFRAME"
+    }
+    fn prompt(&self, s: &Session) -> Prompt {
+        let cur = s.doc().map(|d| d.header.i64("XCLIPFRAME", 2)).unwrap_or(2);
+        Prompt::new("Enter new value for XCLIPFRAME", Accept::TEXT).kw(&["0", "1", "2"]).default(cur.to_string())
+    }
+    fn input(&mut self, s: &mut Session, i: Input) -> Result<Step> {
+        let t = match i {
+            Input::Cancel => return Ok(Step::Cancel),
+            Input::Enter => return Ok(Step::Done),
+            Input::Text(t) | Input::Keyword(t) => t,
+            _ => return Ok(Step::Continue),
+        };
+        match run_frame(s, &json!({ "value": t.trim() })) {
+            Ok(_) => Ok(Step::Done),
+            Err(_) => {
+                s.echo("Requires an integer between 0 and 2.");
+                Ok(Step::Continue)
+            }
+        }
+    }
+}
+
+// ---------------- interactive XCLIP ----------------
+
+#[derive(Default, Clone, Copy, PartialEq, Eq)]
+enum Stage {
+    #[default]
+    Select,
+    Option,
+    DeleteOld,
+    Boundary,
+    Corner1,
+    Corner2,
+    Polygon,
+    Polyline,
+}
+
+#[derive(Default)]
+struct XclipM {
+    stage: Stage,
+    sel: SelectPhase,
+    refs: Vec<Handle>,
+    invert: bool,
+    pts: Vec<Vec2>,
+}
+
+impl XclipM {
+    fn selected(&mut self, s: &mut Session, hs: &[Handle]) -> Result<Step> {
+        self.refs = references(s, hs);
+        if self.refs.is_empty() {
+            s.echo("No block or xref references selected.");
+            return Ok(Step::Done);
+        }
+        self.stage = Stage::Option;
+        Ok(Step::Continue)
+    }
+
+    fn apply(&mut self, s: &mut Session, mut p: Value) -> Result<Step> {
+        p["handles"] = json!(hexes(&self.refs));
+        let r = run(s, &p);
+        s.set_selection(Vec::new());
+        match r {
+            Ok(_) => Ok(Step::Done),
+            Err(e) => {
+                s.echo(e.to_string());
+                Ok(Step::Done)
+            }
+        }
+    }
+
+    /// Delete: as the reference app, with nothing to delete it says so and asks again.
+    fn delete(&mut self, s: &mut Session) -> Result<Step> {
+        if !self.any_clipped(s) {
+            s.echo("No clip boundary found.");
+            return Ok(Step::Continue);
+        }
+        self.apply(s, json!({ "option": "delete" }))
+    }
+
+    fn any_clipped(&self, s: &Session) -> bool {
+        self.refs.iter().any(|h| clip_of(s, *h).is_some())
+    }
+}
+
+fn kw(i: &Input) -> Option<String> {
+    match i {
+        Input::Keyword(k) | Input::Text(k) => Some(k.trim().to_ascii_lowercase()),
+        _ => None,
+    }
+}
+
+impl Interactive for XclipM {
+    fn name(&self) -> &'static str {
+        "XCLIP"
+    }
+
+    fn begin(&mut self, s: &mut Session) -> Result<Step> {
+        self.sel = SelectPhase::begin(s);
+        if self.sel.done {
+            let hs = self.sel.picked.clone();
+            return self.selected(s, &hs);
+        }
+        Ok(Step::Continue)
+    }
+
+    fn prompt(&self, _s: &Session) -> Prompt {
+        match self.stage {
+            Stage::Select => self.sel.prompt(),
+            Stage::Option => Prompt::new("Enter clipping option", Accept::TEXT)
+                .kw(&["ON", "OFF", "Clipdepth", "Delete", "generate Polyline", "New boundary"])
+                .default("New"),
+            Stage::DeleteOld => Prompt::new("Delete old boundary(s)?", Accept::TEXT).kw(&["Yes", "No"]).default("Yes"),
+            Stage::Boundary => Prompt::new("Specify clipping boundary or select invert option", Accept::POINT)
+                .kw(&["Select polyline", "Polygonal", "Rectangular", "Invert clip"])
+                .default("Rectangular"),
+            Stage::Corner1 => Prompt::new("Specify first corner", Accept::POINT),
+            Stage::Corner2 => {
+                let p = Prompt::new("Specify opposite corner", Accept::POINT);
+                match self.pts.first() {
+                    Some(a) => p.corner(*a),
+                    None => p,
+                }
+            }
+            Stage::Polygon => {
+                let msg = if self.pts.is_empty() { "Specify first point" } else { "Specify next point" };
+                let p = Prompt::new(msg, Accept::POINT).base_opt(self.pts.last().copied());
+                if self.pts.is_empty() { p } else { p.kw(&["Undo"]) }
+            }
+            Stage::Polyline => Prompt::new("Select polyline", Accept::SELECT),
+        }
+    }
+
+    fn input(&mut self, s: &mut Session, i: Input) -> Result<Step> {
+        if matches!(i, Input::Cancel) {
+            return Ok(Step::Cancel);
+        }
+        match self.stage {
+            Stage::Select => match self.sel.feed(s, &i)? {
+                SelOutcome::More => Ok(Step::Continue),
+                SelOutcome::Empty => Ok(Step::Done),
+                SelOutcome::Done(hs) => self.selected(s, &hs),
+            },
+            Stage::Option => {
+                let k = if matches!(i, Input::Enter) { Some("new".to_string()) } else { kw(&i) };
+                match k.as_deref() {
+                    Some("on") => self.apply(s, json!({ "option": "on" })),
+                    Some("off") => self.apply(s, json!({ "option": "off" })),
+                    Some(k) if k.starts_with('c') => {
+                        s.echo("Clip depth does not apply to a 2D drawing: front and back clipping planes are ignored.");
+                        Ok(Step::Done)
+                    }
+                    Some(k) if k.starts_with('d') => self.delete(s),
+                    Some(k) if k.starts_with('p') || k.starts_with('g') => self.apply(s, json!({ "option": "polyline" })),
+                    Some(k) if k.starts_with('n') => {
+                        self.stage = if self.any_clipped(s) { Stage::DeleteOld } else { Stage::Boundary };
+                        Ok(Step::Continue)
+                    }
+                    _ => {
+                        s.echo("Invalid option keyword.");
+                        Ok(Step::Continue)
+                    }
+                }
+            }
+            Stage::DeleteOld => match kw(&i).as_deref() {
+                None if matches!(i, Input::Enter) => {
+                    self.stage = Stage::Boundary;
+                    Ok(Step::Continue)
+                }
+                Some(k) if k.starts_with('y') => {
+                    self.stage = Stage::Boundary;
+                    Ok(Step::Continue)
+                }
+                Some(k) if k.starts_with('n') => Ok(Step::Done),
+                _ => Ok(Step::Continue),
+            },
+            Stage::Boundary => match (&i, kw(&i).as_deref()) {
+                (Input::Enter, _) => {
+                    self.stage = Stage::Corner1;
+                    Ok(Step::Continue)
+                }
+                (Input::Point(p), _) => {
+                    // A point starts the default rectangle.
+                    self.pts = vec![*p];
+                    self.stage = Stage::Corner2;
+                    Ok(Step::Continue)
+                }
+                (_, Some(k)) if k.starts_with('i') => {
+                    self.invert = !self.invert;
+                    s.echo(if self.invert {
+                        "Inside mode - Objects inside boundary will be hidden."
+                    } else {
+                        "Outside mode - Objects outside boundary will be hidden."
+                    });
+                    Ok(Step::Continue)
+                }
+                (_, Some(k)) if k.starts_with('s') => {
+                    self.stage = Stage::Polyline;
+                    Ok(Step::Continue)
+                }
+                (_, Some(k)) if k.starts_with('p') => {
+                    self.pts.clear();
+                    self.stage = Stage::Polygon;
+                    Ok(Step::Continue)
+                }
+                (_, Some(k)) if k.starts_with('r') => {
+                    self.stage = Stage::Corner1;
+                    Ok(Step::Continue)
+                }
+                _ => Ok(Step::Continue),
+            },
+            Stage::Corner1 => match i {
+                Input::Point(p) => {
+                    self.pts = vec![p];
+                    self.stage = Stage::Corner2;
+                    Ok(Step::Continue)
+                }
+                _ => Ok(Step::Continue),
+            },
+            Stage::Corner2 => match (i, self.pts.first().copied()) {
+                (Input::Point(b), Some(a)) => self.apply(s, json!({ "option": "new", "rectangle": [[a.x, a.y], [b.x, b.y]], "invert": self.invert })),
+                _ => Ok(Step::Continue),
+            },
+            Stage::Polygon => match i {
+                Input::Point(p) if self.pts.len() < MAX_CLIP_VERTICES => {
+                    self.pts.push(p);
+                    Ok(Step::Continue)
+                }
+                Input::Point(_) => {
+                    s.echo(format!("A boundary has at most {MAX_CLIP_VERTICES} points."));
+                    Ok(Step::Continue)
+                }
+                Input::Keyword(_) | Input::Text(_) => {
+                    self.pts.pop();
+                    Ok(Step::Continue)
+                }
+                Input::Enter if self.pts.len() >= 3 => {
+                    let pts: Vec<[f64; 2]> = self.pts.iter().map(|p| [p.x, p.y]).collect();
+                    self.apply(s, json!({ "option": "new", "points": pts, "invert": self.invert }))
+                }
+                Input::Enter => {
+                    s.echo("A polygonal boundary needs at least three points.");
+                    Ok(Step::Continue)
+                }
+                _ => Ok(Step::Continue),
+            },
+            Stage::Polyline => match i {
+                Input::Pick(hs) => match hs.first() {
+                    Some(h) => {
+                        let h = *h;
+                        self.apply(s, json!({ "option": "new", "polyline": h.hex(), "invert": self.invert }))
+                    }
+                    None => Ok(Step::Continue),
+                },
+                Input::Enter => Ok(Step::Done),
+                _ => Ok(Step::Continue),
+            },
+        }
+    }
+}

crates/engine/src/cmd/blocks/xref.rs

@@ -34,7 +34,7 @@ pub(super) fn specs() -> Vec<CommandSpec> {
             .noundo(),
         CommandSpec::new("-xref", "External References", run_dash_xref)
             .alias(&["-xr"])
-            .params("{option: \"?\"|bind|detach|path|unload|reload|overlay|attach|type, names?: \"A,B*\" (default *), path? (path, attach, overlay), insert?: bool (bind: Insert type), overlay?: bool (type), at?, scale?, rotation? (attach)}")
+            .params("{option: \"?\"|bind|detach|path|unload|reload|overlay|attach|type, names?: \"A,B*\" (default *), exact?: bool (names are literal xref names, no wildcards or commas), path? (path, attach, overlay), insert?: bool (bind: Insert type), overlay?: bool (type), at?, scale?, rotation? (attach)}")
             .interactive(|_| Ok(Box::new(XrefM::new("-XREF", XStage::Option)))),
         CommandSpec::new("xbind", "Bind...", run_xbind)
             .menu(&["Modify", "Object", "External Reference", "Bind..."])
@@ -50,7 +50,7 @@ pub(super) fn specs() -> Vec<CommandSpec> {
 }
 
