security: write the release from the release job only (SonarCloud S8233)

The workflow-level contents: write granted every job the right to push tags and releases; the reusable release workflow is the only job that needs it. Workflow level drops to read. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
Merge pull request #2018 from dylanmtaylor/ci/sonar-main-not-cancelled
2026-10-24 10:56:51 -06:00 · 2026-10-23 17:16:13 -04:00 · 2026-10-23 16:58:56 -04:00 · 2026-10-23 16:50:42 -04:00 · 2026-10-23 16:42:01 -04:00 · 2026-10-23 15:40:12 -04:00
373 changed files with 3355 additions and 1520 deletions
@@ -14,6 +14,17 @@ updates:
          - "*"
    commit-message:
      prefix: "chore(deps)"
+    # craft-ui is still on egui 0.36, and two eguis in the graph don't build (#1990). Remove this
+    # once craft-ui moves to egui 0.37 (storytold/craft-libs#199).
+    ignore:
+      - dependency-name: "egui"
+        versions: [">=0.37"]
+      - dependency-name: "eframe"
+        versions: [">=0.37"]
+      - dependency-name: "egui-wgpu"
+        versions: [">=0.37"]
+      - dependency-name: "egui_kittest"
+        versions: [">=0.37"]

  # Maintain GitHub Actions workflows
  - package-ecosystem: "github-actions"
@@ -0,0 +1,30 @@
+name: CI
+
+# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
+# suite's shared gate workflow in craft-common-actions.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A newer push to a PR branch cancels its older run; every push to main runs to the end.
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  gate:
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      # Same craft-fonts commit as release.yml.
+      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      timeout-minutes: 90
+      packages: >-
+        pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcb1-dev libxcursor-dev
+        libxrandr-dev libxi-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
+        libgl1-mesa-dev
@@ -2,6 +2,9 @@
 # (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
 name: FreeBSD

+# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every pull
+# request: a drifted dependency still shows up within a day, and always before a release ships.
+# PRs that change the FreeBSD workflow or packaging itself still run it.
 on:
  push:
    branches: [release]
@@ -21,3 +21,41 @@ jobs:
  nix:
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/nix.yml@main
+
+  git-sources:
+    name: Git dependencies come from storytold
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Git dependencies come from storytold
+        run: |
+          set -euo pipefail
+          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
+          # Source replacement, patches and path overrides in cargo config never show up
+          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
+          # Cargo still reads the legacy .cargo/config.
+          python3 - <<'PY'
+          import os, sys, tomllib
+          for path in (".cargo/config", ".cargo/config.toml"):
+              if not os.path.exists(path):
+                  continue
+              config = tomllib.load(open(path, "rb"))
+              replaced = [name for name, source in config.get("source", {}).items()
+                          if isinstance(source, dict) and "replace-with" in source]
+              if replaced or "patch" in config or "paths" in config:
+                  print(f"{path} replaces, patches or overrides a source")
+                  sys.exit(1)
+          PY
+          # Fails when Cargo.lock is out of date with the manifests.
+          cargo metadata --locked --format-version 1 > /dev/null
+          python3 - <<'PY'
+          import sys, tomllib
+          lock = tomllib.load(open("Cargo.lock", "rb"))
+          bad = sorted({p["source"] for p in lock.get("package", [])
+                        if p.get("source", "").startswith("git+")
+                        and not p["source"].startswith("git+https://github.com/storytold/")})
+          if bad:
+              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
+              sys.exit(1)
+          PY
@@ -11,14 +11,57 @@ on:
        default: ""

 permissions:
-  contents: write
+  contents: read

 concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

 jobs:
+  git-sources:
+    name: Git dependencies come from storytold
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Git dependencies come from storytold
+        run: |
+          set -euo pipefail
+          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
+          # Source replacement, patches and path overrides in cargo config never show up
+          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
+          # Cargo still reads the legacy .cargo/config.
+          python3 - <<'PY'
+          import os, sys, tomllib
+          for path in (".cargo/config", ".cargo/config.toml"):
+              if not os.path.exists(path):
+                  continue
+              config = tomllib.load(open(path, "rb"))
+              replaced = [name for name, source in config.get("source", {}).items()
+                          if isinstance(source, dict) and "replace-with" in source]
+              if replaced or "patch" in config or "paths" in config:
+                  print(f"{path} replaces, patches or overrides a source")
+                  sys.exit(1)
+          PY
+          # Fails when Cargo.lock is out of date with the manifests.
+          cargo metadata --locked --format-version 1 > /dev/null
+          python3 - <<'PY'
+          import sys, tomllib
+          lock = tomllib.load(open("Cargo.lock", "rb"))
+          bad = sorted({p["source"] for p in lock.get("package", [])
+                        if p.get("source", "").startswith("git+")
+                        and not p["source"].startswith("git+https://github.com/storytold/")})
+          if bad:
+              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
+              sys.exit(1)
+          PY
+
  release:
+    needs: git-sources
+    permissions:
+      # The reusable release workflow tags and uploads the draft release.
+      contents: write
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
    with:
@@ -11,7 +11,8 @@ permissions:

 concurrency:
  group: sonarcloud-${{ github.ref }}
-  cancel-in-progress: true
+  # A push to main is the run that publishes coverage; superseded runs there would never finish.
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

 jobs:
  sonarcloud:
@@ -3,15 +3,17 @@
 # binaries are ARM64, run the CLI natively, and uninstall.
 name: Windows ARM64

+# Nightly on main and on pushes to `release` (dependency and runner-image drift shows up within a
+# day, and always before a release ships), and on PRs that change the Windows packaging itself.
 on:
+  schedule:
+    - cron: "3 5 * * *"
  push:
    branches: [release]
  pull_request:
    paths:
      - .github/workflows/windows-arm64.yml
      - packaging/windows/**
-  schedule:
-    - cron: "41 3 * * 1"
  workflow_dispatch:

 concurrency:
@@ -30,6 +30,7 @@ People trust CADCraft with their drawings; a crash loses their work. **This outr
 - **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form with defaults; only menu/toolbar invocation starts the interactive prompt sequence.
 - **Layering** is enforced by `cargo xtask layers`: L0 `geom`, `dxf` → L1 `color`, `doc` → L2 `fonts`, `render`, `constraints` → L3 `io` → L4 `engine` → L5 `ui-egui`, `mcp` → apps. Nothing below L5 depends on egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.**
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` / `app.start(id)` / `app.cmdline(text)`. Colours come from `theme::Tokens`.
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
 - **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests, assets, layers, wasm). Commit after every feature arc that builds, and push to `main`.

@@ -4,9 +4,9 @@ version = 4

 [[package]]
 name = "acadrust"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94862189cab6e282ed0433a801a216cd1a712953813284a48fa81c67223e38f6"
+checksum = "5eaa72520f70eb6f7f09b06f44e1ed0d8fad5fa743364f2c3715c30df962ec7c"
 dependencies = [
 "anyhow",
 "bitflags 2.13.2",
@@ -209,9 +209,9 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"

 [[package]]
 name = "arboard"
-version = "3.6.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
+checksum = "aeb9553e62312c8756a5979254fc6d7da8bbeb5986a1e17037fab932f7037917"
 dependencies = [
 "clipboard-win",
 "image",
@@ -223,7 +223,7 @@ dependencies = [
 "objc2-foundation 0.3.2",
 "parking_lot",
 "percent-encoding",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 "x11rb",
 ]

@@ -547,11 +547,13 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"

 [[package]]
 name = "cadcraft"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-engine",
 "cadcraft-io",
+ "cadcraft-mcp",
 "cadcraft-ui-egui",
+ "chrono",
 "eframe",
 "egui",
 "hidapi",
@@ -569,7 +571,7 @@ dependencies = [

 [[package]]
 name = "cadcraft-cli"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-engine",
 "cadcraft-io",
@@ -580,14 +582,14 @@ dependencies = [

 [[package]]
 name = "cadcraft-color"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "cadcraft-constraints"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-doc",
 "cadcraft-geom",
@@ -597,7 +599,7 @@ dependencies = [

 [[package]]
 name = "cadcraft-doc"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-color",
 "cadcraft-geom",
@@ -608,14 +610,14 @@ dependencies = [

 [[package]]
 name = "cadcraft-dwg"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "acadrust",
 ]

 [[package]]
 name = "cadcraft-dxf"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "encoding_rs",
 "log",
@@ -624,7 +626,7 @@ dependencies = [

 [[package]]
 name = "cadcraft-engine"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-color",
 "cadcraft-constraints",
@@ -635,6 +637,7 @@ dependencies = [
 "cadcraft-io",
 "cadcraft-render",
 "craft-docpath",
+ "libc",
 "log",
 "rstar",
 "serde",
@@ -644,24 +647,24 @@ dependencies = [

 [[package]]
 name = "cadcraft-fonts"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-geom",
- "harfrust",
- "skrifa 0.47.0",
+ "harfrust 0.14.0",
+ "skrifa 0.48.0",
 "unicode-bidi",
 ]

 [[package]]
 name = "cadcraft-geom"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "cadcraft-io"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "acadrust",
 "cadcraft-color",
@@ -671,8 +674,8 @@ dependencies = [
 "cadcraft-fonts",
 "cadcraft-geom",
 "cadcraft-render",
- "miniz_oxide 0.8.9",
- "quick-xml",
+ "miniz_oxide 0.9.1",
+ "quick-xml 0.42.0",
 "serde",
 "serde_json",
 "thiserror 2.0.21",
@@ -681,18 +684,19 @@ dependencies = [

 [[package]]
 name = "cadcraft-mcp"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-engine",
 "cadcraft-io",
 "cadcraft-render",
+ "getrandom 0.4.3",
 "log",
 "serde_json",
 ]

 [[package]]
 name = "cadcraft-render"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-color",
 "cadcraft-doc",
@@ -706,7 +710,7 @@ dependencies = [

 [[package]]
 name = "cadcraft-ui-egui"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-color",
 "cadcraft-doc",
@@ -714,6 +718,7 @@ dependencies = [
 "cadcraft-fonts",
 "cadcraft-geom",
 "cadcraft-render",
+ "chrono",
 "craft-ui",
 "egui",
 "egui-wgpu",
@@ -728,7 +733,7 @@ dependencies = [

 [[package]]
 name = "cadcraft-web"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
 "cadcraft-engine",
 "cadcraft-io",
@@ -825,6 +830,15 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -1298,7 +1312,7 @@ dependencies = [
 "emath",
 "epaint_default_fonts",
 "font-types",
- "harfrust",
+ "harfrust 0.12.0",
 "log",
 "nohash-hasher",
 "parking_lot",
@@ -1427,9 +1441,9 @@ checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"

 [[package]]
 name = "font-types"
-version = "0.12.6"
+version = "0.12.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c92d9081c7ab3bd83ef1eecdfad090f3d966e3ce74106779664114cfe1a6274"
+checksum = "835ae9d781464a79026cde387f9cbc650c9a4909d7cf7e658b127e3c35d2f35d"
 dependencies = [
 "bytemuck",
 "serde",
@@ -1720,6 +1734,18 @@ dependencies = [
 "smallvec",
 ]

+[[package]]
+name = "harfrust"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86aa776d6d32b072119e1f1650f4db843ff4382a4aaa6a2c9c4e35703cd377cb"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytemuck",
+ "read-fonts 0.45.1",
+ "smallvec",
+]
+
 [[package]]
 name = "hash32"
 version = "0.3.1"
@@ -1900,7 +1926,7 @@ dependencies = [
 "byteorder-lite",
 "moxcms",
 "num-traits",
- "png 0.18.1",
+ "png",
 "tiff",
 "zune-core",
 "zune-jpeg",
@@ -2086,9 +2112,9 @@ checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"

 [[package]]
 name = "libc"
-version = "0.2.190"
+version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"

 [[package]]
 name = "libloading"
@@ -2257,9 +2283,9 @@ dependencies = [

 [[package]]
 name = "muda"
-version = "0.21.0"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6744ab645ebe79f9c428455c7cb9dfa4275fa3b50a25408e08f927da8dc618c"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
 dependencies = [
 "crossbeam-channel",
 "dpi",
@@ -2268,8 +2294,7 @@ dependencies = [
 "objc2-app-kit 0.3.2",
 "objc2-core-foundation",
 "objc2-foundation 0.3.2",
- "once_cell",
- "png 0.18.1",
+ "png",
 "thiserror 2.0.21",
 "windows-sys 0.61.2",
 ]
@@ -2931,19 +2956,6 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"

-[[package]]
-name = "png"
-version = "0.17.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
-dependencies = [
- "bitflags 1.3.2",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide 0.8.9",
-]
-
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -3067,6 +3079,15 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -3145,13 +3166,15 @@ dependencies = [

 [[package]]
 name = "read-fonts"
-version = "0.44.0"
+version = "0.45.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5a0cf4bb6cbce4c29756270d189a5e400ac05e91192161d83a0bcb6e68492e8"
+checksum = "4edc8db0d972de88e53a085b1f01fb3fbdae7bb0cb7a0ce2b2f8285a412fe3ef"
 dependencies = [
 "bytemuck",
+ "foldhash",
 "font-types",
 "once_cell",
+ "yoke",
 ]

 [[package]]
@@ -3230,9 +3253,9 @@ dependencies = [

 [[package]]
 name = "rstar"
-version = "0.12.2"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "421400d13ccfd26dfa5858199c30a5d76f9c54e0dba7575273025b43c5175dbb"
+checksum = "5912b862fa5ffb462607bfd1e35036c458c537921f508c8235a83d5f3987edfe"
 dependencies = [
 "heapless",
 "num-traits",
@@ -3363,9 +3386,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
 "itoa",
 "memchr",
@@ -3450,12 +3473,12 @@ dependencies = [

 [[package]]
 name = "skrifa"
-version = "0.47.0"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "526e654b303ff4ad73a5a40b25de2b3ce3d039c5e3b6da5f89ae6e57004cb40f"
+checksum = "a5213b4825bac3587046330052d61bfac7bd3bd0d203c758d7c2ef726fcea034"
 dependencies = [
 "bytemuck",
- "read-fonts 0.44.0",
+ "read-fonts 0.45.1",
 ]

 [[package]]
@@ -3701,24 +3724,24 @@ dependencies = [

 [[package]]
 name = "tiny-skia"
-version = "0.11.4"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83d13394d44dae3207b52a326c0c85a8bf87f1541f23b0d143811088497b09ab"
+checksum = "47ffee5eaaf5527f630fb0e356b90ebdec84d5d18d937c5e440350f88c5a91ea"
 dependencies = [
 "arrayref",
 "arrayvec",
 "bytemuck",
 "cfg-if",
 "log",
- "png 0.17.16",
+ "png",
 "tiny-skia-path",
 ]

 [[package]]
 name = "tiny-skia-path"
-version = "0.11.4"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e7fc0c2e86a30b117d0462aa261b72b7a99b7ebd7deb3a14ceda95c5bdc93"
+checksum = "edca365c3faccca67d06593c5980fa6c57687de727a03131735bb85f01fdeeb9"
 dependencies = [
 "arrayref",
 "bytemuck",
@@ -4139,7 +4162,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
 "proc-macro2",
- "quick-xml",
+ "quick-xml 0.41.0",
 "quote",
 ]

