Fills: a gradient without stops takes them from its style, and keeps none when saved

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ATTRIBUTION.md

@@ -28,6 +28,8 @@ deck and UI icons are original work of the DeckCraft contributors (drawn or gene
 | `crates/media/tests/fixtures/clip-*` (`clip-h264.mp4`, `clip-h264.mov`, `clip-hevc.mp4`, `clip-vp9.webm`, `clip-av1.mkv`) | DeckCraft contributors | 6 frames of a colour gradient generated by `make.sh` (python3), encoded by ffmpeg (x264 / x265 / libvpx / SVT-AV1 as encoders only) | CC0-1.0 | Video decoding tests |
 | `crates/media/tests/fixtures/make.sh` | DeckCraft contributors | this repository | MIT OR Apache-2.0 | Regenerates the media fixtures |
 | `crates/render/tests/fixtures/colr-squares.ttf` | DeckCraft contributors | two squares as a COLRv0/CPAL test font, built by `make_colr_font.py` (fontTools as the builder only) | CC0-1.0 | Colour glyph rendering tests |
+| `crates/fonts/tests/fixtures/legacy-semibold.ttf` | DeckCraft contributors | a one-glyph Semibold face named like Segoe UI Semibold (its Windows family differs from the typographic one), built by `make_legacy_font.py` (fontTools as the builder only) | CC0-1.0 | Font lookup by Windows family name tests |
+| `crates/fonts/tests/fixtures/legacy-regular.ttf` | DeckCraft contributors | the same family's one-glyph Regular face, built by `make_legacy_font.py` (fontTools as the builder only) | CC0-1.0 | Font lookup by Windows family name tests |
 | `crates/render/tests/fixtures/make_colr_font.py` | DeckCraft contributors | this repository | MIT OR Apache-2.0 | Regenerates the COLR test font |
 
 ## Bundled through dependencies

Cargo.lock

@@ -1046,6 +1046,14 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "deckcraft-metafile"
+version = "0.6.1"
+dependencies = [
+ "kurbo",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "deckcraft-model"
 version = "0.6.1"
@@ -1103,6 +1111,7 @@ dependencies = [
  "deckcraft-color",
  "deckcraft-fonts",
  "deckcraft-geom",
+ "deckcraft-metafile",
  "deckcraft-model",
  "deckcraft-text",
  "image",

Cargo.toml

@@ -14,6 +14,7 @@ repository = "https://github.com/storytold/deckcraft"
 # internal
 deckcraft-geom = { path = "crates/geom" }
 deckcraft-color = { path = "crates/color" }
+deckcraft-metafile = { path = "crates/metafile" }
 deckcraft-model = { path = "crates/model" }
 deckcraft-fonts = { path = "crates/fonts" }
 deckcraft-text = { path = "crates/text" }

ROADMAP.md

@@ -128,6 +128,7 @@ app's JSON control channel (`deckcraft --control PORT`).
 
 | Date | What landed |
 |---|---|
+| 2026-10-12 | Objects off the slide show and can be selected and moved around it in Normal view, as in PowerPoint; the show, exports and thumbnails still clip to the slide (#270) |
 | 2026-10-12 | WordArt text warps (`prstTxWarp`): all 40 presets drawn, curves fitted to PowerPoint by observation; warp adjusts round-trip |
 | 2026-10-10 | Progress docs restructured to the craftrules standard; full re-measure (breadth 79%, ready ~55%, mainstream ~53%, essentials ~62%, alpha). Landed: Animation Painter (#54), Morph geometry outlines (#27), animated GIF playback (#39), hyperlink colour and following links in the show (#37, #45), date fields in their own format (#36), flipped shapes keep readable text (#35), show transition fix (#46), start screen from the Home button (#49), MCP export lists PDF (#65), OmaStore manifest (#57) |
 | 2026-10-09 | v0.4.0 released. UAX #9 bidi and Arabic shaping (#4), Morph with Words and Characters (#5), tables grow to fit and PDF cell text (#14), rotating log file (#7), DX12 default on Windows (#16), H.264/HEVC overflow hardening (#2), PPTX sniffing anywhere in the zip (#19) |

crates/engine/src/cmd/file.rs

@@ -79,7 +79,10 @@ pub fn open_presentation(name: &str, bytes: &[u8]) -> Result<Presentation> {
 
 pub fn add_opened(s: &mut Session, name: &str, path: Option<String>, p: Presentation) -> usize {
     let title = std::path::Path::new(name).file_stem().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| name.to_string());
-    s.add_document(DocState::new(p, path, title))
+    let missing_fonts = crate::fonts::missing_fonts(&p);
+    let mut st = DocState::new(p, path, title);
+    st.missing_fonts = missing_fonts;
+    s.add_document(st)
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -89,7 +92,8 @@ fn open(s: &mut Session, p: &Value) -> Result<Value> {
     let doc = open_presentation(path, &bytes)?;
     let native = deckcraft_format::sniff(&bytes) || deckcraft_pptx::sniff(&bytes);
     let i = add_opened(s, path, native.then(|| path.to_string()), doc);
-    Ok(json!({"document": i, "slides": s.doc()?.doc.slides.len()}))
+    let st = s.doc()?;
+    Ok(json!({"document": i, "slides": st.doc.slides.len(), "missingFonts": st.missing_fonts}))
 }
 #[cfg(target_arch = "wasm32")]
 fn open(_s: &mut Session, _p: &Value) -> Result<Value> {
@@ -101,7 +105,7 @@ fn open_bytes(s: &mut Session, p: &Value) -> Result<Value> {
     let data = str_param(p, "data").and_then(base64_decode).ok_or_else(|| bad("file.openBytes", "missing or invalid base64 `data`"))?;
     let doc = open_presentation(name, &data)?;
     let i = add_opened(s, name, None, doc);
-    Ok(json!({"document": i}))
+    Ok(json!({"document": i, "missingFonts": s.doc()?.missing_fonts}))
 }
 
 /// Encode the presentation in `format` (`deckcraft`, `pptx`, `outline`).

crates/engine/src/fonts.rs

@@ -0,0 +1,65 @@
+//! Fonts a presentation uses that this machine doesn't have, so opening it can say so (its text
+//! draws in a stand-in; see `FontDb::document_face`).
+
+use deckcraft_fonts::FontDb;
+use deckcraft_model::resolve::{self, Ctx};
+use deckcraft_model::text::{Bullet, TextBody};
+use deckcraft_model::{Presentation, Shape, ShapeKind};
+
+/// The font families the slides' text is drawn in (theme fonts resolved, bullet fonts included)
+/// that aren't installed or bundled, sorted, without duplicates (case-insensitive).
+pub fn missing_fonts(p: &Presentation) -> Vec<String> {
+    let db = FontDb::global();
+    let mut out: Vec<String> = Vec::new();
+    for family in used_fonts(p) {
+        if !db.has_family(&family) && !out.iter().any(|f| f.eq_ignore_ascii_case(&family)) {
+            out.push(family);
+        }
+    }
+    out.sort_by_key(|f| f.to_lowercase());
+    out
+}
+
+/// The families the slides' text runs and bullets are drawn in.
+fn used_fonts(p: &Presentation) -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+    let mut add = |f: String| {
+        let f = f.trim().to_string();
+        if !f.is_empty() && !out.iter().any(|o| o.eq_ignore_ascii_case(&f)) {
+            out.push(f);
+        }
+    };
+    for slide in &p.slides {
+        let Some(ctx) = Ctx::for_slide(p, slide) else { continue };
+        deckcraft_model::walk(&slide.shapes, &mut |s, _| {
+            if let Some(body) = &s.text {
+                body_fonts(&ctx, s, body, &mut add);
+            }
+            if let ShapeKind::Table(t) = &s.kind {
+                for cell in t.rows.iter().flat_map(|r| &r.cells) {
+                    body_fonts(&ctx, s, &cell.text, &mut add);
+                }
+            }
+        });
+    }
+    out
+}
+
+fn body_fonts(ctx: &Ctx, s: &Shape, body: &TextBody, add: &mut dyn FnMut(String)) {
+    for para in &body.paragraphs {
+        let has_text = para.runs.iter().any(|r| !r.text.trim().is_empty());
+        if !has_text {
+            continue;
+        }
+        for run in para.runs.iter().filter(|r| !r.text.trim().is_empty()) {
+            let r = resolve::run(ctx, s, para, &run.props);
+            add(resolve::font_family(ctx, &r));
+        }
+        let pp = resolve::para(ctx, s, para);
+        if matches!(pp.bullet, Some(Bullet::Char { .. }))
+            && let Some(f) = pp.bullet_font.as_deref()
+        {
+            add(ctx.master.theme.font(f));
+        }
+    }
+}

crates/engine/src/lib.rs

@@ -9,6 +9,7 @@
 
 pub mod cmd;
 pub mod connect;
+pub mod fonts;
 pub mod guard;
 pub mod keys;
 pub mod links;
@@ -141,6 +142,9 @@ pub struct DocState {
     pub interaction: Option<Interaction>,
     pub uid: u64,
     pub title: String,
+    /// Fonts the file's text uses that aren't installed, found when it was opened (empty for new
+    /// documents); the app mentions them once.
+    pub missing_fonts: Vec<String>,
 }
 
 static NEXT_UID: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
@@ -158,6 +162,7 @@ impl DocState {
             interaction: None,
             uid: NEXT_UID.fetch_add(1, std::sync::atomic::Ordering::Relaxed),
             title,
+            missing_fonts: Vec::new(),
         }
     }
     pub fn is_dirty(&self) -> bool {

crates/engine/src/tests.rs

@@ -504,6 +504,30 @@ fn hyperlink_on_a_word_or_shape_links_it() {
     assert!(s.doc().unwrap().current_slide().unwrap().shapes[0].click.is_some(), "a selected shape gets the link as its click action");
 }
 
+/// A .pptx (base64) whose first slide's title is set in `font`.
+fn deck_in_font(font: &str) -> String {
+    let mut p = deckcraft_model::Presentation::default();
+    let slide = std::sync::Arc::make_mut(&mut p.slides[0]);
+    let mut body = deckcraft_model::text::TextBody::from_text("Hello");
+    body.paragraphs[0].runs[0].props.font = Some(font.into());
+    slide.shapes[0].text = Some(body);
+    crate::cmd::base64_encode(&crate::cmd::file::save_bytes(&p, "pptx").unwrap())
+}
+
+#[test]
+fn opening_a_file_lists_the_fonts_it_uses_that_are_missing() {
+    let mut s = Session::with_new();
+    let r = s.execute("file.openBytes", &json!({"name": "a.pptx", "data": deck_in_font("Qqq Nonexistent Sans")})).unwrap();
+    assert_eq!(r["missingFonts"], json!(["Qqq Nonexistent Sans"]));
+    assert_eq!(s.doc().unwrap().missing_fonts, vec!["Qqq Nonexistent Sans".to_string()]);
+    // A font that is there (bundled or installed) isn't listed; new documents list nothing.
+    let have = deckcraft_fonts::FontDb::global().face(deckcraft_fonts::FALLBACK_FAMILY, "Regular").family.clone();
+    let r = s.execute("file.openBytes", &json!({"name": "b.pptx", "data": deck_in_font(&have)})).unwrap();
+    assert_eq!(r["missingFonts"], json!([]));
+    s.execute("file.new", &json!({})).unwrap();
+    assert!(s.doc().unwrap().missing_fonts.is_empty());
+}
+
 #[test]
 fn clicks_in_flipped_shapes_hit_the_text_where_it_is_drawn() {
     // Flips don't mirror text, so a click lands on the character drawn under it.
@@ -543,3 +567,42 @@ fn inserted_hyperlinks_look_like_links() {
     s.execute("format.underline", &json!({})).unwrap();
     assert_eq!(s.execute("format.state", &json!({})).unwrap()["underline"], false);
 }
+
+/// #270: shapes off the slide (in the editor's pasteboard) are hit, selected, moved and marqueed
+/// like any other; one can be dragged back onto the slide or out of it.
+#[test]
+fn shapes_off_the_slide_can_be_selected_and_moved() {
+    let mut s = session();
+    s.prefs.snap_to_grid = false;
+    s.prefs.smart_guides = false;
+    let off = s.execute("shape.insert", &json!({"preset": "rect", "rect": [1000.0, 100.0, 120.0, 80.0]})).unwrap()["id"].as_u64().unwrap();
+    let half = s.execute("shape.insert", &json!({"preset": "ellipse", "rect": [-60.0, 300.0, 120.0, 80.0]})).unwrap()["id"].as_u64().unwrap();
+    // Inserting off the slide keeps the box where it was asked for.
+    assert_eq!(s.execute("shape.inspect", &json!({"id": off})).unwrap()["box"]["x"], 1000.0);
+    s.execute("edit.select", &json!({"ids": []})).unwrap();
+    let ev = |kind, x, y| PointerEvent { kind, x, y, mods: Mods::default(), tol: 3.0 };
+    // Hover and click wholly off the slide.
+    assert!(matches!(s.hit_test(deckcraft_geom::Point::new(1060.0, 140.0), 3.0), Some(tools::Hit::Shape { id, .. }) if id.0 as u64 == off));
+    s.pointer(ev(PointerKind::Down, 1060.0, 140.0)).unwrap();
+    s.pointer(ev(PointerKind::Up, 1060.0, 140.0)).unwrap();
+    assert_eq!(s.doc().unwrap().selection.shapes.iter().map(|i| i.0 as u64).collect::<Vec<_>>(), vec![off]);
+    // Drag it further off, then back onto the slide.
+    s.pointer(ev(PointerKind::Down, 1060.0, 140.0)).unwrap();
+    s.pointer(ev(PointerKind::Drag, 1110.0, 160.0)).unwrap();
+    s.pointer(ev(PointerKind::Up, 1110.0, 160.0)).unwrap();
+    let v = s.execute("shape.inspect", &json!({"id": off})).unwrap();
+    assert_eq!((v["box"]["x"].as_f64(), v["box"]["y"].as_f64()), (Some(1050.0), Some(120.0)));
+    s.pointer(ev(PointerKind::Down, 1110.0, 160.0)).unwrap();
+    s.pointer(ev(PointerKind::Drag, 500.0, 160.0)).unwrap();
+    s.pointer(ev(PointerKind::Up, 500.0, 160.0)).unwrap();
+    assert_eq!(s.execute("shape.inspect", &json!({"id": off})).unwrap()["box"]["x"], 440.0);
+    // The off-slide half of a straddling shape is hit too.
+    s.pointer(ev(PointerKind::Down, -30.0, 340.0)).unwrap();
+    s.pointer(ev(PointerKind::Up, -30.0, 340.0)).unwrap();
+    assert_eq!(s.doc().unwrap().selection.shapes.iter().map(|i| i.0 as u64).collect::<Vec<_>>(), vec![half]);
+    // A marquee started on the pasteboard selects what it encloses there.
+    s.pointer(ev(PointerKind::Down, -100.0, 250.0)).unwrap();
+    s.pointer(ev(PointerKind::Drag, 80.0, 420.0)).unwrap();
+    s.pointer(ev(PointerKind::Up, 80.0, 420.0)).unwrap();
+    assert_eq!(s.doc().unwrap().selection.shapes.iter().map(|i| i.0 as u64).collect::<Vec<_>>(), vec![half]);
+}

crates/fonts/src/fontdb.rs

@@ -52,6 +52,53 @@ pub fn substitutes(family: &str) -> &'static [&'static str] {
     }
 }
 
+/// Families whose open substitutes ([`substitutes`]) keep their metrics, so text drawn with
+/// them breaks into the same lines.
+fn has_metric_twin(family: &str) -> bool {
+    matches!(
+        family.to_ascii_lowercase().as_str(),
+        "calibri" | "calibri light" | "cambria" | "cambria math" | "arial" | "helvetica" | "times new roman" | "times" | "courier new" | "courier"
+    )
+}
+
+/// The installed family PowerPoint draws a missing `family` with instead of Calibri: Liberation
+/// Sans and Serif as Arial and Times New Roman (observed in PowerPoint; Liberation Mono, Carlito,
+/// Caladea, Arimo and Tinos are not mapped and draw in Calibri), and Windows' standard font
+/// substitutes (Arial CE, Times New Roman CYR…).
+fn office_twin(family: &str) -> Option<&'static str> {
+    let f = family.to_ascii_lowercase();
+    Some(match f.as_str() {
+        "liberation sans" | "helvetica" | "helv" => "Arial",
+        "liberation serif" | "times" | "tms rmn" => "Times New Roman",
+        _ => {
+            let base = f
+                .strip_suffix(" baltic")
+                .or(f.strip_suffix(" ce"))
+                .or(f.strip_suffix(" cyr"))
+                .or(f.strip_suffix(" greek"))
+                .or(f.strip_suffix(" tur"))?;
+            match base {
+                "arial" => "Arial",
+                "courier new" => "Courier New",
+                "times new roman" => "Times New Roman",
+                _ => return None,
+            }
+        }
+    })
+}
+
+/// Office's downloadable (cloud) families: PowerPoint fetches them when a document uses them, so
+/// they draw as themselves there, not as Calibri. Without them DeckCraft keeps their closest open
+/// substitute ([`substitutes`]; Aptos as Inter).
+fn is_office_cloud_font(family: &str) -> bool {
+    let f = family.to_ascii_lowercase();
+    f.starts_with("aptos") || ["bierstadt", "grandview", "seaford", "skeena", "tenorite"].iter().any(|c| f.starts_with(c))
+}
+
+/// The family PowerPoint draws a document's Latin text in when the font it names isn't installed,
+/// whatever the theme, `panose` or `pitchFamily` say.
+pub const MISSING_FONT_FAMILY: &str = "Calibri";
+
 #[derive(Clone)]
 enum FontBytes {
     Static(&'static [u8]),
@@ -65,6 +112,10 @@ pub struct FontFace {
     pub family: String,
     /// Typographic style name (e.g. "Semibold", "Italic").
     pub style: String,
+    /// The Windows (GDI) family and style names (`name` IDs 1 and 2) when the family differs from
+    /// the typographic one: "Segoe UI Semibold" / "Regular" for Segoe UI Semibold. Documents name
+    /// fonts this way.
+    pub legacy: Option<(String, String)>,
     /// usWeightClass-style weight (400 = regular).
     pub weight: f32,
     pub italic: bool,
@@ -253,6 +304,11 @@ pub struct FontDb {
     /// scan, so what they find doesn't depend on what ran before them.
     #[cfg(not(target_arch = "wasm32"))]
     cataloged: std::sync::OnceLock<()>,
+    /// Families (lower case) whose cataloged files have all been loaded: a family's files load
+    /// together, so a lookup never settles for the one face another name loaded ("Segoe UI
+    /// Semibold" loads a face of the family "Segoe UI").
+    #[cfg(not(target_arch = "wasm32"))]
+    loaded_families: Mutex<std::collections::HashSet<String>>,
     /// System fallback state: enabled, and characters no system font covers.
     #[cfg(not(target_arch = "wasm32"))]
     sys: Mutex<SysFallback>,
@@ -316,6 +372,16 @@ fn face_names(f: &skrifa::FontRef<'_>) -> Option<(String, String)> {
     Some((family, style))
 }
 
+/// A face's Windows (GDI) family and style (`name` IDs 1 and 2) when that family differs from the
+/// typographic `family`.
+fn legacy_names(f: &skrifa::FontRef<'_>, family: &str) -> Option<(String, String)> {
+    let legacy = name(f, &[StringId::FAMILY_NAME])?;
+    if legacy.eq_ignore_ascii_case(family) {
+        return None;
+    }
+    Some((legacy, name(f, &[StringId::SUBFAMILY_NAME]).unwrap_or_else(|| "Regular".into())))
+}
+
 /// (family, style) of every face in the font file at `path`, reading only its table directories
 /// and `name` tables: a scan opens hundreds of font files, many of them megabytes long. A
 /// variable font is cataloged under its default style; its named instances appear once it loads.
@@ -362,8 +428,13 @@ fn file_face_names(path: &std::path::Path) -> Vec<(String, String)> {
                 font.extend_from_slice(&u32::to_be_bytes(v));
             }
             font.extend_from_slice(&table);
-            face_names(&skrifa::FontRef::new(&font).ok()?)
+            let f = skrifa::FontRef::new(&font).ok()?;
+            let (family, style) = face_names(&f)?;
+            // Cataloged under its Windows family too, so "Segoe UI Semibold" finds the file.
+            let legacy = legacy_names(&f, &family);
+            Some(std::iter::once((family, style)).chain(legacy))
         })
+        .flatten()
         .collect()
 }
 
@@ -379,6 +450,12 @@ pub fn system_font_dirs() -> Vec<std::path::PathBuf> {
         dirs.extend(["/System/Library/Fonts", "/Library/Fonts"].map(Into::into));
         if let Some(h) = &home {
             dirs.push(h.join("Library/Fonts"));
+            // Fonts Microsoft Office downloads on demand (Aptos…), used where Office put them.
+            dirs.push(h.join("Library/Group Containers/UBF8T346G9.Office/FontCache/4/CloudFonts"));
+        }
+        // Fonts Office installs inside its apps.
+        for app in ["Microsoft PowerPoint", "Microsoft Word", "Microsoft Excel"] {
+            dirs.push(std::path::PathBuf::from(format!("/Applications/{app}.app/Contents/Resources/DFonts")));
         }
         // Fonts macOS ships as assets (PingFang, Yu Mincho, …): com_apple_MobileAsset_Font<N>.
         for parent in ["/System/Library/AssetsV2", "/System/Library/AssetsV2/PreinstalledAssetsV2/InstallWithOs"] {
@@ -393,7 +470,11 @@ pub fn system_font_dirs() -> Vec<std::path::PathBuf> {
         let root = std::env::var_os("WINDIR").map(std::path::PathBuf::from).unwrap_or_else(|| "C:\\Windows".into());
         dirs.push(root.join("Fonts"));
         if let Some(l) = std::env::var_os("LOCALAPPDATA") {
-            dirs.push(std::path::PathBuf::from(l).join("Microsoft\\Windows\\Fonts"));
+            let l = std::path::PathBuf::from(l);
+            dirs.push(l.join("Microsoft\\Windows\\Fonts"));
+            // Fonts Microsoft Office downloads on demand (Aptos…), used where Office put them;
+            // DeckCraft never ships or needs them.
+            dirs.push(l.join("Microsoft\\FontCache\\4\\CloudFonts"));
         }
     } else {
         dirs.extend(["/usr/share/fonts", "/usr/local/share/fonts"].map(Into::into));
@@ -491,10 +572,12 @@ fn make_face(bytes: FontBytes, index: u32, family: String, style: String, coords
         .map(|v| v >= 0.5)
         .or(axis(b"slnt").map(|v| v.abs() > 0.1))
         .unwrap_or(!matches!(a.style, skrifa::attribute::Style::Normal) || style_italic(&style));
+    let legacy = if coords.is_empty() { legacy_names(&f, &family) } else { None };
     Some(FontFace {
         id: NEXT_ID.fetch_add(1, Ordering::Relaxed),
         family,
         style,
+        legacy,
         weight,
         italic,
         upem: m.units_per_em.max(1) as f64,
@@ -571,6 +654,8 @@ impl FontDb {
             #[cfg(not(target_arch = "wasm32"))]
             cataloged: std::sync::OnceLock::new(),
             #[cfg(not(target_arch = "wasm32"))]
+            loaded_families: Mutex::new(std::collections::HashSet::new()),
+            #[cfg(not(target_arch = "wasm32"))]
             sys: Mutex::new(SysFallback { enabled: true, ..Default::default() }),
         }
     }
@@ -676,6 +761,8 @@ impl FontDb {
     /// Returns the number of faces cataloged.
     #[cfg(not(target_arch = "wasm32"))]
     pub fn load_system_fonts(&self) -> usize {
+        // Families load again from the new catalog when next looked up.
+        self.loaded_families.lock().unwrap_or_else(|e| e.into_inner()).clear();
         // The first scan, or a rescan once it is done (never both at once).
         let mut first = None;
         self.cataloged.get_or_init(|| first = Some(self.scan_font_dirs()));
@@ -756,17 +843,35 @@ impl FontDb {
             .unwrap_or_else(last_resort_face)
     }
 
+    /// The face a document's text in `family` is drawn with, as PowerPoint draws it: the family
+    /// when it is installed or bundled, or a metric-compatible stand-in (Carlito for Calibri,
+    /// Liberation Sans for Arial…), or the family PowerPoint maps it to (Liberation Sans as Arial,
+    /// see `office_twin`); any other missing family is drawn in Calibri (or Carlito).
+    /// DeckCraft's own default family keeps [`FontDb::face`]'s fallbacks.
+    pub fn document_face(&self, family: &str, style: &str) -> Arc<FontFace> {
+        if family.eq_ignore_ascii_case(FALLBACK_FAMILY) || has_metric_twin(family) || is_office_cloud_font(family) || self.has_family(family) {
+            return self.face(family, style);
+        }
+        if let Some(twin) = office_twin(family) {
+            return self.face(twin, style);
+        }
+        self.face(MISSING_FONT_FAMILY, style)
+    }
+
     fn try_family(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
-        if let Some(f) = self.find(family, style) {
-            return Some(f);
-        }
+        // Every installed file of the family first, so the best style is among the candidates. The
+        // lock is held while the files load, so another thread looking up the family waits for
+        // them rather than finding none and falling back to another family.
         #[cfg(not(target_arch = "wasm32"))]
-        if self.load_cataloged(family)
-            && let Some(f) = self.find(family, style)
         {
-            return Some(f);
+            let mut loaded = self.loaded_families.lock().unwrap_or_else(|e| e.into_inner());
+            let key = family.to_lowercase();
+            if !loaded.contains(&key) {
+                self.load_cataloged(family);
+                loaded.insert(key);
+            }
         }
-        None
+        self.find(family, style)
     }
 
     /// Is `family` available (loaded, or installed on the system)?
@@ -782,7 +887,9 @@ impl FontDb {
     }
 
     pub(crate) fn is_loaded(&self, family: &str) -> bool {
-        self.read_faces().iter().any(|f| f.family.eq_ignore_ascii_case(family))
+        self.read_faces()
+            .iter()
+            .any(|f| f.family.eq_ignore_ascii_case(family) || f.legacy.as_ref().is_some_and(|(lf, _)| lf.eq_ignore_ascii_case(family)))
     }
 
     /// A variable font's axes: (tag, name, min, default, max), empty for static fonts.
@@ -837,11 +944,27 @@ impl FontDb {
             return self.instance(family, style);
         }
         let faces = self.read_faces();
-        let cands: Vec<&Arc<FontFace>> = faces.iter().filter(|f| f.family.eq_ignore_ascii_case(family)).collect();
+        let mut cands: Vec<&Arc<FontFace>> = faces.iter().filter(|f| f.family.eq_ignore_ascii_case(family)).collect();
+        let ns = norm(style);
+        if cands.is_empty() {
+            // A Windows family name ("Segoe UI Semibold", "Arial Black"): its faces, matched by
+            // their Windows style ("Regular", "Bold"…).
+            cands = faces.iter().filter(|f| f.legacy.as_ref().is_some_and(|(lf, _)| lf.eq_ignore_ascii_case(family))).collect();
+            if let Some(f) = cands.iter().find(|f| f.legacy.as_ref().is_some_and(|(_, ls)| norm(ls) == ns)) {
+                return Some((*f).clone());
+            }
+            // Bold of a family that is itself a weight (Semibold, Light): the face, made bolder
+            // by the caller, as Windows does, rather than a face of another weight.
+            if let Some(f) = cands
+                .iter()
+                .find(|f| f.legacy.as_ref().is_some_and(|(_, ls)| norm(ls) == norm(if style_italic(style) { "Italic" } else { "Regular" })))
+            {
+                return Some((*f).clone());
+            }
+        }
         if cands.is_empty() {
             return None;
         }
-        let ns = norm(style);
         if let Some(f) = cands.iter().find(|f| norm(&f.style) == ns) {
             return Some((*f).clone());
         }

crates/fonts/src/lib.rs

@@ -14,7 +14,9 @@ pub mod script;
 mod shape;
 
 pub use fallback::{bundled_families, covers_cluster, is_emoji_cluster, ligature_carets};
-pub use fontdb::{FALLBACK_FAMILY, FaceRef, FontDb, FontFace, LAST_RESORT_FAMILY, base_style, bundled, substitutes, system_font_dirs};
+pub use fontdb::{
+    FALLBACK_FAMILY, FaceRef, FontDb, FontFace, LAST_RESORT_FAMILY, MISSING_FONT_FAMILY, base_style, bundled, substitutes, system_font_dirs,
+};
 pub use harfrust::Feature;
 use harfrust::Tag;
 pub use kurbo::BezPath;
@@ -182,6 +184,65 @@ mod tests {
         assert!(!shape(&f, "Hello", &[], |c| c).is_empty());
     }
 
+    #[test]
+    fn windows_family_names_find_their_faces() {
+        // Documents name fonts by their Windows family ("Segoe UI Semibold"); the font's
+        // typographic family is "Segoe UI" with a "Semibold" style. The fixture is named the same way.
+        let check = |db: &FontDb| {
+            assert!(db.has_family("DeckCraft Legacy Semibold"));
+            for style in ["Regular", "Bold"] {
+                let f = db.face("DeckCraft Legacy Semibold", style);
+                assert_eq!((f.family.as_str(), f.style.as_str()), ("DeckCraft Legacy", "Semibold"), "{style}");
+            }
+            assert_eq!(db.document_face("DeckCraft Legacy Semibold", "Regular").family, "DeckCraft Legacy", "installed, so not Calibri");
+            // The typographic name still works.
+            assert_eq!(db.face("DeckCraft Legacy", "Semibold").style, "Semibold");
+        };
+        // Loaded directly…
+        let db = FontDb::with_font_dirs(Vec::new());
+        db.set_system_fallback(false);
+        assert_eq!(db.add_font(include_bytes!("../tests/fixtures/legacy-semibold.ttf").to_vec()), 1);
+        check(&db);
+        // …and found by the system font scan under its Windows name, then loaded.
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures");
+            let db = FontDb::with_font_dirs(vec![dir.clone()]);
+            db.set_system_fallback(false);
+            check(&db);
+            // Looking up the Windows name loads the Semibold file only; a later lookup of the
+            // family's Regular must still load and pick the Regular file, not settle for Semibold.
+            let db = FontDb::with_font_dirs(vec![dir]);
+            db.set_system_fallback(false);
+            assert_eq!(db.face("DeckCraft Legacy Semibold", "Regular").style, "Semibold");
+            let regular = db.face("DeckCraft Legacy", "Regular");
+            assert_eq!((regular.style.as_str(), regular.weight), ("Regular", 400.0));
+        }
+    }
+
+    #[test]
+    fn missing_document_fonts_are_drawn_in_calibri() {
+        // PowerPoint draws a missing family in Calibri, whatever its panose or the theme says.
+        let db = FontDb::global();
+        for missing in ["Qqq Nonexistent", "Avenir Next Qqq", "", "Arimo Qqq"] {
+            let f = db.document_face(missing, "Bold");
+            assert_eq!(f.family, db.face(MISSING_FONT_FAMILY, "Bold").family, "{missing:?}");
+        }
+        // PowerPoint's own twins and Windows' substitutes, when the font itself is missing.
+        for (missing, twin) in
+            [("Liberation Sans", "Arial"), ("Liberation Serif", "Times New Roman"), ("Arial CE", "Arial"), ("Times New Roman CYR", "Times New Roman")]
+        {
+            if !db.has_family(missing) {
+                assert_eq!(db.document_face(missing, "Regular").family, db.face(twin, "Regular").family, "{missing}");
+            }
+        }
+        // Metric-compatible stand-ins and DeckCraft's default keep their own fallbacks.
+        // So do Office's cloud fonts, which PowerPoint downloads and draws as themselves.
+        for kept in ["Arial", "Times New Roman", "Cambria", "Courier New", FALLBACK_FAMILY, "Aptos", "Aptos Display", "Grandview"] {
+            assert_eq!(db.document_face(kept, "Regular").family, db.face(kept, "Regular").family, "{kept}");
+        }
+    }
+
     #[test]
     fn office_fonts_have_substitutes() {
         assert!(substitutes("Calibri").contains(&"Carlito"));

crates/fonts/tests/fixtures/make_legacy_font.py

@@ -0,0 +1,55 @@
+"""Build the legacy-name test font: DeckCraft Legacy Semibold (contributor-original, CC0-1.0).
+
+Usage: python make_legacy_font.py legacy-semibold.ttf legacy-regular.ttf  (needs fontTools)
+
+legacy-semibold.ttf: typographic family "DeckCraft Legacy", style "Semibold" (name IDs 16/17,
+weight 600); Windows family "DeckCraft Legacy Semibold", style "Regular" (name IDs 1/2), as fonts
+like Segoe UI Semibold are named. legacy-regular.ttf: the family's Regular ("DeckCraft Legacy",
+"Regular", weight 400), named only by IDs 1/2 as Segoe UI's regular file is. Glyphs: .notdef and
+a square for "A".
+"""
+import sys
+
+from fontTools.fontBuilder import FontBuilder
+from fontTools.pens.ttGlyphPen import TTGlyphPen
+
+
+def square():
+    pen = TTGlyphPen(None)
+    pen.moveTo((100, 0))
+    pen.lineTo((100, 700))
+    pen.lineTo((600, 700))
+    pen.lineTo((600, 0))
+    pen.closePath()
+    return pen.glyph()
+
+
+def build(path, names, weight):
+    fb = FontBuilder(1000, isTTF=True)
+    fb.setupGlyphOrder([".notdef", "A"])
+    fb.setupCharacterMap({ord("A"): "A"})
+    fb.setupGlyf({".notdef": TTGlyphPen(None).glyph(), "A": square()})
+    fb.setupHorizontalMetrics({".notdef": (500, 0), "A": (700, 100)})
+    fb.setupHorizontalHeader(ascent=800, descent=-200)
+    fb.setupNameTable(names)
+    fb.setupOS2(usWeightClass=weight, sTypoAscender=800, sTypoDescender=-200, usWinAscent=800, usWinDescent=200)
+    fb.setupPost()
+    fb.save(path)
+
+
+build(sys.argv[1], {
+    "familyName": "DeckCraft Legacy Semibold",
+    "styleName": "Regular",
+    "typographicFamily": "DeckCraft Legacy",
+    "typographicSubfamily": "Semibold",
+    "uniqueFontIdentifier": "DeckCraft Legacy Semibold",
+    "fullName": "DeckCraft Legacy Semibold",
+    "psName": "DeckCraftLegacy-Semibold",
+}, 600)
+build(sys.argv[2], {
+    "familyName": "DeckCraft Legacy",
+    "styleName": "Regular",
+    "uniqueFontIdentifier": "DeckCraft Legacy Regular",
+    "fullName": "DeckCraft Legacy",
+    "psName": "DeckCraftLegacy-Regular",
+}, 400)

crates/geom/src/preset.rs

@@ -9,6 +9,8 @@
 use kurbo::{Arc, BezPath, Point, Rect, Shape as _, Vec2};
 use serde::{Deserialize, Serialize};
 