 /// Load the xrefs of drawing `i`, just opened (OPEN): the opened state counts as saved, and the
-/// view frames the drawing with them.
+/// view frames the drawing with them, unless the drawing opened on the view it was saved at.
 pub(crate) fn after_open(s: &mut Session, i: usize) {
     let px = s.viewport_px;
     let Some(st) = s.docs.get_mut(i) else { return };
@@ -61,12 +61,21 @@ pub(crate) fn after_open(s: &mut Session, i: usize) {
     let out = load::load_all(Arc::make_mut(&mut st.doc), path.as_deref());
     st.saved = st.doc.clone();
     let ext = st.doc.extents(&cadcraft_doc::Space::Model);
-    if !ext.is_empty() {
-        st.set_view_quiet(crate::View { center: ext.center(), height: (ext.height().max(ext.width() * px.1 / px.0.max(1.0)) * 1.1).max(1e-6) });
+    if !ext.is_empty() && crate::view::saved_view(&st.doc).is_none() {
+        // Fit in the frame of the saved twist, which open_drawing has restored.
+        let twist = st.view().twist;
+        let (center, w, h) = crate::View::twisted_box(ext, twist);
+        st.set_view_quiet(crate::View { center, height: (h.max(w * px.1 / px.0.max(1.0)) * 1.1).max(1e-6), twist });
     }
     echo_all(s, &out);
 }
 
+/// The file a reference saved as `path` in a drawing at `host` is read from, if there is one
+/// (xrefs and raster images look in the same places).
+pub(crate) fn find_file(path: &str, host: Option<&str>) -> Option<std::path::PathBuf> {
+    load::find(path, host.map(std::path::Path::new), false).ok()
+}
+
 /// The open drawing's path (xref paths are relative to its folder).
 fn host(s: &Session) -> Option<String> {
     s.state().ok().and_then(|st| st.path.clone())
@@ -192,6 +201,46 @@ fn run_xattach(s: &mut Session, p: &Value) -> Result<Value> {
 
 /// The xrefs a JSON call names (`names`, default all); an error when none match.
 fn named(s: &Session, cmd: &str, p: &Value) -> Result<Vec<String>> {
+    if p.get("exact").and_then(Value::as_bool) == Some(true) {
+        let lits: Vec<&str> = match p.get("names") {
+            Some(Value::Array(a)) => a.iter().filter_map(Value::as_str).collect(),
+            Some(Value::String(t)) => vec![t.as_str()],
+            _ => str_param(p, "name").into_iter().collect(),
+        };
+        let d = s.doc()?;
+        let mut names = Vec::new();
+        let mut selected = std::collections::HashSet::new();
+        // Symbol names are case-insensitive: two xrefs that differ only by case can't be loaded together.
+        let mut folded = std::collections::HashMap::new();
+        for literal in &lits {
+            if let Some(block) = xrefs(d).find(|block| block.name == *literal) {
+                if let Some(first) = folded.insert(block.name.to_ascii_lowercase(), block.name.clone()).filter(|f| *f != block.name) {
+                    return Err(bad(cmd, format!("xref names \"{first}\" and \"{}\" differ only by case", block.name)));
+                }
+                if selected.insert(block.name.clone()) {
+                    names.push(block.name.clone());
+                }
+                continue;
+            }
+            let normalized = literal.to_ascii_lowercase();
+            let mut matches = xrefs(d).filter(|block| block.name.to_ascii_lowercase() == normalized);
+            if let Some(block) = matches.next() {
+                if matches.next().is_some() {
+                    return Err(bad(cmd, format!("xref name \"{literal}\" is ambiguous ignoring case")));
+                }
+                if let Some(first) = folded.insert(block.name.to_ascii_lowercase(), block.name.clone()).filter(|f| *f != block.name) {
+                    return Err(bad(cmd, format!("xref names \"{first}\" and \"{}\" differ only by case", block.name)));
+                }
+                if selected.insert(block.name.clone()) {
+                    names.push(block.name.clone());
+                }
+            }
+        }
+        if names.is_empty() {
+            return Err(bad(cmd, format!("no xref named \"{}\"", lits.join(","))));
+        }
+        return Ok(names);
+    }
     let pattern = match p.get("names") {
         Some(Value::Array(a)) => a.iter().filter_map(Value::as_str).collect::<Vec<_>>().join(","),
         Some(Value::String(t)) => t.clone(),
@@ -214,6 +263,19 @@ fn run_xref(s: &mut Session, _p: &Value) -> Result<Value> {
     Ok(r)
 }
 
+/// An error when two of `names` (or, with `all`, one of them and any other attached xref) differ only
+/// by case: symbol names are case-insensitive, so such xrefs cannot be handled together, and the
+/// command must refuse before it changes anything.
+fn refuse_case_clash(d: &Drawing, cmd: &str, names: &[String], all: bool) -> Result<()> {
+    let others: Vec<&str> = if all { xrefs(d).map(|b| b.name.as_str()).collect() } else { names.iter().map(String::as_str).collect() };
+    for n in names {
+        if let Some(o) = others.iter().find(|o| *o != n && o.eq_ignore_ascii_case(n)) {
+            return Err(bad(cmd, format!("xref names \"{n}\" and \"{o}\" differ only by case")));
+        }
+    }
+    Ok(())
+}
+
 fn run_dash_xref(s: &mut Session, p: &Value) -> Result<Value> {
     let option = str_param(p, "option").unwrap_or("?").trim().to_ascii_lowercase();
     let host = host(s);
@@ -243,6 +305,7 @@ fn run_dash_xref(s: &mut Session, p: &Value) -> Result<Value> {
         }
         "detach" | "d" => {
             let names = named(s, "-xref", p)?;
+            refuse_case_clash(s.doc()?, "-xref", &names, true)?;
             let mut erased = 0;
             for n in &names {
                 erased += load::detach(s.doc_mut()?, n);
@@ -267,6 +330,7 @@ fn run_dash_xref(s: &mut Session, p: &Value) -> Result<Value> {
         "path" | "p" => {
             let path = str_param(p, "path").map(str::trim).filter(|t| !t.is_empty()).ok_or_else(|| bad("-xref", "`path` is required"))?.to_string();
             let names = named(s, "-xref", p)?;
+            refuse_case_clash(s.doc()?, "-xref", &names, false)?;
             let d = s.doc_mut()?;
             for n in &names {
                 if let Some(b) = d.blocks.get_mut(n) {

crates/engine/src/cmd/blocks/xref/load.rs

@@ -10,6 +10,7 @@
 //! loaded further up (a circular reference) is not loaded again. Every failure leaves the xref's
 //! block empty with a status saying why; nothing here stops the host drawing from opening.
 
+use std::collections::HashSet;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
@@ -312,7 +313,23 @@ pub(crate) fn load(d: &mut Drawing, name: &str, host: Option<&str>, chosen: bool
 /// [`load`] the xrefs `names` within one set of limits.
 pub(crate) fn load_each(d: &mut Drawing, names: &[String], host: Option<&str>, chosen: bool) -> Vec<Outcome> {
     let mut cx = Ctx::new(host);
-    names.iter().flat_map(|n| load_with(d, n, host, chosen, &mut cx)).collect()
+    // Names are case-insensitive, so a name that differs only by case from an earlier one is the same xref.
+    let mut seen = std::collections::HashMap::new();
+    names
+        .iter()
+        .flat_map(|n| match seen.entry(n.to_ascii_lowercase()) {
+            std::collections::hash_map::Entry::Vacant(v) => {
+                v.insert(n.as_str());
+                load_with(d, n, host, chosen, &mut cx)
+            }
+            // Reported, not silent: the skipped xref keeps its status and is not loaded here.
+            std::collections::hash_map::Entry::Occupied(o) => vec![Outcome {
+                name: String::new(),
+                status: XrefStatus::Unresolved,
+                detail: format!("xref \"{n}\" not loaded: it differs only by case from \"{}\"", o.get()),
+            }],
+        })
+        .collect()
 }
 