@@ -4496,7 +4519,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]

 [[package]]
@@ -4505,16 +4528,7 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]

 [[package]]
@@ -4532,31 +4546,14 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]

 [[package]]
@@ -4574,96 +4571,48 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"

-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"

-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"

-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"

-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"

-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"

-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"

-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winit"
 version = "0.30.13"
@@ -4726,9 +4675,9 @@ dependencies = [

 [[package]]
 name = "winresource"
-version = "0.1.31"
+version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+checksum = "a2bc6d36480b829272a5bdabf08e6dca8004761c1da7e35efef800540c66221b"
 dependencies = [
 "toml",
 "version_check",
@@ -4811,8 +4760,9 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"

 [[package]]
 name = "xtask"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
+ "chrono",
 "serde_json",
 ]

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 # default-members

 [workspace.package]
-version = "0.10.0"
+version = "0.12.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.90"
@@ -32,20 +32,22 @@ thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
+# All date/time conversion goes through chrono (no hand-rolled calendar code beyond the 400-year range extension; AGENTS.md).
+chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 rayon = "1"

 # rendering / formats
-tiny-skia = { version = "0.11", default-features = false, features = ["std", "simd", "png-format"] }
+tiny-skia = { version = "0.12", default-features = false, features = ["std", "simd", "png-format"] }
 lyon_tessellation = "1.0.22"
-skrifa = "0.47"
-# Text shaping (OpenType GSUB/GPOS, HarfBuzz port on read-fonts; the version egui's epaint uses)
-# and the Unicode Bidirectional Algorithm for right-to-left drawing text.
-harfrust = "0.12"
+skrifa = "0.48"
+# Text shaping (OpenType GSUB/GPOS, HarfBuzz port on read-fonts; egui's epaint is still on 0.12,
+# so the graph has both) and the Unicode Bidirectional Algorithm for right-to-left drawing text.
+harfrust = "0.14"
 unicode-bidi = "0.3.18"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
 encoding_rs = "0.8.35"
 # XML for the SVG reader (streaming parser, no entity expansion beyond the five predefined ones)
-quick-xml = "0.41"
+quick-xml = "0.42"

 # ui
 craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
@@ -67,9 +69,11 @@ type_complexity = "allow"

 [profile.dev.package."*"]
 opt-level = 2
+debug = false

 [profile.dev]
 opt-level = 1
+debug = "line-tables-only"

 [profile.release]
 opt-level = 3
@@ -7,6 +7,10 @@
  </a>
 </p>

+<p align="center">
+  <img src="assets/app-icon/hicolor/256x256/apps/ai.storyteller.cadcraft.png" width="128" height="128" alt="CADCraft icon: a drafting set square and compass arc on a blue grid tile">
+</p>
+
 <h1 align="center">CADCraft</h1>

 <p align="center">
@@ -285,6 +289,14 @@ See [ROADMAP.md](ROADMAP.md) for the stage, measured parity and the estimate of

 **Download CADCraft** from GitHub: the [latest release](https://github.com/storytold/cadcraft/releases/latest) has every build listed below, and [all releases](https://github.com/storytold/cadcraft/releases) has earlier versions and their notes. `<ver>` in the file names is the version number, and `SHA256SUMS.txt` lists a checksum for every file.

+> [!WARNING]
+> Download official CADCraft builds from the [storytold/cadcraft releases](https://github.com/storytold/cadcraft/releases). Verify that the repository owner is `storytold`. Before you run a download, check that its checksum matches the line for that file in the release's `SHA256SUMS.txt`:
+>
+> ```sh
+> shasum -a 256 cadcraft-<ver>-macos-universal.dmg     # macOS (on Linux: sha256sum FILE)
+> Get-FileHash .\cadcraft-<ver>-windows-x64.msi        # Windows PowerShell
+> ```
+
 ### Windows

 | Build | Installer | Portable |
@@ -0,0 +1,6 @@
+mod cli;
+mod drafting_spacing;
+mod help;
+mod mcp_connect;
+mod skipped_records;
+mod undrawn_entities;
@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>CADCraft</title>
  <link data-trunk rel="rust" data-bin="cadcraft-web" data-wasm-opt="z" data-weak-refs />
  <style>
@@ -14,10 +14,13 @@ workspace = true
 cadcraft-engine = { workspace = true }
 cadcraft-ui-egui = { workspace = true }
 cadcraft-io = { workspace = true }
+# For the shared per-session control-token helper (control_server.rs authentication).
+cadcraft-mcp = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11", "links", "persistence"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+chrono = { workspace = true }

 [build-dependencies]
 winresource = "0.1"
@@ -48,11 +48,26 @@ impl Default for Limits {
    }
 }

+/// Start the loopback server with a fresh session token and a bounded request queue.
+/// Binding or token-issuance failure returns a disconnected receiver.
 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
    match TcpListener::bind(("127.0.0.1", port)) {
        Ok(l) => {
-            log::info!("control server listening on 127.0.0.1:{port}");
-            serve_listener(l, Limits::default(), ctx)
+            // Loopback TCP cannot tell local users apart, so issue an unguessable per-session
+            // token in an owner-only file and require it on every request (CWE-306). A client
+            // (the MCP bridge) reads it from the file, which needs the desktop user's filesystem
+            // access; another local account cannot.
+            let token = match cadcraft_mcp::control_token::issue(port) {
+                Ok(t) => Arc::new(t),
+                Err(e) => {
+                    log::error!("control server not started: could not write the control token: {e}");
+                    return sync_channel::<ControlRequest>(0).1;
+                }
+            };
+            if let Ok(path) = cadcraft_mcp::control_token::token_path(port) {
+                log::info!("control server listening on 127.0.0.1:{port} (token in {})", path.display());
+            }
+            serve_listener(l, Limits::default(), ctx, token)
        }
        Err(e) => {
            log::error!("control server failed to bind 127.0.0.1:{port}: {e}");
@@ -61,10 +76,20 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
    }
 }

+/// How long the accepting thread waits after a failed accept. Accepting can keep failing, for
+/// example while the process has no file descriptors left, and retrying at once would keep a
+/// core busy until it recovers.
+const ACCEPT_RETRY: Duration = Duration::from_millis(100);
+
+/// The connections `incoming` accepts, calling `wait` after each failed accept.
+fn accepted<T>(incoming: impl Iterator<Item = std::io::Result<T>>, mut wait: impl FnMut()) -> impl Iterator<Item = T> {
+    incoming.filter_map(move |stream| stream.map_err(|_| wait()).ok())
+}
+
 /// Accept connections on `listener` under `limits`; requests arrive on the returned receiver.
-fn serve_listener(listener: TcpListener, limits: Limits, ctx: egui::Context) -> Receiver<ControlRequest> {
+fn serve_listener(listener: TcpListener, limits: Limits, ctx: egui::Context, token: Arc<String>) -> Receiver<ControlRequest> {
    let (tx, rx) = sync_channel::<ControlRequest>(limits.queue.max(1));
-    std::thread::spawn(move || accept_loop(listener, tx, ctx, limits));
+    std::thread::spawn(move || accept_loop(listener, tx, ctx, limits, token));
    rx
 }

@@ -78,9 +103,10 @@ impl Drop for Slot {
    }
 }

-fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui::Context, limits: Limits) {
+/// Accept clients within the connection limit and give each worker the same session token.
+fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui::Context, limits: Limits, token: Arc<String>) {
    let open = Arc::new(AtomicUsize::new(0));
-    for mut stream in listener.incoming().flatten() {
+    for mut stream in accepted(listener.incoming(), || std::thread::sleep(ACCEPT_RETRY)) {
        let _ = stream.set_write_timeout(Some(limits.write_timeout));
        if open.fetch_add(1, Ordering::SeqCst) >= limits.max_clients {
            open.fetch_sub(1, Ordering::SeqCst);
@@ -90,9 +116,10 @@ fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui:
        let slot = Slot(Arc::clone(&open));
        let tx = tx.clone();
        let ctx = ctx.clone();
+        let token = Arc::clone(&token);
        let _ = std::thread::Builder::new().spawn(move || {
            let _slot = slot;
-            serve(stream, &tx, &ctx, limits);
+            serve(stream, &tx, &ctx, limits, &token);
        });
    }
 }
@@ -131,12 +158,14 @@ enum Line {
        id: Value,
        method: String,
        params: Value,
+        token: Option<String>,
    },
    Blank,
    /// Not a request: reply with this error and close the connection.
    Reject(String),
 }

+/// Parse a UTF-8 JSON request and its optional token, distinguishing blank lines from rejected input.
 fn parse_line(bytes: &[u8]) -> Line {
    let Ok(text) = std::str::from_utf8(bytes) else {
        return Line::Reject("not a control request (invalid UTF-8); closing the connection".into());
@@ -162,6 +191,7 @@ fn parse_line(bytes: &[u8]) -> Line {
        id: obj.get("id").cloned().unwrap_or(Value::Null),
        method: method.to_string(),
        params: obj.get("params").cloned().unwrap_or(json!({})),
+        token: obj.get("token").and_then(Value::as_str).map(str::to_string),
    }
 }

@@ -172,7 +202,9 @@ fn is_http_request_line(text: &str) -> bool {
        || text.rsplit_once(' ').is_some_and(|(_, version)| version.starts_with("HTTP/"))
 }

-fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context, limits: Limits) {
+/// Serve bounded JSON lines, authenticating each request before enqueueing it for the UI.
+/// Invalid credentials close the connection; queue and reply limits report whether a request ran.
+fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context, limits: Limits, token: &str) {
    if stream.set_read_timeout(Some(limits.idle_timeout)).is_err() || stream.set_write_timeout(Some(limits.write_timeout)).is_err() {
        return;
    }
@@ -190,7 +222,18 @@ fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context
            Ok(true) => match parse_line(&buf) {
                Line::Blank => continue,
                Line::Reject(e) => e,
-                Line::Request { id, method, params } => {
+                Line::Request { id, method, params, token: given } => {
+                    // Authenticate the peer before dispatching: loopback TCP does not identify the
+                    // OS user, so only a client holding the owner-only session token may drive the
+                    // desktop user's commands (CWE-306).
+                    if !given.map(|g| cadcraft_mcp::control_token::matches(token, &g)).unwrap_or(false) {
+                        let mut r = json!({"ok": false, "error": "unauthorized: missing or invalid control token", "state": "not-run"});
+                        if let Some(o) = r.as_object_mut() {
+                            o.insert("id".into(), id);
+                        }
+                        let _ = writeln!(out, "{r}");
+                        break;
+                    }
                    let (req, pending) = ControlRequest::new(method, params);
                    let mut r = match tx.try_send(req) {
                        Ok(()) => {
@@ -222,6 +265,18 @@ fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context
 mod tests {
    use super::*;

+    /// A failed accept is followed by a wait before the next one, so a listener that keeps
+    /// failing does not spin, and the connections around the failures still come through.
+    #[test]
+    fn a_failed_accept_waits_before_the_next() {
+        let failed = || Err(std::io::Error::other("no file descriptors left"));
+        let incoming = vec![failed(), Ok(1), failed(), failed(), Ok(2)];
+        let mut waits = 0;
+        let connections: Vec<i32> = super::accepted(incoming.into_iter(), || waits += 1).collect();
+        assert_eq!(connections, [1, 2]);
+        assert_eq!(waits, 3, "one wait per failed accept");
+    }
+
    #[test]
    fn lines_are_read_up_to_the_limit() {
        let mut buf = Vec::new();
@@ -255,11 +310,14 @@ mod tests {
        }
    }

+    /// A fixed token for tests; real tokens are random (see `cadcraft_mcp::control_token`).
+    const TEST_TOKEN: &str = "test-control-token";
+
    /// The control server on a loopback port under `limits`; requests arrive on the receiver.
    fn serve_with(limits: Limits) -> (std::net::SocketAddr, Receiver<ControlRequest>) {
        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
        let addr = listener.local_addr().unwrap();
-        (addr, serve_listener(listener, limits, egui::Context::default()))
+        (addr, serve_listener(listener, limits, egui::Context::default(), Arc::new(TEST_TOKEN.to_string())))
    }

    /// The control server on a loopback port, with a stand-in UI that echoes each method.
@@ -273,6 +331,11 @@ mod tests {
        addr
    }

+    /// A request line carrying the test token, so it authenticates.
+    fn req_line(id: i64, method: &str) -> String {
+        json!({"id": id, "method": method, "token": TEST_TOKEN}).to_string() + "\n"
+    }
+
    /// Send `input` on a new connection and read reply lines until the server closes it.
    fn exchange(addr: std::net::SocketAddr, input: &[u8]) -> Vec<Value> {
        let mut c = TcpStream::connect(addr).unwrap();
@@ -328,16 +391,17 @@ mod tests {
        assert!(t.elapsed() < Duration::from_secs(4));
    }

+    /// Authenticated requests rejected by a full queue retain their IDs and report that they did not run.
    #[test]
    fn a_full_queue_answers_busy() {
        let (addr, rx) = serve_with(short());
        // No UI drains the one-place queue: the first request fills it, the second finds it full.
-        let first = std::thread::spawn(move || exchange(addr, b"{\"id\":1,\"method\":\"m\"}\n"));
+        let first = std::thread::spawn(move || exchange(addr, req_line(1, "m").as_bytes()));
        let deadline = std::time::Instant::now() + Duration::from_secs(4);
        let busy = loop {
            let mut c = TcpStream::connect(addr).unwrap();
            c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
-            c.write_all(b"{\"id\":2,\"method\":\"m\"}\n").unwrap();
+            c.write_all(req_line(2, "m").as_bytes()).unwrap();
            let mut line = String::new();
            BufReader::new(c).read_line(&mut line).unwrap();
            let v: Value = serde_json::from_str(&line).unwrap();
@@ -350,12 +414,14 @@ mod tests {
        drop(rx);
    }

+    /// Replies on one authenticated connection preserve the ID of each request.
    #[test]
    fn requests_are_answered_with_their_ids() {
        let addr = serve_echo();
        let mut c = TcpStream::connect(addr).unwrap();
        c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
-        c.write_all(b"{\"id\":3,\"method\":\"ping\"}\r\n\n{\"id\":4,\"method\":\"pong\"}\n").unwrap();
+        let input = format!("{}\n{}", req_line(3, "ping").trim_end(), req_line(4, "pong"));
+        c.write_all(input.as_bytes()).unwrap();
        let mut r = BufReader::new(c);
        for (id, method) in [(3, "ping"), (4, "pong")] {
            let mut line = String::new();
@@ -365,6 +431,34 @@ mod tests {
        }
    }