+mod extra;
+
 /// How a sub-path is filled. `Lighten`/`Darken` variants shade the shape's fill (3-D looking faces).
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -148,6 +150,7 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("bentConnector3", "Connector: Elbow", Lines, [50000]),
     p!("curvedConnector3", "Connector: Curved", Lines, [50000]),
     p!("bentConnector2", "Connector: Elbow (one bend)", Lines, []),
+    p!("lineInv", "Line: Rising", Lines, []),
     p!("rect", "Rectangle", Rectangles, []),
     p!("roundRect", "Rectangle: Rounded Corners", Rectangles, [16667]),
     p!("snip1Rect", "Rectangle: Single Corner Snipped", Rectangles, [16667]),
@@ -163,6 +166,7 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("rtTriangle", "Right Triangle", BasicShapes, []),
     p!("parallelogram", "Parallelogram", BasicShapes, [25000]),
     p!("trapezoid", "Trapezoid", BasicShapes, [25000]),
+    p!("nonIsoscelesTrapezoid", "Trapezoid: Uneven Sides", BasicShapes, [25000, 25000]),
     p!("diamond", "Diamond", BasicShapes, []),
     p!("pentagon", "Regular Pentagon", BasicShapes, []),
     p!("hexagon", "Hexagon", BasicShapes, [25000]),
@@ -171,9 +175,13 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("decagon", "Decagon", BasicShapes, []),
     p!("dodecagon", "Dodecagon", BasicShapes, []),
     p!("pie", "Partial Circle", BasicShapes, [0, 16200000]),
+    p!("pieWedge", "Quarter Wedge", BasicShapes, []),
     p!("chord", "Chord", BasicShapes, [2700000, 16200000]),
     p!("teardrop", "Teardrop", BasicShapes, [100000]),
     p!("frame", "Frame", BasicShapes, [12500]),
+    p!("cornerTabs", "Corner Tabs: Triangles", BasicShapes, []),
+    p!("squareTabs", "Corner Tabs: Squares", BasicShapes, []),
+    p!("plaqueTabs", "Corner Tabs: Quarter Circles", BasicShapes, []),
     p!("halfFrame", "Half Frame", BasicShapes, [33333, 33333]),
     p!("corner", "L-Shape", BasicShapes, [50000, 50000]),
     p!("diagStripe", "Diagonal Stripe", BasicShapes, [50000]),
@@ -192,6 +200,9 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("sun", "Sun", BasicShapes, [25000]),
     p!("moon", "Moon", BasicShapes, [50000]),
     p!("cloud", "Cloud", BasicShapes, []),
+    p!("gear6", "Gear: 6 Teeth", BasicShapes, [15000, 3526]),
+    p!("gear9", "Gear: 9 Teeth", BasicShapes, [10000, 1763]),
+    p!("funnel", "Funnel", BasicShapes, []),
     p!("arc", "Arc", BasicShapes, [16200000, 0]),
     p!("bracketPair", "Double Bracket", BasicShapes, [16667]),
     p!("bracePair", "Double Brace", BasicShapes, [8333]),
@@ -199,6 +210,9 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("rightBracket", "Right Bracket", BasicShapes, [8333]),
     p!("leftBrace", "Left Brace", BasicShapes, [8333, 50000]),
     p!("rightBrace", "Right Brace", BasicShapes, [8333, 50000]),
+    p!("chartX", "Chart Marker: Cross Lines", BasicShapes, []),
+    p!("chartStar", "Chart Marker: Star Lines", BasicShapes, []),
+    p!("chartPlus", "Chart Marker: Plus Lines", BasicShapes, []),
     p!("rightArrow", "Arrow: Right", BlockArrows, [50000, 50000]),
     p!("leftArrow", "Arrow: Left", BlockArrows, [50000, 50000]),
     p!("upArrow", "Arrow: Up", BlockArrows, [50000, 50000]),
@@ -209,16 +223,27 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("leftRightUpArrow", "Arrow: Left-Right-Up", BlockArrows, [25000, 25000, 25000]),
     p!("bentArrow", "Arrow: Bent", BlockArrows, [25000, 25000, 25000, 43750]),
     p!("uturnArrow", "Arrow: U-Turn", BlockArrows, [25000, 25000, 25000, 43750, 75000]),
+    p!("curvedRightArrow", "Arrow: Curved Right", BlockArrows, [25000, 50000, 25000]),
+    p!("curvedLeftArrow", "Arrow: Curved Left", BlockArrows, [25000, 50000, 25000]),
+    p!("curvedUpArrow", "Arrow: Curved Up", BlockArrows, [25000, 50000, 25000]),
+    p!("curvedDownArrow", "Arrow: Curved Down", BlockArrows, [25000, 50000, 25000]),
     p!("leftUpArrow", "Arrow: Left-Up", BlockArrows, [25000, 25000, 25000]),
     p!("bentUpArrow", "Arrow: Bent-Up", BlockArrows, [25000, 25000, 25000]),
     p!("stripedRightArrow", "Arrow: Striped Right", BlockArrows, [50000, 50000]),
     p!("notchedRightArrow", "Arrow: Notched Right", BlockArrows, [50000, 50000]),
     p!("homePlate", "Arrow: Pentagon", BlockArrows, [50000]),
     p!("chevron", "Arrow: Chevron", BlockArrows, [50000]),
+    p!("circularArrow", "Arrow: Circular", BlockArrows, [12500, 1142319, 20457681, 10800000, 12500]),
+    p!("leftCircularArrow", "Arrow: Circular Counter-clockwise", BlockArrows, [12500, -1142319, 1142319, 10800000, 12500]),
+    p!("leftRightCircularArrow", "Arrow: Circular Two-headed", BlockArrows, [12500, 1142319, 20457681, 11942319, 12500]),
+    p!("swooshArrow", "Arrow: Swoosh", BlockArrows, [25000, 16667]),
     p!("rightArrowCallout", "Callout: Right Arrow", BlockArrows, [25000, 25000, 25000, 64977]),
     p!("downArrowCallout", "Callout: Down Arrow", BlockArrows, [25000, 25000, 25000, 64977]),
     p!("leftArrowCallout", "Callout: Left Arrow", BlockArrows, [25000, 25000, 25000, 64977]),
     p!("upArrowCallout", "Callout: Up Arrow", BlockArrows, [25000, 25000, 25000, 64977]),
+    p!("leftRightArrowCallout", "Callout: Left-Right Arrow", BlockArrows, [25000, 25000, 25000, 48123]),
+    p!("upDownArrowCallout", "Callout: Up-Down Arrow", BlockArrows, [25000, 25000, 25000, 48123]),
+    p!("quadArrowCallout", "Callout: Quad Arrow", BlockArrows, [18515, 18515, 18515, 48123]),
     p!("mathPlus", "Plus Sign", EquationShapes, [23520]),
     p!("mathMinus", "Minus Sign", EquationShapes, [23520]),
     p!("mathMultiply", "Multiplication Sign", EquationShapes, [23520]),
@@ -253,6 +278,7 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("flowChartMagneticDisk", "Flowchart: Magnetic Disk", Flowchart, []),
     p!("flowChartMagneticDrum", "Flowchart: Direct Access Storage", Flowchart, []),
     p!("flowChartDisplay", "Flowchart: Display", Flowchart, []),
+    p!("flowChartOfflineStorage", "Flowchart: Offline Storage", Flowchart, []),
     p!("irregularSeal1", "Explosion: 8 Points", StarsAndBanners, []),
     p!("irregularSeal2", "Explosion: 14 Points", StarsAndBanners, []),
     p!("star4", "Star: 4 Points", StarsAndBanners, [12500]),
@@ -267,6 +293,9 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("star32", "Star: 32 Points", StarsAndBanners, [37500]),
     p!("ribbon2", "Ribbon: Tilted Up", StarsAndBanners, [16667, 50000]),
     p!("ribbon", "Ribbon: Tilted Down", StarsAndBanners, [16667, 50000]),
+    p!("ellipseRibbon2", "Ribbon: Curved and Tilted Up", StarsAndBanners, [25000, 50000, 12500]),
+    p!("ellipseRibbon", "Ribbon: Curved and Tilted Down", StarsAndBanners, [25000, 50000, 12500]),
+    p!("leftRightRibbon", "Ribbon: Left-Right Fold", StarsAndBanners, [50000, 50000, 16667]),
     p!("verticalScroll", "Scroll: Vertical", StarsAndBanners, [12500]),
     p!("horizontalScroll", "Scroll: Horizontal", StarsAndBanners, [12500]),
     p!("wave", "Wave", StarsAndBanners, [12500, 0]),
@@ -276,6 +305,22 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("wedgeEllipseCallout", "Speech Bubble: Oval", Callouts, [-20833, 62500]),
     p!("cloudCallout", "Thought Bubble: Cloud", Callouts, [-20833, 62500]),
     p!("borderCallout1", "Callout: Line", Callouts, [18750, -8333, 112500, -38333]),
+    p!("borderCallout2", "Callout: Bent Line", Callouts, [18750, -8333, 18750, -16667, 112500, -46667]),
+    p!("borderCallout3", "Callout: Double Bent Line", Callouts, [18750, -8333, 18750, -16667, 100000, -16667, 112963, -8333]),
+    p!("accentCallout1", "Callout: Line with Accent Bar", Callouts, [18750, -8333, 112500, -38333]),
+    p!("accentCallout2", "Callout: Bent Line with Accent Bar", Callouts, [18750, -8333, 18750, -16667, 112500, -46667]),
+    p!("accentCallout3", "Callout: Double Bent Line with Accent Bar", Callouts, [18750, -8333, 18750, -16667, 100000, -16667, 112963, -8333]),
+    p!("callout1", "Callout: Line with No Border", Callouts, [18750, -8333, 112500, -38333]),
+    p!("callout2", "Callout: Bent Line with No Border", Callouts, [18750, -8333, 18750, -16667, 112500, -46667]),
+    p!("callout3", "Callout: Double Bent Line with No Border", Callouts, [18750, -8333, 18750, -16667, 100000, -16667, 112963, -8333]),
+    p!("accentBorderCallout1", "Callout: Line with Border and Accent Bar", Callouts, [18750, -8333, 112500, -38333]),
+    p!("accentBorderCallout2", "Callout: Bent Line with Border and Accent Bar", Callouts, [18750, -8333, 18750, -16667, 112500, -46667]),
+    p!(
+        "accentBorderCallout3",
+        "Callout: Double Bent Line with Border and Accent Bar",
+        Callouts,
+        [18750, -8333, 18750, -16667, 100000, -16667, 112963, -8333]
+    ),
     p!("actionButtonBackPrevious", "Action Button: Go Back or Previous", ActionButtons, []),
     p!("actionButtonForwardNext", "Action Button: Go Forward or Next", ActionButtons, []),
     p!("actionButtonBeginning", "Action Button: Go to Beginning", ActionButtons, []),
@@ -1535,7 +1580,7 @@ pub fn build(name: &str, w: f64, h: f64, adj: &[f64]) -> Option<Geometry> {
             let l = Pb::new().m(0.0, 0.0).c(x / 2.0, 0.0, x, h / 4.0, x, h / 2.0).c(x, h * 0.75, (x + w) / 2.0, h, w, h).take();
             Geometry { paths: vec![stroke_only(l)], text_rect: full, handles: vec![], sites: vec![Point::ZERO, Point::new(w, h)] }
         }
-        _ => return None,
+        _ => return extra::build(name, w, h, &a),
     };
     Some(g)
 }