 impl Ctx {
@@ -339,14 +356,15 @@ fn load_in(d: &mut Drawing, name: &str, host: Option<&Path>, chosen: bool, cx: &
     let (status, detail) = match fetch(&path, host, chosen, cx, depth) {
         Ok((x, file)) => match import(d, &key, &x, cx) {
             Ok(()) => (XrefStatus::Loaded, file.to_string_lossy().into_owned()),
-            Err(e) => (XrefStatus::Unresolved, e),
+            Err(e) => {
+                // Whatever made it in before the failure goes again. A fetch that failed imported
+                // nothing, so it doesn't pay for a second scan of the block table.
+                clear(d, &key);
+                (XrefStatus::Unresolved, e)
+            }
         },
         Err(e) => e,
     };
-    if status != XrefStatus::Loaded {
-        // Whatever made it in before the failure goes again.
-        clear(d, &key);
-    }
     set_status(d, &key, status);
     (status, detail)
 }
@@ -390,9 +408,15 @@ fn import(d: &mut Drawing, key: &str, x: &Drawing, cx: &mut Ctx) -> Result<(), S
         return Err(format!("more than {MAX_XREF_OBJECTS} objects"));
     }
     let dep = |sym: Sym, n: &str| (!shared(sym, n)).then(|| format!("{key}|{n}"));
+    // The host's names per table, looked up in a set built once: both drawings are hostile input,
+    // so a scan per imported record would be quadratic.
+    fn names<T>(all: &[T], name: fn(&T) -> &str) -> HashSet<String> {
+        all.iter().map(|t| name(t).to_ascii_uppercase()).collect()
+    }
+    let mut have = names(&d.layers, |l| &l.name);
     for l in &x.layers {
         if let Some(n) = dep(Sym::Layer, &l.name)
-            && d.layer(&n).is_none()
+            && have.insert(n.to_ascii_uppercase())
         {
             let mut l = l.clone();
             l.name = n;
@@ -400,39 +424,44 @@ fn import(d: &mut Drawing, key: &str, x: &Drawing, cx: &mut Ctx) -> Result<(), S
             d.layers.push(l);
         }
     }
+    let mut have = names(&d.linetypes, |t| &t.name);
     for t in &x.linetypes {
         if let Some(n) = dep(Sym::Linetype, &t.name)
-            && d.linetype(&n).is_none()
+            && have.insert(n.to_ascii_uppercase())
         {
             d.linetypes.push(cadcraft_doc::Linetype { name: n, ..t.clone() });
         }
     }
+    let mut have = names(&d.text_styles, |t| &t.name);
     for t in &x.text_styles {
         if let Some(n) = dep(Sym::Style, &t.name)
-            && d.text_style(&n).is_none()
+            && have.insert(n.to_ascii_uppercase())
         {
             d.text_styles.push(cadcraft_doc::TextStyle { name: n, ..t.clone() });
         }
     }
+    let mut have = names(&d.dim_styles, |t| &t.name);
     for t in &x.dim_styles {
         if let Some(n) = dep(Sym::DimStyle, &t.name)
-            && d.dim_style(&n).is_none()
+            && have.insert(n.to_ascii_uppercase())
         {
             let text_style = dep(Sym::Style, &t.text_style).unwrap_or_else(|| t.text_style.clone());
             d.dim_styles.push(cadcraft_doc::DimStyle { name: n, text_style, ..t.clone() });
         }
     }
+    let mut have = names(&d.mleader_styles, |t| &t.name);
     for t in &x.mleader_styles {
         if let Some(n) = dep(Sym::MLeaderStyle, &t.name)
-            && !d.mleader_styles.iter().any(|o| o.name.eq_ignore_ascii_case(&n))
+            && have.insert(n.to_ascii_uppercase())
         {
             let text_style = dep(Sym::Style, &t.text_style).unwrap_or_else(|| t.text_style.clone());
             d.mleader_styles.push(cadcraft_doc::MLeaderStyle { name: n, text_style, ..t.clone() });
         }
     }
+    let mut have = names(&d.table_styles, |t| &t.name);
     for t in &x.table_styles {
         if let Some(n) = dep(Sym::TableStyle, &t.name)
-            && !d.table_styles.iter().any(|o| o.name.eq_ignore_ascii_case(&n))
+            && have.insert(n.to_ascii_uppercase())
         {
             d.table_styles.push(cadcraft_doc::TableStyle { name: n, ..t.clone() });
         }

crates/engine/src/cmd/clipboard.rs

@@ -10,7 +10,7 @@
 //! The clipboard can also travel as DXF text ([`system_text`], [`load_system_text`]), so a front
 //! end can put it on the system clipboard and paste it into another CADCraft window.
 
-use std::collections::{BTreeMap, BTreeSet, HashSet};
+use std::collections::{BTreeMap, HashSet};
 use std::sync::Arc;
 
 use cadcraft_doc::{Block, Drawing, Entity, EntityKind, HVal, Handle};
@@ -279,20 +279,14 @@ fn defs_for(src: &Drawing, ents: &[Entity]) -> Drawing {
 /// Add `defs`' table records and blocks that `d` doesn't have. Returns the blocks copied, from
 /// their name in `defs` to their name in `d`.
 fn merge(d: &mut Drawing, defs: &Drawing) -> BTreeMap<String, String> {
-    fn add<T: Clone>(ours: &mut Vec<T>, theirs: &[T], name: fn(&T) -> &str) {
-        for t in theirs {
-            if !ours.iter().any(|o| name(o).eq_ignore_ascii_case(name(t))) {
-                ours.push(t.clone());
-            }
-        }
-    }
+    use crate::cmd::merge::merge_named as add;
     add(&mut d.layers, &defs.layers, |l| &l.name);
     add(&mut d.linetypes, &defs.linetypes, |l| &l.name);
     add(&mut d.text_styles, &defs.text_styles, |t| &t.name);
     add(&mut d.dim_styles, &defs.dim_styles, |t| &t.name);
     add(&mut d.mleader_styles, &defs.mleader_styles, |t| &t.name);
     add(&mut d.table_styles, &defs.table_styles, |t| &t.name);
-    let renames = block_names(d, defs);
+    let renames = crate::cmd::merge::block_renames(d, defs, None);
     for (from, to) in &renames {
         let Some(b) = defs.blocks.get(from) else { continue };
         let mut nb = (**b).clone();
@@ -308,34 +302,6 @@ fn merge(d: &mut Drawing, defs: &Drawing) -> BTreeMap<String, String> {
     renames
 }
 
-/// Which blocks of `defs` to copy, and under which name: a new name keeps its own, a generated
-/// (anonymous `*…`) block whose name is taken gets a fresh generated name, and a named block `d`
-/// already has keeps `d`'s definition (not copied).
-fn block_names(d: &Drawing, defs: &Drawing) -> BTreeMap<String, String> {
-    let mut out = BTreeMap::new();
-    let mut taken: BTreeSet<String> = d.blocks.keys().map(|k| up(k)).collect();
-    for (name, b) in &defs.blocks {
-        let upper = up(name);
-        if upper.starts_with("*MODEL_SPACE") || upper.starts_with("*PAPER_SPACE") {
-            continue;
-        }
-        let to = if !taken.contains(&upper) {
-            name.clone()
-        } else if b.anonymous || name.starts_with('*') {
-            let prefix: String = name.chars().take_while(|c| !c.is_ascii_digit()).collect();
-            match (1..=1_000_000).map(|i| format!("{prefix}{i}")).find(|n| !taken.contains(&up(n))) {
-                Some(n) => n,
-                None => continue,
-            }
-        } else {
-            continue;
-        };
-        taken.insert(up(&to));
-        out.insert(name.clone(), to);
-    }
-    out
-}
-
 /// A copy of a clipboard object for `d`: a fresh handle, block references renamed, and links to
 /// objects of the source drawing (associative dimension points) dropped.
 fn adopt(d: &mut Drawing, e: &Entity, renames: &BTreeMap<String, String>) -> Entity {

crates/engine/src/cmd/curves.rs

@@ -453,14 +453,32 @@ impl Chain {
     }
     /// Point and unit tangent at arc length `d` from the start (clamped).
     pub fn at_length(&self, d: f64) -> Option<(Vec2, Vec2)> {
-        let mut acc = 0.0;
-        for s in &self.segs {
-            let l = s.len();
-            if d <= acc + l + 1e-12 && l > 0.0 {
-                let t = ((d - acc) / l).clamp(0.0, 1.0);
-                return Some((s.at(t), s.tangent(t)));
-            }
-            acc += l;
+        self.at_length_in(&self.end_lengths(), d)
+    }
+    /// The arc length from the chain's start to the end of each segment, for [`Self::at_length_in`].
+    pub fn end_lengths(&self) -> Vec<f64> {
+        self.segs
+            .iter()
+            .scan(0.0, |acc, s| {
+                *acc += s.len();
+                Some(*acc)
+            })
+            .collect()
+    }
+    /// [`Self::at_length`] with the segment end lengths computed once (`ends` from
+    /// [`Self::end_lengths`]), so many samples along one chain each cost a binary search.
+    pub fn at_length_in(&self, ends: &[f64], d: f64) -> Option<(Vec2, Vec2)> {
+        let first = ends.partition_point(|e| d > e + 1e-12);
+        // A segment of no length can't hold the point; the next one that has length does.
+        // `ends` never decreases, so the first segment past `first` with length is found by search
+        // (a run of zero-length segments can be long) instead of a scan.
+        let base = first.checked_sub(1).and_then(|p| ends.get(p)).copied().unwrap_or(0.0);
+        let i = first + ends.get(first..).unwrap_or_default().partition_point(|e| *e <= base);
+        let i = (i < self.segs.len()).then_some(i);
+        if let Some(s) = i.and_then(|i| self.segs.get(i)) {
+            let start = i.and_then(|i| i.checked_sub(1)).and_then(|p| ends.get(p)).copied().unwrap_or(0.0);
+            let t = ((d - start) / s.len()).clamp(0.0, 1.0);
+            return Some((s.at(t), s.tangent(t)));
         }
         self.segs.last().map(|s| (s.end(), s.tangent(1.0)))
     }
@@ -640,6 +658,34 @@ pub fn reverse_vertices(vs: &[PolyVertex], closed: bool) -> Vec<PolyVertex> {
 mod tests {
     use super::*;
 