+    /// Missing and incorrect session tokens are rejected before dispatch.
+    #[test]
+    fn a_request_without_the_token_is_unauthorized() {
+        // A local peer that does not hold the session token cannot drive the app (CWE-306).
+        let addr = serve_echo();
+        let replies = exchange(addr, b"{\"id\":9,\"method\":\"ping\"}\n");
+        assert_eq!(replies.len(), 1, "{replies:?}");
+        assert_eq!(replies[0]["ok"], false);
+        assert!(replies[0]["error"].as_str().unwrap().contains("unauthorized"), "{replies:?}");
+        // A wrong token is also refused.
+        let wrong = exchange(addr, b"{\"id\":9,\"method\":\"ping\",\"token\":\"nope\"}\n");
+        assert_eq!(wrong[0]["ok"], false);
+        assert!(wrong[0]["error"].as_str().unwrap().contains("unauthorized"), "{wrong:?}");
+    }
+
+    /// A request carrying the session token reaches the control dispatcher.
+    #[test]
+    fn a_request_with_the_token_is_dispatched() {
+        let addr = serve_echo();
+        let mut c = TcpStream::connect(addr).unwrap();
+        c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        c.write_all(req_line(10, "ping").as_bytes()).unwrap();
+        let mut line = String::new();
+        BufReader::new(c).read_line(&mut line).unwrap();
+        let v: Value = serde_json::from_str(&line).unwrap();
+        assert_eq!((v["ok"].as_bool(), v["method"].as_str()), (Some(true), Some("ping")), "{line}");
+    }
+
    #[test]
    fn extra_connections_are_refused() {
        let addr = serve_echo();
@@ -93,7 +93,10 @@ fn matches(name: &str, target: &str) -> bool {
    }
 }

-/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds). A clock before 1970 reads as the epoch.
+/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds). A clock before 1970 reads as the epoch (the
+/// `duration_since` clamp); past the last date chrono can represent (year 262143) the proleptic
+/// Gregorian date is kept via the 400-year cycle rather than falling back to the epoch, so the
+/// output never changes for a value the old formatter accepted and logging never panics.
 pub fn timestamp(t: SystemTime) -> String {
    let since = t.duration_since(std::time::UNIX_EPOCH).unwrap_or_default();
    let secs = since.as_secs();
@@ -102,20 +105,25 @@ pub fn timestamp(t: SystemTime) -> String {
    format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.{:03}Z", rem / 3600, rem % 3600 / 60, rem % 60, since.subsec_millis())
 }

-/// Days since 1970-01-01 to a proleptic Gregorian (year, month, day) (Howard Hinnant's
-/// `civil_from_days`, unsigned because `timestamp` clamps at the epoch; saturating so an absurd
-/// clock can't overflow).
-fn civil_from_days(days: u64) -> (u64, u64, u64) {
-    let z = days.saturating_add(719_468);
-    let era = z / 146_097;
-    let doe = z % 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = era.saturating_mul(400).saturating_add(yoe).saturating_add(u64::from(m <= 2));
-    (y, m, d)
+/// Days since 1970-01-01 → proleptic Gregorian (year, month, day).
+///
+/// `timestamp` clamps a pre-1970 clock to the epoch, so `days` is an unsigned count that can run
+/// past `NaiveDate`'s ±262143-year range. The Gregorian calendar repeats every 400 years
+/// (146_097 days), so chrono converts the day within one cycle and whole cycles go back into the
+/// year (an `i128`, then saturated into `i64`), keeping chrono as the only calendar logic and
+/// reproducing the old saturating `civil_from_days` result exactly without hand-rolled day math.
+/// 1970-01-01 is `num_days_from_ce` 719_163.
+fn civil_from_days(days: u64) -> (i64, u32, u32) {
+    use chrono::Datelike;
+    let (cycles, rest) = (days / 146_097, days % 146_097);
+    // `rest + 719_163` is 719_163..865_259, always a valid CE day.
+    match i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt) {
+        Some(d) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.month(), d.day())
+        }
+        None => (1970, 1, 1), // unreachable
+    }
 }

 fn numbered(dir: &Path, n: usize) -> PathBuf {
@@ -385,8 +393,20 @@ mod tests {
        // 2000 is a leap year (divisible by 400), 2100 is not.
        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(951_782_400)), "2000-02-29T00:00:00.000Z");
        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(4_107_542_400)), "2100-03-01T00:00:00.000Z");
-        // Before the epoch (a clock set wrong) clamps instead of panicking.
+        // Before the epoch (a clock set wrong) clamps to the epoch instead of panicking.
        assert_eq!(timestamp(UNIX_EPOCH - Duration::from_secs(5)), "1970-01-01T00:00:00.000Z");
+        // Past chrono's range (a clock set absurdly far ahead) keeps the proleptic Gregorian date
+        // the old formatter gave, rather than falling back to the epoch.
+        // Windows' SystemTime holds only up to about year 30828, so this is checked where it fits.
+        if let Some(far) = UNIX_EPOCH.checked_add(Duration::from_secs(10_000_000_000_000)) {
+            assert_eq!(timestamp(far), "318857-05-20T17:46:40.000Z");
+        }
+        // Windows' SystemTime can't hold u64::MAX / 2 seconds, so it is only checked where it exists.
+        if let Some(far) = UNIX_EPOCH.checked_add(Duration::from_secs(u64::MAX / 2)) {
+            assert_eq!(timestamp(far), "292277026596-12-04T15:30:07.000Z");
+        }
+        // Years past 9999 keep the plain zero-padded year (no `+`).
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(253_402_300_800)), "10000-01-01T00:00:00.000Z");
    }

    #[test]
@@ -102,7 +102,11 @@ fn ang_between(d1: Vec2, d2: Vec2) -> f64 {
 pub fn infer(d: &Drawing, handles: &[Handle], o: &InferOptions) -> Vec<Constraint> {
    let tol = if o.distance_tolerance.is_finite() { o.distance_tolerance.clamp(0.0, 1e9) } else { 0.05 };
    let atol = if o.angle_tolerance.is_finite() { o.angle_tolerance.clamp(0.0, 45.0).to_radians() } else { 1f64.to_radians() };
-    let allow = |k: ConstraintKind| o.types.is_empty() || o.types.iter().any(|t| t.eq_ignore_ascii_case(k.name()));
+    // Resolve the allowed type names into a set once, so membership is O(1) per candidate instead
+    // of re-scanning the whole (attacker-controllable) `o.types` list for every geometric match
+    // (CWE-407). Empty `o.types` means "all types".
+    let allowed: std::collections::HashSet<String> = o.types.iter().map(|t| t.to_ascii_lowercase()).collect();
+    let allow = |k: ConstraintKind| allowed.is_empty() || allowed.contains(&k.name().to_ascii_lowercase());
    let g = collect(d, handles);
    let mut out: Vec<Constraint> = Vec::new();
    let mut push = |kind: ConstraintKind, refs: Vec<GeomRef>| {
@@ -12,12 +12,15 @@ use cadcraft_doc::{Constraint, Drawing, Handle};
 use serde::Serialize;

 use crate::model::Model;
-use crate::{Comp, MAX_CONSTRAINTS, SolveError, SolveOptions, build, lm};
+use crate::{Comp, MAX_CONSTRAINTS, SolveError, SolveOptions, build_budgeted, lm};

 /// Most free parameters for which per-object freedom is analysed (null-space basis size).
 const MAX_NULL_COLS: usize = 600;
 /// Largest Jacobian (rows × columns × min) whose rank is computed.
 const MAX_RANK_WORK: f64 = 4e8;
+/// Largest residual-evaluation work (rows × free × per-residual cost, including spline
+/// reconstruction) allowed before building the Jacobian during numerical differentiation.
+const MAX_EVAL_WORK: f64 = 2e9;
 /// Most objects listed in one report.
 const MAX_OBJECTS: usize = 10_000;

@@ -86,6 +89,8 @@ struct CompDof {
    objects: Vec<Option<usize>>,
 }

+/// Compute component and object freedom only when rank and residual-evaluation work fit their budgets.
+/// Return unknown freedom before building the Jacobian when either work limit is exceeded.
 fn analyse(comp: &Comp) -> CompDof {
    let free = comp.free(None);
    let rows = comp.rows(None);
@@ -94,6 +99,14 @@ fn analyse(comp: &Comp) -> CompDof {
    if rows > lm::MAX_ROWS || (rows as f64) * (nf as f64) * (rows.min(nf) as f64) > MAX_RANK_WORK {
        return unknown;
    }
+    // Numerical differentiation evaluates every residual about `rows × free` times, and each
+    // spline-end residual reconstructs its spline through a dense solve. Account for that
+    // reconstruction cost before building the Jacobian so a component with few equations but large
+    // splines cannot pass the rank-work check yet still require billions of operations (row 43).
+    let eval_work = (rows as f64) * (nf as f64) * (1.0 + comp.built.iter().map(|b| b.spline_reconstruct_cost(&comp.model)).sum::<f64>());
+    if eval_work > MAX_EVAL_WORK {
+        return unknown;
+    }
    let f = |x: &[f64], out: &mut Vec<f64>| comp.eval(x, out, None);
    let jac = lm::jacobian(&f, &comp.model.x0, &free, rows);
    if nf > MAX_NULL_COLS {
@@ -126,7 +139,8 @@ fn plural(n: usize, one: &str, many: &str) -> String {
 /// (constrained or not) and the constraint components they belong to.
 pub fn dof(d: &Drawing, handles: &[Handle]) -> Result<DofReport, SolveError> {
    let cons: Vec<&Constraint> = d.constraints.iter().take(MAX_CONSTRAINTS).collect();
-    let (comps, _) = build(d, &cons, &SolveOptions::default())?;
+    let mut members_left = crate::model::MAX_RIGID_WORK;
+    let (comps, _) = build_budgeted(d, &cons, &SolveOptions::default(), &mut members_left)?;
    let want = |h: Handle| handles.is_empty() || handles.contains(&h);
    let mut objects = Vec::new();
    let mut seen = HashSet::new();
@@ -165,7 +179,7 @@ pub fn dof(d: &Drawing, handles: &[Handle]) -> Result<DofReport, SolveError> {
        if seen.contains(&h) {
            continue;
        }
-        let m = Model::build(d, &[h]);
+        let m = Model::build_budgeted(d, &[h], &mut members_left);
        let Some(s) = m.slots.first() else { continue };
        seen.insert(h);
        free_objects = true;
@@ -193,3 +207,35 @@ pub fn dof(d: &Drawing, handles: &[Handle]) -> Result<DofReport, SolveError> {
    };
    Ok(DofReport { dof: total, status, redundant, constraints, objects, message })
 }
+
+#[cfg(test)]
+mod budget_tests {
+    use super::*;
+    use crate::residual::{Built, Form};
+    use cadcraft_doc::{Common, ConstraintKind, EntityKind, GeomRef, Space};
+    use cadcraft_geom::{Spline, Vec2};
+
+    /// An expensive fit-spline endpoint residual produces unknown freedom before numerical differentiation.
+    #[test]
+    fn endpoint_analysis_rejects_cubic_fit_work_before_differentiation() {
+        let mut d = Drawing::default();
+        let pts: Vec<_> = (0..500).map(|i| Vec2::new(i as f64, (i % 3) as f64)).collect();
+        let mut spline = Spline::from_control(pts.clone(), 3);
+        spline.fit = pts;
+        let h = d.add(&Space::Model, Common::default(), EntityKind::Spline(spline)).unwrap();
+        let model = Model::build(&d, &[h]);
+        let endpoint = Built {
+            id: 1,
+            kind: ConstraintKind::Tangent,
+            refs: vec![GeomRef::whole(h)],
+            form: Form::EndOn { spline: 0, at_end: false },
+            target: 0.0,
+            sign: 1.0,
+            rows: 2,
+            aux_init: Vec::new(),
+            aux: 0,
+        };
+        let comp = Comp { model, built: vec![endpoint], weights: vec![1.0; 2], tol: 1e-9 };
+        assert!(analyse(&comp).dof.is_none());
+    }
+}
@@ -324,12 +324,24 @@ fn components<'a>(cons: &[&'a Constraint]) -> Vec<Vec<&'a Constraint>> {

 /// Build the component systems. Constraints that cannot be interpreted are returned as skipped.
 pub(crate) fn build(d: &Drawing, cons: &[&Constraint], opts: &SolveOptions) -> Result<(Vec<Comp>, Vec<(u32, String)>), SolveError> {
+    let mut members_left = model::MAX_RIGID_WORK;
+    build_budgeted(d, cons, opts, &mut members_left)
+}
+
+/// Build constraint components with one caller-owned rigid-member sampling budget shared by every model.
+/// Return constraints that cannot be interpreted as skipped entries.
+pub(crate) fn build_budgeted(
+    d: &Drawing,
+    cons: &[&Constraint],
+    opts: &SolveOptions,
+    members_left: &mut usize,
+) -> Result<(Vec<Comp>, Vec<(u32, String)>), SolveError> {
    let mut e = env(d);
    let mut skipped = Vec::new();
    let mut comps = Vec::new();
    for group in components(cons) {
        let handles: Vec<Handle> = group.iter().flat_map(|c| c.refs.iter().map(|r| r.handle)).collect();
-        let mut model = Model::build(d, &handles);
+        let mut model = Model::build_budgeted(d, &handles, members_left);
        let mut built = Vec::new();
        for c in group {
            let target = if c.kind.is_dimensional() { constraint_value(&mut e, c)? } else { 0.0 };
@@ -27,6 +27,11 @@ pub const MAX_PARAMS: usize = 4000;
 pub const MAX_SPLINE_POINTS: usize = 500;
 /// Most characteristic points of a block reference used as rigid constraint points.
 pub const MAX_RIGID_POINTS: usize = 256;
+/// Block members examined when sampling rigid points, counting those that contribute none, so a
+/// block padded with point-less entities cannot make sampling (repeated per Insert) unbounded.
+const MAX_RIGID_MEMBERS: usize = 100_000;
+/// Shared across every model built for one analysis request.
+pub(crate) const MAX_RIGID_WORK: usize = 1_000_000;

 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) enum Shape {
@@ -74,6 +79,21 @@ pub(crate) struct Model {
    rigid: HashMap<Handle, Vec<Vec2>>,
 }