crates/geom/src/preset/extra.rs

@@ -0,0 +1,796 @@
+//! More preset outlines: line callouts, arrow callouts, curved and circular arrows, curved
+//! ribbons, gears, tabs and chart markers. Like the rest of `preset`, every outline is our own
+//! construction, fitted to how the shapes look and to what their adjust values mean.
+
+use super::*;
+
+/// Builds the presets this module knows; `None` for any other name.
+pub(super) fn build(name: &str, w: f64, h: f64, a: &dyn Fn(usize) -> f64) -> Option<Geometry> {
+    let ss = w.min(h);
+    let full = Rect::new(0.0, 0.0, w, h);
+    let mut b = Pb::new();
+    let g = match name {
+        "lineInv" => {
+            let l = b.m(0.0, h).l(w, 0.0).take();
+            Geometry { paths: vec![stroke_only(l)], text_rect: full, handles: vec![], sites: vec![Point::new(0.0, h), Point::new(w, 0.0)] }
+        }
+        "nonIsoscelesTrapezoid" => {
+            let max = 50000.0 * w / ss.max(1e-9);
+            let (v1, v2) = (a(0).clamp(0.0, max), a(1).clamp(0.0, max));
+            let (d1, d2) = (ss * v1 / 1e5, ss * v2 / 1e5);
+            let mut g = simple(b.poly(&[(0.0, h), (d1, 0.0), (w - d2, 0.0), (w, h)]).take(), Rect::new(d1 * 0.66, h * 0.2, w - d2 * 0.66, h), w, h);
+            g.handles.push(Handle::new(0, Point::ZERO, Vec2::new(ss / 1e5, 0.0), v1, 0.0, max));
+            g.handles.push(Handle::new(1, Point::new(w, 0.0), Vec2::new(-ss / 1e5, 0.0), v2, 0.0, max));
+            g
+        }
+        "pieWedge" => {
+            b.m(0.0, h).arc(w, h, 180.0, 90.0).l(w, h).z();
+            simple(b.take(), Rect::new(w * 0.29289, h * 0.29289, w, h), w, h)
+        }
+        "flowChartOfflineStorage" => {
+            let tri = b.poly(&[(0.0, 0.0), (w, 0.0), (w / 2.0, h)]).take();
+            let bar = Pb::new().m(w * 0.4, h * 0.8).l(w * 0.6, h * 0.8).take();
+            Geometry {
+                paths: vec![fill(tri), stroke_only(bar)],
+                text_rect: Rect::new(w / 4.0, 0.0, w * 0.75, h * 0.8),
+                handles: vec![],
+                sites: vec![Point::new(w / 2.0, 0.0), Point::new(w / 4.0, h / 2.0), Point::new(w / 2.0, h), Point::new(w * 0.75, h / 2.0)],
+            }
+        }
+        "chartX" | "chartStar" | "chartPlus" => {
+            let body = corner_rect(w, h, [Corner::Square; 4]);
+            let mut l = Pb::new();
+            if name != "chartPlus" {
+                l.m(0.0, 0.0).l(w, h).m(0.0, h).l(w, 0.0);
+            }
+            if name != "chartX" {
+                l.m(w / 2.0, 0.0).l(w / 2.0, h);
+            }
+            if name == "chartPlus" {
+                l.m(0.0, h / 2.0).l(w, h / 2.0);
+            }
+            Geometry { paths: vec![fill_only(body), stroke_only(l.take())], text_rect: full, handles: vec![], sites: mid_sites(w, h) }
+        }
+        "cornerTabs" | "squareTabs" | "plaqueTabs" => {
+            // Each tab's size is a twentieth of the diagonal.
+            let d = (w.hypot(h) / 20.0).min(w / 2.0).min(h / 2.0);
+            match name {
+                "cornerTabs" => {
+                    b.poly(&[(0.0, 0.0), (d, 0.0), (0.0, d)]);
+                    b.poly(&[(w - d, 0.0), (w, 0.0), (w, d)]);
+                    b.poly(&[(w, h - d), (w, h), (w - d, h)]);
+                    b.poly(&[(0.0, h - d), (d, h), (0.0, h)]);
+                }
+                "squareTabs" => {
+                    b.poly(&[(0.0, 0.0), (d, 0.0), (d, d), (0.0, d)]);
+                    b.poly(&[(w - d, 0.0), (w, 0.0), (w, d), (w - d, d)]);
+                    b.poly(&[(w - d, h - d), (w, h - d), (w, h), (w - d, h)]);
+                    b.poly(&[(0.0, h - d), (d, h - d), (d, h), (0.0, h)]);
+                }
+                _ => {
+                    if d > 0.0 {
+                        b.m(0.0, 0.0).l(d, 0.0).arc(d, d, 0.0, 90.0).z();
+                        b.m(w, 0.0).l(w, d).arc(d, d, 90.0, 90.0).z();
+                        b.m(w, h).l(w - d, h).arc(d, d, 180.0, 90.0).z();
+                        b.m(0.0, h).l(0.0, h - d).arc(d, d, 270.0, 90.0).z();
+                    } else {
+                        b.m(0.0, 0.0).z();
+                    }
+                }
+            }
+            Geometry { paths: vec![fill(b.take())], text_rect: full.inset(-d), handles: vec![], sites: mid_sites(w, h) }
+        }
+        "callout1"
+        | "callout2"
+        | "callout3"
+        | "accentCallout1"
+        | "accentCallout2"
+        | "accentCallout3"
+        | "borderCallout2"
+        | "borderCallout3"
+        | "accentBorderCallout1"
+        | "accentBorderCallout2"
+        | "accentBorderCallout3" => {
+            let n = match name.chars().last() {
+                Some('2') => 2,
+                Some('3') => 3,
+                _ => 1,
+            };
+            line_callout(w, h, a, n + 1, name.starts_with("accent"), name.contains("order"))
+        }
+        "leftRightArrowCallout" | "upDownArrowCallout" => {
+            let vertical = name == "upDownArrowCallout";
+            let (l, t) = if vertical { (h, w) } else { (w, h) };
+            let ss = l.min(t);
+            let head = (ss * a(1).max(0.0) / 1e5).min(t / 2.0);
+            let shaft = (ss * a(0).max(0.0) / 1e5).min(head * 2.0);
+            let hl = (ss * a(2).max(0.0) / 1e5).min(l / 2.0);
+            let boxl = (l * a(3).max(0.0) / 1e5).min(l - 2.0 * hl);
+            let (c, b0, b1) = (t / 2.0, (l - boxl) / 2.0, (l + boxl) / 2.0);
+            let pts = [
+                (0.0, c),
+                (hl, c - head),
+                (hl, c - shaft / 2.0),
+                (b0, c - shaft / 2.0),
+                (b0, 0.0),
+                (b1, 0.0),
+                (b1, c - shaft / 2.0),
+                (l - hl, c - shaft / 2.0),
+                (l - hl, c - head),
+                (l, c),
+                (l - hl, c + head),
+                (l - hl, c + shaft / 2.0),
+                (b1, c + shaft / 2.0),
+                (b1, t),
+                (b0, t),
+                (b0, c + shaft / 2.0),
+                (hl, c + shaft / 2.0),
+                (hl, c + head),
+            ];
+            let d = if vertical { Dir::Down } else { Dir::Right };
+            let pts = orient(d, w, h, &pts);
+            let tr = orient(d, w, h, &[(b0, 0.0), (b1, t)]);
+            simple(b.poly(&pts).take(), Rect::from_points(Point::new(tr[0].0, tr[0].1), Point::new(tr[1].0, tr[1].1)).abs(), w, h)
+        }
+        "quadArrowCallout" => {
+            let head = (ss * a(1).max(0.0) / 1e5).min(ss / 2.0);
+            let shaft = (ss * a(0).max(0.0) / 1e5).min(head * 2.0);
+            let hl = (ss * a(2).max(0.0) / 1e5).min(ss / 2.0);
+            let k = a(3).clamp(0.0, 100000.0) / 1e5;
+            let (bw, bh) = ((w * k).min(w - 2.0 * hl).max(shaft), (h * k).min(h - 2.0 * hl).max(shaft));
+            let (cx, cy) = (w / 2.0, h / 2.0);
+            let (bx0, bx1, by0, by1) = (cx - bw / 2.0, cx + bw / 2.0, cy - bh / 2.0, cy + bh / 2.0);
+            let (s2, hd) = (shaft / 2.0, head);
+            let pts = [
+                (0.0, cy),
+                (hl, cy - hd),
+                (hl, cy - s2),
+                (bx0, cy - s2),
+                (bx0, by0),
+                (cx - s2, by0),
+                (cx - s2, hl),
+                (cx - hd, hl),
+                (cx, 0.0),
+                (cx + hd, hl),
+                (cx + s2, hl),
+                (cx + s2, by0),
+                (bx1, by0),
+                (bx1, cy - s2),
+                (w - hl, cy - s2),
+                (w - hl, cy - hd),
+                (w, cy),
+                (w - hl, cy + hd),
+                (w - hl, cy + s2),
+                (bx1, cy + s2),
+                (bx1, by1),
+                (cx + s2, by1),
+                (cx + s2, h - hl),
+                (cx + hd, h - hl),
+                (cx, h),
+                (cx - hd, h - hl),
+                (cx - s2, h - hl),
+                (cx - s2, by1),
+                (bx0, by1),
+                (bx0, cy + s2),
+                (hl, cy + s2),
+                (hl, cy + hd),
+            ];
+            simple(b.poly(&pts).take(), Rect::new(bx0, by0, bx1, by1), w, h)
+        }
+        "curvedRightArrow" | "curvedLeftArrow" | "curvedUpArrow" | "curvedDownArrow" => curved_arrow(name, w, h, a(0), a(1), a(2)),
+        "swooshArrow" => swoosh(w, h, a(0), a(1)),
+        "ellipseRibbon" | "ellipseRibbon2" => ellipse_ribbon(name == "ellipseRibbon2", w, h, a(0), a(1), a(2)),
+        "leftRightRibbon" => left_right_ribbon(w, h, a(0), a(1), a(2)),
+        "gear6" | "gear9" => gear(if name == "gear6" { 6 } else { 9 }, w, h, a(0), a(1)),
+        "funnel" => funnel(w, h),
+        "circularArrow" | "leftCircularArrow" | "leftRightCircularArrow" => circular_arrow(name, w, h, [a(0), a(1), a(2), a(3), a(4)]),
+        _ => return None,
+    };
+    Some(g)
+}
+
+/// An ellipse-centred frame for the circular arrows: the band's middle runs on the ellipse
+/// `(rx, ry)`, its edges `th/2` either side.
+struct Ring {
+    c: Point,
+    rx: f64,
+    ry: f64,
+    th: f64,
+    hw: f64,
+}
+
+impl Ring {
+    /// The point at visual angle `deg` on the ellipse grown by `d`.
+    fn at(&self, deg: f64, d: f64) -> Point {
+        let (ax, ay) = ((self.rx + d).max(0.0), (self.ry + d).max(0.0));
+        let t = vis(deg, ax, ay).to_radians();
+        Point::new(self.c.x + ax * t.cos(), self.c.y + ay * t.sin())
+    }
+    /// Parametric angle (degrees) of `p` on the ellipse grown by `d`.
+    fn param(&self, p: Point, d: f64) -> f64 {
+        let (ax, ay) = ((self.rx + d).max(1e-9), (self.ry + d).max(1e-9));
+        ((p.y - self.c.y) / ay).atan2((p.x - self.c.x) / ax).to_degrees()
+    }
+    /// Where the line `b + s·u` meets the ellipse grown by `d`, taking the crossing nearest `b`
+    /// on the side `sign` (+1 outwards, −1 inwards).
+    fn cross(&self, b: Point, u: Vec2, d: f64, sign: f64) -> Point {
+        let (ax, ay) = ((self.rx + d).max(1e-9), (self.ry + d).max(1e-9));
+        let (px, py) = ((b.x - self.c.x) / ax, (b.y - self.c.y) / ay);
+        let (ux, uy) = (u.x / ax, u.y / ay);
+        let qa = ux * ux + uy * uy;
+        let qb = 2.0 * (px * ux + py * uy);
+        let qc = px * px + py * py - 1.0;
+        let disc = qb * qb - 4.0 * qa * qc;
+        if qa < 1e-18 || disc < 0.0 {
+            // The line misses (a long head on a thin ring): the edge then carries on from the
+            // base centre itself, as the reference does.
+            return b;
+        }
+        let r = disc.sqrt();
+        let (s0, s1) = ((-qb - r) / (2.0 * qa), (-qb + r) / (2.0 * qa));
+        let s = if sign > 0.0 {
+            if s0 >= 0.0 { s0 } else { s1 }
+        } else if s1 <= 0.0 {
+            s1
+        } else {
+            s0
+        };
+        b + u * s
+    }
+    /// An arrow head whose base centre sits on the middle ellipse at `base` degrees and whose tip
+    /// sits there at `base + sweep`. The base runs along the line from the centre to the tip.
+    /// Returns (band outer edge, outer wing, tip, inner wing, band inner edge).
+    fn head(&self, base: f64, sweep: f64) -> [Point; 5] {
+        let b = self.at(base, 0.0);
+        let tip = self.at(base + sweep, 0.0);
+        let d = tip - self.c;
+        let u = if d.hypot() > 1e-12 { d / d.hypot() } else { Vec2::new(1.0, 0.0) };
+        let half = self.th / 2.0;
+        [self.cross(b, u, half, 1.0), b + u * self.hw, tip, b - u * self.hw, self.cross(b, u, -half, -1.0)]
+    }
+}
+
+/// Sweep (degrees) from `a` to `b` turning one way: positive when `dir > 0`.
+fn turn(a: f64, b: f64, dir: f64) -> f64 {
+    if dir > 0.0 { (b - a).rem_euclid(360.0) } else { -(a - b).rem_euclid(360.0) }
+}
+
+/// The circular arrows: a band along an ellipse with one head (`circularArrow` clockwise,
+/// `leftCircularArrow` anticlockwise) or a head at each end (`leftRightCircularArrow`).
+/// Adjusts: band thickness, head sweep (degrees), end angle, start angle, head half-width.
+fn circular_arrow(name: &str, w: f64, h: f64, a: [f64; 5]) -> Geometry {
+    let ss = w.min(h);
+    if ss <= 0.0 {
+        return simple(corner_rect(w, h, [Corner::Square; 4]), Rect::new(0.0, 0.0, w, h), w, h);
+    }
+    let a5 = a[4].clamp(0.0, 25000.0);
+    let hw = ss * a5 / 1e5;
+    let th = ss * a[0].clamp(0.0, 2.0 * a5) / 1e5;
+    let ring = Ring { c: Point::new(w / 2.0, h / 2.0), rx: (w / 2.0 - hw).max(th / 2.0), ry: (h / 2.0 - hw).max(th / 2.0), th, hw };
+    let deg = |v: f64| (v / 60000.0) % 360.0;
+    let (sweep, end, start) = (deg(a[1]), deg(a[2]), deg(a[3]));
+    let half = th / 2.0;
+    let mut b = Pb::new();
+    // Arcs of the ellipse grown by `d`, drawn on from the current point (which is on it except in
+    // the degenerate case above, where the arc shifts with it like the reference's).
+    let edge_arc = |b: &mut Pb, from: Point, to: Point, d: f64, dir: f64| {
+        let (ax, ay) = ((ring.rx + d).max(0.0), (ring.ry + d).max(0.0));
+        let (s, e) = (ring.param(from, d), ring.param(to, d));
+        b.arc(ax, ay, s, turn(s, e, dir));
+    };
+    let outer_arc = |b: &mut Pb, from: Point, to: Point, dir: f64| edge_arc(b, from, to, half, dir);
+    let inner_arc = |b: &mut Pb, from: Point, to: Point, dir: f64| edge_arc(b, from, to, -half, dir);
+    if name == "leftRightCircularArrow" {
+        let hs = ring.head(start, -sweep);
+        let he = ring.head(end, sweep);
+        b.m(hs[0].x, hs[0].y);
+        outer_arc(&mut b, hs[0], he[0], 1.0);
+        b.l(he[1].x, he[1].y).l(he[2].x, he[2].y).l(he[3].x, he[3].y).l(he[4].x, he[4].y);
+        inner_arc(&mut b, he[4], hs[4], -1.0);
+        b.l(hs[3].x, hs[3].y).l(hs[2].x, hs[2].y).l(hs[1].x, hs[1].y).z();
+    } else {
+        let dir = if name == "circularArrow" { 1.0 } else { -1.0 };
+        let he = ring.head(end, sweep);
+        let (o0, i0) = (ring.at(start, half), ring.at(start, -half));
+        b.m(o0.x, o0.y);
+        outer_arc(&mut b, o0, he[0], dir);
+        b.l(he[1].x, he[1].y).l(he[2].x, he[2].y).l(he[3].x, he[3].y).l(he[4].x, he[4].y);
+        inner_arc(&mut b, he[4], i0, -dir);
+        b.z();
+    }
+    simple(b.take(), Rect::new(0.0, 0.0, w, h), w, h)
+}
+
+/// A funnel: an elliptical rim (with an open mouth) across the top quarter, and straight sides
+/// down to a small rounded spout. The side lines leave the rim and meet the spout at fixed
+/// angles, fitted to the reference look.
+fn funnel(w: f64, h: f64) -> Geometry {
+    const RIM: f64 = 173.0; // where the left side leaves the rim, degrees on the rim ellipse
+    const SPOUT: f64 = 163.4; // where it meets the spout, degrees on the spout ellipse
+    let ss = w.min(h);
+    let (cx, rim_y) = (w / 2.0, h / 4.0);
+    let (sx, sy) = (w / 8.0, h / 15.0);
+    let spout_y = h - sy;
+    let at = |rx: f64, ry: f64, cy: f64, deg: f64| {
+        let t = deg.to_radians();
+        Point::new(cx + rx * t.cos(), cy + ry * t.sin())
+    };
+    let p0 = at(cx, rim_y, rim_y, RIM);
+    let p1 = at(sx, sy, spout_y, 180.0 - SPOUT);
+    let mut b = Pb::new();
+    b.m(p0.x, p0.y).arc(cx, rim_y, RIM, 540.0 - 2.0 * RIM);
+    b.l(p1.x, p1.y).arc(sx, sy, 180.0 - SPOUT, 2.0 * SPOUT - 180.0).z();
+    let d = ss / 20.0;
+    b.ellipse(cx, rim_y, (cx - d).max(0.0), (rim_y - d).max(0.0));
+    Geometry { paths: vec![fill_eo(b.take())], text_rect: Rect::new(w / 4.0, h / 2.0, w * 0.75, h - sy), handles: vec![], sites: mid_sites(w, h) }
+}
+
+/// A gear: an elliptical body with `n` teeth, the first pointing straight up. Each tooth leaves
+/// the body at two points an equal angle either side of its centre, and its tip corners sit a
+/// tooth height further out along the body's normal and a flank lean further in.
+fn gear(n: usize, w: f64, h: f64, a0: f64, a1: f64) -> Geometry {
+    let ss = w.min(h);
+    let th = ss * a0.clamp(0.0, 20000.0) / 1e5; // tooth height
+    let lean_max = if n == 6 { 5380.0 } else { 2730.0 };
+    let l = ss * a1.clamp(0.0, a0.clamp(0.0, 20000.0).min(lean_max)) / 1e5; // flank lean
+    let (cx, cy) = (w / 2.0, h / 2.0);
+    let (rx, ry) = ((cx - th).max(0.0), (cy - th).max(0.0));
+    let r = (ss / 2.0 - th).max(1e-9);
+    let half = ((th + l) / 2.0 / r).atan();
+    let step = std::f64::consts::TAU / n as f64;
+    let on_body = |t: f64| Point::new(cx + rx * t.cos(), cy + ry * t.sin());
+    let mut b = Pb::new();
+    for k in 0..n {
+        let t = -std::f64::consts::FRAC_PI_2 + step * k as f64;
+        // The tooth stands along the body's normal at its centre.
+        let nrm = Vec2::new(t.cos() * ry, t.sin() * rx);
+        let u = if nrm.hypot() > 1e-12 { nrm / nrm.hypot() } else { Vec2::new(t.cos(), t.sin()) };
+        let v = Vec2::new(-u.y, u.x);
+        let (r0, r1) = (on_body(t - half), on_body(t + half));
+        let (c0, c1) = (r0 + u * th + v * l, r1 + u * th - v * l);
+        if k == 0 {
+            b.m(r0.x, r0.y);
+        } else {
+            b.arc(rx, ry, (t - step + half).to_degrees(), (step - 2.0 * half).to_degrees());
+        }
+        b.l(c0.x, c0.y).l(c1.x, c1.y).l(r1.x, r1.y);
+    }
+    let t_last = -std::f64::consts::FRAC_PI_2 + step * (n - 1) as f64;
+    b.arc(rx, ry, (t_last + half).to_degrees(), (step - 2.0 * half).to_degrees()).z();
+    let k = std::f64::consts::FRAC_1_SQRT_2;
+    let text = Rect::new(cx - rx * k, cy - ry * k, cx + rx * k, cy + ry * k);
+    simple(b.take(), text, w, h)
+}
+
+/// Two arrows on a band that steps down in the middle: the left arrow sits high, the right one low,
+/// and the band rolls over between them in a shaded half-ellipse curl.
+fn left_right_ribbon(w: f64, h: f64, a0: f64, a1: f64, a2: f64) -> Geometry {
+    let ss = w.min(h);
+    let sh = h * a2.clamp(0.0, 33333.0) / 1e5; // step between the two halves
+    let bt = (h * a0.max(0.0) / 1e5).min(h - sh); // band thickness
+    let cx = w / 2.0;
+    let (rx, ry) = (w / 32.0, (sh / 4.0).min(w / 24.0));
+    let hb = (ss * a1.max(0.0) / 1e5).min(cx - rx); // head length
+    let yc = (h - sh) / 2.0;
+    let (lt, lb) = (yc - bt / 2.0, yc + bt / 2.0);
+    let (rt, rb) = (lt + sh, lb + sh);
+    // The left half: filled as a closed outline, stroked only where it can show.
+    let mut edge = Pb::new();
+    edge.m(cx - rx, lb).l(hb, lb).l(hb, h - sh).l(0.0, yc).l(hb, 0.0).l(hb, lt).l(cx, lt);
+    edge.arc(rx, ry, 270.0, 180.0).arc(rx, ry, 270.0, -90.0);
+    let edge = edge.take();
+    let mut left = Pb::new();
+    left.m(0.0, yc).l(hb, 0.0).l(hb, lt).l(cx, lt).arc(rx, ry, 270.0, 180.0).arc(rx, ry, 270.0, -180.0);
+    left.l(cx, lb.max(lt + 4.0 * ry)).l(hb, lb).l(hb, h - sh).z();
+    let left = left.take();
+    let mut curl = Pb::new();
+    curl.m(cx + rx, lt + ry).l(cx + rx, rt).l(cx, lt + 4.0 * ry).arc(rx, ry, 90.0, 180.0).arc(rx, ry, 90.0, -90.0).z();
+    let mut right = Pb::new();
+    right.m(w, yc + sh).l(w - hb, h).l(w - hb, rb).l(cx, rb).arc(rx, ry, 90.0, 90.0).l(cx - rx, rt - ry).arc(rx, ry, 180.0, -90.0);
+    right.l(w - hb, rt).l(w - hb, sh).z();
+    Geometry {
+        paths: vec![fill_only(left), stroke_only(edge), shade(curl.take(), FillMode::DarkenLess), fill(right.take())],
+        text_rect: Rect::new(hb.min(cx - rx), rt, (w - hb).max(cx + rx), lb.max(rt)),
+        handles: vec![],
+        sites: vec![Point::new(0.0, yc), Point::new(cx, rt), Point::new(w, yc + sh), Point::new(cx, lb)],
+    }
+}
+
+/// Adds a piece of the parabola `y = y0 + d·(1 − ((x − w/2)/(w/2))²)` from the current point (at
+/// `xa`) to `xb`, as one quadratic curve.
+fn sag(b: &mut Pb, w: f64, d: f64, y0: f64, xa: f64, xb: f64) {
+    let hw = (w / 2.0).max(1e-9);
+    let f = |x: f64| y0 + d * (1.0 - ((x - hw) / hw).powi(2));
+    let slope = -2.0 * d * (xa - hw) / (hw * hw);
+    b.q((xa + xb) / 2.0, f(xa) + slope * (xb - xa) / 2.0, xb, f(xb));
+}
+
+/// A ribbon whose edges sag along one parabola: a front band in the middle and two notched ends
+/// behind it, joined by shaded folds. Built sagging downwards; `up` mirrors it vertically.
+fn ellipse_ribbon(up: bool, w: f64, h: f64, a0: f64, a1: f64, a2: f64) -> Geometry {
+    let th = h * a0.clamp(0.0, 100000.0) / 1e5; // band drop at the centre
+    // Sag of every edge: never more than the drop, never so little that the band would rise
+    // above the ends by more than half their height.
+    let d = (h * a2.max(0.0) / 1e5).max(th - (h - th) / 2.0).clamp(0.0, th);
+    let bw = w * a1.clamp(25000.0, 75000.0) / 1e5;
+    let (x0, x1) = ((w - bw) / 2.0, (w + bw) / 2.0);
+    let ear = w / 8.0;
+    let (xf, xg) = (x0 + ear, x1 - ear);
+    let e = h - th; // band height
+    let off = th - d; // band top below the ends' top
+    let t = |x: f64| {
+        let hw = (w / 2.0).max(1e-9);
+        d * (1.0 - ((x - hw) / hw).powi(2))
+    };
+    let mut ends = Pb::new();
+    ends.m(0.0, 0.0);
+    sag(&mut ends, w, d, 0.0, 0.0, xf);
+    ends.l(xf, t(xf) + off).l(x0, t(x0) + off).l(x0, t(x0) + e);
+    sag(&mut ends, w, d, e, x0, 0.0);
+    ends.l(ear, t(ear) + e / 2.0).z();
+    ends.m(w, 0.0).l(w - ear, t(w - ear) + e / 2.0).l(w, e);
+    sag(&mut ends, w, d, e, w, x1);
+    ends.l(x1, t(x1) + off).l(xg, t(xg) + off).l(xg, t(xg));
+    sag(&mut ends, w, d, 0.0, xg, w);
+    ends.z();
+    let mut folds = Pb::new();
+    folds.poly(&[(x0, t(x0) + off), (xf, t(xf)), (xf, t(xf) + off)]);
+    folds.poly(&[(x1, t(x1) + off), (xg, t(xg)), (xg, t(xg) + off)]);
+    let mut band = Pb::new();
+    band.m(x0, t(x0) + off);
+    sag(&mut band, w, d, off, x0, x1);
+    band.l(x1, t(x1) + off + e);
+    sag(&mut band, w, d, off + e, x1, x0);
+    band.z();
+    let mut paths = vec![fill(ends.take()), shade(folds.take(), FillMode::DarkenLess), fill(band.take())];
+    let mut text = Rect::new(x0, th, x1, t(x0) + off + e);
+    if up {
+        let m = kurbo::Affine::new([1.0, 0.0, 0.0, -1.0, 0.0, h]);
+        for p in &mut paths {
+            p.path.apply_affine(m);
+        }
+        text = m.transform_rect_bbox(text);
+    }
+    Geometry { paths, text_rect: text, handles: vec![], sites: mid_sites(w, h) }
+}
+
+/// A sweeping arrow rising from the bottom-left corner. The band's two edges are quadratic curves
+/// from the corner; the head's base leans slightly forward and reaches one eighth of the shorter
+/// side above and below the band. The tilt and the tip's lift were fitted to the reference look.
+fn swoosh(w: f64, h: f64, a0: f64, a1: f64) -> Geometry {
+    const TILT: f64 = 0.1126; // tan of the head base's lean from vertical
+    const LIFT: f64 = 0.051; // tip height above the band's centre, per unit of height
+    let ss = w.min(h);
+    let e = ss / 8.0;
+    let th = (h * a0.max(0.0) / 1e5).min((h - 2.0 * e).max(0.0));
+    // The head is at least long enough to keep its leaning base inside the frame.
+    let hl = (ss * a1.max(0.0) / 1e5).max((e + th) * TILT).min((w - e * TILT).max(0.0));
+    let qx = w - hl;
+    let mut b = Pb::new();
+    b.m(0.0, h)
+        .q(w / 6.0, h / 3.0, qx, e)
+        .l(qx - e * TILT, 0.0)
+        .l(w, (e + th / 2.0 - LIFT * h).clamp(0.0, 2.0 * e + th))
+        .l((qx + (e + th) * TILT).min(w), 2.0 * e + th)
+        .l((qx + th * TILT).min(w), e + th)
+        .q(w / 4.0, (th + h / 12.0 + e).min(h), 0.0, h)
+        .z();
+    simple(b.take(), Rect::new(0.0, 0.0, w, h), w, h)
+}
+
+/// A band that sweeps around half an ellipse and ends in an arrow head. Built pointing right
+/// (`curvedRightArrow`) in a `cw`×`ch` frame, then turned for the other directions.
+///
+/// Both halves of the band hang off one ellipse touching the far side: its centre sits on the
+/// head side's edge, its horizontal radius is the full length, and the band has a constant
+/// vertical thickness. The back half (shaded) starts flat against the head side; the front half
+/// runs to the head, centred on the band where it ends.
+fn curved_arrow(name: &str, w: f64, h: f64, a0: f64, a1: f64, a2: f64) -> Geometry {
+    let along_x = matches!(name, "curvedRightArrow" | "curvedLeftArrow");
+    let (cw, ch) = if along_x { (w, h) } else { (h, w) };
+    let ss = cw.min(ch);
+    let head = (ss * a1.max(0.0) / 1e5).min(ch / 2.0);
+    let th = (ss * a0.max(0.0) / 1e5).min(head);
+    let hl = (ss * a2.max(0.0) / 1e5).min(cw);
+    let hh = head / 2.0;
+    // The band's centre line, carried on to the head side, ends at the tip, which sits half a
+    // head width above the bottom.
+    let r = ((ch - hh - th / 2.0) / 2.0).max(0.0);
+    // Parametric angle where the front band reaches the head base.
+    let te = if cw > 0.0 { (-(hl / cw)).clamp(-1.0, 1.0).acos().to_degrees() } else { 90.0 };
+    let mut back = Pb::new();
+    back.m(cw, 0.0).arc(cw, r, 270.0, -90.0).l(0.0, r + th).arc(cw, r, 180.0, 90.0).z();
+    let mut front = Pb::new();
+    front.m(0.0, r).arc(cw, r, 180.0, te - 180.0);
+    let yb = front.cur.y;
+    let yc = yb + th / 2.0;
+    front.l(cw - hl, yc - hh).l(cw, 2.0 * r + th / 2.0).l(cw - hl, yc + hh).l(cw - hl, yb + th).arc(cw, r, te, 180.0 - te).z();
+    let m = match name {
+        "curvedLeftArrow" => kurbo::Affine::new([-1.0, 0.0, 0.0, 1.0, w, 0.0]),
+        "curvedUpArrow" => kurbo::Affine::new([0.0, -1.0, 1.0, 0.0, 0.0, h]),
+        "curvedDownArrow" => kurbo::Affine::new([0.0, 1.0, 1.0, 0.0, 0.0, 0.0]),
+        _ => kurbo::Affine::IDENTITY,
+    };
+    let (mut back, mut front) = (back.take(), front.take());
+    back.apply_affine(m);
+    front.apply_affine(m);
+    Geometry {
+        paths: vec![shade(back, FillMode::DarkenLess), fill(front)],
+        text_rect: Rect::new(0.0, 0.0, w, h),
+        handles: vec![],
+        sites: mid_sites(w, h),
+    }
+}
+
+/// A rectangle with a callout leader through `pts` points (`(y, x)` adjust pairs in 1/100 000 of
+/// the height and width), optionally with an accent bar at the first point's x and a border.
+fn line_callout(w: f64, h: f64, a: &dyn Fn(usize) -> f64, pts: usize, accent: bool, border: bool) -> Geometry {
+    let body = corner_rect(w, h, [Corner::Square; 4]);
+    // Leaders may reach well outside the box, but not without bound.
+    let pt = |i: usize| (w * a(2 * i + 1).clamp(-1e7, 1e7) / 1e5, h * a(2 * i).clamp(-1e7, 1e7) / 1e5);
+    let mut l = Pb::new();
+    let (x0, y0) = pt(0);
+    l.m(x0, y0);
+    for i in 1..pts {
+        let (x, y) = pt(i);
+        l.l(x, y);
+    }
+    let mut paths = vec![if border { fill(body) } else { fill_only(body) }];
+    if accent {
+        paths.push(stroke_only(Pb::new().m(x0, 0.0).l(x0, h).take()));
+    }
+    paths.push(stroke_only(l.take()));
+    Geometry { paths, text_rect: Rect::new(0.0, 0.0, w, h), handles: vec![], sites: mid_sites(w, h) }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{CATALOG, FillMode, build, info};
+    use kurbo::{BezPath, PathEl, Point, Shape};
+
+    const NEW: [&str; 38] = [
+        "lineInv",
+        "nonIsoscelesTrapezoid",
+        "pieWedge",
+        "leftRightArrowCallout",
+        "upDownArrowCallout",
+        "quadArrowCallout",
+        "circularArrow",
+        "leftCircularArrow",
+        "leftRightCircularArrow",
+        "curvedRightArrow",
+        "curvedLeftArrow",
+        "curvedUpArrow",
+        "curvedDownArrow",
+        "swooshArrow",
+        "callout1",
+        "callout2",
+        "callout3",
+        "accentCallout1",
+        "accentCallout2",
+        "accentCallout3",
+        "borderCallout2",
+        "borderCallout3",
+        "accentBorderCallout1",
+        "accentBorderCallout2",
+        "accentBorderCallout3",
+        "ellipseRibbon",
+        "ellipseRibbon2",
+        "leftRightRibbon",
+        "flowChartOfflineStorage",
+        "gear6",
+        "gear9",
+        "funnel",
+        "cornerTabs",
+        "squareTabs",
+        "plaqueTabs",
+        "chartX",
+        "chartStar",
+        "chartPlus",
+    ];
+
+    fn outline(name: &str, w: f64, h: f64, adj: &[f64]) -> BezPath {
+        build(name, w, h, adj).map(|g| g.outline()).unwrap_or_default()
+    }
+
+    /// Distance from `p` to the nearest point of the (flattened) outline.
+    fn dist(path: &BezPath, p: Point) -> f64 {
+        let mut best = f64::MAX;
+        let mut prev = Point::ZERO;
+        let mut start = Point::ZERO;
+        kurbo::flatten(path.iter(), 0.01, |el| {
+            let (a, b) = match el {
+                PathEl::MoveTo(q) => {
+                    prev = q;
+                    start = q;
+                    return;
+                }
+                PathEl::LineTo(q) => (prev, q),
+                PathEl::ClosePath => (prev, start),
+                _ => return,
+            };
+            let d = b - a;
+            let t = if d.hypot2() > 0.0 { ((p - a).dot(d) / d.hypot2()).clamp(0.0, 1.0) } else { 0.0 };
+            best = best.min((a + d * t - p).hypot());
+            prev = b;
+        });
+        best
+    }
+
+    /// Asserts every point lies within 1pt of the outline.
+    fn on(name: &str, w: f64, h: f64, adj: &[f64], pts: &[(f64, f64)]) {
+        let path = outline(name, w, h, adj);
+        for &(x, y) in pts {
+            let d = dist(&path, Point::new(x, y));
+            assert!(d < 1.0, "{name} {w}x{h} {adj:?}: ({x}, {y}) is {d:.2} from the outline");
+        }
+    }
+
+    #[test]
+    fn new_presets_are_in_the_catalog() {
+        for n in NEW {
+            let i = info(n).unwrap_or_else(|| panic!("{n} missing from the catalog"));
+            assert!(!i.label.is_empty());
+        }
+        assert!(CATALOG.len() >= 183);
+    }
+
+    #[test]
+    fn new_presets_build_within_bounds_at_many_sizes_and_adjusts() {
+        let sizes = [(480.0, 300.0), (300.0, 300.0), (200.0, 460.0), (100.0, 460.0), (1.0, 1.0), (0.0, 0.0), (0.0, 50.0), (60.0, 0.0)];
+        let adjusts: [&[f64]; 8] = [
+            &[],
+            &[0.0; 8],
+            &[100000.0; 8],
+            &[-50000.0; 8],
+            &[1e12, -1e12, 1e12, -1e12, 1e12, -1e12, 1e12, -1e12],
+            &[f64::MAX, f64::MIN, f64::MAX, f64::MIN, f64::MAX, f64::MIN, f64::MAX, f64::MIN],
+            &[f64::NAN, f64::INFINITY, f64::NEG_INFINITY, f64::NAN, 5.0, 6.0, 7.0, 8.0],
+            &[30000.0, 60000.0, 20000.0, 9000000.0, 20000.0, 40000.0, 120000.0, -30000.0],
+        ];
+        for n in NEW {
+            // Line callouts' leaders may reach anywhere, by design.
+            let callout = n.contains("allout") && !n.contains("Arrow");
+            for (w, h) in sizes {
+                for adj in adjusts {
+                    let g = build(n, w, h, adj).unwrap_or_else(|| panic!("{n} did not build"));
+                    assert!(!g.paths.is_empty(), "{n} has no paths");
+                    for s in &g.paths {
+                        let bb = s.path.bounding_box();
+                        assert!(bb.x0.is_finite() && bb.y0.is_finite() && bb.x1.is_finite() && bb.y1.is_finite(), "{n} {w}x{h} {adj:?}: {bb:?}");
+                        if !callout {
+                            // Circular arrows with a head longer than their ring can hold carry the
+                            // inner edge on from the head, as the reference does, so may spill.
+                            let spill = if n.contains("ircular") { 0.5 } else { 0.01 };
+                            let tol = 0.5 + w.max(h) * spill;
+                            assert!(
+                                bb.x0 >= -tol && bb.y0 >= -tol && bb.x1 <= w + tol && bb.y1 <= h + tol,
+                                "{n} {w}x{h} {adj:?} out of bounds: {bb:?}"
+                            );
+                        }
+                    }
+                    let t = g.text_rect;
+                    assert!(t.x0.is_finite() && t.y0.is_finite() && t.x1.is_finite() && t.y1.is_finite(), "{n} text rect {t:?}");
+                }
+            }
+            let g = build(n, 480.0, 300.0, &[]).unwrap_or_else(|| panic!("{n}"));
+            assert!(g.outline().elements().len() >= 2, "{n} default outline is empty");
+        }
+    }
+
+    // The spot checks below are outline points measured on reference renders.
+
+    #[test]
+    fn simple_new_presets_match_reference_points() {
+        on("lineInv", 480.0, 300.0, &[], &[(0.0, 300.0), (480.0, 0.0)]);
+        on("nonIsoscelesTrapezoid", 480.0, 300.0, &[], &[(75.0, 0.0), (405.0, 0.0), (0.0, 300.0)]);
+        on("nonIsoscelesTrapezoid", 200.0, 460.0, &[80000.0, 20000.0], &[(100.0, 0.0), (160.0, 0.0)]);
+        on("pieWedge", 480.0, 300.0, &[], &[(64.3, 150.0), (0.0, 300.0), (480.0, 0.0)]);
+        on("flowChartOfflineStorage", 480.0, 300.0, &[], &[(240.0, 300.0), (192.0, 240.0), (288.0, 240.0)]);
+        on("squareTabs", 480.0, 300.0, &[], &[(28.3, 28.3), (451.7, 271.7)]);
+        on("cornerTabs", 480.0, 300.0, &[], &[(23.3, 5.0)]);
+        on("plaqueTabs", 480.0, 300.0, &[], &[(27.85, 5.0)]);
+        on("chartStar", 480.0, 300.0, &[], &[(240.0, 0.0), (240.0, 300.0), (48.0, 30.0)]);
+        on("chartPlus", 480.0, 300.0, &[], &[(0.0, 150.0), (240.0, 0.0)]);
+        // Chart markers and plain callouts leave the box unstroked.
+        for n in ["chartX", "callout1", "accentCallout2"] {
+            let g = build(n, 100.0, 100.0, &[]).unwrap_or_else(|| panic!("{n}"));
+            assert!(!g.paths[0].stroke, "{n}");
+        }
+    }
+
+    #[test]
+    fn line_callouts_follow_their_adjusts() {
+        on("callout3", 480.0, 300.0, &[], &[(-40.0, 56.25), (-80.0, 56.25), (-80.0, 300.0), (-40.0, 338.9)]);
+        let adj = [50000.0, 110000.0, 20000.0, 120000.0, -20000.0, 80000.0, 30000.0, 40000.0];
+        let g = build("accentBorderCallout3", 480.0, 300.0, &adj).unwrap_or_else(|| panic!("accentBorderCallout3"));
+        assert_eq!(g.paths.len(), 3);
+        assert!(g.paths[0].stroke);
+        let accent = g.paths[1].path.bounding_box();
+        assert!((accent.x0 - 528.0).abs() < 1e-6 && accent.y0 == 0.0 && accent.y1 == 300.0, "{accent:?}");
+        on("accentBorderCallout3", 480.0, 300.0, &adj, &[(576.0, 60.0), (384.0, -60.0), (192.0, 90.0)]);
+    }
+
+    #[test]
+    fn arrow_callouts_match_reference_points() {
+        on("leftRightArrowCallout", 480.0, 300.0, &[], &[(0.0, 150.0), (75.0, 75.0), (124.5, 0.0), (355.5, 300.0), (480.0, 150.0)]);
+        on("leftRightArrowCallout", 200.0, 460.0, &[], &[(50.0, 180.0), (52.0, 0.0), (148.0, 460.0)]);
+        on("upDownArrowCallout", 480.0, 300.0, &[], &[(240.0, 0.0), (0.0, 77.8), (480.0, 222.2), (240.0, 300.0)]);
+        on("quadArrowCallout", 480.0, 300.0, &[], &[(0.0, 150.0), (124.5, 77.8), (240.0, 0.0), (480.0, 150.0), (240.0, 300.0)]);
+    }
+
+    #[test]
+    fn curved_arrows_match_reference_points() {
+        on(
+            "curvedRightArrow",
+            480.0,
+            300.0,
+            &[],
+            &[(480.0, 0.0), (480.0, 75.0), (480.0, 225.0), (405.0, 149.0), (405.0, 299.0), (100.0, 151.5), (300.0, 6.7)],
+        );
+        on("curvedRightArrow", 200.0, 460.0, &[30000.0, 60000.0, 40000.0], &[(200.0, 400.0), (120.0, 324.5), (120.0, 443.5), (200.0, 60.0)]);
+        // The band never outgrows the head; the head never outgrows half the frame.
+        on("curvedRightArrow", 200.0, 460.0, &[60000.0, 30000.0, 80000.0], &[(200.0, 60.0)]);
+        on("curvedLeftArrow", 480.0, 300.0, &[], &[(0.0, 225.0), (0.0, 0.0)]);
+        on("curvedUpArrow", 480.0, 300.0, &[], &[(405.0, 0.0), (0.0, 0.0), (75.0, 0.0)]);
+        on("curvedDownArrow", 480.0, 300.0, &[], &[(405.0, 300.0), (0.0, 300.0)]);
+        let g = build("curvedRightArrow", 480.0, 300.0, &[]).unwrap_or_else(|| panic!("curvedRightArrow"));
+        assert_eq!(g.paths[0].fill, FillMode::DarkenLess);
+    }
+
+    #[test]
+    fn swoosh_matches_reference_points() {
+        on("swooshArrow", 480.0, 300.0, &[], &[(0.0, 300.0), (425.8, 0.0), (480.0, 59.7), (442.8, 150.0), (202.0, 105.5), (202.0, 159.0)]);
+        on("swooshArrow", 480.0, 300.0, &[40000.0, 16667.0], &[(480.0, 82.2), (447.8, 195.0)]);
+        on("swooshArrow", 200.0, 460.0, &[], &[(163.9, 0.0), (200.0, 59.4)]);
+    }
+
+    #[test]
+    fn ribbons_match_reference_points() {
+        on(
+            "ellipseRibbon",
+            480.0,
+            300.0,
+            &[],
+            &[(0.0, 0.0), (120.0, 28.1), (60.0, 128.9), (240.0, 300.0), (120.0, 66.1), (180.0, 72.2), (180.0, 35.2)],
+        );
+        on("ellipseRibbon", 480.0, 300.0, &[30000.0, 60000.0, 20000.0], &[(120.0, 45.0), (240.0, 300.0), (96.0, 68.4)]);
+        on("ellipseRibbon", 480.0, 300.0, &[80000.0, 20000.0, 60000.0], &[(240.0, 240.0), (1.0, 61.75)]);
+        on("ellipseRibbon2", 480.0, 300.0, &[], &[(0.0, 300.0), (240.0, 0.0)]);
+        on(
+            "leftRightRibbon",
+            480.0,
+            300.0,
+            &[],
+            &[(0.0, 125.0), (150.0, 0.0), (150.0, 50.0), (255.0, 62.5), (225.0, 87.5), (480.0, 175.0), (330.0, 300.0)],
+        );
+        on("leftRightRibbon", 480.0, 300.0, &[90000.0, 10000.0, 60000.0], &[(0.0, 100.0), (480.0, 200.0), (240.0, 300.0)]);
+    }
+
+    #[test]
+    fn gears_and_funnel_match_reference_points() {
+        // Square gear6: body radius 105, top tooth tip 3.5 inside the frame, tip half-width ~16.3.
+        on("gear6", 300.0, 300.0, &[], &[(150.0, 3.5), (133.7, 3.5), (166.3, 3.5), (45.0, 150.0)]);
+        on("gear9", 300.0, 300.0, &[], &[(150.0, 1.0), (30.0, 150.0)]);
+        on("gear6", 480.0, 300.0, &[], &[(240.0, 3.5), (201.0, 3.5)]);
+        on("funnel", 480.0, 300.0, &[], &[(240.0, 0.0), (0.0, 75.0), (240.0, 15.0), (15.0, 75.0), (240.0, 300.0), (60.5, 150.0)]);
+        let g = build("funnel", 480.0, 300.0, &[]).unwrap_or_else(|| panic!("funnel"));
+        assert!(g.paths[0].even_odd);
+    }
+
+    #[test]
+    fn circular_arrows_match_reference_points() {
+        on("circularArrow", 300.0, 300.0, &[], &[(19.0, 150.0), (56.5, 150.0), (150.0, 19.0), (262.4, 150.0), (218.6, 113.4), (293.6, 113.4)]);
+        on(
+            "circularArrow",
+            300.0,
+            300.0,
+            &[20000.0, 1800000.0, 18000000.0, 5400000.0, 20000.0],
+            &[(150.0, 270.0), (150.0, 210.0), (247.0, 42.1), (143.0, 102.1), (227.9, 105.0)],
+        );
+        on("leftCircularArrow", 300.0, 300.0, &[], &[(37.6, 150.0), (262.4, 150.0), (150.0, 281.0)]);
+        on("leftRightCircularArrow", 300.0, 300.0, &[], &[(262.4, 150.0), (37.6, 150.0), (150.0, 19.0)]);
+        // The band never grows past twice the head's half-width.
+        on("circularArrow", 300.0, 300.0, &[25000.0, 1142319.0, 20457681.0, 10800000.0, 5000.0], &[(0.0, 150.0), (30.0, 150.0)]);
+    }
+}

crates/metafile/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "deckcraft-metafile"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "DeckCraft metafiles (ported from WordCraft): parses Windows WMF and EMF records into a neutral vector model (paths and bitmaps)"
+
+[lints]
+workspace = true
+
+[dependencies]
+kurbo = { workspace = true }
+thiserror = { workspace = true }

crates/metafile/src/bytes.rs

@@ -0,0 +1,59 @@
+//! Bounds-checked little-endian access to hostile input. Every read returns `None` past the end, so
+//! a truncated or lying size field stops the parse instead of panicking.
+
+#[derive(Clone, Copy)]
+pub(crate) struct Bytes<'a>(pub(crate) &'a [u8]);
+
+impl<'a> Bytes<'a> {
+    pub fn slice(&self, off: usize, len: usize) -> Option<&'a [u8]> {
+        self.0.get(off..off.checked_add(len)?)
+    }
+
+    pub fn tail(&self, off: usize) -> Option<Bytes<'a>> {
+        self.0.get(off..).map(Bytes)
+    }
+
+    fn arr<const N: usize>(&self, off: usize) -> Option<[u8; N]> {
+        self.slice(off, N)?.try_into().ok()
+    }
+
+    pub fn u16(&self, off: usize) -> Option<u16> {
+        Some(u16::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn i16(&self, off: usize) -> Option<i16> {
+        Some(i16::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn u32(&self, off: usize) -> Option<u32> {
+        Some(u32::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn i32(&self, off: usize) -> Option<i32> {
+        Some(i32::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn f32(&self, off: usize) -> Option<f32> {
+        Some(f32::from_le_bytes(self.arr(off)?))
+    }
+
+    /// `n` consecutive (x, y) pairs of 16- or 32-bit signed integers starting at `off`.
+    pub fn points(&self, off: usize, n: usize, wide: bool) -> Option<Vec<(f64, f64)>> {
+        let sz = if wide { 8 } else { 4 };
+        let raw = self.slice(off, n.checked_mul(sz)?)?;
+        let mut out = Vec::with_capacity(n);
+        for c in raw.chunks_exact(sz) {
+            let p = if wide {
+                let x = i32::from_le_bytes(c.get(0..4)?.try_into().ok()?);
+                let y = i32::from_le_bytes(c.get(4..8)?.try_into().ok()?);
+                (f64::from(x), f64::from(y))
+            } else {
+                let x = i16::from_le_bytes(c.get(0..2)?.try_into().ok()?);
+                let y = i16::from_le_bytes(c.get(2..4)?.try_into().ok()?);
+                (f64::from(x), f64::from(y))
+            };
+            out.push(p);
+        }
+        Some(out)
+    }
+}