+    /// The indexed lookup gives the point and tangent a scan from the start gives, also past the
+    /// ends and over a segment of no length.
+    #[test]
+    fn at_length_in_matches_a_scan() {
+        let l = |a: (f64, f64), b: (f64, f64)| Segment::Line(Line::new(Vec2::new(a.0, a.1), Vec2::new(b.0, b.1)));
+        let c = Chain {
+            segs: vec![l((0.0, 0.0), (0.0, 0.0)), l((0.0, 0.0), (4.0, 0.0)), l((4.0, 0.0), (4.0, 0.0)), l((4.0, 0.0), (4.0, 3.0))],
+            closed: false,
+        };
+        let ends = c.end_lengths();
+        for d in [-1.0, 0.0, 1.5, 4.0, 4.0 + 1e-13, 5.0, 7.0, 9.0] {
+            // The scan this replaced.
+            let mut acc = 0.0;
+            let mut want = c.segs.last().map(|s| (s.end(), s.tangent(1.0)));
+            for s in &c.segs {
+                let len = s.len();
+                if d <= acc + len + 1e-12 && len > 0.0 {
+                    let t = ((d - acc) / len).clamp(0.0, 1.0);
+                    want = Some((s.at(t), s.tangent(t)));
+                    break;
+                }
+                acc += len;
+            }
+            assert_eq!(c.at_length_in(&ends, d), want, "d = {d}");
+            assert_eq!(c.at_length(d), want);
+        }
+    }
+
     #[test]
     fn arc_builders() {
         let a = arc_sca(Vec2::new(1.0, 0.0), Vec2::ZERO, std::f64::consts::FRAC_PI_2).unwrap();

crates/engine/src/cmd/draw2/breakline.rs

@@ -20,7 +20,7 @@ use crate::{Accept, EngineError, Input, Interactive, Prompt, Result, Session, St
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         CommandSpec::new("breakline", "Break-line Symbol", run_breakline)
-            .menu(&["Tools", "Express Tools", "Break-line Symbol"])
+            .menu(&["Tools", "Additional Tools", "Break-line Symbol"])
             .params(
                 "{p1, p2, at?: [x,y] (symbol location; default the midpoint), size? (default 1, times DIMSCALE), \
                  extension? (past both points; default 0), block? (a block with two points on Defpoints; default the built-in symbol)} → {handle}",

crates/engine/src/cmd/draw2/divide.rs

@@ -36,16 +36,18 @@ fn check_block(s: &Session, b: Option<&str>) -> Result<()> {
 pub(crate) fn divide_points(c: &Chain, n: usize) -> Vec<(Vec2, Vec2)> {
     let l = c.len();
     let range = if c.closed { 0..n } else { 1..n };
-    range.filter_map(|i| c.at_length(l * i as f64 / n as f64)).collect()
+    let ends = c.end_lengths();
+    range.filter_map(|i| c.at_length_in(&ends, l * i as f64 / n as f64)).collect()
 }
 
 pub(crate) fn measure_points(c: &Chain, step: f64) -> Vec<(Vec2, Vec2)> {
     let l = c.len();
+    let ends = c.end_lengths();
     let mut out = Vec::new();
     let mut k = 1usize;
     while (k as f64) * step < l - 1e-9 && out.len() < MAX_GEN {
         let d = k as f64 * step;
-        out.extend(c.at_length(d));
+        out.extend(c.at_length_in(&ends, d));
         k += 1;
     }
     out

crates/engine/src/cmd/draw2/revcloud.rs

@@ -58,8 +58,9 @@ pub(crate) fn cloud_vertices(boundary: &[Vec2], arc_len: f64, per_edge: bool, re
             closed: true,
         };
         let k = ((perim / arc_len).round() as usize).clamp(3, MAX_GEN);
+        let ends = chain.end_lengths();
         for j in 0..k {
-            out.extend(chain.at_length(perim * j as f64 / k as f64).map(|x| x.0));
+            out.extend(chain.at_length_in(&ends, perim * j as f64 / k as f64).map(|x| x.0));
         }
     }
     let b = if reverse { -0.5 } else { 0.5 };

crates/engine/src/cmd/edit.rs

@@ -557,9 +557,15 @@ fn run_clear(s: &mut Session, _p: &Value) -> Result<Value> {
 fn run_selectall(s: &mut Session, _p: &Value) -> Result<Value> {
     let space = s.space();
     let d = s.doc()?;
+    let frozen = s.viewport_frozen();
     let hs: Vec<Handle> = d
         .space(&space)
-        .map(|st| st.iter().filter(|e| d.is_visible(e) && d.layer(&e.common.layer).is_none_or(|l| !l.locked)).map(|e| e.handle).collect())
+        .map(|st| {
+            st.iter()
+                .filter(|e| crate::select::selectable(d, e, frozen) && d.layer(&e.common.layer).is_none_or(|l| !l.locked))
+                .map(|e| e.handle)
+                .collect()
+        })
         .unwrap_or_default();
     let n = hs.len();
     s.set_selection(hs);
@@ -580,16 +586,19 @@ fn run_select(s: &mut Session, p: &Value) -> Result<Value> {
     let add = bool_or(p, "add", false);
     let picked: Vec<Handle> = if let Some(w) = points_param(p, "window") {
         let (Some(a), Some(b)) = (w.first(), w.get(1)) else { return Err(bad("select", "window needs 2 corners")) };
-        crate::select::select_window(s.doc()?, &space, Bounds2::new(*a, *b), bool_or(p, "crossing", false))
+        crate::select::select_window_in(s.doc()?, &space, s.viewport_frozen(), Bounds2::new(*a, *b), bool_or(p, "crossing", false))
     } else if let Some(at) = point_param(p, "at") {
         let ap = f64_or(p, "aperture", s.pixel_size() * s.settings.pickbox * 1.5);
-        crate::select::pick(s.doc()?, &space, at, ap).into_iter().collect()
+        crate::select::pick_in(s.doc()?, &space, s.viewport_frozen(), at, ap).into_iter().collect()
     } else if let Some(f) = points_param(p, "fence") {
-        crate::select::select_fence(s.doc()?, &space, &f)
-    } else {
+        crate::select::select_fence_in(s.doc()?, &space, s.viewport_frozen(), &f)
+    } else if ["handles", "handle"].iter().any(|k| p.get(*k).is_some_and(|v| !v.is_null())) {
         targets(s, p)?
+    } else {
+        // Nothing to select with: the selection stays, also what the active viewport does not draw.
+        s.stored_selection()
     };
-    let mut sel = if add { s.selection() } else { Vec::new() };
+    let mut sel = if add { s.stored_selection() } else { Vec::new() };
     sel.extend(picked);
     s.set_selection(sel);
     let sel = s.selection();

crates/engine/src/cmd/exchange.rs

@@ -7,7 +7,7 @@
 //! stays I/O-agnostic; the JSON forms never open dialogs (the UI asks for files when these
 //! commands come from a menu, the tool bar or the command line).
 
-use std::collections::{BTreeMap, BTreeSet};
+use std::collections::BTreeMap;
 use std::sync::Arc;
 
 use cadcraft_color::Rgb;
@@ -55,11 +55,11 @@ pub fn specs() -> Vec<CommandSpec> {
             .alias(&["printpdf", "pdfb"])
             .params("{path?: \"DIR/NAME^NAME2.pdf\" (default: the drawing's file; a `^` splits the name into one book name per row of frames; else returns base64 `data` per book), names?: [book names], frameHeight?: mm (default 297), unit?: mm per drawing unit (default 1)} → {books: [{name, pages, bytes, path? | data}], skipped}: closed polylines of the frame height in model space are sheet frames; each row (same lower edge, bottom to top) is one PDF, its frames left to right one page each on the paper (ISO A-series, either orientation) they match")
             .noundo(),
-        CommandSpec::new("attach", "Attach", |_, _| {
-            Err(EngineError::Other("ATTACH is not available yet: raster images and PDF/DWF/DGN underlays can't be shown yet".into()))
+        CommandSpec::new("attach", "Attach", |s, p| match str_param(p, "path").map(extension) {
+            Some(e) if super::image::is_image_ext(&e) => super::image::run_imageattach(s, p),
+            _ => Err(EngineError::Other("ATTACH is not available yet for this file: only raster images (PNG, JPEG, BMP, TIFF; see IMAGEATTACH) can be attached, PDF/DWF/DGN underlays can't be shown yet".into())),
         })
-        .params("not available yet")
-        .noundo(),
+        .params("{path: image file, …} as IMAGEATTACH; other file types are not available yet"),
         CommandSpec::new("share", "Share", |_, _| {
             Err(EngineError::Other("SHARE is not available yet: there is no online service to share through; EXPORT or PUBLISH the drawing and send the file".into()))
         })
@@ -166,7 +166,7 @@ fn import_drawing(s: &mut Session, src: &Drawing, at: Vec2, scale: f64, file: &s
     let space = s.space();
     let d = s.doc_mut()?;
     let (layers, styles) = merge_tables(d, src);
-    let renames = block_names(d, src);
+    let renames = crate::cmd::merge::block_renames(d, src, None);
     for (from, to) in &renames {
         let Some(b) = src.blocks.get(from) else { continue };
         let mut nb = (**b).clone();
@@ -204,7 +204,8 @@ fn import_drawing(s: &mut Session, src: &Drawing, at: Vec2, scale: f64, file: &s
 fn read_file(_path: &str) -> Result<Vec<u8>> {
     #[cfg(not(target_arch = "wasm32"))]
     {
-        std::fs::read(_path).map_err(|e| bad("import", format!("{_path}: {e}")))
+        crate::capped_read::read_capped(std::path::Path::new(_path), crate::cmd::file::MAX_DRAWING_BYTES)
+            .map_err(|e| bad("import", format!("{_path}: {e}")))
     }
     #[cfg(target_arch = "wasm32")]
     Err(bad("import", "paths are not available on the web; pass `data`"))
@@ -213,16 +214,7 @@ fn read_file(_path: &str) -> Result<Vec<u8>> {
 /// Add the source's layers, linetypes and styles that this drawing doesn't have (a name that
 /// exists keeps this drawing's definition). Returns how many layers and how many other records were added.
 fn merge_tables(d: &mut Drawing, src: &Drawing) -> (usize, usize) {
-    fn merge<T: Clone>(ours: &mut Vec<T>, theirs: &[T], name: fn(&T) -> &str) -> usize {
-        let mut n = 0;
-        for t in theirs {
-            if !ours.iter().any(|o| name(o).eq_ignore_ascii_case(name(t))) {
-                ours.push(t.clone());
-                n += 1;
-            }
-        }
-        n
-    }
+    use crate::cmd::merge::merge_named as merge;
     let layers = merge(&mut d.layers, &src.layers, |l| &l.name);
     let others = merge(&mut d.linetypes, &src.linetypes, |l| &l.name)
         + merge(&mut d.text_styles, &src.text_styles, |t| &t.name)
@@ -232,35 +224,6 @@ fn merge_tables(d: &mut Drawing, src: &Drawing) -> (usize, usize) {
     (layers, others)
 }
 