+impl Model {
+    /// Work for a spline that an endpoint residual actually reconstructs. Fit interpolation
+    /// uses dense Gaussian elimination (cubic); control splines clone and evaluate their template.
+    pub(crate) fn spline_reconstruct_cost(&self, handle: Handle) -> f64 {
+        let Some(s) = self.splines.get(&handle) else { return 0.0 };
+        let n = s.fit.len() as f64;
+        if fit_mode(s) {
+            n * n * n
+        } else {
+            let n = s.control.len() as f64;
+            n * n
+        }
+    }
+}
+
 /// Can this entity take part in constraints?
 pub fn supported(kind: &EntityKind) -> bool {
    matches!(
@@ -93,13 +113,26 @@ pub fn supported(kind: &EntityKind) -> bool {
 /// centres, vertices, nested insertion points) of the block's own objects, at most
 /// [`MAX_RIGID_POINTS`]. Nested blocks are not entered.
 pub fn rigid_points(d: &Drawing, ins: &Insert) -> Vec<Vec2> {
+    let mut members_left = MAX_RIGID_MEMBERS;
+    rigid_points_budgeted(d, ins, &mut members_left)
+}
+
+/// Sample finite block points within per-insert and caller-shared member limits.
+/// Members that contribute no points still consume traversal work; nested blocks are not entered.
+fn rigid_points_budgeted(d: &Drawing, ins: &Insert, members_left: &mut usize) -> Vec<Vec2> {
    let Some(block) = d.block(&ins.block) else { return Vec::new() };
    let m = ins.transform(block.base.xy());
    let mut out = Vec::new();
+    // Bound the members examined, not only the points collected: entities that contribute no
+    // points (Text, Ray, …) still cost traversal, so a block full of them — scanned again for
+    // every Insert — would otherwise be unbounded (CWE-407).
+    let mut examined = 0usize;
    for e in block.entities.iter() {
-        if out.len() >= MAX_RIGID_POINTS {
+        examined += 1;
+        if out.len() >= MAX_RIGID_POINTS || examined > MAX_RIGID_MEMBERS || *members_left == 0 {
            break;
        }
+        *members_left -= 1;
        let pts: Vec<Vec2> = match &e.kind {
            EntityKind::Line(l) => vec![l.a.xy(), l.b.xy()],
            EntityKind::Arc(a) => {
@@ -152,6 +185,12 @@ fn fit_mode(s: &GSpline) -> bool {
 impl Model {
    /// Build a model for the given entities. Unsupported or missing entities are skipped.
    pub fn build(d: &Drawing, handles: &[Handle]) -> Model {
+        let mut members_left = MAX_RIGID_WORK;
+        Self::build_budgeted(d, handles, &mut members_left)
+    }
+
+    /// Build solver parameters for supported entities while sharing rigid-member sampling work with other models.
+    pub(crate) fn build_budgeted(d: &Drawing, handles: &[Handle], members_left: &mut usize) -> Model {
        let mut m = Model::default();
        for &h in handles {
            if m.index.contains_key(&h) {
@@ -208,12 +247,15 @@ impl Model {
                    // fit point; a control polygon's ends are its first and last points when the
                    // knots are clamped.
                    let ends = !sp.closed && (fit || (clamped(sp, false) && clamped(sp, true)));
-                    m.splines.insert(h, sp.clone());
+                    // Missing weights default to 1 in eval; only excess weights are unused.
+                    let mut kept = sp.clone();
+                    kept.weights.truncate(kept.control.len());
+                    m.splines.insert(h, kept);
                    Shape::Spline { n, fit, ends }
                }
                EntityKind::Insert(ins) => {
                    let base = Vec2::new(ins.insert.x, ins.insert.y);
-                    let pts: Vec<Vec2> = rigid_points(d, ins).into_iter().map(|p| (p - base).rotate(-ins.rotation)).collect();
+                    let pts: Vec<Vec2> = rigid_points_budgeted(d, ins, members_left).into_iter().map(|p| (p - base).rotate(-ins.rotation)).collect();
                    m.x0.extend([ins.insert.x, ins.insert.y, ins.rotation]);
                    let n = pts.len();
                    m.rigid.insert(h, pts);
@@ -573,3 +615,60 @@ impl Model {
        moved
    }
 }
+
+#[cfg(test)]
+mod budget_tests {
+    use super::*;
+    use cadcraft_doc::{Block, Common, Entity, Line, Space};
+    use cadcraft_geom::Vec3;
+    use std::sync::Arc;
+
+    /// Writing an unchanged model back leaves partial rational weights and the original spline geometry intact.
+    #[test]
+    fn write_back_keeps_partial_rational_weights() {
+        let mut drawing = Drawing::default();
+        let mut spline = GSpline::from_control(vec![Vec2::ZERO, Vec2::new(1.0, 2.0), Vec2::new(3.0, 0.0)], 2);
+        spline.weights = vec![2.0, 0.5];
+        let h = drawing.add(&Space::Model, Common::default(), EntityKind::Spline(spline.clone())).unwrap();
+        let model = Model::build(&drawing, &[h]);
+        model.write_back(&mut drawing, &model.x0);
+        let EntityKind::Spline(after) = &drawing.entity(h).unwrap().kind else { panic!("spline") };
+        assert_eq!(after.weights, spline.weights);
+        for i in 0..=10 {
+            assert!(after.eval(i as f64 / 10.0).near(spline.eval(i as f64 / 10.0), 1e-12));
+        }
+    }
+
+    /// A second model receives no sampled block points after the first model spends the shared member budget.
+    #[test]
+    fn rigid_sampling_budget_is_shared_between_models() {
+        let mut d = Drawing::default();
+        let mut block = Block::new("BAR");
+        for _ in 0..3 {
+            block.entities.push(Entity {
+                handle: d.new_handle(),
+                common: Common::default(),
+                kind: EntityKind::Line(Line { a: Vec3::ZERO, b: Vec3::new(1.0, 0.0, 0.0) }),
+            });
+        }
+        d.blocks.insert("BAR".into(), Arc::new(block));
+        let ins = Insert {
+            block: "BAR".into(),
+            insert: Vec3::ZERO,
+            scale: Vec3::new(1.0, 1.0, 1.0),
+            rotation: 0.0,
+            attribs: Vec::new(),
+            cols: 1,
+            rows: 1,
+            col_spacing: 0.0,
+            row_spacing: 0.0,
+        };
+        let h = d.add(&Space::Model, Common::default(), EntityKind::Insert(ins)).unwrap();
+        let mut budget = 2;
+        let first = Model::build_budgeted(&d, &[h], &mut budget);
+        assert_eq!(first.rigid[&h].len(), 4);
+        assert_eq!(budget, 0);
+        let next = Model::build_budgeted(&d, &[h], &mut budget);
+        assert!(next.rigid[&h].is_empty());
+    }
+}
@@ -116,6 +116,16 @@ fn r_at(c: &Constraint, i: usize) -> Option<&GeomRef> {
 }

 impl Built {
+    /// Estimate spline reconstruction work for endpoint and join residuals; other residual forms add no such cost.
+    pub(crate) fn spline_reconstruct_cost(&self, m: &Model) -> f64 {
+        let cost = |i: usize| self.refs.get(i).map_or(0.0, |r| m.spline_reconstruct_cost(r.handle));
+        match self.form {
+            Form::EndOn { spline, .. } => cost(spline),
+            Form::Join { .. } => cost(0) + cost(1),
+            _ => 0.0,
+        }
+    }
+
    /// Interpret a constraint against the model at `x`. `target` is the evaluated value for
    /// dimensional constraints (degrees for angular). Errors explain what references are needed.
    pub fn new(c: &Constraint, m: &Model, x: &[f64], target: f64) -> Result<Built, String> {
@@ -363,3 +363,22 @@ fn hostile_new_geometry_never_panics() {
    let _ = dof(&d, &hs);
    let _ = dof(&d, &[Handle(0), Handle(u64::MAX)]);
 }
+
+/// Fit-point vertex constraints retain a known freedom count because they do not reconstruct the spline.
+#[test]
+fn vertex_constraints_on_large_fit_spline_do_not_charge_reconstruction() {
+    let mut d = Drawing::default();
+    let pts: Vec<_> = (0..500).map(|i| Vec2::new(i as f64, (i % 3) as f64)).collect();
+    let mut sp = GSpline::from_control(pts.clone(), 3);
+    sp.fit = pts;
+    let h = put(&mut d, EntityKind::Spline(sp));
+    for i in 0..5 {
+        let p = point(&mut d, (i as f64, (i % 3) as f64));
+        let mut c = con(K::Coincident, &[s(h, Sub::Vertex(i)), w(p)]);
+        c.id = i + 1;
+        d.constraints.push(c);
+    }
+    let report = dof(&d, &[]).unwrap();
+    assert_eq!(report.status, DofStatus::Under);
+    assert_eq!(report.dof, Some(1000));
+}
@@ -248,10 +248,17 @@ impl ArrayParams {
            return false;
        }
        let Some(items) = self.items() else { return false };
+        // Index the replacement entries by placement so each item is matched in O(1) instead of
+        // scanning the whole `replaced` vector per item, which is quadratic when both the items
+        // and the replacements are large (CWE-407). Last entry wins, as `.rev().find` did.
+        let mut last_replaced: std::collections::HashMap<(u32, u32, u32), usize> = std::collections::HashMap::with_capacity(self.replaced.len());
+        for (idx, r) in self.replaced.iter().enumerate() {
+            last_replaced.insert((r.i, r.j, r.level), idx);
+        }
        let mut source: Option<&str> = None;
        for (it, e) in items.iter().zip(&ents) {
            let EntityKind::Insert(ins) = &e.kind else { return false };
-            match self.replaced.iter_mut().rev().find(|r| (r.i, r.j, r.level) == (it.i, it.j, it.level)) {
+            match last_replaced.get(&(it.i, it.j, it.level)).and_then(|&idx| self.replaced.get_mut(idx)) {
                Some(r) => r.block.clone_from(&ins.block),
                None => match source {
                    None => source = Some(&ins.block),
@@ -334,7 +334,11 @@ fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle
    }
    let graph = objects.get(&graph?).filter(|o| o.kind.eq_ignore_ascii_case("ACAD_EVALUATION_GRAPH"))?;
    let members = section(&sections(&graph.tags), "AcDbEvalGraph").iter().filter(|t| t.code == 360).filter_map(|t| Handle::parse_hex(&t.value));
-    Some(members.take(MAX_NODES).filter_map(|h| objects.get(&h).copied()).collect())
+    // Deduplicate member handles before resolving them: a graph can list the same member many
+    // times, and parsing each occurrence into its own owned parameter multiplies a single large
+    // record into gigabytes of retained allocations (CWE-400).
+    let mut seen = std::collections::HashSet::new();
+    Some(members.take(MAX_NODES).filter(|h| seen.insert(*h)).filter_map(|h| objects.get(&h).copied()).collect())
 }

 /// The dynamic block data of block `name` (any case; `*Model_Space` for a drawing that is a
@@ -464,7 +464,15 @@ fn apply(
        if !(v.x.is_finite() && v.y.is_finite()) || (v.x == 0.0 && v.y == 0.0) {
            continue;
        }
+        // Index this action's vertex lists by handle once, and skip handles already handled in
+        // this action's selection, so a selection that repeats a handle does not re-scan the
+        // vertex list and re-clone its index vector per occurrence (CWE-400).
+        let vtx_by_handle: HashMap<Handle, &Vec<i32>> = vertices.iter().rev().map(|(vh, i)| (*vh, i)).collect();
+        let mut handled: HashSet<Handle> = HashSet::new();
        for h in &a.selection {
+            if !handled.insert(*h) {
+                continue;
+            }
            if let Some(node) = param_of.get(h) {
                // A parameter in the selection is carried along: its points in the frame. Which
                // points are in it is decided where the dynamic block has them (AutoCAD evaluates
@@ -489,7 +497,7 @@ fn apply(
                continue;
            }
            let Some(c) = copy_of(h) else { continue };
-            let idx = vertices.iter().find(|(vh, _)| vh == h).map(|(_, i)| i.clone());
+            let idx = vtx_by_handle.get(h).map(|i| (*i).clone());
            moves.entry(c).or_default().push((idx, v));
        }
    }
@@ -1408,9 +1408,12 @@ impl EntityKind {
            EntityKind::LwPolyline(p) => {
                let mut g: Vec<Vec2> = Vec::new();
                let pl = Polyline { vertices: p.vertices.clone(), closed: p.closed };
+                // Compute the segments once, not once per vertex: rebuilding the whole segment
+                // vector inside the loop is quadratic in the vertex count (CWE-407).
+                let segs = pl.segments();
                for (i, v) in p.vertices.iter().enumerate() {
                    g.push(v.p);
-                    if let Some(s) = pl.segments().get(i) {
+                    if let Some(s) = segs.get(i) {
                        g.push(s.mid());
                    }
                }
@@ -1468,3 +1471,21 @@ fn transform_text(t: &mut Text, m: &Mat3, s: f64, rot: f64, mirror: bool) {
    // MIRRTEXT = 0 (the default): mirrored text keeps reading left to right.
    t.rotation = cadcraft_geom::norm_angle(t.rotation + if mirror { 0.0 } else { rot });
 }
+
+#[cfg(test)]
+mod grip_tests {
+    use super::*;
+    use cadcraft_geom::PolyVertex;
+
+    #[test]
+    fn polyline_grips_are_vertices_and_midpoints() {
+        // Grips are each vertex plus the midpoint of each segment; the segment vector is computed
+        // once rather than rebuilt per vertex (CWE-407, row 35).
+        let verts: Vec<PolyVertex> = [(0.0, 0.0), (10.0, 0.0), (10.0, 10.0)].iter().map(|&(x, y)| PolyVertex::new(Vec2::new(x, y))).collect();
+        let e = EntityKind::LwPolyline(LwPolyline { vertices: verts, closed: false, const_width: 0.0, elevation: 0.0, plinegen: false });
+        let g = e.grips();
+        // 3 vertices + 2 segment midpoints.
+        assert_eq!(g.len(), 5, "{g:?}");
+        assert!(g.contains(&Vec2::new(0.0, 0.0)) && g.contains(&Vec2::new(5.0, 0.0)));
+    }
+}
@@ -165,9 +165,21 @@ fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<
            if let Some(blk) = dm.block.as_ref().and_then(|n| d.block(n))
                && depth < MAX_BLOCK_DEPTH
            {
-                for be in blk.entities.iter().filter(|be| in_block_visible(d, be)) {
-                    b = b.union(&bounds_in(d, be, depth + 1, blocks));
-                }
+                // Reuse the shared block-bounds cache (as the Insert branch does) so a dimension
+                // block with branching or self-referencing children costs one pass per definition
+                // per depth, not one per reference (which grows exponentially) (CWE-400).
+                let inner = match blocks.get(&(blk.name.as_str(), depth)) {
+                    Some(cached) => *cached,
+                    None => {
+                        let mut inner = Bounds2::EMPTY;
+                        for be in blk.entities.iter().filter(|be| in_block_visible(d, be)) {
+                            inner = inner.union(&bounds_in(d, be, depth + 1, blocks));
+                        }
+                        blocks.insert((blk.name.as_str(), depth), inner);
+                        inner
+                    }
+                };
+                b = b.union(&inner);
            }
            b
        }
@@ -752,6 +752,8 @@ pub struct PageSetup {
    pub landscape: bool,
    /// "layout" | "extents" | "display" | "window" | "limits".
    pub plot_area: String,
+    /// Plot window corners `[x1, y1, x2, y2]` (DXF plot layout groups 48, 49, 140, 141); used when `plot_area` is "window".
+    pub plot_window: [f64; 4],
    pub scale_to_fit: bool,
    /// Paper units per drawing unit.
    pub scale: f64,
@@ -779,6 +781,7 @@ impl Default for PageSetup {
            margins_mm: [6.35, 6.35, 6.35, 6.35],
            landscape: true,
            plot_area: "layout".into(),
+            plot_window: [0.0; 4],
            scale_to_fit: false,
            scale: 1.0,
            plot_style_table: String::new(),
@@ -0,0 +1,2 @@
+mod lin_pat_parse;
+mod sub_segment_alias;
@@ -10,4 +10,4 @@ workspace = true