crates/metafile/src/canvas.rs

@@ -0,0 +1,574 @@
+//! Drawing state shared by the WMF and EMF readers: window/viewport mapping and the EMF world
+//! transform, pen and brush selection through an object table, the DC save stack and path brackets.
+//! Output is device-space items; `lib.rs` maps them into the picture frame.
+
+use crate::dib::Rgba;
+use crate::geom::{Op, P};
+use crate::{MAX_BYTES, MAX_ITEMS, MAX_OBJECTS, MAX_PATH_OPS, MAX_STACK};
+
+pub(crate) const MM_TEXT: u32 = 1;
+const MM_ISOTROPIC: u32 = 7;
+const MM_ANISOTROPIC: u32 = 8;
+const STOCK: u32 = 0x8000_0000;
+pub(crate) const PS_NULL: u32 = 5;
+/// Pen style bits; the rest of the style word holds end-cap, join and type flags.
+pub(crate) const PS_STYLE_MASK: u32 = 0x0F;
+const BS_SOLID: u32 = 0;
+pub(crate) const BS_NULL: u32 = 1;
+const WINDING: u32 = 2;
+/// SETROP2 mix mode that leaves the destination alone: outlines and fills draw nothing.
+const R2_NOP: u32 = 11;
+const PATCOPY: u32 = 0x00F0_0021;
+const BLACKNESS: u32 = 0x0000_0042;
+const WHITENESS: u32 = 0x00FF_0062;
+/// Device pixels per millimetre assumed for WMF (96 dpi), and for EMF files without a device size.
+const DEFAULT_PX_PER_MM: f64 = 96.0 / 25.4;
+
+/// Affine transform `[m11, m12, m21, m22, dx, dy]` in EMF XFORM order: `x' = x·m11 + y·m21 + dx`.
+pub(crate) type Xform = [f64; 6];
+const IDENTITY: Xform = [1.0, 0.0, 0.0, 1.0, 0.0, 0.0];
+
+/// `a` then `b` in EMF row-vector convention: the matrix product `a × b`.
+pub(crate) fn mul(a: Xform, b: Xform) -> Xform {
+    [
+        a[0] * b[0] + a[1] * b[2],
+        a[0] * b[1] + a[1] * b[3],
+        a[2] * b[0] + a[3] * b[2],
+        a[2] * b[1] + a[3] * b[3],
+        a[4] * b[0] + a[5] * b[2] + b[4],
+        a[4] * b[1] + a[5] * b[3] + b[5],
+    ]
+}
+
+#[derive(Clone, Copy, PartialEq, Debug)]
+pub(crate) struct Pen {
+    pub style: u32,
+    /// Logical width; 0 means a cosmetic one-pixel hairline.
+    pub width: f64,
+    pub color: [u8; 4],
+}
+
+#[derive(Clone, Copy, PartialEq, Debug)]
+pub(crate) struct Brush {
+    pub style: u32,
+    pub color: [u8; 4],
+}
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum Obj {
+    Pen(Pen),
+    Brush(Brush),
+    /// Fonts, palettes, pattern brushes and regions: they take a table slot but draw nothing.
+    Other,
+}
+
+/// Converts a COLORREF (0x00BBGGRR) to opaque RGBA.
+pub(crate) fn colorref(c: u32) -> [u8; 4] {
+    [(c & 0xFF) as u8, ((c >> 8) & 0xFF) as u8, ((c >> 16) & 0xFF) as u8, 255]
+}
+
+/// Millimetres per logical unit of the metric map modes (LOMETRIC, HIMETRIC, LOENGLISH, HIENGLISH, TWIPS).
+fn metric_mm(mode: u32) -> Option<f64> {
+    match mode {
+        2 => Some(0.1),
+        3 => Some(0.01),
+        4 => Some(25.4 / 100.0),
+        5 => Some(25.4 / 1000.0),
+        6 => Some(25.4 / 1440.0),
+        _ => None,
+    }
+}
+
+#[derive(Clone, Copy)]
+pub(crate) struct Mapping {
+    wo: P,
+    we: P,
+    vo: P,
+    ve: P,
+    mode: u32,
+    world: Xform,
+    /// Device pixels per millimetre on each axis (EMF: from szlDevice and szlMillimeters).
+    px_mm: P,
+}
+
+impl Mapping {
+    fn identity() -> Self {
+        Mapping {
+            wo: (0.0, 0.0),
+            we: (1.0, 1.0),
+            vo: (0.0, 0.0),
+            ve: (1.0, 1.0),
+            mode: MM_TEXT,
+            world: IDENTITY,
+            px_mm: (DEFAULT_PX_PER_MM, DEFAULT_PX_PER_MM),
+        }
+    }
+
+    /// Logical point to device point: world transform, then window to viewport.
+    pub fn device(&self, p: P) -> P {
+        let w = self.world;
+        let (x, y) = (p.0 * w[0] + p.1 * w[2] + w[4], p.0 * w[1] + p.1 * w[3] + w[5]);
+        let (sx, sy) = self.ratios();
+        ((x - self.wo.0) * sx + self.vo.0, (y - self.wo.1) * sy + self.vo.1)
+    }
+
+    /// Window-to-viewport scale per axis. MM_TEXT fixes the scale at 1; the metric modes use a fixed
+    /// scale with y up; MM_ISOTROPIC uses one scale on both axes (the smaller magnitude, each axis's
+    /// sign kept); anisotropic and unknown modes use the extents as given.
+    fn ratios(&self) -> (f64, f64) {
+        if self.mode == MM_TEXT {
+            return (1.0, 1.0);
+        }
+        if let Some(mm) = metric_mm(self.mode) {
+            return (mm * self.px_mm.0, -mm * self.px_mm.1);
+        }
+        let (rx, ry) = (ratio(self.ve.0, self.we.0), ratio(self.ve.1, self.we.1));
+        if self.mode == MM_ISOTROPIC {
+            let s = rx.abs().min(ry.abs());
+            return (if rx < 0.0 { -s } else { s }, if ry < 0.0 { -s } else { s });
+        }
+        (rx, ry)
+    }
+
+    /// Approximate device length per logical length, for pen widths.
+    fn scale(&self) -> f64 {
+        let w = self.world;
+        let det = (w[0] * w[3] - w[1] * w[2]).abs().sqrt();
+        let (sx, sy) = self.ratios();
+        det * (sx.abs() + sy.abs()) / 2.0
+    }
+
+    /// True when the window-to-viewport extents set the scale (the isotropic and anisotropic modes).
+    pub fn uses_extents(&self) -> bool {
+        matches!(self.mode, MM_ISOTROPIC | MM_ANISOTROPIC)
+    }
+
+    pub fn window_ext(&self) -> P {
+        self.we
+    }
+
+    pub fn viewport_ext(&self) -> P {
+        self.ve
+    }
+
+    /// The window in device units as `[x, y, w, h]` with positive extents, used as the picture frame
+    /// of a plain WMF.
+    pub fn window_rect(&self) -> [f64; 4] {
+        let a = self.device(self.wo);
+        let b = self.device((self.wo.0 + self.we.0, self.wo.1 + self.we.1));
+        [a.0.min(b.0), a.1.min(b.1), (b.0 - a.0).abs(), (b.1 - a.1).abs()]
+    }
+}
+
+fn ratio(num: f64, den: f64) -> f64 {
+    if den == 0.0 { 1.0 } else { num / den }
+}
+
+/// Output of drawing, in device units. Path points are already mapped; `lib.rs` normalises them.
+pub(crate) enum Raw {
+    Path { ops: Vec<Op>, fill: Option<[u8; 4]>, stroke: Option<([u8; 4], f64)>, even_odd: bool },
+    Bitmap { rect: [f64; 4], img: Rgba },
+}
+
+#[derive(Clone)]
+struct Saved {
+    map: Mapping,
+    pen: Pen,
+    brush: Brush,
+    even_odd: bool,
+    nop: bool,
+}
+
+pub(crate) struct Canvas {
+    pub items: Vec<Raw>,
+    pub map: Mapping,
+    /// True once SETWINDOWEXT was seen, so a plain WMF has a frame to use.
+    pub window_set: bool,
+    /// True once the file set the viewport extent itself (not the player, see [`Canvas::play_into`]).
+    pub viewport_set: bool,
+    saved: Vec<Saved>,
+    /// Bytes held by the items so far (path ops and pixels), capped at [`MAX_BYTES`].
+    used: usize,
+    objects: Vec<Option<Obj>>,
+    pen: Pen,
+    brush: Brush,
+    even_odd: bool,
+    /// The mix mode is R2_NOP: shapes draw nothing.
+    nop: bool,
+    pos: P,
+    in_path: bool,
+    path: Vec<Op>,
+    full: bool,
+}
+
+impl Canvas {
+    pub fn new() -> Self {
+        Canvas {
+            items: Vec::new(),
+            map: Mapping::identity(),
+            window_set: false,
+            viewport_set: false,
+            saved: Vec::new(),
+            used: 0,
+            objects: Vec::new(),
+            pen: Pen { style: 0, width: 0.0, color: [0, 0, 0, 255] },
+            brush: Brush { style: BS_SOLID, color: [255, 255, 255, 255] },
+            even_odd: true,
+            nop: false,
+            pos: (0.0, 0.0),
+            in_path: false,
+            path: Vec::new(),
+            full: false,
+        }
+    }
+
+    /// True once the item cap is hit; the readers stop there and keep what they have.
+    pub fn full(&self) -> bool {
+        self.full
+    }
+
+    fn push(&mut self, raw: Raw) {
+        let cost = match &raw {
+            Raw::Path { ops, .. } => ops.len() * std::mem::size_of::<Op>(),
+            Raw::Bitmap { img, .. } => img.px.len(),
+        };
+        if self.items.len() >= MAX_ITEMS || self.used.saturating_add(cost) > MAX_BYTES {
+            self.full = true;
+        } else {
+            self.used += cost;
+            self.items.push(raw);
+        }
+    }
+
+    pub fn set_window_org(&mut self, p: P) {
+        self.map.wo = p;
+    }
+
+    pub fn set_window_ext(&mut self, e: P) {
+        self.map.we = e;
+        self.window_set = true;
+    }
+
+    pub fn set_viewport_org(&mut self, p: P) {
+        self.map.vo = p;
+    }
+
+    pub fn set_viewport_ext(&mut self, e: P) {
+        self.map.ve = e;
+        self.viewport_set = true;
+    }
+
+    /// Sets up the mapping the way a player does before it plays a WMF into a target: anisotropic,
+    /// `window` (`[x, y, w, h]` in logical units) onto a viewport of `size` at the origin. The file's
+    /// own window records then replace the window; the viewport stays unless the file sets one.
+    /// Without a window (a plain WMF) only the viewport extent is set: the map mode and viewport
+    /// origin stay the file's.
+    pub fn play_into(&mut self, window: Option<[f64; 4]>, size: P) {
+        if let Some([x, y, w, h]) = window {
+            self.map.mode = MM_ANISOTROPIC;
+            self.map.wo = (x, y);
+            self.map.we = (w, h);
+            self.map.vo = (0.0, 0.0);
+        }
+        self.map.ve = size;
+    }
+
+    pub fn set_map_mode(&mut self, mode: u32) {
+        self.map.mode = mode;
+    }
+
+    /// Device pixels per millimetre (x, y) for the metric map modes. Ignored unless both are positive.
+    pub fn set_device_mm(&mut self, px_mm: P) {
+        if px_mm.0.is_finite() && px_mm.1.is_finite() && px_mm.0 > 0.0 && px_mm.1 > 0.0 {
+            self.map.px_mm = px_mm;
+        }
+    }
+
+    pub fn set_polyfill(&mut self, mode: u32) {
+        self.even_odd = mode != WINDING;
+    }
+
+    /// SETROP2: only R2_NOP changes what is drawn (nothing); the other mix modes draw as copy.
+    pub fn set_rop2(&mut self, mode: u32) {
+        self.nop = mode == R2_NOP;
+    }
+
+    /// EMF SETWORLDTRANSFORM (`mode` 4) and MODIFYWORLDTRANSFORM (1 identity, 2 left, 3 right, 4 set).
+    /// An unknown mode leaves the world transform as it was.
+    pub fn modify_world(&mut self, x: Xform, mode: u32) {
+        match mode {
+            1 => self.map.world = IDENTITY,
+            2 => self.map.world = mul(x, self.map.world),
+            3 => self.map.world = mul(self.map.world, x),
+            4 => self.map.world = x,
+            _ => {}
+        }
+    }
+
+    /// Pushes the drawing state. Past [`MAX_STACK`] levels the parse stops, since later restores
+    /// could no longer match the file.
+    pub fn save_dc(&mut self) {
+        if self.saved.len() < MAX_STACK {
+            self.saved.push(Saved { map: self.map, pen: self.pen, brush: self.brush, even_odd: self.even_odd, nop: self.nop });
+        } else {
+            self.full = true;
+        }
+    }
+
+    /// Negative `n` pops `-n` levels; positive `n` restores absolute level `n`.
+    pub fn restore_dc(&mut self, n: i32) {
+        let idx = if n < 0 { self.saved.len().checked_sub(n.unsigned_abs() as usize) } else { (n as usize).checked_sub(1) };
+        let Some(idx) = idx else { return };
+        let Some(s) = self.saved.get(idx).cloned() else { return };
+        self.saved.truncate(idx);
+        self.map = s.map;
+        self.pen = s.pen;
+        self.brush = s.brush;
+        self.even_odd = s.even_odd;
+        self.nop = s.nop;
+    }
+
+    /// Stores an object in `slot` (EMF index), or in the first free slot (WMF handle table).
+    pub fn add_object(&mut self, slot: Option<usize>, obj: Obj) {
+        match slot {
+            Some(i) if i < MAX_OBJECTS => {
+                if self.objects.len() <= i {
+                    self.objects.resize(i + 1, None);
+                }
+                if let Some(s) = self.objects.get_mut(i) {
+                    *s = Some(obj);
+                }
+            }
+            Some(_) => {}
+            None => match self.objects.iter().position(Option::is_none) {
+                Some(i) => {
+                    if let Some(s) = self.objects.get_mut(i) {
+                        *s = Some(obj);
+                    }
+                }
+                None if self.objects.len() < MAX_OBJECTS => self.objects.push(Some(obj)),
+                None => {}
+            },
+        }
+    }
+
+    pub fn delete_object(&mut self, i: u32) {
+        if let Some(s) = self.objects.get_mut(i as usize) {
+            *s = None;
+        }
+    }
+
+    /// Selects an object by index; indices with the high bit set are stock objects.
+    pub fn select(&mut self, i: u32) {
+        if i & STOCK != 0 {
+            return self.select_stock(i & !STOCK);
+        }
+        match self.objects.get(i as usize).copied().flatten() {
+            Some(Obj::Pen(p)) => self.pen = p,
+            Some(Obj::Brush(b)) => self.brush = b,
+            Some(Obj::Other) | None => {}
+        }
+    }
+
+    fn select_stock(&mut self, i: u32) {
+        let white = [255, 255, 255, 255];
+        let black = [0, 0, 0, 255];
+        let gray = |v: u8| Brush { style: BS_SOLID, color: [v, v, v, 255] };
+        match i {
+            0 | 18 => self.brush = Brush { style: BS_SOLID, color: white },
+            1 => self.brush = gray(192),
+            2 => self.brush = gray(128),
+            3 => self.brush = gray(64),
+            4 => self.brush = Brush { style: BS_SOLID, color: black },
+            5 => self.brush = Brush { style: BS_NULL, color: black },
+            6 => self.pen = Pen { style: 0, width: 0.0, color: white },
+            7 | 19 => self.pen = Pen { style: 0, width: 0.0, color: black },
+            8 => self.pen = Pen { style: PS_NULL, width: 0.0, color: black },
+            _ => {}
+        }
+    }
+
+    fn map_op(&self, op: Op) -> Op {
+        match op {
+            Op::M(p) => Op::M(self.map.device(p)),
+            Op::L(p) => Op::L(self.map.device(p)),
+            Op::C(a, b, c) => Op::C(self.map.device(a), self.map.device(b), self.map.device(c)),
+            Op::Z => Op::Z,
+        }
+    }
+
+    fn fill_color(&self) -> Option<[u8; 4]> {
+        (self.brush.style == BS_SOLID).then_some(self.brush.color)
+    }
+
+    fn stroke_pen(&self) -> Option<([u8; 4], f64)> {
+        if (self.pen.style & PS_STYLE_MASK) == PS_NULL {
+            return None;
+        }
+        // A cosmetic pen (width 0) stays 0: the renderers draw that as a hairline.
+        let w = if self.pen.width == 0.0 { 0.0 } else { self.pen.width.abs() * self.map.scale() };
+        Some((self.pen.color, w))
+    }
+
+    fn push_path_ops(&mut self, ops: impl IntoIterator<Item = Op>) {
+        for op in ops {
+            if self.path.len() >= MAX_PATH_OPS {
+                return;
+            }
+            self.path.push(op);
+        }
+    }
+
+    /// Draws logical-space ops with the current pen (`stroke`) and brush (`fill`), or appends them to
+    /// the open path bracket, where fill and stroke wait for FILLPATH/STROKEPATH.
+    pub fn shape(&mut self, ops: &[Op], fill: bool, stroke: bool) {
+        let dev: Vec<Op> = ops.iter().map(|o| self.map_op(*o)).collect();
+        if self.in_path {
+            return self.push_path_ops(dev);
+        }
+        if self.nop {
+            return;
+        }
+        let fill = if fill { self.fill_color() } else { None };
+        let stroke = if stroke { self.stroke_pen() } else { None };
+        if (fill.is_none() && stroke.is_none()) || dev.len() < 2 {
+            return;
+        }
+        let even_odd = self.even_odd;
+        self.push(Raw::Path { ops: dev, fill, stroke, even_odd });
+    }
+
+    pub fn move_to(&mut self, p: P) {
+        if self.in_path {
+            self.push_path_ops([Op::M(self.map.device(p))]);
+        }
+        self.pos = p;
+    }
+
+    /// LINETO from the current point, then moves the current point to `p`.
+    pub fn line_to(&mut self, p: P) {
+        self.line_chain(&[p], false, true);
+    }
+
+    /// Lines from the current point through `pts` (POLYLINETO), or a polyline from the current point.
+    pub fn line_chain(&mut self, pts: &[P], fill: bool, stroke: bool) {
+        // Inside an open bracket the path already ends at the current point, so no MoveTo is needed.
+        let mut ops = if self.in_path && !self.path.is_empty() { Vec::new() } else { vec![Op::M(self.pos)] };
+        ops.extend(pts.iter().map(|p| Op::L(*p)));
+        if let Some(last) = pts.last() {
+            self.pos = *last;
+        }
+        self.shape(&ops, fill, stroke);
+    }
+
+    /// POLYBEZIER: cubic segments that start a new figure at `from`. The current point is unchanged.
+    pub fn bezier(&mut self, from: P, pts: &[P]) {
+        let mut ops = vec![Op::M(from)];
+        ops.extend(cubics(pts));
+        self.shape(&ops, false, true);
+    }
+
+    /// POLYBEZIERTO: cubic segments from the current point through groups of three control or end
+    /// points; the current point moves to the last point. Inside an open bracket the path already
+    /// ends at the current point, so no MoveTo is needed.
+    pub fn bezier_to(&mut self, pts: &[P]) {
+        let mut ops = if self.in_path && !self.path.is_empty() { Vec::new() } else { vec![Op::M(self.pos)] };
+        ops.extend(cubics(pts));
+        if let Some(last) = pts.last() {
+            self.pos = *last;
+        }
+        self.shape(&ops, false, true);
+    }
+
+    pub fn poly(&mut self, pts: &[P], close: bool, fill: bool, stroke: bool) {
+        let Some(first) = pts.first() else { return };
+        let mut ops = vec![Op::M(*first)];
+        ops.extend(pts.iter().skip(1).map(|p| Op::L(*p)));
+        if close {
+            ops.push(Op::Z);
+        }
+        self.shape(&ops, fill, stroke);
+    }
+
+    pub fn begin_path(&mut self) {
+        self.in_path = true;
+        self.path.clear();
+    }
+
+    pub fn end_path(&mut self) {
+        self.in_path = false;
+    }
+
+    pub fn close_figure(&mut self) {
+        if self.in_path {
+            self.push_path_ops([Op::Z]);
+        }
+    }
+
+    /// FILLPATH, STROKEPATH and STROKEANDFILLPATH: paints the bracketed path and empties it.
+    pub fn paint_path(&mut self, fill: bool, stroke: bool) {
+        let ops = std::mem::take(&mut self.path);
+        if self.nop {
+            return;
+        }
+        let fill = if fill { self.fill_color() } else { None };
+        let stroke = if stroke { self.stroke_pen() } else { None };
+        if ops.len() < 2 || (fill.is_none() && stroke.is_none()) {
+            return;
+        }
+        let even_odd = self.even_odd;
+        self.push(Raw::Path { ops, fill, stroke, even_odd });
+    }
+
+    /// Fills a logical rectangle `[l, t, r, b]` with the current brush (nothing when it is not solid).
+    pub fn fill_brush_rect(&mut self, rect: [f64; 4]) {
+        if let Some(color) = self.fill_color() {
+            self.fill_rect_with(rect, color);
+        }
+    }
+
+    /// Fills a logical rectangle `[l, t, r, b]` with a solid colour (ROP fills such as BLACKNESS).
+    pub fn fill_rect_with(&mut self, [l, t, r, b]: [f64; 4], color: [u8; 4]) {
+        let dev: Vec<Op> = crate::geom::rect(l, t, r, b).iter().map(|o| self.map_op(*o)).collect();
+        self.push(Raw::Path { ops: dev, fill: Some(color), stroke: None, even_odd: true });
+    }
+
+    /// Whether a raster operation draws without a source bitmap (PATCOPY, BLACKNESS, WHITENESS).
+    pub fn sourceless(rop: u32) -> bool {
+        matches!(rop, PATCOPY | BLACKNESS | WHITENESS)
+    }
+
+    /// Fills a logical rectangle `[x, y, w, h]` for a source-less raster operation. PATCOPY uses the
+    /// brush (when solid); the others fill black or white. Other operations are not handled here.
+    pub fn fill_rop(&mut self, [x, y, w, h]: [f64; 4], rop: u32) {
+        let rect = [x, y, x + w, y + h];
+        match rop {
+            PATCOPY => self.fill_brush_rect(rect),
+            BLACKNESS => self.fill_rect_with(rect, [0, 0, 0, 255]),
+            WHITENESS => self.fill_rect_with(rect, [255, 255, 255, 255]),
+            _ => {}
+        }
+    }
+
+    /// A bitmap stretched into a logical rectangle `[x, y, w, h]`. A negative extent mirrors the
+    /// bitmap, as the mapping does.
+    pub fn bitmap(&mut self, rect: [f64; 4], mut img: Rgba) {
+        let [x, y, w, h] = rect;
+        let a = self.map.device((x, y));
+        let b = self.map.device((x + w, y + h));
+        crate::dib::flip(&mut img, a.0 > b.0, a.1 > b.1);
+        let dev = [a.0.min(b.0), a.1.min(b.1), (b.0 - a.0).abs(), (b.1 - a.1).abs()];
+        self.push(Raw::Bitmap { rect: dev, img });
+    }
+}
+
+/// Cubic segments from groups of three points (control, control, end). A trailing partial group is
+/// dropped.
+fn cubics(pts: &[P]) -> Vec<Op> {
+    let mut ops = Vec::with_capacity(pts.len() / 3);
+    let mut it = pts.iter().copied();
+    while let (Some(a), Some(b), Some(e)) = (it.next(), it.next(), it.next()) {
+        ops.push(Op::C(a, b, e));
+    }
+    ops
+}

crates/metafile/src/dib.rs

@@ -0,0 +1,259 @@
+//! Device-independent bitmaps. BITMAPINFOHEADER DIBs at 1/4/8/16/24/32 bpp with BI_RGB or BI_BITFIELDS
+//! decode to RGBA8 rows, top-down. Compressed (RLE, JPEG, PNG) and V4/V5-only features are not decoded.
+
+use crate::{MAX_PIXELS, bytes::Bytes};
+
+const BI_RGB: u32 = 0;
+const BI_BITFIELDS: u32 = 3;
+/// Most palette entries a DIB can carry (the colour table never exceeds 2^8).
+const MAX_PALETTE: usize = 256;
+const ROP_SRCAND: u32 = 0x0088_00C6;
+const ROP_SRCPAINT: u32 = 0x00EE_0086;
+const ROP_SRCINVERT: u32 = 0x0066_0046;
+
+/// A decoded picture. `bottom_up` records the DIB's native row order, which source rectangles use.
+pub(crate) struct Rgba {
+    pub w: usize,
+    pub h: usize,
+    pub bottom_up: bool,
+    pub px: Vec<u8>,
+}
+
+/// How a decoded bitmap combines with the destination.
+#[derive(Clone, Copy)]
+pub(crate) enum Blend {
+    /// A raster operation (BITBLT, STRETCHDIB and friends).
+    Rop(u32),
+    /// EMR_ALPHABLEND: a constant alpha (0..=255), times the per-pixel alpha when `per_pixel` is set
+    /// (AC_SRC_ALPHA: the source colours are premultiplied by it).
+    Alpha { constant: u8, per_pixel: bool },
+}
+
+impl Blend {
+    /// Whether the decoder must keep the 32-bit alpha byte of each pixel.
+    pub fn per_pixel(self) -> bool {
+        matches!(self, Blend::Alpha { per_pixel: true, .. })
+    }
+}
+
+struct Header {
+    w: usize,
+    h: usize,
+    top_down: bool,
+    bpp: usize,
+    masks: [u32; 3],
+    pal_off: usize,
+    pal_n: usize,
+}
+
+impl Header {
+    fn read(info: Bytes) -> Option<Header> {
+        let size = info.u32(0)? as usize;
+        let w = info.i32(4)?;
+        let h = info.i32(8)?;
+        let bpp = info.u16(14)? as usize;
+        let comp = info.u32(16)?;
+        let clr_used = info.u32(32)? as usize;
+        if size < 40 || w <= 0 || h == 0 || !matches!(bpp, 1 | 4 | 8 | 16 | 24 | 32) || !matches!(comp, BI_RGB | BI_BITFIELDS) {
+            return None;
+        }
+        let masks = if comp == BI_BITFIELDS {
+            [info.u32(40)?, info.u32(44)?, info.u32(48)?]
+        } else if bpp == 16 {
+            [0x7C00, 0x03E0, 0x001F]
+        } else {
+            [0xFF_0000, 0xFF00, 0xFF]
+        };
+        let masks_len = if comp == BI_BITFIELDS && size == 40 { 12 } else { 0 };
+        let pal_off = size.checked_add(masks_len)?;
+        // Indexed formats take 2^bpp entries when clrUsed is 0. Deeper formats carry only the
+        // entries clrUsed names (WMF DIBs can have them), still capped.
+        let pal_n = match (bpp <= 8, clr_used) {
+            (true, 0) => 1usize << bpp,
+            (true, n) => n.min(1usize << bpp),
+            (false, n) => n.min(MAX_PALETTE),
+        };
+        Some(Header { w: w as usize, h: h.unsigned_abs() as usize, top_down: h < 0, bpp, masks, pal_off, pal_n })
+    }
+}
+
+/// Byte length of the info part (header, masks, palette) of a DIB, so the pixel bits follow it.
+pub(crate) fn info_len(dib: Bytes) -> Option<usize> {
+    let h = Header::read(dib)?;
+    h.pal_off.checked_add(h.pal_n.checked_mul(4)?)
+}
+
+/// Decodes a DIB given as its info part (header plus masks and palette) and its pixel bits. The
+/// 32-bit alpha byte is kept only when `keep_alpha` is set (per-pixel alpha blends); otherwise pixels
+/// are opaque.
+pub(crate) fn decode(info: Bytes, bits: Bytes, keep_alpha: bool) -> Option<Rgba> {
+    let hd = Header::read(info)?;
+    let pixels = hd.w.checked_mul(hd.h)?;
+    if pixels == 0 || pixels > MAX_PIXELS {
+        return None;
+    }
+    let stride = hd.w.checked_mul(hd.bpp)?.checked_add(31)? / 32 * 4;
+    let data = bits.slice(0, stride.checked_mul(hd.h)?)?;
+    let pal = info.slice(hd.pal_off, hd.pal_n * 4)?;
+    let mut px = vec![0u8; pixels * 4];
+    for y in 0..hd.h {
+        let src_row = if hd.top_down { y } else { hd.h - 1 - y };
+        let row = src_row * stride;
+        for x in 0..hd.w {
+            let p = pixel(data, row, x, &hd, pal, keep_alpha)?;
+            let o = (y * hd.w + x) * 4;
+            px.get_mut(o..o + 4)?.copy_from_slice(&p);
+        }
+    }
+    Some(Rgba { w: hd.w, h: hd.h, bottom_up: !hd.top_down, px })
+}
+
+fn pixel(data: &[u8], row: usize, x: usize, hd: &Header, pal: &[u8], keep_alpha: bool) -> Option<[u8; 4]> {
+    let [m_r, m_g, m_b] = hd.masks;
+    let [r, g, b] = match hd.bpp {
+        1 => {
+            let b = *data.get(row + x / 8)?;
+            palette(pal, usize::from((b >> (7 - x % 8)) & 1))
+        }
+        4 => {
+            let b = *data.get(row + x / 2)?;
+            palette(pal, usize::from(if x.is_multiple_of(2) { b >> 4 } else { b & 0x0F }))
+        }
+        8 => palette(pal, usize::from(*data.get(row + x)?)),
+        24 => {
+            let [b, g, r] = data.get(row + x * 3..row + x * 3 + 3)?.try_into().ok()?;
+            [r, g, b]
+        }
+        16 => {
+            let o = row + x * 2;
+            let v = u32::from(u16::from_le_bytes(data.get(o..o + 2)?.try_into().ok()?));
+            [field(v, m_r), field(v, m_g), field(v, m_b)]
+        }
+        _ => {
+            let o = row + x * 4;
+            let v = u32::from_le_bytes(data.get(o..o + 4)?.try_into().ok()?);
+            let a = if keep_alpha { (v >> 24) as u8 } else { 255 };
+            return Some([field(v, m_r), field(v, m_g), field(v, m_b), a]);
+        }
+    };
+    Some([r, g, b, 255])
+}
+
+/// Palette entries are BGRX quads; an index past the table reads as black rather than failing the image.
+fn palette(pal: &[u8], i: usize) -> [u8; 3] {
+    pal.get(i * 4..i * 4 + 4).and_then(|c| <[u8; 4]>::try_from(c).ok()).map_or([0, 0, 0], |c| [c[2], c[1], c[0]])
+}
+
+/// Extracts one channel from a masked pixel value and scales it to 8 bits.
+fn field(v: u32, mask: u32) -> u8 {
+    if mask == 0 {
+        return 0;
+    }
+    let shift = mask.trailing_zeros();
+    let max = u64::from(mask >> shift);
+    let val = u64::from((v & mask) >> shift);
+    ((val * 255 + max / 2) / max) as u8
+}
+
+/// Clips a source rectangle `src` = `[x, y, w, h]` to the bitmap and returns the cropped pixels (top-down)
+/// with the part of the destination `dst` that they fill. `src` is in DIB pixel coordinates (`y` counted
+/// from the DIB's origin, so bottom-up images count from the bottom); a non-positive source size means the
+/// whole bitmap. Clipping shrinks the destination by the same ratio and shifts it by the clipped-off part,
+/// so the rest of the image keeps its place. A negative destination extent is kept (the caller mirrors).
+pub(crate) fn clip_blit(img: &Rgba, src: [i64; 4], dst: [f64; 4]) -> Option<(Rgba, [f64; 4])> {
+    let (iw, ih) = (img.w as i64, img.h as i64);
+    let [sx, sy, sw, sh] = if src[2] > 0 && src[3] > 0 { src } else { [0, 0, iw, ih] };
+    // The request's top row in top-down order.
+    let top = if img.bottom_up { ih.saturating_sub(sy).saturating_sub(sh) } else { sy };
+    let (x0, x1) = (sx.max(0), sx.saturating_add(sw).min(iw));
+    let (r0, r1) = (top.max(0), top.saturating_add(sh).min(ih));
+    if x1 <= x0 || r1 <= r0 {
+        return None;
+    }
+    let (kx, ky) = (dst[2] / sw as f64, dst[3] / sh as f64);
+    let out = [dst[0] + (x0 - sx) as f64 * kx, dst[1] + (r0 - top) as f64 * ky, (x1 - x0) as f64 * kx, (r1 - r0) as f64 * ky];
+    let (x0, x1, r0, r1) = (x0 as usize, x1 as usize, r0 as usize, r1 as usize);
+    let (ow, oh) = (x1 - x0, r1 - r0);
+    let mut px = Vec::with_capacity(ow * oh * 4);
+    for row in r0..r1 {
+        let s = (row * img.w + x0) * 4;
+        px.extend_from_slice(img.px.get(s..s + ow * 4)?);
+    }
+    Some((Rgba { w: ow, h: oh, bottom_up: false, px }, out))
+}
+
+/// Applies a blend to decoded pixels before they are drawn. The picture has no destination pixels, so
+/// raster operations are drawn as they look over white paper: SRCAND (destination AND source) leaves
+/// white source pixels out and draws the rest; SRCPAINT and SRCINVERT leave black ones out. Other
+/// operations draw the source as copied. Constant alpha scales every pixel's alpha, after a
+/// per-pixel (premultiplied) source is made straight.
+pub(crate) fn prepare(img: &mut Rgba, blend: Blend) {
+    match blend {
+        Blend::Rop(ROP_SRCAND) => clear_where(img, [255, 255, 255]),
+        Blend::Rop(ROP_SRCPAINT | ROP_SRCINVERT) => clear_where(img, [0, 0, 0]),
+        Blend::Rop(_) => {}
+        Blend::Alpha { constant, per_pixel } => {
+            for p in img.px.as_chunks_mut::<4>().0 {
+                if per_pixel {
+                    unpremultiply(p);
+                }
+                p[3] = (u16::from(p[3]) * u16::from(constant) / 255) as u8;
+            }
+        }
+    }
+}
+
+/// Makes the pixels of colour `rgb` transparent: where a raster operation keeps the destination.
+fn clear_where(img: &mut Rgba, rgb: [u8; 3]) {
+    for p in img.px.as_chunks_mut::<4>().0 {
+        if p[..3] == rgb {
+            p[3] = 0;
+        }
+    }
+}
+
+/// AC_SRC_ALPHA sources are premultiplied; the model holds straight RGBA, so divide the colour by the
+/// alpha (rounded, capped at 255). A transparent pixel keeps its colour bytes.
+fn unpremultiply(p: &mut [u8; 4]) {
+    let a = u32::from(p[3]);
+    if a == 0 || a == 255 {
+        return;
+    }
+    for c in &mut p[..3] {
+        *c = ((u32::from(*c) * 255 + a / 2) / a).min(255) as u8;
+    }
+}
+
+/// Mirrors a decoded image left-right and/or top-bottom. Rows come from the buffer as chunks, so a
+/// short buffer flips only the rows it has.
+pub(crate) fn flip(img: &mut Rgba, horizontal: bool, vertical: bool) {
+    let (w, h) = (img.w, img.h);
+    if w == 0 || h == 0 {
+        return;
+    }
+    let row = w * 4;
+    if horizontal {
+        for line in img.px.chunks_exact_mut(row) {
+            for x in 0..w / 2 {
+                for c in 0..4 {
+                    line.swap(x * 4 + c, (w - 1 - x) * 4 + c);
+                }
+            }
+        }
+    }
+    if vertical {
+        // Rows the buffer actually holds: a short buffer flips only those.
+        let n = h.min(img.px.len() / row);
+        for y in 0..n / 2 {
+            swap_rows(&mut img.px, y * row, (n - 1 - y) * row, row);
+        }
+    }
+}
+
+/// Swaps the `len` bytes at `a` with those at `b` (`a < b`); does nothing when either is out of range.
+fn swap_rows(px: &mut [u8], a: usize, b: usize, len: usize) {
+    let Some((head, tail)) = px.split_at_mut_checked(b) else { return };
+    if let (Some(top), Some(bottom)) = (head.get_mut(a..a.saturating_add(len)), tail.get_mut(..len)) {
+        top.swap_with_slice(bottom);
+    }
+}