-/// Which source blocks to copy, and under which name: new names keep theirs, generated
-/// (anonymous `*…`) blocks that collide get a fresh generated name, and a named block this drawing
-/// already has keeps this drawing's definition (not copied).
-fn block_names(d: &Drawing, src: &Drawing) -> BTreeMap<String, String> {
-    let mut out = BTreeMap::new();
-    let mut taken: BTreeSet<String> = d.blocks.keys().map(|k| k.to_ascii_uppercase()).collect();
-    for (name, b) in &src.blocks {
-        let upper = name.to_ascii_uppercase();
-        if upper.starts_with("*MODEL_SPACE") || upper.starts_with("*PAPER_SPACE") {
-            continue;
-        }
-        let anonymous = b.anonymous || name.starts_with('*');
-        let to = if !taken.contains(&upper) {
-            name.clone()
-        } else if anonymous {
-            let prefix: String = name.chars().take_while(|c| !c.is_ascii_digit()).collect();
-            match (1..=1_000_000).map(|i| format!("{prefix}{i}")).find(|n| !taken.contains(&n.to_ascii_uppercase())) {
-                Some(n) => n,
-                None => continue,
-            }
-        } else {
-            continue;
-        };
-        taken.insert(to.to_ascii_uppercase());
-        out.insert(name.clone(), to);
-    }
-    out
-}
-
 /// A copy of a source entity for this drawing: a fresh handle, block references renamed, and
 /// links to other source objects (associative dimension points) dropped.
 fn adopt(d: &mut Drawing, e: &Entity, renames: &BTreeMap<String, String>) -> Entity {
@@ -680,6 +643,7 @@ mod tests {
             rows: 1,
             col_spacing: 0.0,
             row_spacing: 0.0,
+            clip: None,
         })
     }
 

crates/engine/src/cmd/file.rs

@@ -8,7 +8,7 @@ mod template;
 use std::sync::OnceLock;
 
 use cadcraft_doc::{Drawing, Format};
-pub use cadcraft_dxf::Version;
+pub use craft_dxf::Version;
 use serde_json::{Value, json};
 
 use super::{CommandSpec, EngineError, Interactive, always, bad, bool_or, find_command, ok, str_param};
@@ -16,15 +16,15 @@ use super::{CommandSpec, EngineError, Interactive, always, bad, bool_or, find_co
 use crate::{Accept, Input, Prompt, Result, Session, Step};
 
 /// The rules the Command Aliases dialog checks before it sends an alias to ALIASEDIT.
-pub use pgp::{MAX_ALIASES, alias_name, command_id};
-pub(crate) use pgp::{specs as alias_specs, user_alias};
+pub use pgp::{MAX_ALIAS_PROFILE_BYTES, MAX_ALIASES, alias_name, alias_profile, command_id, restore_aliases};
+pub(crate) use pgp::{greek_alias, specs as alias_specs, user_alias};
 pub use template::{qnew_template, set_qnew_template};
 
 /// Largest drawing accepted from a local path, matching the per-file xref limit. A path naming an
 /// endless device must be rejected before it exhausts memory (CWE-400), so native opens read
 /// through [`crate::capped_read`] rather than buffering to EOF.
 #[cfg(not(target_arch = "wasm32"))]
-const MAX_DRAWING_BYTES: usize = 512 << 20;
+pub(crate) const MAX_DRAWING_BYTES: usize = 512 << 20;
 /// Largest `.scr` script accepted from a local path.
 #[cfg(not(target_arch = "wasm32"))]
 const MAX_SCRIPT_BYTES: usize = 64 << 20;
@@ -53,9 +53,9 @@ pub fn io() -> Option<&'static IoHooks> {
 /// (installed by the app with the DXF reader and writer, a lower layer).
 pub struct EntityCodec {
     /// The entity's type name and the groups of its record, without its `0` group.
-    pub groups: fn(&Drawing, &cadcraft_doc::Entity) -> (String, Vec<cadcraft_dxf::Tag>),
+    pub groups: fn(&Drawing, &cadcraft_doc::Entity) -> (String, Vec<craft_dxf::Tag>),
     /// An entity from a type name and groups.
-    pub entity: fn(&str, &[cadcraft_dxf::Tag]) -> Option<(cadcraft_doc::Common, cadcraft_doc::EntityKind)>,
+    pub entity: fn(&str, &[craft_dxf::Tag]) -> Option<(cadcraft_doc::Common, cadcraft_doc::EntityKind)>,
 }
 
 static CODEC: OnceLock<EntityCodec> = OnceLock::new();
@@ -70,6 +70,19 @@ pub fn entity_codec() -> Option<&'static EntityCodec> {
 /// COMPARE (drawing comparison).
 pub mod compare;
 
+/// Decode a raster image file (PNG, JPEG, BMP, TIFF) to pixels: installed by the app with the
+/// image reader, a lower layer.
+pub type ImageHook = fn(&[u8]) -> std::result::Result<cadcraft_doc::Raster, String>;
+
+static IMAGE: OnceLock<ImageHook> = OnceLock::new();
+
+pub fn set_image_decoder(h: ImageHook) {
+    let _ = IMAGE.set(h);
+}
+pub fn image_decoder() -> Option<ImageHook> {
+    IMAGE.get().copied()
+}
+
 /// Hand finished file bytes to the user where there is no file system (the browser: a download).
 /// Arguments: file name, MIME type, bytes. `Ok` only once the delivery was actually started.
 pub type DeliverHook = fn(&str, &str, &[u8]) -> std::result::Result<(), String>;
@@ -311,6 +324,7 @@ pub fn finish_open(s: &mut Session, f: ReadFile) -> Result<Value> {
     let ReadFile { drawing, binary_dxf, name, path } = f;
     let i = add_read(s, drawing, binary_dxf, &name, path);
     super::blocks::xref::after_open(s, i);
+    super::image::after_open(s, i);
     Ok(opened(s, i, true))
 }
 
@@ -320,7 +334,13 @@ fn read_bytes(bytes: &[u8], name: &str, path: Option<String>) -> Result<ReadFile
     // A file that isn't a drawing (an imported SVG) gives the drawing no file name: QSAVE then
     // asks where to save instead of exporting over the original.
     let path = path.filter(|p| is_drawing_file(p));
-    Ok(ReadFile { drawing, binary_dxf: cadcraft_dxf::is_binary(bytes), name: name.to_string(), path })
+    // The SHX fonts its text styles name are looked for beside the drawing too.
+    if let Some(dir) = path.as_deref().and_then(|p| std::path::Path::new(p).parent()) {
+        // A bare file name is in the current folder.
+        let dir = if dir.as_os_str().is_empty() { std::path::Path::new(".") } else { dir };
+        cadcraft_fonts::shx::add_drawing_dir(&std::path::absolute(dir).unwrap_or_else(|_| dir.to_path_buf()));
+    }
+    Ok(ReadFile { drawing, binary_dxf: craft_dxf::is_binary(bytes), name: name.to_string(), path })
 }
 
 fn add_read(s: &mut Session, drawing: Drawing, binary_dxf: bool, name: &str, path: Option<String>) -> usize {
@@ -345,10 +365,12 @@ pub(crate) fn open_bytes(s: &mut Session, bytes: &[u8], name: &str, path: Option
 fn opened(s: &Session, i: usize, entities: bool) -> Value {
     let d = s.docs.get(i).map(|st| &st.doc);
     let warnings = d.map(|d| d.read_notes.clone()).unwrap_or_default();
+    // Opened on the view it was saved at: a viewer keeps it instead of fitting the extents.
+    let saved_view = d.is_some_and(|d| crate::view::saved_view(d).is_some());
     if entities {
-        json!({ "index": i, "entities": d.map(|d| d.entity_count()), "warnings": warnings })
+        json!({ "index": i, "entities": d.map(|d| d.entity_count()), "warnings": warnings, "saved_view": saved_view })
     } else {
-        json!({ "index": i, "warnings": warnings })
+        json!({ "index": i, "warnings": warnings, "saved_view": saved_view })
     }
 }
 
@@ -363,6 +385,7 @@ fn run_open(s: &mut Session, p: &Value) -> Result<Value> {
                 crate::capped_read::read_capped(std::path::Path::new(path), MAX_DRAWING_BYTES).map_err(|e| bad("open", format!("{path}: {e}")))?;
             let i = open_bytes(s, &bytes, path, Some(path.to_string()))?;
             super::blocks::xref::after_open(s, i);
+            super::image::after_open(s, i);
             return Ok(opened(s, i, true));
         }
         #[cfg(target_arch = "wasm32")]
@@ -373,6 +396,7 @@ fn run_open(s: &mut Session, p: &Value) -> Result<Value> {
     let name = str_param(p, "name").unwrap_or("Drawing.dxf");
     let i = open_bytes(s, &bytes, name, None)?;
     super::blocks::xref::after_open(s, i);
+    super::image::after_open(s, i);
     Ok(opened(s, i, false))
 }
 