 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 # MPL-2.0: used as an unmodified dependency only (see plan/adr/0001 and NOTICE).
-acadrust = "0.6.4"
+acadrust = "0.6.5"
@@ -4,6 +4,25 @@
 //! converted to DXF bytes, which CADCraft's own DXF reader maps to its document model; saving
 //! goes the other way. Keeping the dependency behind this byte-level API isolates it: nothing
 //! else in CADCraft depends on its types. Native targets only (it memory-maps files).
+//!
+//! # Guardrails around the third-party decoder
+//!
+//! The decoder allocates tables and section buffers from sizes a (possibly damaged or hostile)
+//! file declares, and once it starts it cannot be interrupted (an allocation failure aborts the
+//! process, which `catch_unwind` cannot recover). Because the dependency is used unmodified, this
+//! crate guards it from the outside:
+//!
+//! - Both directions reject oversized input *before* the decoder runs ([`Limits::max_dwg_bytes`]
+//!   for DWG→DXF, [`Limits::max_dxf_bytes`] for DXF→DWG), and the DWG→DXF output is capped while
+//!   it is written (`CappedWriter`).
+//! - The reader and writer run inside `catch_unwind`, so a decode failure is reported instead of
+//!   crashing.
+//!
+//! These bound the input- and output-size variants. A small file that declares a huge internal
+//! table or section can still make the dependency allocate before any size is known; fully fixing
+//! that requires an upstream fix in `acadrust` (validate declared sizes against a decoded-memory
+//! budget) or running the decode in a separate worker with an OS memory limit. The limits here
+//! keep the blast radius bounded in the meantime.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]

@@ -88,7 +107,6 @@ mod native {
        current_style_names(&mut doc);
        table_merges(&mut doc);
        table_style_rows(&mut doc, false);
-        dimension_flags(&mut doc, false);
        let orphans = drop_orphaned_dgn_components(&mut doc);
        if orphans > 0 {
            let (s, were) = if orphans == 1 { ("", "was") } else { ("s", "were") };
@@ -272,24 +290,14 @@ mod native {
        }
    }

-    /// The DWG dimension flags byte. Its bit 0 is the opposite of DXF group 70's bit 128 (set: the
-    /// text is at its default position) and its bit 1 is group 70's bit 32 (ODA DWG
-    /// specification, common dimension data), while acadrust 0.6.4 reads and writes bit 0 as
-    /// `text_user_positioned` itself and keeps no bit 32 from DXF. Without this, every dimension
-    /// of a DWG CADCraft writes is user-positioned for AutoCAD (#1094), and every dimension of an
-    /// AutoCAD DWG is read as user-positioned. `to_dwg` sets the fields up for the writer:
-    /// bit 32 as CADCraft's DXF writer always sets it, and bit 0 through the inverted field;
-    /// otherwise the field is read from bit 0 after a DWG is read.
-    fn dimension_flags(doc: &mut acadrust::CadDocument, to_dwg: bool) {
+    /// The DWG dimension flags byte. Its bit 1 is DXF group 70's bit 32 (ODA DWG specification,
+    /// common dimension data), which acadrust keeps no copy of from DXF: it is set here as
+    /// CADCraft's DXF writer always sets it (#1094). Bit 0, the opposite of group 70's bit 128,
+    /// acadrust 0.6.5 reads and writes itself.
+    fn dimension_flags(doc: &mut acadrust::CadDocument) {
        for e in doc.entities_mut() {
            let acadrust::entities::EntityType::Dimension(d) = e else { continue };
-            let b = d.base_mut();
-            if to_dwg {
-                b.dwg_flags_byte |= 0x02;
-                b.text_user_positioned = !b.text_user_positioned;
-            } else {
-                b.text_user_positioned = b.dwg_flags_byte & 0x01 == 0;
-            }
+            d.base_mut().dwg_flags_byte |= 0x02;
        }
    }

@@ -494,7 +502,28 @@ mod native {
        }
    }

+    /// The current text style (`$TEXTSTYLE`) by its name, the same way as [`current_dimstyle`]:
+    /// the handle read with the DXF needn't be the style's in the document, in which case the DWG
+    /// writer fell back to Standard and AutoCAD opened the drawing with Standard current (#1650).
+    fn current_text_style(doc: &mut acadrust::CadDocument) {
+        let name = doc.header.current_text_style_name.clone();
+        if let Some(h) = doc.text_styles.iter().find(|ts| ts.name.eq_ignore_ascii_case(&name)).map(|ts| ts.handle) {
+            doc.header.current_text_style_handle = h;
+        }
+    }
+
    fn convert(dxf: &[u8], version: Option<acadrust::DxfVersion>) -> Result<Vec<u8>, String> {
+        // Reject a pathologically large DXF before handing it to the third-party decoder, which
+        // allocates tables and section buffers from the input's declared sizes and cannot be
+        // interrupted once it starts (CWE-789). This bounds the large-input variant; the decoder
+        // runs inside `catch_unwind` so a decode failure is reported rather than crashing.
+        if dxf.len() > Limits::DEFAULT.max_dxf_bytes {
+            return Err(format!(
+                "DXF: the input is {}, larger than the {} CADCraft converts to DWG",
+                mb(dxf.len() as u64),
+                mb(Limits::DEFAULT.max_dxf_bytes as u64)
+            ));
+        }
        let data = dxf.to_vec();
        let mut doc = std::panic::catch_unwind(move || acadrust::DxfReader::from_reader(Cursor::new(data)).and_then(|r| r.read()))
            .map_err(|_| "the DXF→DWG conversion failed".to_string())?
@@ -509,9 +538,10 @@ mod native {
        }
        other_layout_owners(&mut doc);
        table_style_rows(&mut doc, true);
-        dimension_flags(&mut doc, true);
+        dimension_flags(&mut doc);
        drop_unwritable(&mut doc);
        current_dimstyle(&mut doc);
+        current_text_style(&mut doc);
        std::panic::catch_unwind(AssertUnwindSafe(|| acadrust::DwgWriter::write_to_vec(&doc)))
            .map_err(|_| "the DWG writer failed on this drawing".to_string())?
            .map_err(|e| format!("DWG write: {e}"))
@@ -585,12 +615,37 @@ mod tests {
        assert_eq!(version(b"AC1018xxxx").as_deref(), Some("AC1018"));
    }

+    /// A DXF with ROMANS as `$TEXTSTYLE` gives a DWG whose current text style is ROMANS, not
+    /// Standard: the DXF names the style, and the handle read with it was Standard's (#1650).
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn current_text_style_reaches_the_dwg() {
+        let header = "  0\nSECTION\n  2\nHEADER\n  9\n$ACADVER\n  1\nAC1032\n  9\n$TEXTSTYLE\n  7\nROMANS\n  0\nENDSEC\n";
+        let style = "  0\nSTYLE\n  5\n1F0\n100\nAcDbSymbolTableRecord\n100\nAcDbTextStyleTableRecord\n  2\nROMANS\n 70\n0\n";
+        let style = format!("{style} 40\n0\n 41\n1\n 50\n0\n 71\n0\n 42\n2.5\n  3\nromans.shx\n  4\n\n");
+        let dxf = format!("{header}  0\nSECTION\n  2\nTABLES\n  0\nTABLE\n  2\nSTYLE\n 70\n1\n{style}  0\nENDTAB\n  0\nENDSEC\n  0\nEOF\n");
+        let dwg = dxf_to_dwg(dxf.as_bytes()).unwrap();
+        let doc = acadrust::DwgReader::from_stream(std::io::Cursor::new(&dwg)).read().unwrap();
+        let romans = doc.text_styles.iter().find(|ts| ts.name == "ROMANS").map(|ts| ts.handle);
+        assert!(romans.is_some(), "ROMANS is missing from the DWG");
+        assert_eq!(Some(doc.header.current_text_style_handle), romans);
+    }
+
    #[test]
    fn garbage_is_an_error_not_a_crash() {
        assert!(dwg_to_dxf(b"AC1032 this is not a dwg file at all").is_err());
        assert!(dwg_to_dxf(b"").is_err());
    }

+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn dxf_to_dwg_rejects_garbage_without_crashing() {
+        // The DXF→DWG path runs the third-party reader inside catch_unwind and reports failures
+        // rather than crashing (and rejects oversized input before decoding).
+        assert!(dxf_to_dwg(b"not a dxf file").is_err());
+        assert!(dxf_to_dwg(b"").is_err());
+    }
+
    /// A DXF with one DIMENSION per (text, group 70, subclass, points) row.
    #[cfg(not(target_arch = "wasm32"))]
    fn dims_dxf(dims: &[(&str, i64, &str, &[(i32, [f64; 2])])]) -> String {
@@ -22,7 +22,10 @@ serde_json = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
 # R-tree spatial index for picking, window selection and object snaps (MIT OR Apache-2.0).
-rstar = { version = "0.12", default-features = false }
+rstar = { version = "0.13", default-features = false }
+
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"

 [dev-dependencies]
 # Real DXF files for the external reference tests (io is a lower layer).
@@ -0,0 +1,163 @@
+//! Safe, atomic file replacement.
+//!
+//! Save, export, plot, autosave and the audit log all write a file by first putting the bytes in
+//! a sibling temporary file and then renaming it over the destination, so a failed or partial
+//! write never truncates the real file. The temporary file must be created *exclusively*: opening
+//! a predictable, pre-existing temporary path for a truncating write lets another local user plant
+//! a symlink there and redirect the write onto a file the victim can write but the attacker chose
+//! (CWE-59). [`write_atomic`] creates a fresh temporary file with `create_new` (`O_CREAT|O_EXCL`),
+//! so an existing entry at that path — symlink or not — makes the create fail rather than follow
+//! it. The handle is retained for the whole write, and only its own fresh file is renamed into
+//! place.
+
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::fs::{File, OpenOptions, Permissions};
+use std::io::{self, Write};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+/// Monotonic counter making temporary names unique within this process without a RNG dependency.
+static SEQ: AtomicU64 = AtomicU64::new(0);
+
+/// How many fresh temporary names to try before giving up (each collision is another local race).
+const MAX_TRIES: u32 = 32;
+
+/// Write `bytes` to `path`, replacing it atomically and without ever following a pre-existing
+/// temporary symlink.
+///
+/// A fresh temporary file is created with exclusive semantics in `path`'s own directory, the bytes
+/// are written through the retained handle and flushed, and the temporary is then renamed over
+/// `path`. On any failure the temporary is removed and the original `path` is left untouched.
+pub fn write_atomic(path: &Path, bytes: &[u8]) -> io::Result<()> {
+    let permissions = match std::fs::symlink_metadata(path) {
+        Ok(meta) if meta.is_file() => Some(meta.permissions()),
+        Ok(_) => None,
+        Err(e) if e.kind() == io::ErrorKind::NotFound => None,
+        Err(e) => return Err(e),
+    };
+    let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).map_or_else(|| PathBuf::from("."), Path::to_path_buf);
+    let (mut file, tmp) = create_temp(&dir, permissions.as_ref())?;
+    let write = (|| {
+        if let Some(permissions) = permissions {
+            file.set_permissions(permissions)?;
+        }
+        file.write_all(bytes)?;
+        file.flush()?;
+        file.sync_all()
+    })();
+    if let Err(e) = write {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e);
+    }
+    drop(file);
+    if let Err(e) = std::fs::rename(&tmp, path) {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e);
+    }
+    Ok(())
+}
+
+/// Create a fresh, exclusively-owned temporary file inside `dir`, returning its handle and path.
+///
+/// `create_new(true)` opens with `O_CREAT | O_EXCL`, which refuses to follow or reuse an existing
+/// entry (including a symlink), closing the plant-a-symlink race. Names are unpredictable enough to
+/// avoid collisions in practice, and genuine collisions are retried with a new name.
+fn create_temp(dir: &Path, permissions: Option<&Permissions>) -> io::Result<(File, PathBuf)> {
+    let pid = std::process::id();
+    let mut last_err = None;
+    for _ in 0..MAX_TRIES {
+        let seq = SEQ.fetch_add(1, Ordering::Relaxed);
+        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.subsec_nanos()).unwrap_or(0);
+        let tmp = dir.join(format!(".cadcraft-tmp-{pid}-{seq}-{nanos}"));
+        match create_exclusive(&tmp, permissions) {
+            Ok(file) => return Ok((file, tmp)),
+            Err(e) if e.kind() == io::ErrorKind::AlreadyExists => {
+                last_err = Some(e);
+                continue;
+            }
+            Err(e) => return Err(e),
+        }
+    }
+    Err(last_err.unwrap_or_else(|| io::Error::new(io::ErrorKind::AlreadyExists, "could not create a unique temporary file")))
+}
+
+fn create_exclusive(path: &Path, permissions: Option<&Permissions>) -> io::Result<File> {
+    let mut options = OpenOptions::new();
+    options.write(true).create_new(true);
+    #[cfg(unix)]
+    if let Some(permissions) = permissions {
+        use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
+        // Restrict access in the create syscall: chmod afterwards leaves a window in which a
+        // different user can open the inode and retain read access to bytes written later.
+        options.mode(permissions.mode() & 0o777);
+    }
+    #[cfg(not(unix))]
+    let _ = permissions;
+    options.open(path)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn replaces_contents_atomically() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let dest = dir.join("out.bin");
+        std::fs::write(&dest, b"old").unwrap();
+        write_atomic(&dest, b"new bytes").unwrap();
+        assert_eq!(std::fs::read(&dest).unwrap(), b"new bytes");
+        // No temporary files left behind.
+        let leftovers: Vec<_> =
+            std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.file_name()).filter(|n| n.to_string_lossy().starts_with(".cadcraft-tmp")).collect();
+        assert!(leftovers.is_empty(), "left temp files: {leftovers:?}");
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn does_not_follow_a_planted_temp_symlink() {
+        use std::os::unix::fs::symlink;
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-sym-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let victim = dir.join("victim");
+        std::fs::write(&victim, b"precious").unwrap();
+        let planted = dir.join(".cadcraft-tmp-plant");
+        symlink(&victim, &planted).unwrap();
+        assert_eq!(create_exclusive(&planted, None).unwrap_err().kind(), io::ErrorKind::AlreadyExists);
+        let dest = dir.join("drawing.dxf");
+        write_atomic(&dest, b"drawing bytes").unwrap();
+        assert_eq!(std::fs::read(&victim).unwrap(), b"precious", "victim file was overwritten");
+        assert_eq!(std::fs::read(&dest).unwrap(), b"drawing bytes");
+        std::fs::remove_dir_all(&dir).ok();
+    }
+    #[cfg(unix)]
+    #[test]
+    fn replacement_preserves_private_permissions() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-mode-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let dest = dir.join("private.adt");
+        std::fs::write(&dest, b"old").unwrap();
+        std::fs::set_permissions(&dest, std::fs::Permissions::from_mode(0o600)).unwrap();
+        write_atomic(&dest, b"private report").unwrap();
+        assert_eq!(std::fs::metadata(&dest).unwrap().permissions().mode() & 0o777, 0o600);
+        assert_eq!(std::fs::read(&dest).unwrap(), b"private report");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+    #[cfg(unix)]
+    #[test]
+    fn private_temp_is_restricted_from_creation() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-create-mode-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("private-temp");
+        let permissions = Permissions::from_mode(0o600);
+        let file = create_exclusive(&path, Some(&permissions)).unwrap();
+        assert_eq!(file.metadata().unwrap().permissions().mode() & 0o077, 0);
+        drop(file);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
@@ -339,9 +339,9 @@ mod native {
        if let Some(dir) = Path::new(path).parent() {
            std::fs::create_dir_all(dir).map_err(|e| e.to_string())?;
        }
-        let tmp = format!("{path}.tmp");
-        std::fs::write(&tmp, bytes).map_err(|e| e.to_string())?;
-        std::fs::rename(&tmp, path).map_err(|e| e.to_string())
+        // Create a fresh temporary file exclusively and rename it into place, so a planted
+        // `<path>.tmp` symlink in a shared autosave directory cannot redirect the write (CWE-59).
+        crate::atomic_write::write_atomic(Path::new(path), &bytes).map_err(|e| e.to_string())
    }