crates/metafile/src/emf.rs

@@ -0,0 +1,315 @@
+//! EMF reader (MS-EMF). Records are (type, size in bytes) followed by a payload; offsets inside a
+//! record (bitmap info and bits) are relative to the record start, so each handler reads the record slice.
+
+use crate::bytes::Bytes;
+use crate::canvas::{BS_NULL, Brush, Canvas, Obj, PS_NULL, PS_STYLE_MASK, Pen, Xform, colorref};
+use crate::dib::{self, Blend};
+use crate::geom::{self, ArcKind, P};
+use crate::{Error, Frame, MAX_PATH_OPS};
+
+const EMF_SIGNATURE: u32 = 0x464D_4520;
+/// Hundredths of a millimetre to points.
+const HMM_TO_PT: f64 = 72.0 / 2540.0;
+/// SRCCOPY, the plain copy of a bitmap.
+const SRCCOPY: u32 = 0x00CC_0020;
+/// LogPenEx pen type bits; PS_COSMETIC pens are one device pixel wide.
+const PS_TYPE_MASK: u32 = 0x000F_0000;
+const PS_COSMETIC: u32 = 0;
+
+pub(crate) fn is_emf(b: Bytes) -> bool {
+    b.u32(0) == Some(1) && b.u32(40) == Some(EMF_SIGNATURE)
+}
+
+/// The picture frame: `rclFrame` (0.01 mm) mapped to device units through `szlDevice` and
+/// `szlMillimeters`, sized in points. Without a usable frame, the device bounds stand in (1 unit = 1 point).
+pub(crate) fn parse(input: Bytes) -> Result<(Canvas, Option<Frame>), Error> {
+    if !is_emf(input) {
+        return Err(Error::BadHeader);
+    }
+    let hsize = input.u32(4).ok_or(Error::BadHeader)? as usize;
+    let bounds = rect32(input, 8).ok_or(Error::BadHeader)?;
+    let [l, t, r, b] = bounds;
+    let frame = frame_from_header(input).or_else(|| (r > l && b > t).then_some(Frame { rect: [l, t, r - l, b - t], size: None }));
+    let mut cv = Canvas::new();
+    if let Some(px_mm) = device_px_per_mm(input) {
+        cv.set_device_mm(px_mm);
+    }
+    let mut parsed = 0usize;
+    let mut pos = hsize.max(88);
+    while !cv.full() {
+        let (Some(typ), Some(size)) = (input.u32(pos), pos.checked_add(4).and_then(|o| input.u32(o))) else { break };
+        let size = size as usize;
+        if size < 8 || !size.is_multiple_of(4) {
+            break;
+        }
+        let Some(rec) = input.slice(pos, size) else { break };
+        if typ == 14 {
+            break;
+        }
+        record(&mut cv, typ, Bytes(rec));
+        parsed += 1;
+        let Some(next) = pos.checked_add(size) else { break };
+        pos = next;
+    }
+    if parsed == 0 {
+        return Err(Error::NoRecords);
+    }
+    Ok((cv, frame))
+}
+
+/// Device pixels per millimetre on each axis, from `szlDevice` (72) and `szlMillimeters` (80).
+fn device_px_per_mm(input: Bytes) -> Option<(f64, f64)> {
+    let (dw, dh) = (input.i32(72)?, input.i32(76)?);
+    let (mw, mh) = (input.i32(80)?, input.i32(84)?);
+    (dw > 0 && dh > 0 && mw > 0 && mh > 0).then(|| (f64::from(dw) / f64::from(mw), f64::from(dh) / f64::from(mh)))
+}
+
+/// The frame from `rclFrame` (offset 24), `szlDevice` (72) and `szlMillimeters` (80) in the header.
+fn frame_from_header(input: Bytes) -> Option<Frame> {
+    let [fl, ft, fr, fb] = rect32(input, 24)?;
+    if fr <= fl || fb <= ft {
+        return None;
+    }
+    // Device units per hundredth of a millimetre.
+    let (px_mm_x, px_mm_y) = device_px_per_mm(input)?;
+    let (sx, sy) = (px_mm_x / 100.0, px_mm_y / 100.0);
+    let rect = [fl * sx, ft * sy, (fr - fl) * sx, (fb - ft) * sy];
+    Some(Frame { rect, size: Some(((fr - fl) * HMM_TO_PT, (fb - ft) * HMM_TO_PT)) })
+}
+
+fn record(cv: &mut Canvas, typ: u32, r: Bytes) {
+    if cv.full() {
+        return;
+    }
+    let _ = match typ {
+        9 => xy32(r, 8).map(|p| cv.set_window_ext(p)),
+        10 => xy32(r, 8).map(|p| cv.set_window_org(p)),
+        11 => xy32(r, 8).map(|p| cv.set_viewport_ext(p)),
+        12 => xy32(r, 8).map(|p| cv.set_viewport_org(p)),
+        17 => r.u32(8).map(|m| cv.set_map_mode(m)),
+        19 => r.u32(8).map(|m| cv.set_polyfill(m)),
+        20 => r.u32(8).map(|m| cv.set_rop2(m)),
+        33 => {
+            cv.save_dc();
+            Some(())
+        }
+        34 => r.i32(8).map(|n| cv.restore_dc(n)),
+        35 => xform(r, 8).map(|x| cv.modify_world(x, 4)),
+        36 => xform(r, 8).zip(r.u32(32)).map(|(x, m)| cv.modify_world(x, m)),
+        37 => r.u32(8).map(|i| cv.select(i)),
+        38 => create_pen(cv, r),
+        95 => create_ext_pen(cv, r),
+        39 => create_brush(cv, r),
+        40 => r.u32(8).map(|i| cv.delete_object(i)),
+        27 => xy32(r, 8).map(|p| cv.move_to(p)),
+        54 => xy32(r, 8).map(|p| cv.line_to(p)),
+        42 => rect32(r, 8).map(|[l, t, rr, b]| cv.shape(&geom::ellipse(l, t, rr, b), true, true)),
+        43 => rect32(r, 8).map(|[l, t, rr, b]| cv.shape(&geom::rect(l, t, rr, b), true, true)),
+        44 => {
+            let (cw, ch) = (r.i32(24), r.i32(28));
+            let (Some(cw), Some(ch)) = (cw, ch) else { return };
+            rect32(r, 8).map(|[l, t, rr, b]| {
+                cv.shape(&geom::round_rect(l, t, rr, b, f64::from(cw), f64::from(ch)), true, true);
+            })
+        }
+        45..=47 => arc32(r).map(|(bounds, s, e)| {
+            let kind = match typ {
+                45 => ArcKind::Arc,
+                46 => ArcKind::Chord,
+                _ => ArcKind::Pie,
+            };
+            let [l, t, rr, b] = bounds;
+            cv.shape(&geom::arc_shape(l, t, rr, b, s, e, kind), kind != ArcKind::Arc, true);
+        }),
+        4 | 87 => counted(r, typ == 4).map(|pts| cv.poly(&pts, false, false, true)),
+        3 | 86 => counted(r, typ == 3).map(|pts| cv.poly(&pts, true, true, true)),
+        6 | 89 => counted(r, typ == 6).map(|pts| cv.line_chain(&pts, false, true)),
+        // POLYBEZIER starts its own figure at the first point and leaves the current point alone;
+        // POLYBEZIERTO continues from the current point.
+        2 | 85 => counted(r, typ == 2).and_then(|pts| {
+            let from = *pts.first()?;
+            cv.bezier(from, pts.get(1..)?);
+            Some(())
+        }),
+        5 | 88 => counted(r, typ == 5).map(|pts| cv.bezier_to(&pts)),
+        7 | 90 => poly_groups(r, typ == 7).map(|(counts, pts)| cv.shape(&geom::subpaths(&pts, &counts, false), false, true)),
+        8 | 91 => poly_groups(r, typ == 8).map(|(counts, pts)| cv.shape(&geom::subpaths(&pts, &counts, true), true, true)),
+        59 => {
+            cv.begin_path();
+            Some(())
+        }
+        60 => {
+            cv.end_path();
+            Some(())
+        }
+        61 => {
+            cv.close_figure();
+            Some(())
+        }
+        62 => {
+            cv.paint_path(true, false);
+            Some(())
+        }
+        63 => {
+            cv.paint_path(true, true);
+            Some(())
+        }
+        64 => {
+            cv.paint_path(false, true);
+            Some(())
+        }
+        76 | 77 => bitblt(cv, r, typ == 77),
+        80 => set_dibits(cv, r),
+        81 => stretch_dibits(cv, r),
+        114 => alphablend(cv, r),
+        _ => Some(()),
+    };
+}
+
+/// Two little-endian i32 values at `off`, as a point.
+fn xy32(r: Bytes, off: usize) -> Option<P> {
+    Some((f64::from(r.i32(off)?), f64::from(r.i32(off + 4)?)))
+}
+
+/// RECTL (left, top, right, bottom) as i32 values widened to f64.
+fn rect32(r: Bytes, off: usize) -> Option<[f64; 4]> {
+    Some([f64::from(r.i32(off)?), f64::from(r.i32(off + 4)?), f64::from(r.i32(off + 8)?), f64::from(r.i32(off + 12)?)])
+}
+
+/// An i32 field as f64; 0 past the end.
+fn i32s(r: Bytes, off: usize) -> f64 {
+    r.i32(off).map_or(0.0, f64::from)
+}
+
+/// XFORM: six f32 values in M11, M12, M21, M22, Dx, Dy order.
+fn xform(r: Bytes, off: usize) -> Option<Xform> {
+    let mut x = [0.0f64; 6];
+    for (i, v) in x.iter_mut().enumerate() {
+        *v = f64::from(r.f32(off + i * 4)?);
+    }
+    Some(x)
+}
+
+/// ARC, CHORD, PIE: bounds at 8, start point at 24, end point at 32.
+fn arc32(r: Bytes) -> Option<([f64; 4], P, P)> {
+    Some((rect32(r, 8)?, xy32(r, 24)?, xy32(r, 32)?))
+}
+
+/// A point count from a record, rejected when it exceeds the path budget (before any allocation).
+fn budget(n: u32) -> Option<usize> {
+    let n = n as usize;
+    (n <= MAX_PATH_OPS).then_some(n)
+}
+
+/// Point count at 24, then the points (32-bit or 16-bit) at 28.
+fn counted(r: Bytes, wide: bool) -> Option<Vec<P>> {
+    let n = budget(r.u32(24)?)?;
+    r.tail(28)?.points(0, n, wide)
+}
+
+/// Subpath count at 24, total point count at 28, per-subpath counts at 32, then the points.
+fn poly_groups(r: Bytes, wide: bool) -> Option<(Vec<usize>, Vec<P>)> {
+    let n = budget(r.u32(24)?)?;
+    // The record must hold the n counts before anything is allocated for them.
+    let raw = r.slice(32, n.checked_mul(4)?)?;
+    let counts: Vec<usize> = raw.as_chunks::<4>().0.iter().map(|c| u32::from_le_bytes(*c) as usize).collect();
+    let total = counts.iter().try_fold(0usize, |a, c| a.checked_add(*c))?;
+    let total = budget(u32::try_from(total).ok()?)?;
+    let pts = r.tail(n.checked_mul(4)?.checked_add(32)?)?.points(0, total, wide)?;
+    Some((counts, pts))
+}
+
+/// EMR_CREATEPEN: handle, LogPen (style, width x/y, colour).
+fn create_pen(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let style = r.u32(12)?;
+    let width = r.i32(16)?;
+    let color = r.u32(24)?;
+    cv.add_object(Some(slot), Obj::Pen(Pen { style, width: f64::from(width), color: colorref(color) }));
+    Some(())
+}
+
+/// EMR_EXTCREATEPEN: handle, bitmap offsets (unused), LogPenEx (style, width, brush style, colour).
+/// A cosmetic pen's width is in device pixels (always 1), so it is a hairline; a BS_NULL brush draws
+/// no line at all.
+fn create_ext_pen(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let (style, width, brush, color) = (r.u32(28)?, r.u32(32)?, r.u32(36)?, r.u32(40)?);
+    let width = if style & PS_TYPE_MASK == PS_COSMETIC { 0.0 } else { f64::from(width) };
+    let style = if brush == BS_NULL { PS_NULL } else { style & PS_STYLE_MASK };
+    cv.add_object(Some(slot), Obj::Pen(Pen { style, width, color: colorref(color) }));
+    Some(())
+}
+
+/// EMR_CREATEBRUSHINDIRECT: handle, LogBrush32 (style, colour, hatch).
+fn create_brush(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let style = r.u32(12)?;
+    let color = r.u32(16)?;
+    cv.add_object(Some(slot), Obj::Brush(Brush { style, color: colorref(color) }));
+    Some(())
+}
+
+/// BITBLT (76) and STRETCHBLT (77): dest at 24..40, rop at 40, source x/y at 44, bmi at 84, bits at
+/// 92; STRETCHBLT adds the source w/h at 100. A source-less rop fills the destination instead.
+fn bitblt(cv: &mut Canvas, r: Bytes, stretch: bool) -> Option<()> {
+    let dst = [i32s(r, 24), i32s(r, 28), i32s(r, 32), i32s(r, 36)];
+    let rop = r.u32(40)?;
+    if Canvas::sourceless(rop) {
+        cv.fill_rop(dst, rop);
+        return Some(());
+    }
+    let (sw, sh) = if stretch { (i32s(r, 100), i32s(r, 104)) } else { (dst[2], dst[3]) };
+    let src = [i32s(r, 44), i32s(r, 48), sw, sh];
+    blit(cv, r, dst, src, (84, 92), Blend::Rop(rop))
+}
+
+/// ALPHABLEND: laid out like STRETCHBLT, with a BLENDFUNCTION at 40. Constant alpha at 42 applies to
+/// every pixel; AlphaFormat at 43 with AC_SRC_ALPHA (1) also uses the per-pixel alpha.
+fn alphablend(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let dst = [i32s(r, 24), i32s(r, 28), i32s(r, 32), i32s(r, 36)];
+    let constant = *r.0.get(42)?;
+    let per_pixel = (*r.0.get(43)? & 0x01) != 0;
+    let src = [i32s(r, 44), i32s(r, 48), i32s(r, 100), i32s(r, 104)];
+    blit(cv, r, dst, src, (84, 92), Blend::Alpha { constant, per_pixel })
+}
+
+/// STRETCHDIBITS: dest x/y at 24, src x/y/w/h at 32..48, bmi offset/size at 48, bits at 56, rop at 68,
+/// dest w/h at 72.
+fn stretch_dibits(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let dst = [i32s(r, 24), i32s(r, 28), i32s(r, 72), i32s(r, 76)];
+    let src = [i32s(r, 32), i32s(r, 36), i32s(r, 40), i32s(r, 44)];
+    let rop = r.u32(68)?;
+    blit(cv, r, dst, src, (48, 56), Blend::Rop(rop))
+}
+
+/// SETDIBITSTODEVICE (MS-EMF 2.3.1.5): dest x/y at 24, src x/y at 32, size (cxSrc, cySrc) at 40, bmi
+/// at 48, bits at 56, start scan at 68. The image keeps its own size; the bits begin at scan line
+/// `iStartScan`, so the source y counts from there.
+fn set_dibits(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let (cx, cy) = (i32s(r, 40), i32s(r, 44));
+    if cx <= 0.0 || cy <= 0.0 {
+        return None;
+    }
+    let dst = [i32s(r, 24), i32s(r, 28), cx, cy];
+    let src = [i32s(r, 32), i32s(r, 36) - f64::from(r.u32(68)?), cx, cy];
+    blit(cv, r, dst, src, (48, 56), Blend::Rop(SRCCOPY))
+}
+
+/// Decodes the bitmap at `at` = (offset of the bmi offset/length pair, offset of the bits pair), both
+/// inside the record, and stretches the source rectangle `src` into `dst`. Both are `[x, y, w, h]`; a
+/// non-positive source size means the whole bitmap. `blend` decides how it combines.
+fn blit(cv: &mut Canvas, r: Bytes, dst: [f64; 4], src: [f64; 4], at: (usize, usize), blend: Blend) -> Option<()> {
+    let (bo, bl) = (r.u32(at.0)? as usize, r.u32(at.0 + 4)? as usize);
+    let (po, pl) = (r.u32(at.1)? as usize, r.u32(at.1 + 4)? as usize);
+    if pl == 0 {
+        return None;
+    }
+    let info = Bytes(r.slice(bo, bl)?);
+    let pixels = Bytes(r.slice(po, pl)?);
+    let mut img = dib::decode(info, pixels, blend.per_pixel())?;
+    dib::prepare(&mut img, blend);
+    let (img, dst) = dib::clip_blit(&img, src.map(|v| v as i64), dst)?;
+    cv.bitmap(dst, img);
+    Some(())
+}

crates/metafile/src/geom.rs

@@ -0,0 +1,118 @@
+//! Path operations in `f64` and the shape builders that turn WMF/EMF rectangles, ellipses and arcs
+//! into cubic Béziers (the classic 4/3·tan(Δ/4) approximation, at most 90° per piece).
+
+use std::f64::consts::{FRAC_PI_2, PI, TAU};
+
+pub(crate) type P = (f64, f64);
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum Op {
+    M(P),
+    L(P),
+    C(P, P, P),
+    Z,
+}
+
+pub(crate) fn rect(l: f64, t: f64, r: f64, b: f64) -> Vec<Op> {
+    vec![Op::M((l, t)), Op::L((r, t)), Op::L((r, b)), Op::L((l, b)), Op::Z]
+}
+
+/// Corner radii are half the EMF/WMF corner ellipse size, clamped so the corners never overlap.
+pub(crate) fn round_rect(l: f64, t: f64, r: f64, b: f64, ew: f64, eh: f64) -> Vec<Op> {
+    // Reversed corners (right < left, bottom < top) describe the same rectangle.
+    let (l, r) = (l.min(r), l.max(r));
+    let (t, b) = (t.min(b), t.max(b));
+    let rx = (ew / 2.0).abs().min((r - l) / 2.0);
+    let ry = (eh / 2.0).abs().min((b - t) / 2.0);
+    let mut ops = vec![Op::M((l + rx, t)), Op::L((r - rx, t))];
+    ops.extend(arc(r - rx, t + ry, rx, ry, -FRAC_PI_2, FRAC_PI_2));
+    ops.push(Op::L((r, b - ry)));
+    ops.extend(arc(r - rx, b - ry, rx, ry, 0.0, FRAC_PI_2));
+    ops.push(Op::L((l + rx, b)));
+    ops.extend(arc(l + rx, b - ry, rx, ry, FRAC_PI_2, FRAC_PI_2));
+    ops.push(Op::L((l, t + ry)));
+    ops.extend(arc(l + rx, t + ry, rx, ry, PI, FRAC_PI_2));
+    ops.push(Op::Z);
+    ops
+}
+
+pub(crate) fn ellipse(l: f64, t: f64, r: f64, b: f64) -> Vec<Op> {
+    let (cx, cy, rx, ry) = center(l, t, r, b);
+    let mut ops = vec![Op::M((cx + rx, cy))];
+    ops.extend(arc(cx, cy, rx, ry, 0.0, TAU));
+    ops.push(Op::Z);
+    ops
+}
+
+/// Which closed or open shape an ARC/CHORD/PIE record draws.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ArcKind {
+    Arc,
+    Chord,
+    Pie,
+}
+
+/// ARC, CHORD and PIE: the arc runs counter-clockwise on screen from the start point to the end point.
+pub(crate) fn arc_shape(l: f64, t: f64, r: f64, b: f64, s: P, e: P, kind: ArcKind) -> Vec<Op> {
+    let (cx, cy, rx, ry) = center(l, t, r, b);
+    let ang = |p: P| ((p.1 - cy) / ry.max(f64::MIN_POSITIVE)).atan2((p.0 - cx) / rx.max(f64::MIN_POSITIVE));
+    let (a0, a1) = (ang(s), ang(e));
+    let mut d = (a0 - a1).rem_euclid(TAU);
+    if d < 1e-12 {
+        d = TAU;
+    }
+    let sweep = -d;
+    let start = (cx + rx * a0.cos(), cy + ry * a0.sin());
+    let mut ops = if kind == ArcKind::Pie { vec![Op::M((cx, cy)), Op::L(start)] } else { vec![Op::M(start)] };
+    ops.extend(arc(cx, cy, rx, ry, a0, sweep));
+    match kind {
+        ArcKind::Arc => {}
+        ArcKind::Chord => ops.push(Op::Z),
+        ArcKind::Pie => ops.extend([Op::L((cx, cy)), Op::Z]),
+    }
+    ops
+}
+
+fn center(l: f64, t: f64, r: f64, b: f64) -> (f64, f64, f64, f64) {
+    ((l + r) / 2.0, (t + b) / 2.0, (r - l).abs() / 2.0, (b - t).abs() / 2.0)
+}
+
+/// Cubic pieces along an ellipse from parameter `a0` over signed `sweep` radians. The current point
+/// must already be at `(cx + rx cos a0, cy + ry sin a0)`.
+fn arc(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, sweep: f64) -> Vec<Op> {
+    let n = ((sweep.abs() / FRAC_PI_2).ceil() as usize).clamp(1, 8);
+    let step = sweep / n as f64;
+    let k = 4.0 / 3.0 * (step / 4.0).tan();
+    let pt = |t: f64| (cx + rx * t.cos(), cy + ry * t.sin());
+    let mut ops = Vec::with_capacity(n);
+    for i in 0..n {
+        let t0 = a0 + step * i as f64;
+        let t1 = t0 + step;
+        let (p0, p3) = (pt(t0), pt(t1));
+        let c1 = (p0.0 - k * rx * t0.sin(), p0.1 + k * ry * t0.cos());
+        let c2 = (p3.0 + k * rx * t1.sin(), p3.1 - k * ry * t1.cos());
+        ops.push(Op::C(c1, c2, p3));
+    }
+    ops
+}
+
+/// Consecutive subpaths: `counts[i]` points each, taken in order from `pts`. Counts that run past the
+/// point list are cut short rather than failing the whole record.
+pub(crate) fn subpaths(pts: &[P], counts: &[usize], close: bool) -> Vec<Op> {
+    let mut ops = Vec::with_capacity(pts.len() + counts.len());
+    let mut at = 0usize;
+    for &c in counts {
+        let end = at.saturating_add(c).min(pts.len());
+        let Some((first, rest)) = pts.get(at..end).and_then(|s| s.split_first()) else {
+            at = end;
+            continue;
+        };
+        ops.push(Op::M(*first));
+        ops.extend(rest.iter().map(|p| Op::L(*p)));
+        if close {
+            ops.push(Op::Z);
+        }
+        at = end;
+    }
+    ops
+}

crates/metafile/src/lib.rs

@@ -0,0 +1,208 @@
+//! DeckCraft metafiles (ported from WordCraft's `crates/metafile`): reads Windows Metafiles (WMF)
+//! and Enhanced Metafiles (EMF) into a neutral vector model of filled and stroked paths and RGBA
+//! bitmaps, in a picture frame with y down.
+//!
+//! The reader is pure Rust over byte slices (no file system), so it builds for wasm. Every read is
+//! bounds-checked and every count is capped; hostile input yields a shorter picture or an [`Error`],
+//! never a panic.
+//!
+//! Records follow MS-WMF and MS-EMF. Records outside the supported set are skipped silently.
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+#![forbid(unsafe_code)]
+
+mod bytes;
+mod canvas;
+mod dib;
+mod emf;
+mod geom;
+mod place;
+mod wmf;
+
+#[cfg(test)]
+mod tests;
+
+use bytes::Bytes;
+use canvas::Raw;
+use geom::{Op, P};
+pub use place::{MAX_BITMAP_SIDE, PlacedItem};
+
+/// Items kept from one file. Past the cap the parse stops and keeps what it has.
+pub(crate) const MAX_ITEMS: usize = 200_000;
+/// Object table slots (WMF handles, EMF object indices).
+pub(crate) const MAX_OBJECTS: usize = 4096;
+/// Largest bitmap in pixels (about 40 megapixels, 160 MB of RGBA).
+pub(crate) const MAX_PIXELS: usize = 40_000_000;
+/// DC save-stack depth.
+pub(crate) const MAX_STACK: usize = 1024;
+/// Points in one open path bracket.
+pub(crate) const MAX_PATH_OPS: usize = 2_000_000;
+/// Bytes of path ops and pixels kept from one file (about 256 MB).
+pub(crate) const MAX_BYTES: usize = 256 * 1024 * 1024;
+
+/// A parsed metafile. Items use coordinates in `0..width` and `0..height`, y down.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Picture {
+    /// Size of the drawing in its own units: points for placeable WMF and EMF (from the frame), device
+    /// or logical units otherwise.
+    pub width: f32,
+    pub height: f32,
+    pub items: Vec<Item>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Item {
+    /// A filled and/or stroked path, in picture coordinates.
+    Path {
+        segs: Vec<Seg>,
+        fill: Option<[u8; 4]>,
+        /// Colour and width in picture units.
+        stroke: Option<([u8; 4], f32)>,
+        even_odd: bool,
+    },
+    /// A bitmap stretched into `rect` = `[x, y, w, h]` (picture units), RGBA8 rows top-down.
+    Bitmap { rect: [f32; 4], width: u32, height: u32, rgba: Vec<u8> },
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Seg {
+    Move(f32, f32),
+    Line(f32, f32),
+    Cubic(f32, f32, f32, f32, f32, f32),
+    Close,
+}
+
+#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq)]
+pub enum Error {
+    #[error("not a WMF or EMF file")]
+    NotMetafile,
+    #[error("metafile header is truncated or invalid")]
+    BadHeader,
+    #[error("metafile has no readable records")]
+    NoRecords,
+}
+
+/// The picture frame in device units (`rect` = `[x, y, w, h]`) and, when the file states one, its
+/// size in picture units.
+pub(crate) struct Frame {
+    pub rect: [f64; 4],
+    pub size: Option<(f64, f64)>,
+}
+
+/// Parses a WMF (placeable or plain) or EMF file.
+pub fn parse(bytes: &[u8]) -> Result<Picture, Error> {
+    let b = Bytes(bytes);
+    let (cv, frame) = if emf::is_emf(b) {
+        emf::parse(b)?
+    } else if wmf::is_wmf(b) {
+        wmf::parse(b)?
+    } else {
+        return Err(Error::NotMetafile);
+    };
+    Ok(build(cv.items, frame))
+}
+
+/// True when the bytes start like a WMF (placeable or plain header) or an EMF.
+pub fn is_metafile(bytes: &[u8]) -> bool {
+    let b = Bytes(bytes);
+    emf::is_emf(b) || wmf::is_wmf(b)
+}
+
+/// Maps device-space output into the picture frame. Without a usable frame the frame is the bounding
+/// box of the drawing, so the origin is still the top-left of what was drawn.
+fn build(raw: Vec<Raw>, frame: Option<Frame>) -> Picture {
+    let frame = frame.filter(|f| f.rect.iter().all(|v| v.is_finite()) && f.rect[2] > 0.0 && f.rect[3] > 0.0);
+    let (rect, size) = match frame {
+        Some(f) => (f.rect, f.size.unwrap_or((f.rect[2], f.rect[3]))),
+        None => match bbox(&raw) {
+            Some([x0, y0, x1, y1]) => ([x0, y0, x1 - x0, y1 - y0], (x1 - x0, y1 - y0)),
+            None => return Picture { width: 0.0, height: 0.0, items: Vec::new() },
+        },
+    };
+    let sx = if rect[2] > 0.0 { size.0 / rect[2] } else { 1.0 };
+    let sy = if rect[3] > 0.0 { size.1 / rect[3] } else { 1.0 };
+    let tf = move |p: P| ((p.0 - rect[0]) * sx, (p.1 - rect[1]) * sy);
+    let stroke_scale = (sx + sy) / 2.0;
+    // No stroke is wider than the picture's diagonal: anything wider is a mapping artefact.
+    let diag = size.0.hypot(size.1);
+    let items = raw.into_iter().filter_map(|r| match r {
+        Raw::Path { ops, fill, stroke, even_odd } => {
+            let segs = ops.iter().map(|op| seg(op, tf)).collect::<Option<Vec<Seg>>>()?;
+            if segs.len() < 2 {
+                return None;
+            }
+            let stroke = stroke.and_then(|(c, w)| Some((c, f((w * stroke_scale).min(diag))?)));
+            Some(Item::Path { segs, fill, stroke, even_odd })
+        }
+        Raw::Bitmap { rect: r, img } => {
+            let (x, y) = tf((r[0], r[1]));
+            let rect = [f(x)?, f(y)?, f(r[2] * sx)?, f(r[3] * sy)?];
+            Some(Item::Bitmap { rect, width: img.w as u32, height: img.h as u32, rgba: img.px })
+        }
+    });
+    let items = items.collect();
+    Picture { width: f(size.0).unwrap_or(0.0), height: f(size.1).unwrap_or(0.0), items }
+}
+
+fn f(v: f64) -> Option<f32> {
+    let v = v as f32;
+    v.is_finite().then_some(v)
+}
+
+fn seg(op: &Op, tf: impl Fn(P) -> P) -> Option<Seg> {
+    let pt = |p: P| {
+        let (x, y) = tf(p);
+        Some((f(x)?, f(y)?))
+    };
+    Some(match *op {
+        Op::M(p) => {
+            let (x, y) = pt(p)?;
+            Seg::Move(x, y)
+        }
+        Op::L(p) => {
+            let (x, y) = pt(p)?;
+            Seg::Line(x, y)
+        }
+        Op::C(a, b, c) => {
+            let (x1, y1) = pt(a)?;
+            let (x2, y2) = pt(b)?;
+            let (x3, y3) = pt(c)?;
+            Seg::Cubic(x1, y1, x2, y2, x3, y3)
+        }
+        Op::Z => Seg::Close,
+    })
+}
+
+/// Bounding box `[x0, y0, x1, y1]` over the finite points of the output.
+fn bbox(raw: &[Raw]) -> Option<[f64; 4]> {
+    let mut b: Option<[f64; 4]> = None;
+    let mut grow = |p: P| {
+        if p.0.is_finite() && p.1.is_finite() {
+            b = Some(match b {
+                None => [p.0, p.1, p.0, p.1],
+                Some([x0, y0, x1, y1]) => [x0.min(p.0), y0.min(p.1), x1.max(p.0), y1.max(p.1)],
+            });
+        }
+    };
+    for r in raw {
+        match r {
+            Raw::Path { ops, .. } => {
+                for op in ops {
+                    match *op {
+                        Op::M(p) | Op::L(p) => grow(p),
+                        Op::C(a, c, d) => {
+                            grow(a);
+                            grow(c);
+                            grow(d);
+                        }
+                        Op::Z => {}
+                    }
+                }
+            }
+            Raw::Bitmap { rect, .. } => {
+                grow((rect[0], rect[1]));
+                grow((rect[0] + rect[2], rect[1] + rect[3]));
+            }
+        }
+    }
+    b
+}