@@ -479,7 +503,7 @@ pub fn backup_path(path: &std::path::Path) -> std::path::PathBuf {
 pub fn looks_like_drawing(bytes: &[u8]) -> bool {
     // DWG: a version tag like `AC1032` (R12 is `AC1009`).
     let dwg = bytes.len() >= 6 && bytes.starts_with(b"AC") && bytes[2..6].iter().all(|b| b.is_ascii_digit());
-    if dwg || cadcraft_dxf::is_binary(bytes) {
+    if dwg || craft_dxf::is_binary(bytes) {
         return true;
     }
     // ASCII DXF: optional comments (999), then group 0 SECTION.
@@ -509,7 +533,7 @@ pub fn completeness(head: &[u8], tail: &[u8], len: u64) -> Option<bool> {
         // Too short for any DWG's header: cut off, not unknown.
         return if head.len() < 256 { Some(false) } else { dwg_complete(head, len) };
     }
-    if cadcraft_dxf::is_binary(head) {
+    if craft_dxf::is_binary(head) {
         return Some(tail.ends_with(b"EOF\0"));
     }
     let text = String::from_utf8_lossy(tail);
@@ -601,6 +625,40 @@ pub fn save_keeps_current(_path: &std::path::Path) -> bool {
     false
 }
 
+/// The mode of a new backup: no more open than the drawing (`src_mode`, group `src_gid`) nor than the
+/// `.bak` it replaces (`old`: mode and group). The backup keeps the old `.bak`'s group, so when that
+/// differs from the drawing's group, its group bits are dropped and its other bits are capped by
+/// the drawing's group bits: a member of the drawing's group must not gain access through `other`.
+#[cfg(unix)]
+fn backup_mode(src_mode: u32, src_gid: u32, old: Option<(u32, u32)>) -> u32 {
+    let mut mode = src_mode & 0o777;
+    if let Some((old_mode, old_gid)) = old {
+        mode &= old_mode;
+        if old_gid != src_gid {
+            mode = without_group(src_mode, mode);
+        }
+    }
+    mode
+}
+
+/// `mode` for a backup that is not in the drawing's group: no group bits, and `other` capped by the
+/// drawing's group bits (`src_mode`).
+#[cfg(unix)]
+fn without_group(src_mode: u32, mode: u32) -> u32 {
+    (mode & !0o070) & (!0o007 | ((src_mode & 0o070) >> 3))
+}
+
+/// A first backup is created in the process's (or folder's) group, not the drawing's: move it to the
+/// drawing's group before any data is written, else drop its group bits ([`without_group`]).
+#[cfg(unix)]
+fn adopt_source_group(out: &std::fs::File, src: &std::fs::Metadata) -> std::io::Result<()> {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt, fchown};
+    if out.metadata()?.gid() == src.gid() || fchown(out, None, Some(src.gid())).is_ok() {
+        return Ok(());
+    }
+    out.set_permissions(std::fs::Permissions::from_mode(without_group(src.mode(), src.mode() & 0o777)))
+}
+
 /// Before `path` is replaced: copy it to its `.bak`, streamed and written atomically too
 /// ([`crate::atomic_write::write_atomic_with`]). Nothing
 /// to keep when there is no file yet. A file that doesn't look like a drawing
@@ -624,19 +682,23 @@ fn backup(path: &std::path::Path) -> std::io::Result<()> {
     // failed write leaves the old .bak as it was; a symlink at the .bak is replaced, never
     // written through.
     #[cfg(unix)]
-    let permissions = {
-        use std::os::unix::fs::PermissionsExt;
-        let mut mode = src.metadata()?.permissions().mode() & 0o777;
-        if let Ok(m) = std::fs::symlink_metadata(&bak)
-            && m.is_file()
-        {
-            mode &= m.permissions().mode();
-        }
-        Some(std::fs::Permissions::from_mode(mode))
+    let source_metadata = src.metadata()?;
+    #[cfg(unix)]
+    let first_backup = std::cell::Cell::new(false);
+    #[cfg(unix)]
+    let permissions = || {
+        use std::os::unix::fs::{MetadataExt, PermissionsExt};
+        let old = std::fs::symlink_metadata(&bak).ok().filter(|m| m.is_file());
+        first_backup.set(old.is_none());
+        Ok(Some(std::fs::Permissions::from_mode(backup_mode(source_metadata.mode(), source_metadata.gid(), old.map(|m| (m.mode(), m.gid()))))))
     };
     #[cfg(not(unix))]
-    let permissions = None;
-    crate::atomic_write::write_atomic_with(&bak, permissions, |out| {
+    let permissions = || Ok(None);
+    crate::atomic_write::write_atomic_with_permissions(&bak, permissions, |out| {
+        #[cfg(unix)]
+        if first_backup.get() {
+            adopt_source_group(out, &source_metadata)?;
+        }
         std::io::Write::write_all(out, &head)?;
         std::io::copy(&mut src, out).map(|_| ())
     })
@@ -755,7 +817,10 @@ const MODELER_TYPES: [&str; 3] = ["3DSOLID", "REGION", "BODY"];
 const DWG_WRITES: [&str; 1] = ["OLE2FRAME"];
 
 /// [`not_saved`] for a file saved as `version`. From 2013 on, a 3D solid, region or body the data
-/// store has a record for keeps its geometry and is not counted; neither are [`DWG_WRITES`].
+/// store has a record for keeps its geometry and is not counted; neither are [`DWG_WRITES`], nor
+/// another program's proxy entity whose class the file names: the DWG writes it with that class.
+/// Before 2013, or when its group 91 names no class of the file, the DWG leaves the proxy out and
+/// it is counted.
 pub fn not_saved_as(d: &Drawing, version: Version) -> std::collections::BTreeMap<String, usize> {
     let mut out: std::collections::BTreeMap<String, usize> = std::collections::BTreeMap::new();
     let stored = if version >= Version::R2013 { d.foreign.data_store_entities() } else { Default::default() };
@@ -772,10 +837,21 @@ pub fn not_saved_as(d: &Drawing, version: Version) -> std::collections::BTreeMap
             if DWG_WRITES.contains(&u.dxf_type.as_str()) {
                 continue;
             }
+            if version >= Version::R2013 && u.dxf_type.eq_ignore_ascii_case("ACAD_PROXY_ENTITY") && d.foreign.proxy_class(&u.tags).is_some() {
+                continue;
+            }
             let n = out.entry(u.dxf_type.clone()).or_insert(0);
             *n = n.saturating_add(1);
         }
     }
+    // Another program's proxy objects (in the OBJECTS section) follow the same rule as its proxy
+    // entities: the DWG writer leaves them out before 2013, or when their class can't be named.
+    for o in d.foreign.objects.iter().filter(|o| o.kind.eq_ignore_ascii_case("ACAD_PROXY_OBJECT")) {
+        if version < Version::R2013 || d.foreign.proxy_class(&o.tags).is_none() {
+            let n = out.entry("ACAD_PROXY_OBJECT".to_string()).or_insert(0);
+            *n = n.saturating_add(1);
+        }
+    }
     out
 }
 
@@ -993,6 +1069,52 @@ mod tests {
     use crate::Session;
     use crate::temp_dir::TempDir;
 
+    /// A backup is never more open than the drawing or the old `.bak`, and loses the group bits when
+    /// it would keep the old `.bak`'s group while the drawing is in another.
+    #[cfg(unix)]
+    #[test]
+    fn backup_mode_drops_group_bits_for_a_different_group() {
+        use super::backup_mode;
+        assert_eq!(backup_mode(0o640, 10, None), 0o640);
+        assert_eq!(backup_mode(0o640, 10, Some((0o664, 10))), 0o640);
+        assert_eq!(backup_mode(0o640, 10, Some((0o664, 20))), 0o600);
+        assert_eq!(backup_mode(0o644, 10, Some((0o644, 20))), 0o604);
+        assert_eq!(backup_mode(0o600, 10, Some((0o664, 10))), 0o600);
+    }
+
+    /// With no `.bak` yet, the first backup takes the drawing's group (when the user is in another
+    /// group, as `id -G` says), never the group the new file would be created in.
+    #[cfg(unix)]
+    #[test]
+    fn first_backup_takes_the_drawings_group() {
+        use std::os::unix::fs::{MetadataExt, PermissionsExt, chown};
+        let dir = TempDir::new("first-bak-grp");
+        let src = dir.join("a.dxf");
+        std::fs::write(&src, "0\nSECTION\n2\nHEADER\n0\nENDSEC\n0\nEOF\n").unwrap();
+        std::fs::set_permissions(&src, std::fs::Permissions::from_mode(0o640)).unwrap();
+        let own = std::fs::metadata(&src).unwrap().gid();
+        let other = std::process::Command::new("id")
+            .arg("-G")
+            .output()
+            .ok()
+            .and_then(|o| String::from_utf8_lossy(&o.stdout).split_whitespace().filter_map(|g| g.parse::<u32>().ok()).find(|g| *g != own));
+        if let Some(gid) = other {
+            chown(&src, None, Some(gid)).unwrap();
+        }
+        super::backup(&src).unwrap();
+        let (s, b) = (std::fs::metadata(&src).unwrap(), std::fs::metadata(super::backup_path(&src)).unwrap());
+        assert_eq!((b.gid(), b.mode() & 0o777), (s.gid(), 0o640));
+    }
+
+    /// The fail-safe when the group cannot be adopted: no group bits, `other` capped by the group's.
+    #[cfg(unix)]
+    #[test]
+    fn without_group_drops_group_bits_and_caps_other() {
+        assert_eq!(super::without_group(0o640, 0o640), 0o600);
+        assert_eq!(super::without_group(0o604, 0o604), 0o600);
+        assert_eq!(super::without_group(0o644, 0o644), 0o604);
+    }
+
     fn active_title(s: &Session) -> String {
         s.state().unwrap().title.clone()
     }

crates/engine/src/cmd/file/compare.rs

@@ -8,7 +8,7 @@ use std::collections::HashMap;
 use std::hash::{Hash, Hasher};
 use std::sync::Arc;
 