    impl Autosaver {
@@ -0,0 +1,84 @@
+//! Bounded reads of local files.
+//!
+//! Reading a path with [`std::fs::read`] buffers until EOF, so a path naming an endless readable
+//! device (for example `/dev/urandom` or a FIFO) exhausts process memory before any size check
+//! runs (CWE-400). [`read_capped`] opens the path once, refuses anything that is not a regular
+//! file, and reads through a reader limited to `max + 1` bytes so oversized input is rejected
+//! before it is fully buffered.
+
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::fs::OpenOptions;
+use std::io::{self, Read};
+use std::path::Path;
+
+/// Read at most `max` bytes from the regular file at `path`.
+///
+/// Returns an error if the path is not a regular file, cannot be opened, or holds more than `max`
+/// bytes. At most `max + 1` bytes are ever buffered, so an endless device cannot exhaust memory.
+pub fn read_capped(path: &Path, max: usize) -> io::Result<Vec<u8>> {
+    let mut options = OpenOptions::new();
+    options.read(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.custom_flags(libc::O_NONBLOCK);
+    }
+    let file = options.open(path)?;
+    let meta = file.metadata()?;
+    if !meta.is_file() {
+        return Err(io::Error::new(io::ErrorKind::InvalidInput, "not a regular file"));
+    }
+    // Read one byte past the limit so we can tell "exactly max" from "too big" without trusting
+    // the metadata length (which a device may misreport).
+    let mut buf = Vec::new();
+    let cap = (max as u64).saturating_add(1);
+    let read = file.take(cap).read_to_end(&mut buf)?;
+    if read as u64 > max as u64 {
+        return Err(io::Error::new(io::ErrorKind::InvalidData, format!("file is larger than the {max}-byte limit")));
+    }
+    Ok(buf)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Regular-file reads accept the byte boundary and reject any larger payload.
+    #[test]
+    fn reads_within_limit_and_rejects_oversize() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-cr-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let p = dir.join("f.bin");
+        std::fs::write(&p, vec![7u8; 100]).unwrap();
+        assert_eq!(read_capped(&p, 100).unwrap().len(), 100);
+        assert_eq!(read_capped(&p, 200).unwrap().len(), 100);
+        assert!(read_capped(&p, 99).is_err());
+        assert_eq!(read_capped(&p, usize::MAX).unwrap().len(), 100);
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
+    /// An endless device is rejected before its contents can be buffered.
+    #[cfg(unix)]
+    #[test]
+    fn rejects_non_regular_file() {
+        // /dev/zero is an endless readable device; it must be rejected, not buffered.
+        let p = Path::new("/dev/zero");
+        if p.exists() {
+            assert!(read_capped(p, 8 << 20).is_err());
+        }
+    }
+    /// Opening a FIFO without a writer returns an error without waiting for a peer.
+    #[cfg(unix)]
+    #[test]
+    fn rejects_fifo_without_a_writer() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-cr-fifo-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let fifo = dir.join("pipe");
+        assert!(std::process::Command::new("mkfifo").arg(&fifo).status().unwrap().success());
+        let started = std::time::Instant::now();
+        assert_eq!(read_capped(&fifo, 1024).unwrap_err().kind(), io::ErrorKind::InvalidInput);
+        assert!(started.elapsed() < std::time::Duration::from_secs(2));
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
@@ -427,13 +427,13 @@ fn mleader_kind(s: &Session, pts: &[Vec2], text: &str, landing: bool) -> Option<
    let d = s.doc().ok()?;
    let cur = d.header.str("CMLEADERSTYLE", "Standard");
    let st = d.mleader_styles.iter().find(|m| m.name.eq_ignore_ascii_case(&cur)).or(d.mleader_styles.first()).cloned().unwrap_or_default();
-    // An annotative style's sizes are paper sizes: the annotation scale applies when drawn.
-    let k = if st.annotative { 1.0 } else { d.header.f64("DIMSCALE", 1.0) };
-    let th = st.text_height * k;
+    // The style's sizes are the drawn sizes: a multileader style has no scale of its own and
+    // DIMSCALE (a dimension-style setting) does not apply, as in AutoCAD.
+    let th = st.text_height;
    let dir = if arrow_pts.first().is_some_and(|a| a.x > landing_pt.x) { -1.0 } else { 1.0 };
    let attach = if dir > 0.0 { 4 } else { 6 };
-    let dogleg = if landing { st.dogleg * k } else { 0.0 };
-    let tpos = *landing_pt + Vec2::new((dogleg + st.landing_gap * k) * dir, 0.0);
+    let dogleg = if landing { st.dogleg } else { 0.0 };
+    let tpos = *landing_pt + Vec2::new((dogleg + st.landing_gap) * dir, 0.0);
    Some(EntityKind::MLeader(MLeader {
        leaders: vec![arrow_pts.iter().map(|p| v3(*p)).collect()],
        landing: v3(*landing_pt),
@@ -451,7 +451,7 @@ fn mleader_kind(s: &Session, pts: &[Vec2], text: &str, landing: bool) -> Option<
            columns: None,
        }),
        style: st.name.clone(),
-        arrow_size: st.arrow_size * k,
+        arrow_size: st.arrow_size,
        spline: false,
        block: None,
    }))
@@ -142,7 +142,10 @@ fn write_audit_log(s: &Session, report: &crate::audit::Report) {
    let Some(path) = &path_str else { return };
    let adt_path = std::path::PathBuf::from(path).with_extension("adt");
    let content = report.format_adt(&title, path_str.as_deref());
-    if let Err(e) = std::fs::write(&adt_path, content) {
+    // Write through an exclusively-created temporary and rename over the companion path, so a
+    // planted `.adt` symlink beside the drawing cannot redirect the report onto another file
+    // writable by the victim (CWE-59).
+    if let Err(e) = crate::atomic_write::write_atomic(&adt_path, content.as_bytes()) {
        log::warn!("AUDITCTL: could not write audit log {}: {e}", adt_path.display());
    }
 }
@@ -79,10 +79,9 @@ fn extension(path: &str) -> String {
 fn write_file(cmd: &str, path: &str, bytes: &[u8]) -> Result<()> {
    #[cfg(not(target_arch = "wasm32"))]
    {
-        let tmp = format!("{path}.cadcraft-tmp");
-        std::fs::write(&tmp, bytes).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
-        std::fs::rename(&tmp, path).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
-        Ok(())
+        // Exclusively create a fresh temporary file and rename it into place so a planted
+        // `<path>.cadcraft-tmp` symlink cannot redirect the export write (CWE-59).
+        crate::atomic_write::write_atomic(std::path::Path::new(path), bytes).map_err(|e| bad(cmd, format!("{path}: {e}")))
    }
    #[cfg(target_arch = "wasm32")]
    {
@@ -19,6 +19,15 @@ pub use pgp::{MAX_ALIASES, alias_name, command_id};
 pub(crate) use pgp::{specs as alias_specs, user_alias};
 pub use template::{qnew_template, set_qnew_template};

+/// Largest drawing accepted from a local path, matching the per-file xref limit. A path naming an
+/// endless device must be rejected before it exhausts memory (CWE-400), so native opens read
+/// through [`crate::capped_read`] rather than buffering to EOF.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_DRAWING_BYTES: usize = 512 << 20;
+/// Largest `.scr` script accepted from a local path.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_SCRIPT_BYTES: usize = 64 << 20;
+
 /// Plot a space to PDF bytes with JSON options (`{paper?, landscape?, fit?, lineweights?, …}`).
 pub type PlotHook = fn(&Drawing, &cadcraft_doc::Space, &Value) -> std::result::Result<Vec<u8>, String>;

@@ -192,7 +201,8 @@ fn run_script(s: &mut Session, p: &Value) -> Result<Value> {
        let path = _path;
        #[cfg(not(target_arch = "wasm32"))]
        {
-            let bytes = std::fs::read(path).map_err(|e| bad("script", format!("{path}: {e}")))?;
+            let bytes =
+                crate::capped_read::read_capped(std::path::Path::new(path), MAX_SCRIPT_BYTES).map_err(|e| bad("script", format!("{path}: {e}")))?;
            String::from_utf8_lossy(&bytes).into_owned()
        }
        #[cfg(target_arch = "wasm32")]
@@ -265,7 +275,8 @@ pub fn read_file(path: &str) -> std::result::Result<ReadFile, String> {
    #[cfg(not(target_arch = "wasm32"))]
    {
        let r = std::panic::catch_unwind(|| {
-            let bytes = std::fs::read(path).map_err(|e| bad("open", format!("{path}: {e}")))?;
+            let bytes =
+                crate::capped_read::read_capped(std::path::Path::new(path), MAX_DRAWING_BYTES).map_err(|e| bad("open", format!("{path}: {e}")))?;
            read_bytes(&bytes, path, Some(path.to_string()))
        });
        match r {
@@ -326,13 +337,15 @@ fn opened(s: &Session, i: usize, entities: bool) -> Value {
    }
 }

+/// Open a drawing from bounded regular-file bytes or base64 data and resolve its external references.
 fn run_open(s: &mut Session, p: &Value) -> Result<Value> {
    if let Some(_path) = str_param(p, "path") {
        #[cfg(not(target_arch = "wasm32"))]
        let path = _path;
        #[cfg(not(target_arch = "wasm32"))]
        {
-            let bytes = std::fs::read(path).map_err(|e| bad("open", format!("{path}: {e}")))?;
+            let bytes =
+                crate::capped_read::read_capped(std::path::Path::new(path), MAX_DRAWING_BYTES).map_err(|e| bad("open", format!("{path}: {e}")))?;
            let i = open_bytes(s, &bytes, path, Some(path.to_string()))?;
            super::blocks::xref::after_open(s, i);
            return Ok(opened(s, i, true));
@@ -403,10 +416,9 @@ fn save_as(s: &mut Session, cmd: &str, path: &str, opts: &SaveAs) -> Result<usiz
 fn store(path: &str, bytes: &[u8]) -> Result<()> {
    #[cfg(not(target_arch = "wasm32"))]
    {
-        let tmp = format!("{path}.cadcraft-tmp");
-        std::fs::write(&tmp, bytes).map_err(|e| bad("save", format!("{path}: {e}")))?;
-        std::fs::rename(&tmp, path).map_err(|e| bad("save", format!("{path}: {e}")))?;
-        Ok(())
+        // Exclusively create a fresh temporary file and rename it over `path`, so a planted
+        // `<path>.cadcraft-tmp` symlink cannot redirect the write onto another file (CWE-59).
+        crate::atomic_write::write_atomic(std::path::Path::new(path), bytes).map_err(|e| bad("save", format!("{path}: {e}")))
    }
    #[cfg(target_arch = "wasm32")]
    {
@@ -826,9 +826,9 @@ fn run_plot(s: &mut Session, p: &Value, cmd: &str) -> Result<Value> {
            #[cfg(not(target_arch = "wasm32"))]
            {
                let path = _path;
-                let tmp = format!("{path}.cadcraft-tmp");
-                std::fs::write(&tmp, &bytes).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
-                std::fs::rename(&tmp, path).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
+                // Exclusively create a fresh temporary file and rename it into place so a planted
+                // `<path>.cadcraft-tmp` symlink cannot redirect the plot write (CWE-59).
+                crate::atomic_write::write_atomic(std::path::Path::new(path), &bytes).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
                Ok(json!({ "path": path, "bytes": bytes.len(), "layout": layout, "pages": pages }))
            }
            #[cfg(target_arch = "wasm32")]
@@ -18,8 +18,7 @@ pub use craft_docpath::Refused;
 /// on other platforms.
 pub fn resolve(stored: &str, document: Option<&Path>) -> Result<PathBuf, Refused> {
    let document = document.filter(|d| !d.as_os_str().is_empty()).map(|d| std::path::absolute(d).unwrap_or_else(|_| d.to_path_buf()));
-    let path = craft_docpath::resolve(stored.trim(), document.as_deref())?;
-    if path.is_absolute() { Ok(path) } else { Err(Refused::Invalid) }
+    craft_docpath::resolve_absolute(stored.trim(), document.as_deref())
 }

 #[cfg(test)]
@@ -9,9 +9,13 @@
 #![forbid(unsafe_code)]

 pub mod assoc;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod atomic_write;
 pub mod audit;
 pub mod autosave;
 pub mod blockedit;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod capped_read;
 pub mod cmd;
 pub mod doc_path;
 mod finite;
@@ -307,11 +307,32 @@ fn chain(a: &[Value], ok: fn(std::cmp::Ordering) -> bool) -> R {
    }
    Ok(Value::t())
 }
+/// `=` and `/=`: numbers and strings compare as [`compare`] does, and any other atom compares by
+/// what it is, as `eq` does. AutoLISP answers `(= (type x) 'LIST)` -- the idiom for a type test,
+/// since `type` returns a symbol -- where coercing that symbol to a number failed the whole
+/// routine with "bad argument type" instead (#1597). A mismatch is `nil`, not an error, so
+/// `(= 1 "1")` and `(= '(1) '(1))` answer too. The ordering comparisons stay numbers and strings
+/// only, as AutoLISP has them.
+fn eq_chain(a: &[Value], want_equal: bool) -> R {
+    arity(a, 1, usize::MAX)?;
+    for w in a.windows(2) {
+        let [x, y] = w else { continue };
+        let same = match (x, y) {
+            (Value::Str(_), Value::Str(_)) => compare(x, y)?.is_eq(),
+            _ if x.as_number().is_some() && y.as_number().is_some() => compare(x, y)?.is_eq(),
+            _ => eq(x, y),
+        };
+        if same != want_equal {
+            return Ok(Value::Nil);
+        }
+    }
+    Ok(Value::t())
+}
 fn num_eq(a: &[Value]) -> R {
-    chain(a, |o| o.is_eq())
+    eq_chain(a, true)
 }
 fn num_ne(a: &[Value]) -> R {
-    chain(a, |o| o.is_ne())
+    eq_chain(a, false)
 }
 fn lt(a: &[Value]) -> R {
    chain(a, |o| o.is_lt())
@@ -658,19 +679,47 @@ fn wcmatch(a: &[Value]) -> R {
    arity(a, 2, 2)?;
    let (s, pat) = (string(&a[0])?, string(&a[1])?);
    let text: Vec<char> = s.chars().collect();
-    Ok(Value::bool(split_patterns(&pat).iter().any(|p| match_pattern(&text, p))))
+    // Native wildcard matching runs as a single interpreter step, so its internal `*` backtracking
+    // must not explore exponentially many placements unchecked (CWE-400). Charge every glob step
+    // against a shared budget and fail the call if it is exhausted.
+    let mut budget: u64 = WCMATCH_BUDGET;
+    for p in split_patterns(&pat, &mut budget).map_err(|()| LispError::new("wcmatch: pattern too complex"))? {
+        match match_pattern(&text, &p, &mut budget) {
+            Ok(true) => return Ok(Value::bool(true)),
+            Ok(false) => {}
+            Err(()) => return Err(LispError::new("wcmatch: pattern too complex")),
+        }
+    }
+    Ok(Value::bool(false))
 }