crates/metafile/src/place.rs

@@ -0,0 +1,124 @@
+//! Placing a picture on a target (a page or a device): the fitted transform, paths as kurbo paths in
+//! target units and bitmaps as target rectangles. The rasteriser and the PDF writer only paint the result.
+
+use kurbo::{Affine, BezPath, Rect, Shape};
+
+use crate::{Item, Picture, Seg};
+
+/// Largest bitmap side the renderers draw: within the PDF image limit and the rasteriser's 16-bit sides.
+pub const MAX_BITMAP_SIDE: u32 = 30_000;
+/// Placed coordinates past this (target units) are far off any page; such items are left out.
+const MAX_COORD: f64 = 1e6;
+/// Smallest placed bitmap side (target units), so the stretch onto it is never singular.
+const MIN_BITMAP_SIDE: f64 = 1e-6;
+
+/// One item of a placed picture, in target units.
+pub enum PlacedItem {
+    /// A filled and/or stroked path. The stroke width is in target units; 0 is a cosmetic hairline that
+    /// the renderer draws at its minimum width.
+    Path { path: BezPath, fill: Option<[u8; 4]>, stroke: Option<([u8; 4], f64)>, even_odd: bool },
+    /// `Picture::items[index]`, a bitmap, stretched into `rect`.
+    Bitmap { index: usize, rect: Rect },
+}
+
+impl Picture {
+    /// Whether the picture has a finite, positive size, so it can be fitted into a frame.
+    pub fn has_size(&self) -> bool {
+        self.width.is_finite() && self.height.is_finite() && self.width > 0.0 && self.height > 0.0
+    }
+
+    /// The transform that fits the picture into `r` with the crop fractions `crop` (left, top, right,
+    /// bottom) removed first: the visible part fills `r`. None for a degenerate size.
+    pub fn fit(&self, r: Rect, crop: [f32; 4]) -> Option<Affine> {
+        let [cl, ct, cr, cb] = crop.map(|v| if v.is_finite() { f64::from(v.clamp(0.0, 0.95)) } else { 0.0 });
+        let (w, h) = (f64::from(self.width), f64::from(self.height));
+        let sx = r.width() / (w * (1.0 - cl - cr).max(0.05));
+        let sy = r.height() / (h * (1.0 - ct - cb).max(0.05));
+        (sx.is_finite() && sy.is_finite() && sx > 0.0 && sy > 0.0)
+            .then(|| Affine::translate((r.x0 - cl * w * sx, r.y0 - ct * h * sy)) * Affine::scale_non_uniform(sx, sy))
+    }
+
+    /// The items placed into `r` with `crop` applied. Items that are not finite or reach past ±1e6
+    /// target units are left out (they are far off any page), as are bitmaps with no area. Stroke
+    /// widths are scaled to target units (along the mean axis scale, so a non-uniform fit keeps
+    /// strokes even).
+    pub fn place(&self, r: Rect, crop: [f32; 4]) -> Vec<PlacedItem> {
+        let Some(tf) = self.fit(r, crop) else { return Vec::new() };
+        let c = tf.as_coeffs();
+        let k = (c[0].abs() + c[3].abs()) / 2.0;
+        let mut out = Vec::with_capacity(self.items.len());
+        for (index, item) in self.items.iter().enumerate() {
+            match item {
+                Item::Path { segs, fill, stroke, even_odd } => {
+                    let path = tf * bez(segs);
+                    if in_range(path.bounding_box()) {
+                        let stroke = stroke.map(|(c, w)| (c, f64::from(w) * k));
+                        out.push(PlacedItem::Path { path, fill: *fill, stroke, even_odd: *even_odd });
+                    }
+                }
+                Item::Bitmap { rect: [x, y, w, h], .. } => {
+                    let (x0, y0) = (f64::from(*x), f64::from(*y));
+                    let rect = tf.transform_rect_bbox(Rect::new(x0, y0, x0 + f64::from(*w), y0 + f64::from(*h)));
+                    if in_range(rect) && rect.width() > MIN_BITMAP_SIDE && rect.height() > MIN_BITMAP_SIDE {
+                        out.push(PlacedItem::Bitmap { index, rect });
+                    }
+                }
+            }
+        }
+        out
+    }
+}
+
+impl Item {
+    /// Takes a bitmap's pixels out of the item (its geometry stays) and returns them as (width, height,
+    /// RGBA) when a renderer can draw them: both sides in 1..=[`MAX_BITMAP_SIDE`] and exactly that many
+    /// pixels. None for paths and for bitmaps that cannot be drawn.
+    pub fn take_pixels(&mut self) -> Option<(u32, u32, Vec<u8>)> {
+        let Item::Bitmap { width, height, rgba, .. } = self else { return None };
+        let (w, h, px) = (*width, *height, std::mem::take(rgba));
+        let sides = (1..=MAX_BITMAP_SIDE).contains(&w) && (1..=MAX_BITMAP_SIDE).contains(&h);
+        (sides && px.len() == (w as usize).saturating_mul(h as usize).saturating_mul(4)).then_some((w, h, px))
+    }
+}
+
+/// Segments as a kurbo path. A segment after a close opens a new subpath at the last start point.
+fn bez(segs: &[Seg]) -> BezPath {
+    let mut p = BezPath::new();
+    let mut start = (0.0, 0.0);
+    let mut open = false;
+    for s in segs {
+        match *s {
+            Seg::Move(x, y) => {
+                start = (f64::from(x), f64::from(y));
+                p.move_to(start);
+                open = true;
+            }
+            Seg::Line(x, y) => {
+                if !open {
+                    p.move_to(start);
+                }
+                p.line_to((f64::from(x), f64::from(y)));
+                open = true;
+            }
+            Seg::Cubic(a, b, c, d, e, f) => {
+                if !open {
+                    p.move_to(start);
+                }
+                p.curve_to((f64::from(a), f64::from(b)), (f64::from(c), f64::from(d)), (f64::from(e), f64::from(f)));
+                open = true;
+            }
+            Seg::Close => {
+                if open {
+                    p.close_path();
+                }
+                open = false;
+            }
+        }
+    }
+    p
+}
+
+/// Whether a placed box is finite and within ±[`MAX_COORD`].
+fn in_range(b: Rect) -> bool {
+    [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() < MAX_COORD)
+}

crates/metafile/src/wmf.rs

@@ -0,0 +1,273 @@
+//! WMF reader (MS-WMF). A file is an optional 22-byte placeable header, a 9-word standard header, then
+//! records of (size in 16-bit words, function, parameters). Parameters are read at byte 6 of each record.
+
+use crate::bytes::Bytes;
+use crate::canvas::{Brush, Canvas, Obj, Pen, colorref};
+use crate::dib;
+use crate::geom::{self, ArcKind, P};
+use crate::{Error, Frame, MAX_PATH_OPS};
+
+const PLACEABLE_KEY: u32 = 0x9AC6_CDD7;
+const DEFAULT_INCH: f64 = 1440.0;
+
+pub(crate) fn is_wmf(b: Bytes) -> bool {
+    if b.u32(0) == Some(PLACEABLE_KEY) {
+        return true;
+    }
+    matches!(b.u16(0), Some(1 | 2)) && b.u16(2) == Some(9) && matches!(b.u16(4), Some(0x100 | 0x300))
+}
+
+/// Reads all records. Returns the drawing state and the picture frame, or an error when no record
+/// could be read at all.
+pub(crate) fn parse(input: Bytes) -> Result<(Canvas, Option<Frame>), Error> {
+    let placeable = input.u32(0) == Some(PLACEABLE_KEY);
+    // Placeable bounds: logical corners (left, top, right, bottom) and their size in points.
+    let (hdr, bounds) = if placeable {
+        let [l, t, r, b] = [6, 8, 10, 12].map(|o| input.i16(o).map(f64::from));
+        let (Some(l), Some(t), Some(r), Some(b)) = (l, t, r, b) else { return Err(Error::BadHeader) };
+        let inch = input.u16(14).filter(|v| *v > 0).map_or(DEFAULT_INCH, f64::from);
+        let (w, h) = (r - l, b - t);
+        let bounds = (w > 0.0 && h > 0.0).then_some(([l, t, r, b], (w * 72.0 / inch, h * 72.0 / inch)));
+        (22, bounds)
+    } else {
+        (0, None)
+    };
+    let hsize = input.u16(hdr + 2).ok_or(Error::BadHeader)? as usize;
+    if hsize < 9 {
+        return Err(Error::BadHeader);
+    }
+    let mut pos = hdr.checked_add(hsize.checked_mul(2).ok_or(Error::BadHeader)?).ok_or(Error::BadHeader)?;
+    // Played into a target like Word does: the placeable bounds are the first window, the target (the
+    // picture size) the viewport. A plain WMF's target is its first window.
+    let mut cv = Canvas::new();
+    if let Some((c, size)) = bounds {
+        cv.play_into(Some([c[0], c[1], c[2] - c[0], c[3] - c[1]]), size);
+    }
+    let mut player_viewport = bounds.is_some();
+    let mut parsed = 0usize;
+    while !cv.full() {
+        let (Some(words), Some(func)) = (input.u32(pos), pos.checked_add(4).and_then(|o| input.u16(o))) else { break };
+        let Some(len) = (words as usize).checked_mul(2).filter(|l| *l >= 6) else { break };
+        let Some(rec) = input.slice(pos, len) else { break };
+        if func == 0 {
+            break;
+        }
+        record(&mut cv, func, Bytes(rec));
+        if func == 0x020C && cv.window_set && !player_viewport && !cv.viewport_set {
+            let we = cv.map.window_ext();
+            cv.play_into(None, (we.0.abs(), we.1.abs()));
+            player_viewport = true;
+        }
+        parsed += 1;
+        let Some(next) = pos.checked_add(len) else { break };
+        pos = next;
+    }
+    if parsed == 0 {
+        return Err(Error::NoRecords);
+    }
+    let frame = match bounds {
+        // Played into its target: the frame is the target.
+        Some((_, size)) if !cv.viewport_set && cv.map.uses_extents() => Some(Frame { rect: [0.0, 0.0, size.0, size.1], size: Some(size) }),
+        // The file set its own viewport, so the drawing is in its device units and the logical bounds
+        // go through the final mapping.
+        Some((c, size)) => {
+            let (a, b) = (cv.map.device((c[0], c[1])), cv.map.device((c[2], c[3])));
+            let rect = [a.0.min(b.0), a.1.min(b.1), (b.0 - a.0).abs(), (b.1 - a.1).abs()];
+            (rect[2] > 0.0 && rect[3] > 0.0).then_some(Frame { rect, size: Some(size) })
+        }
+        None if player_viewport && !cv.viewport_set && cv.map.uses_extents() => {
+            let ve = cv.map.viewport_ext();
+            Some(Frame { rect: [0.0, 0.0, ve.0, ve.1], size: None })
+        }
+        None if cv.window_set => Some(Frame { rect: cv.map.window_rect(), size: None }),
+        None => None,
+    };
+    Ok((cv, frame))
+}
+
+fn record(cv: &mut Canvas, func: u16, r: Bytes) {
+    if cv.full() {
+        return;
+    }
+    let _ = match func {
+        0x0103 => r.u16(6).map(|m| cv.set_map_mode(u32::from(m))),
+        0x0106 => r.u16(6).map(|m| cv.set_polyfill(u32::from(m))),
+        0x0104 => r.u16(6).map(|m| cv.set_rop2(u32::from(m))),
+        // Y is stored before X in these records.
+        0x020B => xy16(r, 6).map(|p| cv.set_window_org(p)),
+        0x020C => xy16(r, 6).map(|p| cv.set_window_ext(p)),
+        0x020D => xy16(r, 6).map(|p| cv.set_viewport_org(p)),
+        0x020E => xy16(r, 6).map(|p| cv.set_viewport_ext(p)),
+        0x001E => {
+            cv.save_dc();
+            Some(())
+        }
+        0x0127 => r.i16(6).map(|n| cv.restore_dc(i32::from(n))),
+        0x0214 => xy16(r, 6).map(|p| cv.move_to(p)),
+        0x0213 => xy16(r, 6).map(|p| cv.line_to(p)),
+        0x0325 => counted_points(r).map(|pts| cv.poly(&pts, false, false, true)),
+        0x0324 => counted_points(r).map(|pts| cv.poly(&pts, true, true, true)),
+        0x0538 => polypolygon(r).map(|ops| cv.shape(&ops, true, true)),
+        0x041B => rect16(r, 6).map(|[l, t, rr, b]| cv.shape(&geom::rect(l, t, rr, b), true, true)),
+        0x061C => {
+            let [ew, eh] = [r.i16(8), r.i16(6)];
+            let (Some(ew), Some(eh)) = (ew, eh) else { return };
+            rect16(r, 10).map(|[l, t, rr, b]| {
+                cv.shape(&geom::round_rect(l, t, rr, b, f64::from(ew), f64::from(eh)), true, true);
+            })
+        }
+        0x0418 => rect16(r, 6).map(|[l, t, rr, b]| cv.shape(&geom::ellipse(l, t, rr, b), true, true)),
+        0x0817 | 0x081A | 0x0830 => arc16(r).map(|(bounds, s, e)| {
+            let kind = match func {
+                0x0817 => ArcKind::Arc,
+                0x081A => ArcKind::Pie,
+                _ => ArcKind::Chord,
+            };
+            let [l, t, rr, b] = bounds;
+            cv.shape(&geom::arc_shape(l, t, rr, b, s, e, kind), kind != ArcKind::Arc, true);
+        }),
+        0x02FA => create_pen(cv, r),
+        0x02FC => create_brush(cv, r),
+        // Fonts, palettes, pattern brushes and regions take a handle slot too, so later SELECTOBJECT
+        // handles count them; selecting one draws nothing.
+        0x02FB | 0x00F7 | 0x01F9 | 0x0142 | 0x06FF => {
+            cv.add_object(None, Obj::Other);
+            Some(())
+        }
+        0x012D => r.u16(6).map(|h| cv.select(wmf_handle(h))),
+        0x01F0 => r.u16(6).map(|h| cv.delete_object(u32::from(h))),
+        // STRETCHDIB: rop(4) usage(2) srcH srcW ySrc xSrc destH destW yDest xDest, then the DIB.
+        0x0F43 => {
+            let rop = r.u32(6).unwrap_or(0);
+            dib_blit(cv, r, 28, rop, [i16s(r, 26), i16s(r, 24), i16s(r, 22), i16s(r, 20)], [i16s(r, 18), i16s(r, 16), i16s(r, 14), i16s(r, 12)])
+        }
+        0x0B41 => dib_stretchblt(cv, r),
+        0x0940 => dib_bitblt(cv, r),
+        _ => Some(()),
+    };
+}
+
+/// A 16-bit WMF handle as a canvas object index: stock objects are `0x8000 | index`, which the
+/// canvas reads with the 32-bit stock flag.
+fn wmf_handle(h: u16) -> u32 {
+    let h = u32::from(h);
+    if h & 0x8000 != 0 { (h & 0x7FFF) | 0x8000_0000 } else { h }
+}
+
+/// An i16 field as f64; 0 past the end.
+fn i16s(r: Bytes, off: usize) -> f64 {
+    r.i16(off).map_or(0.0, f64::from)
+}
+
+/// CREATEPENINDIRECT: style, width (x, y), colour. Only the width's x component is used.
+fn create_pen(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let style = r.u16(6)?;
+    let width = r.i16(8)?;
+    let color = r.u32(12)?;
+    cv.add_object(None, Obj::Pen(Pen { style: u32::from(style), width: f64::from(width), color: colorref(color) }));
+    Some(())
+}
+
+/// CREATEBRUSHINDIRECT: style, colour, hatch (hatch is not drawn).
+fn create_brush(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let style = r.u16(6)?;
+    let color = r.u32(8)?;
+    cv.add_object(None, Obj::Brush(Brush { style: u32::from(style), color: colorref(color) }));
+    Some(())
+}
+
+/// (x, y) from a Y-then-X pair stored at `off`.
+fn xy16(r: Bytes, off: usize) -> Option<P> {
+    Some((f64::from(r.i16(off + 2)?), f64::from(r.i16(off)?)))
+}
+
+/// Rectangle stored as bottom, right, top, left (the order MS-WMF uses for RECTANGLE and ELLIPSE).
+fn rect16(r: Bytes, off: usize) -> Option<[f64; 4]> {
+    let (b, rr, t, l) = (r.i16(off)?, r.i16(off + 2)?, r.i16(off + 4)?, r.i16(off + 6)?);
+    Some([f64::from(l), f64::from(t), f64::from(rr), f64::from(b)])
+}
+
+/// ARC, PIE and CHORD: end Y, end X, start Y, start X, then the bounding rectangle (bottom, right, top, left).
+fn arc16(r: Bytes) -> Option<([f64; 4], P, P)> {
+    let end = xy16(r, 6)?;
+    let start = xy16(r, 10)?;
+    let bounds = rect16(r, 14)?;
+    Some((bounds, start, end))
+}
+
+/// A count of 16-bit points, then the points (POLYLINE, POLYGON).
+fn counted_points(r: Bytes) -> Option<Vec<P>> {
+    let n = r.u16(6)? as usize;
+    r.tail(8)?.points(0, n, false)
+}
+
+/// POLYPOLYGON: polygon count, one 16-bit point count per polygon, then all points.
+fn polypolygon(r: Bytes) -> Option<Vec<geom::Op>> {
+    let n = r.u16(6)? as usize;
+    let mut counts = Vec::with_capacity(n);
+    for i in 0..n {
+        counts.push(r.u16(i.checked_mul(2)?.checked_add(8)?)? as usize);
+    }
+    let total = counts.iter().try_fold(0usize, |a, c| a.checked_add(*c))?;
+    if total > MAX_PATH_OPS {
+        return None;
+    }
+    let pts = r.tail(n.checked_mul(2)?.checked_add(8)?)?.points(0, total, false)?;
+    Some(geom::subpaths(&pts, &counts, true))
+}
+
+/// Whether a DIBBITBLT or DIBSTRETCHBLT record carries a bitmap: without one it is exactly
+/// `(function >> 8) + 3` words long (MS-WMF 2.3.1.2, 2.3.1.3).
+fn has_bitmap(func: u16, r: Bytes) -> bool {
+    r.0.len() / 2 > usize::from(func >> 8) + 3
+}
+
+/// META_DIBBITBLT: rop(4), ySrc, xSrc, then height, width, yDest, xDest and the DIB at 22. The
+/// bitmap-less form has a reserved word before the height, so its fields sit 2 bytes later; it, or
+/// a source-less raster operation, fills the destination.
+fn dib_bitblt(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let rop = r.u32(6)?;
+    if !has_bitmap(0x0940, r) {
+        cv.fill_rop([i16s(r, 22), i16s(r, 20), i16s(r, 18), i16s(r, 16)], rop);
+        return Some(());
+    }
+    let dst = [i16s(r, 20), i16s(r, 18), i16s(r, 16), i16s(r, 14)];
+    if Canvas::sourceless(rop) {
+        cv.fill_rop(dst, rop);
+        return Some(());
+    }
+    let src = [i16s(r, 12), i16s(r, 10), dst[2], dst[3]];
+    dib_blit(cv, r, 22, rop, dst, src)
+}
+
+/// META_DIBSTRETCHBLT: rop(4), srcH, srcW, ySrc, xSrc, then destH, destW, yDest, xDest and the DIB at
+/// 26. The bitmap-less form has a reserved word after xSrc, so the destination sits 2 bytes later;
+/// it, or a source-less raster operation, fills the destination.
+fn dib_stretchblt(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let rop = r.u32(6)?;
+    if !has_bitmap(0x0B41, r) {
+        cv.fill_rop([i16s(r, 26), i16s(r, 24), i16s(r, 22), i16s(r, 20)], rop);
+        return Some(());
+    }
+    let dst = [i16s(r, 24), i16s(r, 22), i16s(r, 20), i16s(r, 18)];
+    if Canvas::sourceless(rop) {
+        cv.fill_rop(dst, rop);
+        return Some(());
+    }
+    let src = [i16s(r, 16), i16s(r, 14), i16s(r, 12), i16s(r, 10)];
+    dib_blit(cv, r, 26, rop, dst, src)
+}
+
+/// A DIB at `at`, stretched from source rectangle `src` into `dst` (both in logical units, pixels for `src`).
+/// The raster operation `rop` decides how the pixels combine (see [`dib::prepare`]).
+fn dib_blit(cv: &mut Canvas, r: Bytes, at: usize, rop: u32, dst: [f64; 4], src: [f64; 4]) -> Option<()> {
+    let dib = r.tail(at)?;
+    let n = dib::info_len(dib)?;
+    let info = dib.slice(0, n)?;
+    let bits = dib.tail(n)?;
+    let mut img = dib::decode(Bytes(info), bits, false)?;
+    dib::prepare(&mut img, dib::Blend::Rop(rop));
+    let (img, dst) = dib::clip_blit(&img, src.map(|v| v as i64), dst)?;
+    cv.bitmap(dst, img);
+    Some(())
+}

crates/model/src/resolve.rs

@@ -134,11 +134,8 @@ pub fn xfrm(ctx: &Ctx, shape: &Shape) -> Xfrm {
 /// Effective fill and the style colour (`phClr`) to resolve it with.
 pub fn fill(ctx: &Ctx, shape: &Shape) -> (Option<Fill>, Option<Rgba>) {
     let (lp, mp) = parents(ctx, shape);
-    for s in [Some(shape), lp, mp].into_iter().flatten() {
-        if let Some(f) = &s.fill {
-            return (Some(f.clone()), None);
-        }
-        if let Some(st) = &s.style {
+    let style_fill = |s: &Shape| {
+        s.style.as_ref().map(|st| {
             let (idx, col) = &st.fill_ref;
             let ph = ctx.color(col, None);
             let f = match *idx {
@@ -146,7 +143,25 @@ pub fn fill(ctx: &Ctx, shape: &Shape) -> (Option<Fill>, Option<Rgba>) {
                 i if i >= 1001 => ctx.master.theme.format.bg_fills.get((i - 1001) as usize).cloned(),
                 i => ctx.master.theme.format.fills.get((i - 1) as usize).cloned(),
             };
-            return (f, Some(ph));
+            (f, Some(ph))
+        })
+    };
+    for s in [Some(shape), lp, mp].into_iter().flatten() {
+        if let Some(f) = &s.fill {
+            // A gradient without stops (`a:gradFill` with no `a:gsLst`) takes them from the
+            // gradient its style refers to, keeping its own direction, as PowerPoint draws it.
+            if let Fill::Gradient(g) = f
+                && g.stops.is_empty()
+                && let Some((Some(Fill::Gradient(sg)), ph)) = style_fill(s)
+            {
+                let mut g = g.clone();
+                g.stops = sg.stops;
+                return (Some(Fill::Gradient(g)), ph);
+            }
+            return (Some(f.clone()), None);
+        }
+        if let Some(r) = style_fill(s) {
+            return r;
         }
     }
     if shape.text_box {

crates/model/src/tests.rs

@@ -62,6 +62,29 @@ fn shape_style_fill_resolves_through_theme() {
     assert!(ph.is_some());
 }
 
+#[test]
+fn a_gradient_without_stops_takes_them_from_its_style() {
+    // `a:gradFill` with only a direction: PowerPoint fills it with the stops of the theme gradient
+    // the style's fillRef names, in the style's colour, along the shape's own direction.
+    let p = Presentation::default();
+    let s = &p.slides[0];
+    let ctx = Ctx::for_slide(&p, s).unwrap();
+    let own = style::Gradient { stops: vec![], shape: style::GradientShape::Linear { angle: 45.0, scaled: true }, rotate_with_shape: true };
+    let mut st = ShapeStyle::accent(SchemeSlot::Accent2);
+    st.fill_ref.0 = 3;
+    let sh = Shape { style: Some(st.clone()), fill: Some(Fill::Gradient(own.clone())), ..Default::default() };
+    let (f, ph) = resolve::fill(&ctx, &sh);
+    let Some(Fill::Gradient(g)) = f else { panic!("expected a gradient") };
+    let Some(Fill::Gradient(theme)) = p.masters[0].theme.format.fills.get(2).cloned() else { panic!("theme fill 3 is a gradient") };
+    assert_eq!(g.stops, theme.stops);
+    assert_eq!(g.shape, own.shape, "the shape's own direction");
+    assert_eq!(ph, Some(p.masters[0].theme.colors.get(SchemeSlot::Accent2)));
+    // A solid style fill has no stops to give: the gradient stays empty (draws nothing).
+    st.fill_ref.0 = 1;
+    let sh = Shape { style: Some(st), fill: Some(Fill::Gradient(own.clone())), ..Default::default() };
+    assert_eq!(resolve::fill(&ctx, &sh).0, Some(Fill::Gradient(own)));
+}
+
 #[test]
 fn serde_roundtrip() {
     let p = Presentation::default();

crates/pptx/src/read/shapes.rs

@@ -356,7 +356,8 @@ fn frame(imp: &mut Imp, part: &Part, ctx: &mut IdCtx, e: &El, depth: usize) -> S
         let mut pics = vec![];
         e.find_all("blip", &mut pics);
         pics.into_iter().find_map(|b| dml::media_ref(imp, part, b))
-    };
+    }
+    .or_else(|| gd.and_then(|g| g.find("oleObj")).and_then(|o| vml_preview(imp, part, o.attr("spid")?)));
     let label = if let Some(o) = gd.and_then(|g| g.find("oleObj")) {
         o.attr("progId").or(o.attr("name")).unwrap_or("Object").to_string()
     } else if uri.ends_with("/diagram") {
@@ -370,6 +371,21 @@ fn frame(imp: &mut Imp, part: &Part, ctx: &mut IdCtx, e: &El, depth: usize) -> S
     s
 }
 