-use cadcraft_doc::{Drawing, Entity, EntityKind, Handle, MAX_BLOCK_DEPTH, Space, entity_bounds};
+use cadcraft_doc::{BlockBoundsCache, Drawing, Entity, EntityKind, Handle, MAX_BLOCK_DEPTH, Space, entity_bounds_cached};
 use cadcraft_geom::{Bounds2, Vec2};
 use serde_json::{Value, json};
 
@@ -110,7 +110,7 @@ fn other_drawing(s: &Session, p: &Value) -> Result<(Arc<Drawing>, String)> {
 fn read_path(_path: &str) -> Result<Vec<u8>> {
     #[cfg(not(target_arch = "wasm32"))]
     {
-        std::fs::read(_path).map_err(|e| bad("compare", format!("{_path}: {e}")))
+        crate::capped_read::read_capped(std::path::Path::new(_path), super::MAX_DRAWING_BYTES).map_err(|e| bad("compare", format!("{_path}: {e}")))
     }
     #[cfg(target_arch = "wasm32")]
     Err(bad("compare", "paths are not available on the web: open the other drawing and compare with it by name (`document`)"))
@@ -375,16 +375,20 @@ fn run_compare(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let Diff { added, removed, changed, common, truncated } = diff(&cur, &other, &space);
     let mut boxes = Vec::new();
-    let mut bound = |d: &Drawing, h: Handle| {
-        if let Some(b) = d.entity(h).map(|e| entity_bounds(d, e, 0)).filter(|b| !b.is_empty() && b.min.is_finite() && b.max.is_finite()) {
+    // One block-bounds cache for each drawing, so a block many differing entities refer to is
+    // measured once, not once per entity.
+    let (mut cur_cache, mut other_cache) = (BlockBoundsCache::default(), BlockBoundsCache::default());
+    fn bound<'a>(boxes: &mut Vec<Bounds2>, d: &'a Drawing, h: Handle, cache: &mut BlockBoundsCache<'a>) {
+        if let Some(b) = d.entity(h).map(|e| entity_bounds_cached(d, e, 0, cache)).filter(|b| !b.is_empty() && b.min.is_finite() && b.max.is_finite())
+        {
             boxes.push(b);
         }
-    };
-    added.iter().for_each(|h| bound(&cur, *h));
-    removed.iter().for_each(|h| bound(&other, *h));
+    }
+    added.iter().for_each(|h| bound(&mut boxes, &cur, *h, &mut cur_cache));
+    removed.iter().for_each(|h| bound(&mut boxes, &other, *h, &mut other_cache));
     for (a, b, _, _) in &changed {
-        bound(&cur, *a);
-        bound(&other, *b);
+        bound(&mut boxes, &cur, *a, &mut cur_cache);
+        bound(&mut boxes, &other, *b, &mut other_cache);
     }
     let regions = regions(&boxes);
     let ch: Vec<Value> = changed

crates/engine/src/cmd/file/compare/export.rs

@@ -20,7 +20,7 @@ use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
 use cadcraft_doc::color::{Color, Rgb};
-use cadcraft_doc::{Block, CellStyle, DimStyle, Drawing, Entity, EntityKind, EntityStore, Group, Handle, MAX_BLOCK_DEPTH, TableStyle};
+use cadcraft_doc::{Block, CellStyle, DimStyle, Drawing, Entity, EntityKind, EntityStore, Group, Handle, Layer, MAX_BLOCK_DEPTH, TableStyle};
 use serde_json::{Value, json};
 
 use super::super::super::{CommandSpec, bad};
@@ -197,6 +197,7 @@ fn snapshot(cur: &Drawing, c: &Comparison, folders: &Folders) -> Snapshot {
     d.skipped_records.clear();
     d.handseed = d.handseed.max(other.handseed);
 
+    use crate::cmd::merge::merge_named as merge;
     merge(&mut d.layers, &other.layers, |t| &t.name);
     merge(&mut d.linetypes, &other.linetypes, |t| &t.name);
     merge(&mut d.text_styles, &other.text_styles, |t| &t.name);
@@ -235,22 +236,17 @@ fn snapshot(cur: &Drawing, c: &Comparison, folders: &Folders) -> Snapshot {
     Snapshot { drawing: d, current, compared, counts: (here.len(), there.len()), truncated: diff.truncated, blocks_left_out, uncolored }
 }
 
-/// Add the entries of `from` whose names `to` lacks (compared without letter case).
-fn merge<T: Clone>(to: &mut Vec<T>, from: &[T], name: impl Fn(&T) -> &String) {
-    for t in from {
-        if !to.iter().any(|x| name(x).eq_ignore_ascii_case(name(t))) {
-            to.push(t.clone());
-        }
-    }
-}
-
 /// Add copies of `objs` to model space with new handles, their block references renamed by
 /// `renames` and their files rebased on `folder`, each painted in its comparison color, and
 /// group them as `name` (or `name_2`… when that group name is taken). Returns the group's name.
 fn add_group(d: &mut Drawing, name: &str, objs: &[(&Entity, Color)], renames: &Renames, folder: Option<&Path>, tinted: &mut Tinted) -> String {
     let mut members = Vec::new();
+    // The layers this drawing has, looked up once per object rather than scanned.
+    let mut layers: HashSet<String> = d.layers.iter().map(|l| l.name.to_ascii_uppercase()).collect();
     for (e, color) in objs {
-        d.ensure_layer(&e.common.layer);
+        if layers.insert(e.common.layer.to_ascii_uppercase()) {
+            d.layers.push(Layer::new(&e.common.layer));
+        }
         let h = d.new_handle();
         let mut copy = Entity { handle: h, ..(*e).clone() };
         detach(&mut copy.kind);

crates/engine/src/cmd/file/pgp.rs

@@ -1,11 +1,16 @@
 //! The user's command alias file (the publicly documented `.pgp` format: `ALIAS, *COMMAND` lines,
 //! `;` comments): ALIASEDIT and REINIT.
 //!
-//! A loaded file adds aliases or overrides the built-in ones for the rest of the session, for
-//! every drawing; command names themselves always win. Lines that define external commands
+//! A loaded file replaces the user aliases, which add to or override the built-in ones for every
+//! drawing; command names themselves always win. Lines that define external commands
 //! (programs the file would have the application start) are never run: they are skipped with a
 //! note. CADCraft ships no alias file; the aliases built into the command catalog stay the
 //! defaults.
+//!
+//! The aliases are user settings, never part of a drawing: [`alias_profile`] gives them (and the
+//! file REINIT reads) to the host's user profile, and [`restore_aliases`] brings them back on the
+//! next start. The desktop and web hosts keep that profile; the headless CLI has no profile, so
+//! aliases set in a script last for that session only.
 
 use std::collections::BTreeMap;
 use std::sync::{Mutex, MutexGuard, OnceLock, PoisonError};
@@ -20,10 +25,21 @@ use super::{CommandSpec, Result, Session, bad, bool_or, find_command};
 pub const MAX_ALIASES: usize = 10_000;
 /// Longest alias name.
 const MAX_ALIAS_CHARS: usize = 64;
+/// Longest command id (the catalog's longest is `texttofront.dimensions`; a test keeps it true).
+const MAX_COMMAND_ID_CHARS: usize = 32;
 /// Longest line read.
 const MAX_LINE_CHARS: usize = 4096;
 /// Most warnings reported.
 const MAX_WARNINGS: usize = 100;
+/// Longest alias file path kept in the user profile.
+const MAX_ALIAS_FILE_CHARS: usize = 1024;
+
+/// The largest alias section [`alias_profile`] can produce: [`MAX_ALIASES`] entries, each a
+/// [`MAX_ALIAS_CHARS`]-character name (up to four UTF-8 bytes per character, and JSON adds its
+/// quotes) mapped to a command id, plus the alias file path and the section's keys. A host that
+/// keeps the section in its user profile allows at least this much, so a full set always comes
+/// back after a restart.
+pub const MAX_ALIAS_PROFILE_BYTES: usize = MAX_ALIASES * (MAX_ALIAS_CHARS * 4 + MAX_COMMAND_ID_CHARS + 6) + MAX_ALIAS_FILE_CHARS * 4 + 64;
 
 #[derive(Default)]
 struct Aliases {
@@ -43,6 +59,55 @@ pub(crate) fn user_alias(name: &str) -> Option<String> {
     store().map.get(name).cloned()
 }
 