-fn split_patterns(pat: &str) -> Vec<Vec<char>> {
+/// Shared step budget for one `wcmatch` call's wildcard matching. Large enough for the patterns
+/// AutoLISP routines legitimately use (including the pathological-but-bounded cases the tests
+/// cover), but finite so truly exponential `*`-heavy patterns are rejected rather than hanging.
+const WCMATCH_BUDGET: u64 = 200_000_000;
+
+/// Spend one wildcard work unit, returning an error when the shared budget is exhausted.
+fn charge_match(budget: &mut u64) -> Result<(), ()> {
+    *budget = budget.checked_sub(1).ok_or(())?;
+    Ok(())
+}
+
+/// Split comma-separated wildcard alternatives while preserving escapes and bracket sets.
+/// Every consumed character spends from the same budget used for matching.
+fn split_patterns(pat: &str, budget: &mut u64) -> Result<Vec<Vec<char>>, ()> {
    let mut out = vec![Vec::new()];
    let mut chars = pat.chars().peekable();
    let mut in_set = false;
    while let Some(c) = chars.next() {
+        charge_match(budget)?;
        match c {
            '`' => {
                if let Some(cur) = out.last_mut() {
                    cur.push('`');
-                    cur.extend(chars.next());
+                    if let Some(escaped) = chars.next() {
+                        charge_match(budget)?;
+                        cur.push(escaped);
+                    }
                }
            }
            '[' => {
@@ -693,41 +742,96 @@ fn split_patterns(pat: &str) -> Vec<Vec<char>> {
            }
        }
    }
-    out
+    Ok(out)
 }

-fn match_pattern(text: &[char], pat: &[char]) -> bool {
+/// Match one wildcard alternative, including leading `~` negation, within the shared budget.
+fn match_pattern(text: &[char], pat: &[char], budget: &mut u64) -> Result<bool, ()> {
    if let Some(('~', rest)) = pat.split_first().map(|(c, r)| (*c, r))
        && !rest.is_empty()
    {
-        return !glob(text, rest, 0);
+        return glob(text, rest, 0, budget).map(|m| !m);
    }
-    glob(text, pat, 0)
+    glob(text, pat, 0, budget)
 }

-/// Iterative-enough glob with `*` backtracking; `depth` bounds the recursion on `*`.
-fn glob(text: &[char], pat: &[char], depth: usize) -> bool {
+/// Iterative-enough glob with `*` backtracking; `depth` bounds the recursion on `*`. Every step is
+/// charged against `budget`; `Err(())` means the shared budget ran out (treated as too complex).
+fn glob(text: &[char], pat: &[char], depth: usize, budget: &mut u64) -> Result<bool, ()> {
+    glob_cached(text, pat, depth, budget, &mut std::collections::HashSet::new())
+}
+
+/// Match suffixes while memoizing failures; both matching work and retained failure entries are bounded.
+fn glob_cached(
+    text: &[char],
+    pat: &[char],
+    depth: usize,
+    budget: &mut u64,
+    failed: &mut std::collections::HashSet<(usize, usize, usize)>,
+) -> Result<bool, ()> {
+    charge_match(budget)?;
+    let key = (text.len(), pat.len(), depth);
+    if failed.contains(&key) {
+        return Ok(false);
+    }
+    let matched = glob_inner(text, pat, depth, budget, failed)?;
+    // Avoid revisiting the same failed suffix exponentially. Bound the memo table independently
+    // of the step limit so a very large pattern cannot turn the optimization into an allocation bomb.
+    if !matched && failed.len() < 100_000 {
+        failed.insert(key);
+    }
+    Ok(matched)
+}
+
+/// Evaluate wildcard tokens and backtracking branches under shared work and recursion limits.
+fn glob_inner(
+    text: &[char],
+    pat: &[char],
+    depth: usize,
+    budget: &mut u64,
+    failed: &mut std::collections::HashSet<(usize, usize, usize)>,
+) -> Result<bool, ()> {
+    if *budget == 0 {
+        return Err(());
+    }
+    *budget -= 1;
    if depth > 64 {
-        return false;
+        return Ok(false);
    }
    let (mut t, mut p) = (0usize, 0usize);
    while p < pat.len() {
+        charge_match(budget)?;
        match pat[p] {
            '*' => {
                let rest = &pat[p + 1..];
-                return (t..=text.len()).any(|i| glob(&text[i..], rest, depth + 1));
+                for i in t..=text.len() {
+                    if glob_cached(&text[i..], rest, depth + 1, budget, failed)? {
+                        return Ok(true);
+                    }
+                }
+                return Ok(false);
            }
            '`' => {
-                let Some(&lit) = pat.get(p + 1) else { return false };
+                let Some(&lit) = pat.get(p + 1) else { return Ok(false) };
                if text.get(t) != Some(&lit) {
-                    return false;
+                    return Ok(false);
                }
                t += 1;
                p += 2;
            }
            '[' => {
-                let Some(close) = pat[p..].iter().position(|c| *c == ']').map(|i| p + i) else { return false };
-                let Some(&c) = text.get(t) else { return false };
+                let mut close = p;
+                while let Some(c) = pat.get(close) {
+                    charge_match(budget)?;
+                    if *c == ']' {
+                        break;
+                    }
+                    close += 1;
+                }
+                if close == pat.len() {
+                    return Ok(false);
+                }
+                let Some(&c) = text.get(t) else { return Ok(false) };
                let set = &pat[p + 1..close];
                let (neg, set) = match set.split_first() {
                    Some(('~', r)) if !r.is_empty() => (true, r),
@@ -736,6 +840,7 @@ fn glob(text: &[char], pat: &[char], depth: usize) -> bool {
                let mut hit = false;
                let mut i = 0;
                while i < set.len() {
+                    charge_match(budget)?;
                    if set.get(i + 1) == Some(&'-') && i + 2 < set.len() {
                        if set[i] <= c && c <= set[i + 2] {
                            hit = true;
@@ -749,13 +854,13 @@ fn glob(text: &[char], pat: &[char], depth: usize) -> bool {
                    }
                }
                if hit == neg {
-                    return false;
+                    return Ok(false);
                }
                t += 1;
                p = close + 1;
            }
            pc => {
-                let Some(&c) = text.get(t) else { return false };
+                let Some(&c) = text.get(t) else { return Ok(false) };
                let ok = match pc {
                    '#' => c.is_ascii_digit(),
                    '@' => c.is_alphabetic(),
@@ -764,14 +869,14 @@ fn glob(text: &[char], pat: &[char], depth: usize) -> bool {
                    other => other == c,
                };
                if !ok {
-                    return false;
+                    return Ok(false);
                }
                t += 1;
                p += 1;
            }
        }
    }
-    t == text.len()
+    Ok(t == text.len())
 }

 // ---------------- geometry ----------------
@@ -961,15 +1066,16 @@ fn findfile(a: &[Value]) -> R {
    Ok(if file_exists(&p) { Value::Str(p) } else { Value::Nil })
 }

+/// Read a regular text file up to 64 MiB, replacing invalid UTF-8 and returning `None` on read failure.
 #[cfg(not(target_arch = "wasm32"))]
 pub fn read_text_file(path: &str) -> Option<String> {
-    let bytes = std::fs::read(path).ok()?;
-    // Cap what a routine can pull into memory.
-    if bytes.len() > 64 * 1024 * 1024 {
-        return None;
-    }
+    // Read through a byte-limited, regular-file-only reader so a path naming an endless device
+    // cannot exhaust memory before the 64 MiB cap is enforced (CWE-400).
+    const MAX: usize = 64 * 1024 * 1024;
+    let bytes = crate::capped_read::read_capped(std::path::Path::new(path), MAX).ok()?;
    Some(String::from_utf8_lossy(&bytes).into_owned())
 }
+/// Return `None` on the web, where native filesystem paths are unavailable.
 #[cfg(target_arch = "wasm32")]
 pub fn read_text_file(_path: &str) -> Option<String> {
    None
@@ -1482,5 +1588,25 @@ pub fn real(r: f64) -> String {
 /// `wcmatch` for other callers (`ssget` filters).
 pub fn wild_match(text: &str, pattern: &str) -> bool {
    let t: Vec<char> = text.chars().collect();
-    split_patterns(pattern).iter().any(|p| match_pattern(&t, p))
+    let mut budget: u64 = WCMATCH_BUDGET;
+    split_patterns(pattern, &mut budget).is_ok_and(|patterns| patterns.iter().any(|p| match_pattern(&t, p, &mut budget) == Ok(true)))
+}
+
+#[cfg(test)]
+mod wildcard_budget_tests {
+    use super::*;
+
+    /// Pattern splitting, literal matching, and bracket scans all stop when their shared fuel runs out.
+    #[test]
+    fn all_native_scans_consume_fuel() {
+        assert!(split_patterns("abcdefgh", &mut 4).is_err());
+        assert!(split_patterns("`a`b`c", &mut 4).is_err());
+        let text: Vec<_> = "abcdefgh".chars().collect();
+        assert!(glob(&text, &text, 0, &mut 4).is_err());
+        let pattern: Vec<_> = "[abcdefgh]".chars().collect();
+        assert!(glob(&['!'], &pattern, 0, &mut 6).is_err());
+        // Enough for finding the closing bracket, but not scanning the entire set again.
+        assert!(glob(&['!'], &pattern, 0, &mut 14).is_err());
+        assert_eq!(glob(&['a'], &pattern, 0, &mut 100), Ok(true));
+    }
 }
@@ -151,16 +151,34 @@ pub fn from_json(v: &serde_json::Value) -> Value {
    }
 }

-/// A LISP value as JSON (for `setvar`).
-pub fn to_json(v: &Value) -> serde_json::Value {
-    match v {
+/// A LISP value as JSON (for `setvar`), bounded so a shared cons structure cannot expand into
+/// exponentially many owned array elements before the setter can reject it (CWE-400).
+///
+/// Largest number of elements it may expand, and the deepest nesting it follows.
+const TO_JSON_BUDGET: u64 = 2_000_000;
+const TO_JSON_MAX_DEPTH: usize = 256;
+
+/// Convert a LISP value to owned JSON within element and nesting limits.
+/// Return `None` before a shared cons structure can expand beyond the remaining budget.
+fn to_json_bounded(v: &Value, depth: usize, budget: &mut u64) -> Option<serde_json::Value> {
+    if depth > TO_JSON_MAX_DEPTH || *budget == 0 {
+        return None;
+    }
+    *budget -= 1;
+    Some(match v {
        Value::Nil => serde_json::Value::Null,
        Value::Int(i) => serde_json::json!(i),
        Value::Real(r) => serde_json::json!(r),
        Value::Str(s) => serde_json::json!(&**s),
-        Value::Cons(_) => serde_json::Value::Array(v.iter().map(|x| to_json(&x)).collect()),
+        Value::Cons(_) => {
+            let mut arr = Vec::new();
+            for x in v.iter() {
+                arr.push(to_json_bounded(&x, depth + 1, budget)?);
+            }
+            serde_json::Value::Array(arr)
+        }
        other => serde_json::json!(to_text(other, false)),
-    }
+    })
 }

 pub fn getvar(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError> {
@@ -169,10 +187,15 @@ pub fn getvar(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError> {
    Ok(Flow::Value(crate::sysvars::get(ctx.s, &name).map(|v| from_json(&v)).unwrap_or_default()))
 }

+/// Set a system variable after bounded JSON conversion, reporting invalid or oversized values as LISP errors.
 pub fn setvar(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError> {
    arity(&a, 2, 2)?;
    let name = string(&a[0])?;
-    match crate::sysvars::set(ctx.s, &name, &to_json(&a[1])) {
+    let mut budget: u64 = TO_JSON_BUDGET;
+    let Some(json) = to_json_bounded(&a[1], 0, &mut budget) else {
+        return Err(LispError::new(format!("AutoCAD variable setting rejected: {} value too large", to_text(&a[0], true))));
+    };
+    match crate::sysvars::set(ctx.s, &name, &json) {
        Ok(()) => Ok(Flow::Value(a[1].clone())),
        Err(_) => Err(LispError::new(format!("AutoCAD variable setting rejected: {} {}", to_text(&a[0], true), to_text(&a[1], true)))),
    }
@@ -163,7 +163,8 @@ pub struct Ctx<'a> {
 pub const MAX_STACK: usize = 100_000;
 /// Nesting depth of synchronous callbacks (`vl-sort` comparing with a LISP function, …).
 const MAX_SYNC_DEPTH: usize = 32;
-
+/// Steps per slice while driving a synchronous callback ([`Ctx::call_sync`]).
+const SYNC_SLICE: u64 = 400_000;
 enum State {
    Eval(Value),
    Ret(Value),
@@ -645,12 +646,31 @@ impl Ctx<'_> {
            super::value::charge_result(&v)?;
            return Ok(v);
        }
+        let cap = self.s.lisp.limits.callback_steps;
        let mut m = Machine::calling(f.clone(), args);
        let mut sub = Ctx { s: &mut *self.s, env: &mut *self.env, depth: self.depth + 1 };
-        match m.run(&mut sub, u64::MAX) {
-            Outcome::Done(v) => Ok(v),
-            Outcome::Error(e) => Err(e),
-            Outcome::Wait(_) => Err(LispError::new("this function can't ask for input here")),
+        // Drive the callback in bounded slices instead of granting it `u64::MAX` fuel. A `Yield`
+        // (the step budget ran out) is retried until a hard cap, so a constant-memory infinite
+        // loop inside a comparator or predicate terminates with an error rather than hanging the
+        // thread and bypassing the blocking execution cap (CWE-400).
+        let mut spent: u64 = 0;
+        loop {
+            let remaining = cap.saturating_sub(spent);
+            if remaining == 0 {
+                return Err(LispError::new(format!("callback stopped after {cap} steps")));
+            }
+            let slice = remaining.min(SYNC_SLICE);
+            match m.run(&mut sub, slice) {
+                Outcome::Done(v) => return Ok(v),
+                Outcome::Error(e) => return Err(e),
+                Outcome::Wait(Need::Yield) => {
+                    spent = spent.saturating_add(slice);
+                    if spent >= cap {
+                        return Err(LispError::new(format!("callback stopped after {cap} steps")));
+                    }
+                }
+                Outcome::Wait(_) => return Err(LispError::new("this function can't ask for input here")),
+            }
        }
    }
 }
@@ -67,6 +67,12 @@ impl GetRequest {
        let mut p = Prompt::new(message, accept).base_opt(base);
        p.keywords = self.initget.keywords.clone();
        p.raw = true;
+        // `entsel`/`nentsel` pick one object. The routine writes the message, so the prompt says
+        // so itself rather than being read for the word "Select" -- with a message of its own
+        // ("\nSelect the second line: ", or no mention of selecting at all) the pick box went
+        // missing, while the same call without one got it from the default "Select object: "
+        // (#1598).
+        p.picks_one = matches!(self.kind, GetKind::EntSel);
        p
    }