+/// The preview picture of an old-style embedded object (`p:oleObj spid` with no `p:pic`): the
+/// `v:imagedata` of the legacy VML drawing shape with that id, as PowerPoint 2007 wrote them.
+fn vml_preview(imp: &mut Imp, part: &Part, spid: &str) -> Option<deckcraft_model::MediaId> {
+    for rel in part.rels.items.iter().filter(|r| r.kind == "vmlDrawing" && !r.external) {
+        let Some(doc) = imp.pkg.xml(&rel.target) else { continue };
+        let mut shapes = vec![];
+        doc.root.find_all("shape", &mut shapes);
+        let Some(img) = shapes.into_iter().find(|s| s.attr("id") == Some(spid)).and_then(|s| s.find("imagedata")) else { continue };
+        let Some(id) = img.attr("o:relid").or(img.attr("r:id")) else { continue };
+        let target = imp.pkg.rels(&rel.target).get(id).filter(|r| !r.external).map(|r| r.target.clone())?;
+        return imp.media_for(&target);
+    }
+    None
+}
+
 /// SmartArt: read the pre-drawn shapes of its drawing part as a group.
 fn smartart(imp: &mut Imp, part: &Part, gd: &El, frame: &Shape, depth: usize) -> Option<Shape> {
     let rel_ids = gd.child("relIds")?;

crates/pptx/src/write/dml.rs

@@ -78,22 +78,22 @@ pub fn fill(w: &mut W, x: &mut Exp, o: &mut Out, f: &Fill) {
         Fill::Solid { color: c } => solid(w, c),
         Fill::Gradient(g) => {
             w.open("a:gradFill", A::new().a("rotWithShape", if g.rotate_with_shape { "1" } else { "0" }));
-            w.open0("a:gsLst");
+            // No stops: no `a:gsLst`, so the gradient keeps taking them from its style's fill.
             let mut stops = g.stops.clone();
-            if stops.is_empty() {
-                stops.push(deckcraft_model::style::GradientStop { pos: 0.0, color: ColorRef::rgb(deckcraft_color::Rgba::WHITE) });
-            }
             if stops.len() == 1 {
                 let mut s = stops[0].clone();
                 s.pos = 1.0;
                 stops.push(s);
             }
-            for s in &stops {
-                w.open("a:gs", A::new().a("pos", pct(s.pos.clamp(0.0, 1.0))));
-                color(w, &s.color);
-                w.close("a:gs");
+            if !stops.is_empty() {
+                w.open0("a:gsLst");
+                for s in &stops {
+                    w.open("a:gs", A::new().a("pos", pct(s.pos.clamp(0.0, 1.0))));
+                    color(w, &s.color);
+                    w.close("a:gs");
+                }
+                w.close("a:gsLst");
             }
-            w.close("a:gsLst");
             match &g.shape {
                 GradientShape::Linear { angle, scaled } => {
                     w.empty("a:lin", A::new().a("ang", ang(*angle)).a("scaled", if *scaled { "1" } else { "0" }))

crates/pptx/tests/fills.rs

@@ -79,3 +79,26 @@ fn regex_free_strip(s: &str, open: &str, close: &str) -> String {
     let Some(j) = s[i..].find(close).map(|j| j + i + close.len()) else { return s.to_string() };
     format!("{}{}", &s[..i], &s[j..])
 }
+
+#[test]
+fn a_gradient_without_stops_is_saved_without_stops() {
+    // `a:gradFill` with no `a:gsLst` takes its stops from the style's fill in PowerPoint; saving
+    // must not turn it into a gradient of its own (it used to become solid white).
+    use deckcraft_model::style::{Gradient, GradientShape};
+    let mut p = defaults::new_presentation(None);
+    let id = ShapeId(p.alloc_id());
+    let first = p.slides[0].id;
+    let own = Gradient { stops: vec![], shape: GradientShape::Linear { angle: 45.0, scaled: true }, rotate_with_shape: true };
+    p.slide_mut(first).expect("slide").shapes.push(Shape {
+        id,
+        name: "Styled".into(),
+        xfrm: Some(Xfrm::new(10.0, 10.0, 200.0, 100.0)),
+        fill: Some(Fill::Gradient(own.clone())),
+        style: Some(deckcraft_model::ShapeStyle::accent(deckcraft_color::SchemeSlot::Accent1)),
+        ..Default::default()
+    });
+    let bytes = deckcraft_pptx::export(&p).expect("export");
+    let q = deckcraft_pptx::import(&bytes).expect("import");
+    let s = q.slides[0].shapes.iter().find(|s| s.name == "Styled").expect("shape");
+    assert_eq!(s.fill, Some(Fill::Gradient(own)));
+}

crates/pptx/tests/ole.rs

@@ -0,0 +1,98 @@
+//! Embedded (OLE) objects and their preview pictures, as other versions of PowerPoint write them.
+
+use std::io::{Cursor, Read, Write};
+
+use deckcraft_model::{ShapeKind, defaults};
+
+fn png() -> Vec<u8> {
+    let mut out = Cursor::new(vec![]);
+    image::DynamicImage::ImageRgb8(image::RgbImage::from_pixel(4, 4, image::Rgb([10, 200, 30])))
+        .write_to(&mut out, image::ImageFormat::Png)
+        .expect("png");
+    out.into_inner()
+}
+
+/// An exported deck with `parts` added (or replaced) and `edit` applied to every part's text.
+fn with_parts(parts: &[(&str, Vec<u8>)], edit: impl Fn(&str, String) -> String) -> Vec<u8> {
+    let base = deckcraft_pptx::export(&defaults::new_presentation(None)).expect("export");
+    let mut z = zip::ZipArchive::new(Cursor::new(base)).expect("zip");
+    let mut out = zip::ZipWriter::new(Cursor::new(Vec::new()));
+    let o = zip::write::SimpleFileOptions::default();
+    for i in 0..z.len() {
+        let mut f = z.by_index(i).expect("entry");
+        let name = f.name().to_string();
+        if parts.iter().any(|(n, _)| *n == name) {
+            continue;
+        }
+        let mut d = vec![];
+        f.read_to_end(&mut d).expect("read");
+        if name.ends_with(".xml") || name.ends_with(".rels") {
+            d = edit(&name, String::from_utf8(d).expect("utf8")).into_bytes();
+        }
+        out.start_file(name, o).expect("start");
+        out.write_all(&d).expect("write");
+    }
+    for (name, data) in parts {
+        out.start_file(*name, o).expect("start");
+        out.write_all(data).expect("write");
+    }
+    out.finish().expect("finish").into_inner()
+}
+
+/// PowerPoint 2007 style: `p:oleObj spid` with no `p:pic`; the preview is the `v:imagedata` of the
+/// VML shape with that id in the slide's legacy drawing part.
+fn ole_deck(spid_in_vml: &str) -> Vec<u8> {
+    let vml = format!(
+        r#"<xml xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
+ <v:shape id="_x0000_s9999" style='position:absolute;left:0;top:0;width:1in;height:1in'><v:imagedata o:relid="rId7" o:title=""/></v:shape>
+ <v:shape id="{spid_in_vml}" style='position:absolute;left:0;top:0;width:2in;height:1in'><v:imagedata o:relid="rId1" o:title=""/></v:shape>
+</xml>"#
+    );
+    let vml_rels = r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../media/preview.png"/><Relationship Id="rId7" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../media/other.png"/></Relationships>"#;
+    let frame = r#"<p:graphicFrame><p:nvGraphicFramePr><p:cNvPr id="900" name="Object 3"/><p:cNvGraphicFramePr/><p:nvPr/></p:nvGraphicFramePr><p:xfrm><a:off x="0" y="0"/><a:ext cx="1828800" cy="914400"/></p:xfrm><a:graphic><a:graphicData uri="http://schemas.openxmlformats.org/presentationml/2006/ole"><p:oleObj spid="_x0000_s681987" name="Slide" r:id="rIdOle" imgW="4664160" imgH="3497400" progId="PowerPoint.Slide.8"><p:embed/></p:oleObj></a:graphicData></a:graphic></p:graphicFrame>"#;
+    with_parts(
+        &[
+            ("ppt/drawings/vmlDrawing1.vml", vml.into_bytes()),
+            ("ppt/drawings/_rels/vmlDrawing1.vml.rels", vml_rels.as_bytes().to_vec()),
+            ("ppt/media/preview.png", png()),
+            ("ppt/media/other.png", vec![1, 2, 3]),
+            ("ppt/embeddings/oleObject1.bin", vec![0; 16]),
+        ],
+        |name, s| {
+            if name == "ppt/slides/slide1.xml" {
+                s.replacen("</p:spTree>", &format!("{frame}</p:spTree>"), 1)
+            } else if name == "ppt/slides/_rels/slide1.xml.rels" {
+                s.replacen(
+                    "</Relationships>",
+                    r#"<Relationship Id="rIdVml" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/vmlDrawing" Target="../drawings/vmlDrawing1.vml"/><Relationship Id="rIdOle" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject" Target="../embeddings/oleObject1.bin"/></Relationships>"#,
+                    1,
+                )
+            } else {
+                s
+            }
+        },
+    )
+}
+
+fn object_preview(bytes: &[u8]) -> Option<Vec<u8>> {
+    let p = deckcraft_pptx::import(bytes).expect("import");
+    let s = p.slides[0].shapes.iter().find(|s| s.name == "Object 3").expect("object");
+    match &s.kind {
+        ShapeKind::Opaque { preview, label, .. } => {
+            assert_eq!(label, "PowerPoint.Slide.8");
+            preview.and_then(|m| p.media(m)).map(|m| m.data.to_vec())
+        }
+        k => panic!("{k:?}"),
+    }
+}
+
+#[test]
+fn an_old_ole_object_shows_its_vml_preview() {
+    assert_eq!(object_preview(&ole_deck("_x0000_s681987")), Some(png()), "the VML shape with the object's spid");
+}
+
+#[test]
+fn an_ole_object_without_a_matching_vml_shape_has_no_preview() {
+    assert_eq!(object_preview(&ole_deck("_x0000_s1")), None);
+}

crates/render/Cargo.toml

@@ -11,6 +11,7 @@ workspace = true
 [dependencies]
 deckcraft-geom = { workspace = true }
 deckcraft-color = { workspace = true }
+deckcraft-metafile = { workspace = true }
 deckcraft-model = { workspace = true }
 deckcraft-fonts = { workspace = true }
 deckcraft-text = { workspace = true }

crates/render/src/extent.rs

@@ -0,0 +1,329 @@
+//! The pasteboard: what the editor draws around the slide.
+//!
+//! PowerPoint's Normal view draws shapes, pictures and text that sit partly or wholly off the slide
+//! on the area around it, at full strength and with their effects (master and layout graphics
+//! too), so they can be seen and grabbed. Slide shows, exports and thumbnails clip to the slide.
+//!
+//! The editor renders only what it needs: the slide, grown to take in the drawing that spills off
+//! it and is in view ([`pasteboard_region`]). A slide with nothing off it costs what it always did.
+
+use deckcraft_geom::Xfrm;
+use deckcraft_model::resolve::{self, Ctx};
+use deckcraft_model::style::{Effects, Line};
+use deckcraft_model::{Presentation, Shape, ShapeKind};
+use kurbo::Rect;
+
+use crate::MAX_SIDE;
+
+/// Largest distance (points) a shape's outline or effects are taken to reach beyond its box:
+/// hostile files can't blow the pasteboard up.
+const MAX_SPILL: f64 = 2000.0;
+
+/// The visible area is rounded out to tiles of this many pixels, so scrolling over a pasteboard
+/// that is wider than the window re-renders only when a new tile comes into view.
+pub const TILE: i64 = 256;
+
+/// How far (points) a shape's outline and effects reach beyond its box: half the outline and its
+/// arrowheads, the outer shadow (offset, blur and scale), the glow and the reflection.
+pub(crate) fn spill(line: Option<&Line>, effects: Option<&Effects>, w: f64, h: f64) -> f64 {
+    let fin = |v: f64| if v.is_finite() { v.abs() } else { 0.0 };
+    let mut s: f64 = 0.0;
+    if let Some(l) = line
+        && l.fill.as_ref().is_some_and(|f| !f.is_none())
+    {
+        // Arrowheads reach up to a few line widths past the end point.
+        s = s.max(fin(l.width.unwrap_or(0.75)) * 3.0 + 1.0);
+    }
+    if let Some(e) = effects {
+        let big = fin(w).max(fin(h));
+        if let Some(sh) = &e.outer_shadow {
+            let grow = (fin(sh.sx).max(fin(sh.sy)) - 1.0).max(0.0) * big;
+            s = s.max(fin(sh.dist) + fin(sh.blur) + grow);
+        }
+        if let Some(g) = &e.glow {
+            s = s.max(fin(g.radius));
+        }
+        if let Some(r) = &e.reflection {
+            s = s.max(fin(h) + fin(r.dist));
+        }
+    }
+    s.min(MAX_SPILL)
+}
+
+/// Slide-space box a top-level shape draws into, its spill included.
+fn shape_box(rctx: &Ctx, s: &Shape) -> Option<Rect> {
+    if s.hidden {
+        return None;
+    }
+    let x: Xfrm = resolve::xfrm(rctx, s);
+    if !x.is_finite() {
+        return None;
+    }
+    let b = match &s.kind {
+        ShapeKind::Ink { strokes } => {
+            let mut pts = strokes.iter().flat_map(|k| k.points.iter()).filter(|(px, py, _)| px.is_finite() && py.is_finite());
+            let (px, py, _) = pts.next()?;
+            let r = pts.fold(Rect::new(*px, *py, *px, *py), |r, (px, py, _)| r.union_pt(kurbo::Point::new(*px, *py)));
+            let w = strokes.iter().map(|k| k.width).filter(|w| w.is_finite()).fold(0.0_f64, f64::max).min(MAX_SPILL);
+            return Some(r.inflate(w, w));
+        }
+        _ => x.bounds(),
+    };
+    let (line, _) = resolve::line(rctx, s);
+    let (fx, _) = resolve::effects(rctx, s);
+    let d = spill(Some(&line), fx.as_ref(), x.w, x.h);
+    Some(b.inflate(d, d))
+}
+
+fn union_boxes<'a>(rctx: &Ctx, shapes: impl IntoIterator<Item = &'a Shape>, into: Rect) -> Rect {
+    shapes.into_iter().filter_map(|s| shape_box(rctx, s)).filter(|r| r.is_finite()).fold(into, |a, r| a.union(r))
+}
+
+fn slide_rect(pres: &Presentation) -> Rect {
+    Rect::new(0.0, 0.0, pres.slide_size.width, pres.slide_size.height)
+}
+
+/// What slide `index` draws, in slide space: at least the slide, grown by every shape (and master
+/// and layout graphic) that reaches off it. Estimated from the shapes' boxes, outlines and effects;
+/// text spilling out of its box is found while rendering ([`crate::render_slide_drawn`]).
+pub fn slide_extent(pres: &Presentation, index: usize) -> Rect {
+    let page = slide_rect(pres);
+    let Some(slide) = pres.slides.get(index) else { return page };
+    let Some(rctx) = Ctx::for_slide(pres, slide) else { return page };
+    let mut r = union_boxes(&rctx, &slide.shapes, page);
+    let (show_layout, show_master) = resolve::show_master_shapes(slide, rctx.layout);
+    if show_master {
+        let mctx = Ctx::for_master(pres, rctx.master);
+        r = union_boxes(&mctx, rctx.master.shapes.iter().filter(|s| s.ph.is_none()), r);
+    }
+    if show_layout && let Some(l) = rctx.layout {
+        let lctx = Ctx::for_layout(pres, rctx.master, l);
+        r = union_boxes(&lctx, l.shapes.iter().filter(|s| s.ph.is_none()), r);
+    }
+    r
+}
+
+/// What a layout (or the master, `layout: None`) draws in Slide Master view, in slide space.
+pub fn layout_extent(pres: &Presentation, master: usize, layout: Option<usize>) -> Rect {
+    let page = slide_rect(pres);
+    let Some(m) = pres.masters.get(master) else { return page };
+    match layout.and_then(|i| m.layouts.get(i)) {
+        Some(l) => {
+            let mut r = union_boxes(&Ctx::for_layout(pres, m, l), &l.shapes, page);
+            if l.show_master_shapes {
+                r = union_boxes(&Ctx::for_master(pres, m), m.shapes.iter().filter(|s| s.ph.is_none()), r);
+            }
+            r
+        }
+        None => union_boxes(&Ctx::for_master(pres, m), &m.shapes, page),
+    }
+}
+
+/// A rectangle of pixels on the editor canvas, relative to the slide's top-left corner.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub struct Region {
+    pub x: i32,
+    pub y: i32,
+    pub w: u32,
+    pub h: u32,
+}
+
+impl Region {
+    /// The slide itself, `w` × `h` pixels.
+    pub fn slide(w: u32, h: u32) -> Self {
+        Region { x: 0, y: 0, w: w.max(1), h: h.max(1) }
+    }
+
+    fn edges(&self) -> (i64, i64, i64, i64) {
+        let (x, y) = (self.x as i64, self.y as i64);
+        (x, y, x + self.w as i64, y + self.h as i64)
+    }
+
+    fn from_edges(x0: i64, y0: i64, x1: i64, y1: i64) -> Self {
+        let clamp = |v: i64| v.clamp(i32::MIN as i64, i32::MAX as i64) as i32;
+        let side = |a: i64, b: i64| (b - a).clamp(1, MAX_SIDE as i64) as u32;
+        Region { x: clamp(x0), y: clamp(y0), w: side(x0, x1), h: side(y0, y1) }
+    }
+
+    /// Does this region cover all of `other`?
+    pub fn contains(&self, other: &Region) -> bool {
+        let (a, b) = (self.edges(), other.edges());
+        a.0 <= b.0 && a.1 <= b.1 && a.2 >= b.2 && a.3 >= b.3
+    }
+
+    /// Is the region more than the slide (some of the pasteboard is drawn)?
+    pub fn beyond(&self, slide: (u32, u32)) -> bool {
+        *self != Region::slide(slide.0, slide.1)
+    }
+
+    /// Render options' `offset` that puts the slide's top-left corner where it falls in the region.
+    pub fn offset(&self) -> (f64, f64) {
+        (-(self.x as f64), -(self.y as f64))
+    }
+
+    /// The region's size, for render options' `size`.
+    pub fn size(&self) -> (u32, u32) {
+        (self.w, self.h)
+    }
+}
+
+/// `r` (slide space) in pixels at `scale` pixels per point, rounded outwards; `None` when not finite.
+fn to_px(r: Rect, scale: f64) -> Option<(i64, i64, i64, i64)> {
+    let lim = i32::MAX as f64 / 2.0;
+    let px = |v: f64| if v.is_finite() { Some(v.clamp(-lim, lim)) } else { None };
+    Some((
+        px((r.x0 * scale).floor())? as i64,
+        px((r.y0 * scale).floor())? as i64,
+        px((r.x1 * scale).ceil())? as i64,
+        px((r.y1 * scale).ceil())? as i64,
+    ))
+}
+
+/// The pixels the editor renders: the slide (`slide_px`, its size in pixels at `scale` pixels per
+/// point) plus the part of `extent` (slide space, from [`slide_extent`] or what a render drew) that
+/// falls within `visible`, the canvas's area relative to the slide's top-left corner. The visible
+/// area is rounded out to whole [`TILE`]s.
+pub fn pasteboard_region(slide_px: (u32, u32), scale: f64, extent: Rect, visible: Region) -> Region {
+    let page = Region::slide(slide_px.0, slide_px.1);
+    if !(scale.is_finite() && scale > 0.0) {
+        return page;
+    }
+    let Some((ex0, ey0, ex1, ey1)) = to_px(extent, scale) else { return page };
+    let (vx0, vy0, vx1, vy1) = visible.edges();
+    let (vx0, vy0) = (vx0.div_euclid(TILE) * TILE, vy0.div_euclid(TILE) * TILE);
+    let (vx1, vy1) = ((vx1 + TILE - 1).div_euclid(TILE) * TILE, (vy1 + TILE - 1).div_euclid(TILE) * TILE);
+    let (cx0, cy0, cx1, cy1) = (ex0.max(vx0), ey0.max(vy0), ex1.min(vx1), ey1.min(vy1));
+    if cx0 >= cx1 || cy0 >= cy1 {
+        return page;
+    }
+    let (px0, py0, px1, py1) = page.edges();
+    Region::from_edges(cx0.min(px0), cy0.min(py0), cx1.max(px1), cy1.max(py1))
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used)]
+
+    use super::*;
+    use deckcraft_model::Shape;
+
+    fn black() -> deckcraft_model::ColorRef {
+        deckcraft_model::ColorRef::rgb(deckcraft_color::Rgba::BLACK)
+    }
+
+    fn deck_with(x: f64, y: f64, w: f64, h: f64) -> Presentation {
+        let mut p = Presentation::default();
+        let sl = std::sync::Arc::make_mut(&mut p.slides[0]);
+        sl.shapes.push(Shape { id: deckcraft_model::ShapeId(900), xfrm: Some(Xfrm::new(x, y, w, h)), ..Default::default() });
+        p
+    }
+
+    #[test]
+    fn a_slide_with_nothing_off_it_extends_no_further_than_the_slide() {
+        let p = deck_with(100.0, 100.0, 50.0, 50.0);
+        assert_eq!(slide_extent(&p, 0), Rect::new(0.0, 0.0, p.slide_size.width, p.slide_size.height));
+    }
+
+    #[test]
+    fn shapes_off_the_slide_grow_the_extent() {
+        let p = deck_with(-200.0, 50.0, 100.0, 80.0);
+        let e = slide_extent(&p, 0);
+        assert!(e.x0 <= -200.0 && e.x0 > -220.0, "{e:?}");
+        assert_eq!(e.y0, 0.0);
+        assert_eq!(e.x1, p.slide_size.width);
+        // Missing slides are just the page.
+        assert_eq!(slide_extent(&p, 7), Rect::new(0.0, 0.0, p.slide_size.width, p.slide_size.height));
+    }
+
+    #[test]
+    fn hidden_shapes_and_hostile_boxes_do_not_grow_it() {
+        let mut p = deck_with(-5000.0, 0.0, 10.0, 10.0);
+        std::sync::Arc::make_mut(&mut p.slides[0]).shapes.last_mut().unwrap().hidden = true;
+        let page = Rect::new(0.0, 0.0, p.slide_size.width, p.slide_size.height);
+        assert_eq!(slide_extent(&p, 0), page);
+        let p = deck_with(f64::NAN, 0.0, 10.0, 10.0);
+        assert_eq!(slide_extent(&p, 0), page);
+        let p = deck_with(f64::INFINITY, 0.0, 10.0, 10.0);
+        assert_eq!(slide_extent(&p, 0), page);
+    }
+
+    #[test]
+    fn effects_count_towards_the_extent() {
+        let mut p = deck_with(10.0, -100.0, 100.0, 50.0);
+        let sh = std::sync::Arc::make_mut(&mut p.slides[0]).shapes.last_mut().unwrap();
+        sh.effects = Some(Effects {
+            outer_shadow: Some(deckcraft_model::style::Shadow {
+                color: black(),
+                blur: 10.0,
+                dist: 20.0,
+                dir: 270.0,
+                inner: false,
+                sx: 1.0,
+                sy: 1.0,
+                kx: 0.0,
+                ky: 0.0,
+                align: String::new(),
+                rotate_with_shape: false,
+            }),
+            ..Default::default()
+        });
+        assert!(slide_extent(&p, 0).y0 <= -130.0);
+        assert_eq!(
+            spill(
+                None,
+                Some(&Effects { glow: Some(deckcraft_model::style::Glow { color: black(), radius: f64::MAX }), ..Default::default() }),
+                1.0,
+                1.0
+            ),
+            MAX_SPILL
+        );
+    }
+
+    #[test]
+    fn master_graphics_off_the_slide_count_but_not_master_placeholders() {
+        let mut p = Presentation::default();
+        let m = std::sync::Arc::make_mut(&mut p.masters[0]);
+        m.shapes.push(Shape { id: deckcraft_model::ShapeId(901), xfrm: Some(Xfrm::new(-150.0, 10.0, 100.0, 50.0)), ..Default::default() });
+        assert!(slide_extent(&p, 0).x0 <= -150.0);
+        assert!(layout_extent(&p, 0, None).x0 <= -150.0);
+        assert!(layout_extent(&p, 0, Some(0)).x0 <= -150.0 || !p.masters[0].layouts[0].show_master_shapes);
+    }
+
+    #[test]
+    fn the_region_is_the_slide_unless_something_off_it_is_in_view() {
+        let slide = (960, 540);
+        let page = Region::slide(960, 540);
+        let view = Region { x: -100, y: -50, w: 1160, h: 640 };
+        let whole = Rect::new(0.0, 0.0, 960.0, 540.0);
+        assert_eq!(pasteboard_region(slide, 1.0, whole, view), page);
+        assert!(!pasteboard_region(slide, 1.0, whole, view).beyond(slide));
+        // Off to the left, in view: the region reaches it.
+        let r = pasteboard_region(slide, 1.0, Rect::new(-80.0, 0.0, 960.0, 540.0), view);
+        assert_eq!((r.x, r.y, r.w, r.h), (-80, 0, 1040, 540));
+        assert!(r.beyond(slide) && r.contains(&page));
+        assert_eq!(r.offset(), (80.0, 0.0));
+        // Far off and out of view (the view rounds out to tiles): only what's visible.
+        let r = pasteboard_region(slide, 1.0, Rect::new(-5000.0, 0.0, 960.0, 540.0), view);
+        assert_eq!(r.x, -256);
+        // Wholly out of view: the slide.
+        assert_eq!(pasteboard_region(slide, 1.0, Rect::new(-5000.0, 0.0, -4000.0, 540.0).union(whole), Region { x: 0, y: 0, w: 960, h: 540 }), page);
+        // Scale applies; nonsense falls back to the slide.
+        let r = pasteboard_region((480, 270), 0.5, Rect::new(-80.0, 0.0, 960.0, 540.0), view);
+        assert_eq!(r.x, -40);
+        assert_eq!(pasteboard_region(slide, f64::NAN, whole, view), page);
+        assert_eq!(pasteboard_region(slide, 1.0, Rect::new(f64::NAN, 0.0, 1.0, 1.0), view), page);
+        // Huge extents are capped.
+        let r =
+            pasteboard_region(slide, 1.0, Rect::new(-1e12, -1e12, 1e12, 1e12), Region { x: -1_000_000, y: -1_000_000, w: 2_000_000, h: 2_000_000 });
+        assert!(r.w <= MAX_SIDE && r.h <= MAX_SIDE);
+    }
+
+    #[test]
+    fn scrolling_within_a_tile_keeps_the_region() {
+        let slide = (2000, 1125);
+        let e = Rect::new(-500.0, 0.0, 960.0, 540.0);
+        let a = pasteboard_region(slide, 2.0, e, Region { x: -300, y: 0, w: 1000, h: 700 });
+        let b = pasteboard_region(slide, 2.0, e, Region { x: -290, y: 10, w: 1000, h: 700 });
+        assert_eq!(a, b);
+    }
+}

crates/render/src/images.rs

@@ -99,11 +99,20 @@ fn duotone_rgb(a: &PictureAdjust) -> Option<(deckcraft_color::Rgba, deckcraft_co
     Some((rgb(d, deckcraft_color::Rgba::BLACK), rgb(l, deckcraft_color::Rgba::WHITE)))
 }
 
-/// Decode encoded bytes (PNG, JPEG, GIF, WebP, BMP, TIFF) to straight RGBA.
+/// Decode encoded bytes (PNG, JPEG, GIF, WebP, BMP, TIFF; WMF and EMF drawn at
+/// [`crate::metafile::DEFAULT_SIDE`]) to straight RGBA.
 pub fn decode(bytes: &[u8]) -> Option<image::RgbaImage> {
+    decode_at(bytes, crate::metafile::DEFAULT_SIDE)
+}
+
+/// [`decode`], with a metafile drawn with its longer side `side` px.
+fn decode_at(bytes: &[u8], side: u32) -> Option<image::RgbaImage> {
     if bytes.len() > 512 << 20 {
         return None;
     }
+    if crate::metafile::is_metafile(bytes) {
+        return crate::metafile::rasterize(bytes, side);
+    }
     let img = image::load_from_memory(bytes).ok()?;
     let (w, h) = (img.width(), img.height());
     if w == 0 || h == 0 || (w as u64) * (h as u64) > 400_000_000 {
@@ -131,13 +140,13 @@ pub fn decode_for(bytes: &Arc<Vec<u8>>, want: f64, adj: &PictureAdjust) -> Optio
     }) {
         return Some(pm);
     }
-    let Some(mut img) = decode(bytes) else {
+    let target = 1u32 << bucket;
+    let Some(mut img) = decode_at(bytes, target) else {
         with(|c| {
             c.bad.insert(addr, bytes.clone());
         });
         return None;
     };
-    let target = 1u32 << bucket;
     let (w, h) = img.dimensions();
     if w.max(h) > target.max(16) && w.max(h) > 4096.min(target * 2) {
         let k = target as f64 / w.max(h) as f64;

crates/render/src/lib.rs

@@ -11,7 +11,9 @@ mod chart;
 mod colr;
 
 mod compound;
+mod extent;
 mod images;
+mod metafile;
 mod morph_path;
 mod morph_text;
 mod paint;
@@ -39,6 +41,7 @@ use kurbo::{Affine, BezPath, PathEl, Point, Rect, Shape as _, Vec2};
 use vello_common::filter_effects::{EdgeMode, Filter, FilterPrimitive};
 use vello_cpu::{RenderContext, Resources, peniko};
 
+pub use extent::{Region, TILE, layout_extent, pasteboard_region, slide_extent};
 pub use images::{decode as decode_image, gif_frame};
 pub use morph_path::PathMorph;
 pub use morph_text::TextMorph;
@@ -232,11 +235,14 @@ pub struct Renderer {
     /// The background of the slide (layout, master) being drawn, its placeholder colour and the
     /// slide's view transform: shapes filled with the background (`useBgFill`) show it through.
     bg: Option<(Fill, Option<Rgba>, Affine)>,
+    /// What the frame being drawn has painted so far, in output pixels: the editor learns from it
+    /// how far a slide's drawing (text spilling out of its box too) reaches off the slide.
+    drawn: Option<Rect>,
 }
 
 impl Default for Renderer {
     fn default() -> Self {
-        Renderer { resources: Resources::new(), paths: Vec::new(), bg: None }
+        Renderer { resources: Resources::new(), paths: Vec::new(), bg: None, drawn: None }
     }
 }
 
@@ -284,14 +290,38 @@ fn text_has_effects(rctx: &Ctx, s: &Shape) -> bool {
 /// Render slide `index` at `opts.scale` pixels per point. A panic inside the renderer becomes a
 /// blank image (logged), never a crash.
 pub fn render_slide(pres: &Presentation, index: usize, opts: &RenderOpts) -> Image {
-    let Some(slide) = pres.slides.get(index) else { return Image::default() };
-    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| RENDERER.with(|r| r.borrow_mut().slide(pres, slide, index, opts)))) {
-        Ok(img) => img,
+    render_slide_drawn(pres, index, opts).0
+}
+
+/// [`render_slide`], also returning how far the drawing reached, in slide space (at least the
+/// slide; off it, what the shapes, their effects and their text drew, the parts outside the output
+/// included). The editor grows its pasteboard to it ([`pasteboard_region`]).
+pub fn render_slide_drawn(pres: &Presentation, index: usize, opts: &RenderOpts) -> (Image, Rect) {
+    let page = Rect::new(0.0, 0.0, pres.slide_size.width, pres.slide_size.height);
+    let Some(slide) = pres.slides.get(index) else { return (Image::default(), page) };
+    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        RENDERER.with(|r| {
+            let mut r = r.borrow_mut();
+            r.drawn = None;
+            let img = r.slide(pres, slide, index, opts);
+            (img, r.drawn.take())
+        })
+    })) {
+        Ok((img, drawn)) => {
+            let k = opts.scale;
+            let to_slide =
+                |d: Rect| Rect::new((d.x0 - opts.offset.0) / k, (d.y0 - opts.offset.1) / k, (d.x1 - opts.offset.0) / k, (d.y1 - opts.offset.1) / k);
+            let extent = match drawn {
+                Some(d) if k.is_finite() && k > 0.0 && to_slide(d).is_finite() => page.union(to_slide(d)),
+                _ => page,
+            };
+            (img, extent)
+        }
         Err(_) => {
             log::error!("rendering slide {index} panicked; showing a blank slide");
             RENDERER.with(|r| *r.borrow_mut() = Renderer::default());
             let (w, h) = output_size(pres, opts);
-            Image { width: w as u32, height: h as u32, pixels: vec![255; w as usize * h as usize * 4] }
+            (Image { width: w as u32, height: h as u32, pixels: vec![255; w as usize * h as usize * 4] }, page)
         }
     }
 }
@@ -471,6 +501,14 @@ impl Renderer {
         (ctx, w, h, view)
     }
 