+/// The user alias that is the Greek word `word` in another case or accent.
+pub(crate) fn greek_alias(word: &str) -> Option<String> {
+    let same = crate::keyboard::same_greek_word_as(word)?;
+    store().map.keys().find(|alias| same(alias)).cloned()
+}
+
+/// The user aliases and the file REINIT reads, as the host's user profile keeps them:
+/// `{"aliases": {alias: command}, "file": path or null}`. Not drawing data.
+pub fn alias_profile() -> Value {
+    let st = store();
+    // A path [`restore_aliases`] would refuse is left out, so it can't grow the profile either.
+    json!({ "aliases": st.map, "file": st.file.as_deref().filter(|f| keepable_path(f)) })
+}
+
+/// Whether the profile keeps an alias file path: short enough, and no control characters.
+fn keepable_path(f: &str) -> bool {
+    f.chars().count() <= MAX_ALIAS_FILE_CHARS && !f.chars().any(char::is_control)
+}
+
+/// Restore aliases saved by [`alias_profile`], replacing the user aliases and the file.
+///
+/// The saved set is untrusted (a hand-edited or older profile): entries that are not aliases of
+/// real commands are skipped, command names are never aliased, at most [`MAX_ALIASES`] are kept,
+/// and a malformed section changes nothing.
+pub fn restore_aliases(saved: &Value) {
+    let Some(obj) = saved.as_object() else { return };
+    let file = match obj.get("file") {
+        None | Some(Value::Null) => None,
+        Some(Value::String(f)) if keepable_path(f) => Some(f.clone()),
+        Some(Value::String(_)) => None,
+        // A file entry that is not a path makes the section malformed: keep the aliases as they are.
+        Some(_) => return,
+    };
+    let Some(map) = obj.get("aliases").and_then(Value::as_object) else { return };
+    let mut aliases = BTreeMap::new();
+    // Entries that are skipped don't use up the cap.
+    for (alias, target) in map {
+        if aliases.len() >= MAX_ALIASES {
+            break;
+        }
+        let Ok(name) = alias_name(alias) else { continue };
+        let Some(id) = target.as_str().and_then(command_id) else { continue };
+        aliases.insert(name, id);
+    }
+    let mut st = store();
+    st.map = aliases;
+    st.file = file;
+}
+
 /// The command id `target` names (`*LINE`, `_.line`, `-LAYER`…), if there is such a command.
 pub fn command_id(target: &str) -> Option<String> {
     let t = target.trim().trim_start_matches('*').trim().trim_start_matches(['_', '.']).to_ascii_lowercase();
@@ -201,3 +266,25 @@ pub(crate) fn specs() -> Vec<CommandSpec> {
         CommandSpec::new("reinit", "Reinitialize", run_reinit).params("{file? | text?} (default: the alias file loaded last)").enabled(always).noundo(),
     ]
 }
+
+#[cfg(test)]
+mod tests {
+    use super::MAX_COMMAND_ID_CHARS;
+
+    /// [`super::MAX_ALIAS_PROFILE_BYTES`] bounds a saved alias's command id by the longest id in
+    /// the catalog: keep that true as commands are added.
+    #[test]
+    fn every_command_id_fits_the_saved_alias_bound() {
+        for spec in crate::cmd::command_specs() {
+            assert!(spec.id.chars().count() <= MAX_COMMAND_ID_CHARS, "`{}` exceeds the alias profile bound", spec.id);
+        }
+    }
+
+    /// An alias file path the profile couldn't restore isn't saved in it.
+    #[test]
+    fn only_paths_the_profile_restores_are_saved() {
+        assert!(super::keepable_path("C:\\support\\mine.pgp"));
+        assert!(!super::keepable_path(&"x".repeat(super::MAX_ALIAS_FILE_CHARS + 1)));
+        assert!(!super::keepable_path("mine\n.pgp"));
+    }
+}

crates/engine/src/cmd/file/template.rs

@@ -59,7 +59,8 @@ pub(super) fn run_new(s: &mut Session, p: &Value) -> Result<Option<Value>> {
         && hi.y > lo.y
     {
         let center = cadcraft_geom::Vec2::new((lo.x + hi.x) / 2.0, (lo.y + hi.y) / 2.0);
-        st.set_view_quiet(crate::View { center, height: (hi.y - lo.y).max(1e-6) });
+        let twist = st.view().twist;
+        st.set_view_quiet(crate::View { center, height: (hi.y - lo.y).max(1e-6), twist });
     }
     Ok(Some(json!({ "index": i, "title": title, "template": path })))
 }
@@ -73,7 +74,7 @@ fn read_template(path: &str) -> Result<Drawing> {
 
 #[cfg(not(target_arch = "wasm32"))]
 fn read_bytes(path: &str) -> Result<Vec<u8>> {
-    std::fs::read(path).map_err(|e| bad("new", format!("template {path}: {e}")))
+    crate::capped_read::read_capped(std::path::Path::new(path), super::MAX_DRAWING_BYTES).map_err(|e| bad("new", format!("template {path}: {e}")))
 }
 
 #[cfg(target_arch = "wasm32")]

crates/engine/src/cmd/griphot.rs

@@ -43,7 +43,8 @@ pub(crate) struct GripEdit {
     hot: Vec<(Handle, usize)>,
     /// Typed `GRIP`: still collecting grips ("Select grips").
     picking: bool,
-    /// What MOVE/ROTATE/SCALE/MIRROR transform: the hot grips' objects and the selection.
+    /// What MOVE/ROTATE/SCALE/MIRROR transform: the hot grips' objects and the objects of the
+    /// selection that the view being edited shows.
     targets: Vec<Handle>,
     base: Vec2,
     mode: GripMode,
@@ -69,6 +70,13 @@ fn positive(v: Option<f64>) -> Result<f64> {
     v.filter(|f| f.is_finite() && *f > 1e-12).ok_or_else(|| other("Requires a positive number."))
 }
 
+/// Whether the view being edited shows `h`. A hidden object (HIDEOBJECTS, an off or frozen layer,
+/// a layer frozen in the active MSPACE viewport) takes no part in a grip edit, even when Undo or
+/// a selection command put it back into the selection.
+fn shown(s: &Session, h: Handle) -> bool {
+    s.state().is_ok_and(|st| st.doc.entity(h).is_some_and(|e| st.shows(e)))
+}
+
 impl GripEdit {
     fn new(s: &Session, hot: Vec<(Handle, usize)>) -> Result<Self> {
         let mut g = GripEdit {
@@ -87,16 +95,22 @@ impl GripEdit {
         Ok(g)
     }
 
-    /// Make grip `index` of `h` hot (the first one becomes the base point).
+    /// Make grip `index` of `h` hot (the first one becomes the base point). The grip of an object
+    /// the view being edited does not show is left out, and so are the hidden objects of the
+    /// selection.
     fn add_hot(&mut self, s: &Session, (h, i): (Handle, usize)) -> Result<()> {
         if self.hot.contains(&(h, i)) || self.hot.len() >= MAX_HOT {
             return Ok(());
         }
         let p = s.grips_of(h)?.get(i).copied().ok_or_else(|| other("no such grip"))?;
+        // After the lookup: a missing object or grip stays the error it was.
+        if !shown(s, h) {
+            return Ok(());
+        }
         if self.hot.is_empty() {
             self.base = p;
             self.targets.push(h);
-            self.targets.extend(s.selection().into_iter().filter(|x| *x != h));
+            self.targets.extend(s.selection().into_iter().filter(|x| *x != h && shown(s, *x)));
         } else if !self.targets.contains(&h) {
             self.targets.push(h);
         }
@@ -107,13 +121,13 @@ impl GripEdit {
     /// The grips of the selected objects at `p` (typed `GRIP`): all objects with a grip there.
     fn grips_at(s: &Session, p: Vec2) -> Vec<(Handle, usize)> {
         let tol = (s.pixel_size() * (s.settings.gripsize + 3.0)).max(1e-9 * (1.0 + p.len()));
-        let Ok(d) = s.doc() else { return Vec::new() };
+        let Ok(st) = s.state() else { return Vec::new() };
         let mut out = Vec::new();
         for h in s.selection().into_iter().take(MAX_HOT) {
             if super::curves::is_locked(s, h) {
                 continue;
             }
-            let Some(e) = d.entity(h) else { continue };
+            let Some(e) = st.doc.entity(h).filter(|e| st.shows(e)) else { continue };
             let gs = e.kind.grips();
             // The nearest grip of this object within the tolerance.
             let best = gs
@@ -470,7 +484,9 @@ impl Interactive for GripEdit {
 impl Session {
     /// Make grips hot and start editing them (the UI's click on a grip; Shift+click collects
     /// several first). `hot` lists (object, grip index); the first is the base grip. The grip
-    /// modes and their options then run at the command line like any prompt.
+    /// modes and their options then run at the command line like any prompt. Grips of objects the
+    /// view being edited does not show are left out (the first grip left is the base grip), and it
+    /// is an error when none is left.
     pub fn start_grip_edit(&mut self, hot: &[(Handle, usize)]) -> Result<()> {
         if self.running.is_some() {
             self.cancel();
@@ -479,6 +495,9 @@ impl Session {
             return Err(other("no grip"));
         }
         let g = GripEdit::new(self, hot.to_vec())?;
+        if g.hot.is_empty() {
+            return Err(other("no grip"));
+        }
         let label = g.label();
         let machine = crate::guard::Guarded::wrap(Box::new(g));
         let st = self.state()?;

crates/engine/src/cmd/groups/pick.rs

@@ -28,7 +28,8 @@ pub fn specs() -> Vec<CommandSpec> {
 const MEMBER_PICKS: &[&str] = &["groupedit", "-group"];
 
 /// `hs` plus the other members of the selectable groups they belong to (in the space being
-/// edited, visible), when PICKSTYLE has group selection on. Order: `hs` first.
+/// edited, visible, and inside an MSPACE viewport not on a layer frozen in it), when PICKSTYLE
+/// has group selection on. Order: `hs` first.
 pub(crate) fn expand(s: &Session, hs: Vec<Handle>) -> Vec<Handle> {
     if s.settings.pickstyle & 1 == 0 || hs.is_empty() || s.running.as_ref().is_some_and(|r| MEMBER_PICKS.contains(&r.id.as_str())) {
         return hs;
@@ -39,6 +40,7 @@ pub(crate) fn expand(s: &Session, hs: Vec<Handle>) -> Vec<Handle> {
     }
     let space = s.space();
     let Some(store) = d.space(&space) else { return hs };
+    let frozen = s.viewport_frozen();
     // Member → its selectable groups, built once (window selections may hold many objects).
     let mut of: HashMap<Handle, Vec<usize>> = HashMap::new();
     for (i, g) in d.groups.iter().enumerate().filter(|(_, g)| g.selectable) {
@@ -56,7 +58,7 @@ pub(crate) fn expand(s: &Session, hs: Vec<Handle>) -> Vec<Handle> {
             }
             let Some(g) = d.groups.get(*gi) else { continue };
             for m in &g.members {
-                if store.get(*m).is_some_and(|e| d.is_visible(e)) && seen.insert(*m) {
+                if store.get(*m).is_some_and(|e| crate::select::selectable(d, e, frozen)) && seen.insert(*m) {
                     out.push(*m);
                 }
             }