@@ -126,11 +126,14 @@ pub(crate) struct Limits {
    pub cells: usize,
    /// Bytes of strings, printed text and files read per run.
    pub string_bytes: u64,
+    /// Maximum interpreter steps per synchronous callback.
+    pub callback_steps: u64,
 }

 impl Default for Limits {
+    /// Provide finite cons-cell, string-byte, and synchronous-callback limits for a LISP run.
    fn default() -> Self {
-        Limits { cells: value::MAX_CELLS, string_bytes: value::STRING_BUDGET }
+        Limits { cells: value::MAX_CELLS, string_bytes: value::STRING_BUDGET, callback_steps: 500_000_000 }
    }
 }

@@ -70,6 +70,39 @@ fn arithmetic_follows_autolisp() {
    assert_eq!(eval(&mut s, "(+ 1 nil)"), Err("bad argument type: numberp: nil".into()));
 }

+/// `=` answers for the symbols `type` returns, which is how AutoLISP routines test a type:
+/// `(= (type x) 'INT)`. Coercing the symbol to a number failed the whole routine with "bad
+/// argument type" instead, so a routine written for AutoLISP stopped at its first type test
+/// (#1597). The ordering comparisons are still numbers and strings, as AutoLISP has them.
+#[test]
+fn equality_compares_symbols_as_autolisp_does() {
+    let mut s = session();
+    assert_eq!(ok(&mut s, "(= (type 1) 'INT)"), "T");
+    assert_eq!(ok(&mut s, "(= (type 1.0) 'INT)"), "nil");
+    assert_eq!(ok(&mut s, "(= (type '(1 2)) 'LIST)"), "T");
+    assert_eq!(ok(&mut s, "(= (type \"a\") 'STR)"), "T");
+    assert_eq!(ok(&mut s, "(/= (type 1) 'REAL)"), "T");
+    assert_eq!(ok(&mut s, "(= 'a 'a 'a)"), "T");
+    assert_eq!(ok(&mut s, "(= 'a 'b)"), "nil");
+
+    // The routine from the report runs.
+    ok(&mut s, "(defun isint (a) (if (= (type a) 'INT) T nil))");
+    assert_eq!(ok(&mut s, "(isint 3)"), "T");
+    assert_eq!(ok(&mut s, "(isint 3.0)"), "nil");
+    assert_eq!(ok(&mut s, "(isint \"3\")"), "nil");
+
+    // A mismatch of kinds is nil, not an error; numbers and strings are unchanged.
+    assert_eq!(ok(&mut s, "(= 1 \"1\")"), "nil");
+    assert_eq!(ok(&mut s, "(= '(1) '(1))"), "nil", "`=` is not `equal`");
+    assert_eq!(ok(&mut s, "(= nil nil)"), "T");
+    assert_eq!(ok(&mut s, "(= 1 1.0)"), "T");
+    assert_eq!(ok(&mut s, "(= \"a\" \"a\" \"a\")"), "T");
+    assert_eq!(ok(&mut s, "(= 1 1 2)"), "nil");
+
+    // Ordering still refuses what AutoLISP refuses.
+    assert_eq!(eval(&mut s, "(< 'a 'b)"), Err("bad argument type: numberp: A".into()));
+}
+
 #[test]
 fn lists_and_strings() {
    let mut s = session();
@@ -188,6 +221,69 @@ fn runaway_routines_are_errors_not_crashes() {
    assert_eq!(r, Ok("3000000".into()));
 }

+/// An infinite comparator stops at its callback cap, and a later finite comparator still succeeds.
+#[test]
+fn synchronous_callback_loop_is_an_error_not_a_hang() {
+    // A comparator with an infinite loop used to run with u64::MAX fuel and hang the thread; it
+    // now terminates at the synchronous-callback step cap (CWE-400, finding row 2).
+    let mut s = session();
+    s.lisp.limits.callback_steps = 1_000;
+    assert!(eval(&mut s, "(vl-sort '(1 2) (function (lambda (a b) (while t))))").is_err());
+    // A well-behaved comparator still works afterwards.
+    assert_eq!(ok(&mut s, "(vl-sort '(3 1 2) '<)"), "(1 2 3)");
+}
+
+/// A zero-step callback limit prevents even the first callback side effect.
+#[test]
+fn a_zero_callback_budget_does_not_run_the_callback() {
+    let mut s = session();
+    s.lisp.limits.callback_steps = 0;
+    ok(&mut s, "(setq callback-ran nil)");
+    let result = eval(&mut s, "(vl-remove-if '(lambda (x) (setq callback-ran t)) '(1))");
+    assert_eq!(result, Err("callback stopped after 0 steps".into()));
+    assert_eq!(ok(&mut s, "callback-ran"), "nil");
+}
+
+/// A callback stops at a cap smaller than one scheduling slice without completing all its assignments.
+#[test]
+fn a_callback_must_fit_within_a_partial_slice() {
+    let mut s = session();
+    s.lisp.limits.callback_steps = 1_000;
+    ok(&mut s, "(setq callback-count 0)");
+    let result = eval(&mut s, "(vl-remove-if '(lambda (x) (repeat 1000 (setq callback-count (1+ callback-count)))) '(1))");
+    assert_eq!(result, Err("callback stopped after 1000 steps".into()));
+    assert_eq!(ok(&mut s, "(and (> callback-count 0) (< callback-count 1000))"), "T");
+}
+
+/// Crossing a scheduling boundary grants only the additional configured step, rather than another slice.
+#[test]
+fn reaching_a_callback_slice_boundary_does_not_grant_another_slice() {
+    let counts: Vec<u64> = [399_999, 400_000]
+        .into_iter()
+        .map(|cap| {
+            let mut s = session();
+            s.lisp.limits.callback_steps = cap;
+            ok(&mut s, "(setq callback-count 0)");
+            let result = eval(&mut s, "(vl-remove-if '(lambda (x) (while t (setq callback-count (1+ callback-count)))) '(1))");
+            assert_eq!(result, Err(format!("callback stopped after {cap} steps")));
+            ok(&mut s, "callback-count").parse().unwrap()
+        })
+        .collect();
+    // One additional VM step can perform at most one assignment, even at SYNC_SLICE's boundary.
+    assert!(counts[0] > 0);
+    assert!(counts[1] >= counts[0] && counts[1] - counts[0] <= 1, "{counts:?}");
+}
+
+/// System-variable conversion rejects a shared list whose owned JSON expansion would exceed its budget.
+#[test]
+fn setvar_rejects_an_oversized_shared_structure() {
+    // A list repeatedly sharing its own contents expands exponentially; setvar's bounded JSON
+    // conversion rejects it instead of allocating gigabytes (CWE-400, finding row 39).
+    let mut s = session();
+    let build = "(setq x '(1)) (repeat 40 (setq x (list x x))) (setvar \"GRIDUNIT\" x)";
+    assert!(eval(&mut s, build).is_err());
+}
+
 #[test]
 fn printing() {
    let mut s = session();
@@ -452,6 +548,37 @@ fn hostile_lisp_never_panics() {
    assert!(!s.lisp_running());
 }

+/// `entsel` and `nentsel` pick one object, so the cursor shows the pick box at their prompt. It
+/// was read off the message's first word, and a routine's own message begins with a newline -- so
+/// the same call showed the pick box without a message and lost it with one (#1598).
+#[test]
+fn an_entsel_prompt_picks_objects_whatever_its_message_says() {
+    let mut s = session();
+    // No message: the default "Select object: ".
+    s.cmdline("(nentsel)").unwrap();
+    assert!(s.current_prompt().unwrap().picks_objects(), "{}", s.prompt_text());
+    s.cancel();
+
+    // The reported case: the routine's own message, starting with a newline.
+    s.cmdline("(nentsel \"\nSelect second line or polyline: \")").unwrap();
+    assert!(s.current_prompt().unwrap().picks_objects(), "{}", s.prompt_text());
+    s.cancel();
+
+    // Wording that never says "select" picks an object just the same.
+    s.cmdline("(entsel \"\nPick a line: \")").unwrap();
+    assert!(s.current_prompt().unwrap().picks_objects(), "{}", s.prompt_text());
+    s.cancel();
+
+    // A point prompt is not a pick, and keeps its point modifiers -- including one whose own
+    // message happens to begin with the word the built-in commands are read by. `picks_one` says
+    // which calls pick, so the wording is only ever read where the engine wrote it (#1635 review).
+    for point in ["(getpoint \"\nSpecify a point: \")", "(getpoint \"\nSelect a point: \")", "(getpoint \"Select a point: \")"] {
+        s.cmdline(point).unwrap();
+        assert!(!s.current_prompt().unwrap().picks_objects(), "{point}: {}", s.prompt_text());
+        s.cancel();
+    }
+}
+
 #[test]
 fn a_waiting_routine_is_a_prompt_with_a_rubber_band() {
    let mut s = session();
@@ -343,18 +343,30 @@ pub fn eq(a: &Value, b: &Value) -> bool {

 /// `equal`: the same structure, numbers within `fuzz`.
 pub fn equal(a: &Value, b: &Value, fuzz: f64) -> bool {
-    equal_depth(a, b, fuzz, 0)
+    // A shared cons DAG can expand into exponentially many node visits when compared as a tree.
+    // Bound the total comparisons so `equal` on adversarial shared structure cannot monopolise the
+    // thread (CWE-407); exhausting the budget reports "not equal" rather than looping.
+    let mut budget: u64 = EQUAL_BUDGET;
+    equal_depth(a, b, fuzz, 0, &mut budget)
 }

-fn equal_depth(a: &Value, b: &Value, fuzz: f64, depth: usize) -> bool {
-    if depth > MAX_DEPTH {
+/// Largest number of node comparisons one `equal` call may perform.
+const EQUAL_BUDGET: u64 = 50_000_000;
+
+/// Compare nested values within depth and node-work limits, returning false when either limit is reached.
+fn equal_depth(a: &Value, b: &Value, fuzz: f64, depth: usize, budget: &mut u64) -> bool {
+    if depth > MAX_DEPTH || *budget == 0 {
        return false;
    }
+    *budget -= 1;
    let (mut a, mut b) = (a.clone(), b.clone());
    loop {
+        if *budget == 0 {
+            return false;
+        }
        match (&a, &b) {
            (Value::Cons(x), Value::Cons(y)) => {
-                if !equal_depth(&x.car, &y.car, fuzz, depth + 1) {
+                if !equal_depth(&x.car, &y.car, fuzz, depth + 1, budget) {
                    return false;
                }
                let (na, nb) = (x.cdr.clone(), y.cdr.clone());
@@ -62,6 +62,10 @@ pub struct Prompt {
    /// pointer boxes.
    #[serde(skip_serializing_if = "std::ops::Not::not")]
    pub distance: bool,
+    /// The prompt picks one object whatever it says: an AutoLISP `entsel`/`nentsel`, whose message
+    /// the routine writes, so it cannot be read for the word "Select" (#1598).
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    pub picks_one: bool,
 }

 /// Parse `@distance<angle` (relative polar), returning `(distance, angle in radians)`.
@@ -128,11 +132,14 @@ impl Prompt {
        self.default = Some(d.into());
        self
    }
-    /// The prompt picks objects: a "Select objects" prompt, or a point prompt whose click selects
-    /// one object ("Select object to offset", "Select first line"…, the commands that pick a
-    /// single object themselves). The UI shows the pick box there.
+    /// The prompt picks objects: a "Select objects" prompt, one that says it picks a single object
+    /// ([`Prompt::picks_one`]), or a point prompt whose click selects one ("Select object to
+    /// offset", "Select first line"…, the commands that pick a single object themselves). The UI
+    /// shows the pick box there. The wording is only read where the engine wrote it: a routine
+    /// writes its own message (`raw`), which may open with "Select" and still ask for a point,
+    /// and says through `picks_one` when it picks instead (#1635 review).
    pub fn picks_objects(&self) -> bool {
-        self.accept.select || (self.accept.point && self.message.starts_with("Select"))
+        self.picks_one || self.accept.select || (self.accept.point && !self.raw && self.message.starts_with("Select"))
    }
    /// "Specify next point or [Undo/Close] <default>:".
    pub fn display(&self) -> String {
@@ -208,7 +208,7 @@ impl SpatialIndex {
        let pad = (b.width() + b.height()) * 1e-9 + (b.min.x.abs() + b.min.y.abs() + b.max.x.abs() + b.max.y.abs()) * 1e-12 + 1e-300;
        let env = AABB::from_corners([b.min.x - pad, b.min.y - pad], [b.max.x + pad, b.max.y + pad]);
        let mut out: Vec<u32> =
-            self.tree.locate_in_envelope_intersecting(&env).filter_map(|it| self.offsets.get(&it.data.0).map(|off| off + it.data.1)).collect();
+            self.tree.locate_in_envelope_intersecting(env).filter_map(|it| self.offsets.get(&it.data.0).map(|off| off + it.data.1)).collect();
        if with_infinite {
            out.extend_from_slice(&self.infinite);
        }
@@ -29,7 +29,7 @@ fn session() -> (Session, Handle) {
 /// As [`session`], with the fixture's text changed by `edit` first.
 fn session_with(edit: impl Fn(String) -> String) -> (Session, Handle) {
    let grip = "0 BLOCKLINEARGRIP\n5 68\n330 61\n100 AcDbEvalExpr\n90 9\n98 33\n99 232\n100 AcDbBlockElement\n300 End Grip\n98 33\n99 232\n1071 0\n";
-    let src = include_str!("../../io/tests/data/dynblock_door.txt")
+    let src = include_str!("../../../io/tests/data/dynblock_door.txt")
        .replace("\r\n", "\n")
        .replace("170 4\n91 0\n91 0\n", "170 4\n91 8\n91 9\n")
        .replace("1030 0\n93 0\n170 0\n171 0\n100 AcDbBlockVisibilityParameter", "1030 0\n93 10\n170 0\n171 0\n100 AcDbBlockVisibilityParameter")
--- a/Show More
+++ b/Show More