+    /// Note that `r` (local space, placed by `m`) was drawn.
+    fn track(&mut self, m: Affine, r: Rect) {
+        let b = m.transform_rect_bbox(r);
+        if b.is_finite() {
+            self.drawn = Some(self.drawn.map_or(b, |d| d.union(b)));
+        }
+    }
+
     fn fields(pres: &Presentation, index: usize, opts: &RenderOpts) -> SlideFields {
         SlideFields::new(pres.slide_number(index), pres.header_footer.footer_text.clone(), opts)
     }
@@ -657,10 +695,21 @@ impl Renderer {
                     self.shape(ctx, f, rctx, c, gm, depth + 1);
                 }
             }
-            ShapeKind::Table(t) => table::draw(ctx, f.pres, rctx, t, m, x.w, x.h, &f.fields),
-            ShapeKind::Chart(c) => chart::draw(ctx, rctx, c, m, x.w, x.h),
+            ShapeKind::Table(t) => {
+                // Rows grow with their text: what the cells cover, borders included.
+                let cells = table::draw(ctx, f.pres, rctx, t, m, x.w, x.h, &f.fields);
+                self.track(m, cells.unwrap_or(Rect::new(0.0, 0.0, x.w, x.h)).inflate(2.0, 2.0));
+            }
+            ShapeKind::Chart(c) => {
+                self.track(m, Rect::new(0.0, 0.0, x.w, x.h));
+                chart::draw(ctx, rctx, c, m, x.w, x.h)
+            }
             ShapeKind::Ink { strokes } => {
                 for sk in strokes {
+                    let w = if sk.width.is_finite() { sk.width.abs() } else { 0.0 };
+                    for (px, py, _) in &sk.points {
+                        self.track(parent, Rect::new(*px, *py, *px, *py).inflate(w, w));
+                    }
                     let mut bp = BezPath::new();
                     for (i, (px, py, _)) in sk.points.iter().enumerate() {
                         if i == 0 {
@@ -691,6 +740,8 @@ impl Renderer {
         let (fill, fill_ph) = resolve::fill(rctx, s);
         let (line, line_ph) = resolve::line(rctx, s);
         let (effects, fx_ph) = resolve::effects(rctx, s);
+        let reach = extent::spill(Some(&line), effects.as_ref(), w, h);
+        self.track(m, Rect::new(0.0, 0.0, w, h).inflate(reach, reach));
         let is_pic = matches!(s.kind, ShapeKind::Picture { .. });
         let outline = geo.outline();
         // Placeholders in the editor: dashed outline and prompt, nothing else when empty.
@@ -716,6 +767,13 @@ impl Renderer {
                 paint::picture(ctx, f.pres, &paint::resolved(rctx, pf, None), bounds, m, t);
                 ctx.pop_layer();
             }
+            // An object DeckCraft doesn't model (an embedded OLE object, an unknown graphic): its
+            // preview picture, stretched over the frame, as PowerPoint draws it.
+            ShapeKind::Opaque { preview: Some(media), .. } => {
+                ctx.set_transform(m);
+                let pf = deckcraft_model::style::PictureFill { media: *media, ..Default::default() };
+                paint::picture(ctx, f.pres, &pf, Rect::new(0.0, 0.0, w, h), m, None);
+            }
             ShapeKind::Media(mc) => {
                 ctx.set_transform(m);
                 let bounds = Rect::new(0.0, 0.0, w, h);
@@ -817,6 +875,12 @@ impl Renderer {
             let tr = geo.text_rect;
             if !body.is_empty() {
                 let l = deckcraft_text::layout(rctx, s, body, &Opts { rect: tr, fields: &f.fields, prompt_color: None, no_shrink: false });
+                let tm = text_transform(m, tr, l.rotation);
+                for b in l.lines.iter().filter_map(line_bounds) {
+                    // Glyphs reach a little past their carets and line box (italics, swashes).
+                    let pad = b.height() * 0.3;
+                    self.track(tm, b.inflate(pad, pad));
+                }
                 match text_warp(rctx, s, tr).filter(|_| l.rotation == 0.0) {
                     Some(w) => warp::draw(ctx, &l, tr, m, &st.paras, &w),
                     None => draw_layout_with(ctx, &l, tr, m, &st.paras),

crates/render/src/metafile.rs

@@ -0,0 +1,105 @@
+//! Windows Metafile and Enhanced Metafile pictures (`image/x-wmf`, `image/x-emf`): parsed by
+//! `deckcraft-metafile` and drawn as vectors into a bitmap of the size the slide needs, so they go
+//! through the same crop, tile and recolour path as any other picture.
+
+use std::sync::Arc;
+
+use deckcraft_metafile::PlacedItem;
+use kurbo::{Affine, Rect, Shape as _};
+use vello_cpu::{Pixmap, RenderContext, Resources, peniko};
+
+/// Longest side of a metafile drawn without a target size (export, thumbnails of the picture).
+pub const DEFAULT_SIDE: u32 = 1024;
+/// Largest side drawn.
+const MAX_SIDE: u32 = 8192;
+
+/// Is `bytes` a WMF or EMF file?
+pub fn is_metafile(bytes: &[u8]) -> bool {
+    deckcraft_metafile::is_metafile(bytes)
+}
+
+/// Draw the metafile `bytes` into straight RGBA with its longer side `side` px (transparent where
+/// it draws nothing). `None` when it doesn't parse or has no size.
+pub fn rasterize(bytes: &[u8], side: u32) -> Option<image::RgbaImage> {
+    let mut pic = deckcraft_metafile::parse(bytes).ok()?;
+    if !pic.has_size() {
+        return None;
+    }
+    let side = side.clamp(16, MAX_SIDE) as f64;
+    let (pw, ph) = (pic.width as f64, pic.height as f64);
+    let k = side / pw.max(ph);
+    let w = (pw * k).round().clamp(1.0, MAX_SIDE as f64) as u16;
+    let h = (ph * k).round().clamp(1.0, MAX_SIDE as f64) as u16;
+    let pixmaps: Vec<Option<Arc<Pixmap>>> = pic.items.iter_mut().map(|it| it.take_pixels().and_then(|(w, h, px)| premul(w, h, &px))).collect();
+    let mut ctx = RenderContext::new_with(w, h, vello_cpu::RenderSettings { num_threads: 0, ..Default::default() });
+    let r = Rect::new(0.0, 0.0, w as f64, h as f64);
+    ctx.push_clip_layer(&r.to_path(0.1));
+    for it in pic.place(r, [0.0; 4]) {
+        match it {
+            PlacedItem::Path { path, fill, stroke, even_odd } => {
+                if let Some(f) = fill {
+                    ctx.set_paint(rgba(f));
+                    ctx.set_fill_rule(if even_odd { peniko::Fill::EvenOdd } else { peniko::Fill::NonZero });
+                    ctx.fill_path(&path);
+                }
+                // GDI pens: round caps and joins; a cosmetic (zero-width) pen is one pixel.
+                if let Some((s, sw)) = stroke {
+                    ctx.set_paint(rgba(s));
+                    ctx.set_stroke(kurbo::Stroke::new(sw.max(1.0)).with_caps(kurbo::Cap::Round).with_join(kurbo::Join::Round));
+                    ctx.stroke_path(&path);
+                }
+            }
+            PlacedItem::Bitmap { index, rect } => {
+                let Some(Some(pm)) = pixmaps.get(index) else { continue };
+                let (bw, bh) = (pm.width().max(1) as f64, pm.height().max(1) as f64);
+                ctx.set_paint(vello_cpu::Image {
+                    image: vello_cpu::ImageSource::Pixmap(pm.clone()),
+                    sampler: peniko::ImageSampler::default().with_quality(peniko::ImageQuality::Medium),
+                });
+                ctx.set_paint_transform(Affine::translate((rect.x0, rect.y0)) * Affine::scale_non_uniform(rect.width() / bw, rect.height() / bh));
+                ctx.fill_rect(&rect);
+                ctx.reset_paint_transform();
+            }
+        }
+    }
+    ctx.set_fill_rule(peniko::Fill::NonZero);
+    ctx.pop_layer();
+    ctx.flush();
+    let mut px = vec![0u8; w as usize * h as usize * 4];
+    if let Some(pm) = vello_cpu::PixmapMut::new(w, h, &mut px) {
+        ctx.render(pm, &mut Resources::new());
+    }
+    // Premultiplied to straight.
+    for p in px.as_chunks_mut::<4>().0 {
+        let a = p[3] as u32;
+        if a != 0 && a != 255 {
+            for c in p.iter_mut().take(3) {
+                *c = ((*c as u32 * 255 + a / 2) / a).min(255) as u8;
+            }
+        }
+    }
+    image::RgbaImage::from_raw(w as u32, h as u32, px)
+}
+
+fn rgba(c: [u8; 4]) -> peniko::Color {
+    peniko::Color::from_rgba8(c[0], c[1], c[2], c[3])
+}
+
+/// Straight RGBA rows to a premultiplied pixmap.
+fn premul(w: u32, h: u32, px: &[u8]) -> Option<Arc<Pixmap>> {
+    if w == 0 || h == 0 || w > u16::MAX as u32 || h > u16::MAX as u32 || px.len() < w as usize * h as usize * 4 {
+        return None;
+    }
+    let data = px
+        .as_chunks::<4>()
+        .0
+        .iter()
+        .take(w as usize * h as usize)
+        .map(|p| {
+            let a = p[3] as u16;
+            let m = |c: u8| ((c as u16 * a + 127) / 255) as u8;
+            vello_cpu::color::PremulRgba8 { r: m(p[0]), g: m(p[1]), b: m(p[2]), a: p[3] }
+        })
+        .collect();
+    Some(Arc::new(Pixmap::from_parts(data, w as u16, h as u16)))
+}

crates/render/src/table.rs

@@ -297,9 +297,21 @@ pub fn cell_rects(t: &Table, heights: &[f64]) -> Vec<(usize, usize, Rect)> {
     out
 }
 
-pub fn draw(ctx: &mut RenderContext, pres: &Presentation, rctx: &Ctx, t: &Table, m: Affine, _w: f64, _h: f64, fields: &dyn deckcraft_text::Fields) {
+/// Draws the table; returns the box its cells cover (table space), which grows with their text.
+#[allow(clippy::too_many_arguments)]
+pub fn draw(
+    ctx: &mut RenderContext,
+    pres: &Presentation,
+    rctx: &Ctx,
+    t: &Table,
+    m: Affine,
+    _w: f64,
+    _h: f64,
+    fields: &dyn deckcraft_text::Fields,
+) -> Option<kurbo::Rect> {
     let _ = pres;
     let rects = cell_rects(t, &row_heights(rctx, t, fields));
+    let covered = rects.iter().map(|(_, _, r)| *r).reduce(|a, b| a.union(b));
     // Table backgrounds behind every cell: a file-defined style's, then the table's own fill.
     let style_bg = rctx
         .pres
@@ -379,4 +391,5 @@ pub fn draw(ctx: &mut RenderContext, pres: &Presentation, rctx: &Ctx, t: &Table,
         crate::draw_text(ctx, rctx, &tmp, &body, *rect, m, fields, None);
         let _ = peniko::Fill::NonZero;
     }
+    covered
 }

crates/render/src/tests.rs

@@ -1037,7 +1037,8 @@ fn wordart_arch_up_lifts_the_middle_of_the_line() {
     // at the box top and the ends sit clearly lower.
     let (al, am, ar) = (top_near(&atops, ax0 + 20).unwrap(), top_near(&atops, (ax0 + ax1) / 2).unwrap(), top_near(&atops, ax1 - 20).unwrap());
     assert!(al > am + 10 && ar > am + 10, "arched {al} {am} {ar}");
-    assert!((80..=110).contains(&ay0), "arch top {ay0}");
+    // At the box top (y = 100), give or take the font: Linux's fallback face reaches 79.
+    assert!((70..=110).contains(&ay0), "arch top {ay0}");
 }
 
 #[test]
@@ -1075,3 +1076,195 @@ fn every_warp_preset_renders_text_inside_the_slide() {
         assert!(x0 <= x1 && y0 <= y1, "{name}: no ink");
     }
 }
+
+/// A placeable WMF, 2 × 1 inch (2880 × 1440 twips): a solid red brush and a rectangle over the
+/// left half, nothing on the right.
+fn half_red_wmf() -> Vec<u8> {
+    fn rec(func: u16, params: &[i16]) -> Vec<u8> {
+        let mut v = ((3 + params.len()) as u32).to_le_bytes().to_vec();
+        v.extend(func.to_le_bytes());
+        for p in params {
+            v.extend(p.to_le_bytes());
+        }
+        v
+    }
+    // CREATEBRUSHINDIRECT (solid, COLORREF 0x000000FF = red), SELECTOBJECT 0, RECTANGLE (bottom,
+    // right, top, left).
+    let body = [rec(0x02FC, &[0, 0xFF, 0, 0]), rec(0x012D, &[0]), rec(0x041B, &[1440, 1440, 0, 0]), rec(0, &[])].concat();
+    let mut f = 0x9AC6_CDD7u32.to_le_bytes().to_vec();
+    f.extend(0u16.to_le_bytes());
+    for v in [0i16, 0, 2880, 1440] {
+        f.extend(v.to_le_bytes());
+    }
+    f.extend(1440u16.to_le_bytes());
+    f.extend(0u32.to_le_bytes());
+    f.extend(0u16.to_le_bytes());
+    let total = (f.len() + 18 + body.len()) / 2;
+    for v in [1u16, 9, 0x300] {
+        f.extend(v.to_le_bytes());
+    }
+    f.extend((total as u32).to_le_bytes());
+    f.extend(16u16.to_le_bytes());
+    f.extend(0u32.to_le_bytes());
+    f.extend(0u16.to_le_bytes());
+    f.extend(body);
+    f
+}
+
+#[test]
+fn metafile_pictures_draw_their_vectors() {
+    let mut p = Presentation::default();
+    let media = p.add_media("image1.wmf", "image/x-wmf", half_red_wmf());
+    let fill = deckcraft_model::style::PictureFill { media, ..Default::default() };
+    let sh = Shape { id: ShapeId(600), xfrm: Some(Xfrm::new(100.0, 100.0, 400.0, 200.0)), kind: ShapeKind::Picture { fill }, ..Default::default() };
+    std::sync::Arc::make_mut(&mut p.slides[0]).shapes = vec![sh];
+    for scale in [0.5, 1.0, 3.0] {
+        let img = render_slide(&p, 0, &RenderOpts { scale, ..Default::default() });
+        let at = |x: f64, y: f64| img.pixel((x * scale) as u32, (y * scale) as u32);
+        let left = at(200.0, 200.0);
+        assert!(left[0] > 200 && left[1] < 60 && left[2] < 60, "left half red at {scale}: {left:?}");
+        let right = at(400.0, 200.0);
+        assert!(right[0] > 200 && right[1] > 200 && right[2] > 200, "right half empty at {scale}: {right:?}");
+    }
+}
+
+#[test]
+fn broken_metafiles_draw_nothing_and_never_panic() {
+    let wmf = half_red_wmf();
+    let mut cases: Vec<Vec<u8>> = (0..wmf.len()).step_by(3).map(|n| wmf[..n].to_vec()).collect();
+    cases.push(vec![1, 0, 0, 0, 0xFF, 0xFF, 0xFF, 0xFF]);
+    let mut huge = wmf.clone();
+    huge[10] = 0xFF;
+    huge[11] = 0x7F;
+    cases.push(huge);
+    for bytes in cases {
+        let mut p = Presentation::default();
+        let media = p.add_media("image1.emf", "image/x-emf", bytes);
+        let fill = deckcraft_model::style::PictureFill { media, ..Default::default() };
+        let sh = Shape { id: ShapeId(600), xfrm: Some(Xfrm::new(0.0, 0.0, 400.0, 200.0)), kind: ShapeKind::Picture { fill }, ..Default::default() };
+        std::sync::Arc::make_mut(&mut p.slides[0]).shapes = vec![sh];
+        let _ = render_slide(&p, 0, &RenderOpts { scale: 0.25, ..Default::default() });
+    }
+}
+
+#[test]
+fn an_object_deckcraft_doesnt_model_shows_its_preview_picture() {
+    // An embedded OLE object (or an unknown graphic) draws its preview stretched over its frame,
+    // as PowerPoint does; with no preview it draws nothing.
+    let png = {
+        let mut out = std::io::Cursor::new(vec![]);
+        image::DynamicImage::ImageRgb8(image::RgbImage::from_pixel(4, 2, image::Rgb([200, 20, 20])))
+            .write_to(&mut out, image::ImageFormat::Png)
+            .unwrap();
+        out.into_inner()
+    };
+    for with_preview in [true, false] {
+        let mut p = Presentation::default();
+        let media = p.add_media("image1.png", "image/png", png.clone());
+        let sh = Shape {
+            id: ShapeId(600),
+            xfrm: Some(Xfrm::new(100.0, 100.0, 400.0, 200.0)),
+            kind: ShapeKind::Opaque { xml: String::new(), preview: with_preview.then_some(media), label: "Package".into() },
+            ..Default::default()
+        };
+        std::sync::Arc::make_mut(&mut p.slides[0]).shapes = vec![sh];
+        let img = render_slide(&p, 0, &RenderOpts { scale: 1.0, ..Default::default() });
+        for (x, y) in [(110, 110), (300, 200), (490, 290)] {
+            let px = img.pixel(x, y);
+            let red = px[0] > 180 && px[1] < 60 && px[2] < 60;
+            assert_eq!(red, with_preview, "({x}, {y}) {px:?}");
+        }
+        assert!(img.pixel(520, 200)[1] > 200, "nothing outside the frame");
+    }
+}
+
+/// #270: a filled shape half off the slide's left edge, and one wholly below it.
+fn off_slide_deck() -> Presentation {
+    let half = Shape {
+        id: ShapeId(2700),
+        xfrm: Some(Xfrm::new(-100.0, 100.0, 200.0, 100.0)),
+        style: Some(ShapeStyle::accent(deckcraft_color::SchemeSlot::Accent1)),
+        ..Default::default()
+    };
+    let below = Shape {
+        id: ShapeId(2701),
+        xfrm: Some(Xfrm::new(400.0, 600.0, 100.0, 60.0)),
+        style: Some(ShapeStyle::accent(deckcraft_color::SchemeSlot::Accent2)),
+        ..Default::default()
+    };
+    deck_with(vec![half, below])
+}
+
+fn near(px: [u8; 4], c: deckcraft_color::Rgba) -> bool {
+    (px[0] as i32 - c.r as i32).abs() <= 3 && (px[1] as i32 - c.g as i32).abs() <= 3 && (px[2] as i32 - c.b as i32).abs() <= 3 && px[3] == 255
+}
+
+#[test]
+fn shows_exports_and_thumbnails_clip_to_the_slide() {
+    let p = off_slide_deck();
+    let img = render_slide(&p, 0, &RenderOpts { scale: 1.0, ..Default::default() });
+    assert_eq!((img.width, img.height), (960, 540));
+    let a1 = p.masters[0].theme.colors.get(deckcraft_color::SchemeSlot::Accent1);
+    // The on-slide half is there, nothing else is drawn outside the slide.
+    assert!(near(img.pixel(50, 150), a1), "{:?}", img.pixel(50, 150));
+    assert_eq!(img.pixel(150, 150), [255, 255, 255, 255]);
+}
+
+#[test]
+fn the_editor_pasteboard_draws_shapes_off_the_slide() {
+    let p = off_slide_deck();
+    let extent = slide_extent(&p, 0);
+    let region = pasteboard_region((960, 540), 1.0, extent, Region { x: -300, y: -200, w: 1560, h: 1000 });
+    assert!(region.x <= -100 && region.y == 0 && region.y as i64 + region.h as i64 >= 660, "{region:?}");
+    let opts = RenderOpts { scale: 1.0, edit: true, offset: region.offset(), size: Some(region.size()), ..Default::default() };
+    let (img, drawn) = render_slide_drawn(&p, 0, &opts);
+    assert_eq!((img.width, img.height), region.size());
+    let at = |x: i32, y: i32| img.pixel((x - region.x) as u32, (y - region.y) as u32);
+    let a1 = p.masters[0].theme.colors.get(deckcraft_color::SchemeSlot::Accent1);
+    let a2 = p.masters[0].theme.colors.get(deckcraft_color::SchemeSlot::Accent2);
+    // Both halves of the straddling shape, at full strength, and the shape below the slide.
+    assert!(near(at(-50, 150), a1), "{:?}", at(-50, 150));
+    assert!(near(at(50, 150), a1), "{:?}", at(50, 150));
+    assert!(near(at(450, 630), a2), "{:?}", at(450, 630));
+    // The pasteboard itself stays clear (the UI's own colour shows through); the slide is white.
+    assert_eq!(at(-50, 50), [0, 0, 0, 0]);
+    assert_eq!(at(200, 300), [255, 255, 255, 255]);
+    // The drawing's reach, in slide space.
+    assert!(drawn.x0 <= -100.0 && drawn.y1 >= 660.0 && drawn.x1 >= 960.0, "{drawn:?}");
+}
+
+#[test]
+fn master_graphics_off_the_slide_show_on_the_pasteboard() {
+    let mut p = Presentation::default();
+    let m = std::sync::Arc::make_mut(&mut p.masters[0]);
+    m.shapes.push(Shape {
+        id: ShapeId(2702),
+        xfrm: Some(Xfrm::new(-150.0, 300.0, 100.0, 60.0)),
+        style: Some(ShapeStyle::accent(deckcraft_color::SchemeSlot::Accent3)),
+        ..Default::default()
+    });
+    let region = pasteboard_region((960, 540), 1.0, slide_extent(&p, 0), Region { x: -300, y: -100, w: 1500, h: 800 });
+    let img = render_slide(&p, 0, &RenderOpts { scale: 1.0, edit: true, offset: region.offset(), size: Some(region.size()), ..Default::default() });
+    let a3 = p.masters[0].theme.colors.get(deckcraft_color::SchemeSlot::Accent3);
+    assert!(near(img.pixel((-100 - region.x) as u32, (330 - region.y) as u32), a3));
+}
+
+#[test]
+fn text_spilling_out_of_its_box_below_the_slide_is_reported() {
+    let mut sh = Shape { id: ShapeId(2703), xfrm: Some(Xfrm::new(100.0, 500.0, 400.0, 20.0)), ..Default::default() };
+    let mut t = TextBody::from_text("one\ntwo\nthree\nfour\nfive");
+    for para in &mut t.paragraphs {
+        for r in &mut para.runs {
+            r.props.size = Some(40.0);
+        }
+    }
+    sh.text = Some(t);
+    let p = deck_with(vec![sh]);
+    // The box estimate doesn't see the text below the slide; the render does.
+    assert!(slide_extent(&p, 0).y1 <= 540.0 + 4.0);
+    let (_, drawn) = render_slide_drawn(&p, 0, &RenderOpts { scale: 0.5, ..Default::default() });
+    assert!(drawn.y1 > 600.0, "{drawn:?}");
+    // A slide with nothing off it reaches just the slide.
+    let (_, drawn) = render_slide_drawn(&Presentation::default(), 0, &RenderOpts { scale: 0.5, edit: true, ..Default::default() });
+    assert_eq!(drawn, Rect::new(0.0, 0.0, 960.0, 540.0));
+}

crates/text/src/lib.rs

@@ -261,7 +261,7 @@ fn make_style(ctx: &Ctx, r: &RunProps, scale: f64, prompt: Option<Rgba>) -> Styl
     let family = resolve::font_family(ctx, r);
     let bold = r.bold.unwrap_or(false);
     let italic = r.italic.unwrap_or(false);
-    let face = FontDb::global().face(&family, style_name(bold, italic));
+    let face = FontDb::global().document_face(&family, style_name(bold, italic));
     let fake_bold = bold && face.weight < 550.0;
     let fake_italic = italic && !face.italic;
     let size = (r.size.unwrap_or(18.0) * scale).clamp(0.5, 4000.0);

crates/ui-egui/src/canvas.rs

@@ -1,6 +1,10 @@
 //! The slide canvas: the rendered slide, zoom and fit, pointer input routed to the engine's tools,
 //! and the overlays drawn on top (selection box and handles, smart guides, marquee, drawing
 //! previews, the text caret and text selection).
+//!
+//! As in PowerPoint's Normal view, shapes, pictures and text that sit partly or wholly off the
+//! slide are drawn on the area around it (the pasteboard), where they can be selected and moved;
+//! the slide show, exports and thumbnails clip to the slide.
 
 use deckcraft_engine::tools::{Hit, box_handles};
 use deckcraft_engine::{Mods, PointerEvent, PointerKind, Target, ToolKind};
@@ -108,18 +112,26 @@ pub fn show(app: &mut SlideApp, ui: &mut Ui) {
     crate::media::gif_repaint(ui.ctx(), &gifs);
     let times: Vec<_> = gifs.iter().map(|g| (g.id, g.t)).collect();
     let st = app.session.active();
+    // One texture pixel in screen points, and the canvas in pixels from the slide's corner.
+    let pixel = vec2(slide_rect.width() / px.0 as f32, slide_rect.height() / px.1 as f32);
+    let visible = visible_region(avail, slide_rect, pixel);
     let tex = match st.map(|d| (d.selection.target, d)) {
         Some((Target::Slides, d)) => {
             let idx = d.selection.slide;
             let doc = d.doc.clone();
-            app.textures.slide(ui.ctx(), &doc, idx, px, true, crate::media::gif_key(&gifs), app.ui.grayscale, &times)
+            app.textures.slide(ui.ctx(), &doc, idx, px, visible, true, crate::media::gif_key(&gifs), app.ui.grayscale, &times)
         }
-        Some((Target::Master { master }, d)) => master_tex(ui.ctx(), &d.doc, master, None, px),
-        Some((Target::Layout { master, layout }, d)) => master_tex(ui.ctx(), &d.doc, master, Some(layout), px),
+        Some((Target::Master { master }, d)) => master_tex(ui.ctx(), &d.doc, master, None, px, visible),
+        Some((Target::Layout { master, layout }, d)) => master_tex(ui.ctx(), &d.doc, master, Some(layout), px, visible),
         None => None,
     };
-    if let Some(tex) = tex {
-        painter.image(tex.id(), slide_rect, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+    if let Some((tex, region)) = tex {
+        let at = Rect::from_min_size(
+            slide_rect.min + vec2(region.x as f32 * pixel.x, region.y as f32 * pixel.y),
+            vec2(region.w as f32 * pixel.x, region.h as f32 * pixel.y),
+        );
+        app.canvas_region = Some(at);
+        painter.image(tex.id(), at, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
     }
     app.perf.render_ms = app.textures.last_render_ms;
     media_frames(app, &painter, xf);
@@ -157,6 +169,22 @@ pub fn show(app: &mut SlideApp, ui: &mut Ui) {
     context_menu(app, &resp);
 }
 
+/// The canvas `avail` in texture pixels (`pixel`: one pixel's size in points) from the slide's
+/// top-left corner.
+fn visible_region(avail: Rect, slide: Rect, pixel: egui::Vec2) -> deckcraft_render::Region {
+    let px = |v: f32, k: f32| if v.is_finite() && k > 0.0 { (v / k) as f64 } else { 0.0 };
+    let (x0, y0) = (px(avail.min.x - slide.min.x, pixel.x).floor(), px(avail.min.y - slide.min.y, pixel.y).floor());
+    let (x1, y1) = (px(avail.max.x - slide.min.x, pixel.x).ceil(), px(avail.max.y - slide.min.y, pixel.y).ceil());
+    let lim = i32::MAX as f64 / 4.0;
+    let (x0, y0) = (x0.clamp(-lim, lim), y0.clamp(-lim, lim));
+    deckcraft_render::Region {
+        x: x0 as i32,
+        y: y0 as i32,
+        w: (x1 - x0).clamp(1.0, u32::MAX as f64) as u32,
+        h: (y1 - y0).clamp(1.0, u32::MAX as f64) as u32,
+    }
+}
+
 /// Play/pause on an animated GIF under the pointer or selected on its own.
 fn gif_buttons(app: &mut SlideApp, ui: &mut Ui, xf: Xf, gifs: &[crate::media::Gif]) {
     let Some(d) = app.session.active() else { return };
@@ -240,14 +268,17 @@ fn master_tex(
     master: usize,
     layout: Option<usize>,
     px: (u32, u32),
-) -> Option<egui::TextureHandle> {
+    visible: deckcraft_render::Region,
+) -> Option<(egui::TextureHandle, deckcraft_render::Region)> {
+    let scale = px.0 as f64 / doc.slide_size.width.max(1.0);
+    let region = deckcraft_render::pasteboard_region(px, scale, deckcraft_render::layout_extent(doc, master, layout), visible);
     let img = deckcraft_render::render_layout(
         doc,
         master,
         layout,
-        &deckcraft_render::RenderOpts { scale: px.0 as f64 / doc.slide_size.width.max(1.0), edit: true, size: Some(px), ..Default::default() },
+        &deckcraft_render::RenderOpts { scale, edit: true, offset: region.offset(), size: Some(region.size()), ..Default::default() },
     );
-    Some(ctx.load_texture("master-canvas", crate::textures::to_color_image(&img, false), egui::TextureOptions::LINEAR))
+    Some((ctx.load_texture("master-canvas", crate::textures::to_color_image(&img, false), egui::TextureOptions::LINEAR), region))
 }
 
 fn ruler(p: &egui::Painter, avail: Rect, slide: Rect, scale: f32, t: &Tokens) {

crates/ui-egui/src/lib.rs

@@ -22,6 +22,7 @@ pub mod status;
 pub mod textures;
 pub mod theme;
 pub mod thumbs;
+pub mod toast;
 pub mod widgets;
 
 use std::sync::mpsc::{Receiver, Sender};
@@ -181,6 +182,10 @@ pub struct SlideApp {
     /// Audio/video playback (editor control bar, slide show, `media.*` commands).
     pub media: media::MediaHost,
     pub status: Option<(String, f64)>,
+    /// A brief notice over the bottom of the window (missing fonts on opening a file).
+    pub toast: Option<toast::Toast>,
+    /// Documents (by uid) whose missing fonts have been mentioned.
+    fonts_noted: std::collections::HashSet<u64>,
     pub perf: Perf,
     /// Synthetic input events (control channel `ui.click` etc.), injected one per frame.
     pub synthetic: Vec<egui::Event>,
@@ -188,6 +193,8 @@ pub struct SlideApp {
     pub canvas_rect: Option<egui::Rect>,
     pub canvas_scale: f32,
     pub slide_rect: Option<egui::Rect>,
+    /// Where the canvas texture (the slide and the pasteboard drawn around it) is on screen.
+    pub canvas_region: Option<egui::Rect>,
     pub palette: Option<(String, usize)>,
     /// Integrated title bar (macOS traffic lights over our chrome).
     pub integrated_titlebar: bool,
@@ -224,11 +231,14 @@ impl SlideApp {
             show: None,
             media: media::MediaHost::new(audio_out),
             status: None,
+            toast: None,
+            fonts_noted: Default::default(),
             perf: Perf { frame_ms: 0.0, render_ms: 0.0, fps: 0.0 },
             synthetic: vec![],
             canvas_rect: None,
             canvas_scale: 1.0,
             slide_rect: None,
+            canvas_region: None,
             palette: None,
             integrated_titlebar: false,
             home: None,
@@ -730,6 +740,8 @@ impl SlideApp {
                 }
             }
         });
+        toast::note_missing_fonts(self);
+        toast::show(self, &ctx);
         dialogs::show(self, &ctx);
         menus::palette(self, &ctx);
         for url in std::mem::take(&mut self.pending_urls) {
@@ -889,6 +901,37 @@ mod tests {
         sh.text.as_ref().map(|t| t.paragraphs.iter().map(|p| p.text()).collect::<Vec<_>>().join("\n")).unwrap_or_default()
     }
 
+    #[test]
+    fn opening_a_file_with_missing_fonts_shows_a_toast_once() {
+        use egui_kittest::kittest::Queryable;
+        let mut p = deckcraft_model::Presentation::default();
+        let slide = std::sync::Arc::make_mut(&mut p.slides[0]);
+        let mut body = deckcraft_model::text::TextBody::from_text("Hello");
+        body.paragraphs[0].runs[0].props.font = Some("Qqq Nonexistent Sans".into());
+        slide.shapes[0].text = Some(body);
+        let data = deckcraft_engine::cmd::base64_encode(&deckcraft_engine::cmd::file::save_bytes(&p, "pptx").unwrap());
+        let mut harness = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_ui_state(
+            |ui, app: &mut SlideApp| {
+                app.logic(ui.ctx());
+                app.ui(ui);
+            },
+            SlideApp::new(Session::with_new(), Services::default()),
+        );
+        harness.run_steps(2);
+        assert!(harness.state().toast.is_none(), "a new presentation has nothing to say");
+        harness.state_mut().session.execute("file.openBytes", &json!({"name": "a.pptx", "data": data})).unwrap();
+        harness.run_steps(2);
+        let text = harness.state().toast.as_ref().map(|t| t.text.clone()).unwrap_or_default();
+        assert!(text.starts_with("Qqq Nonexistent Sans isn't installed"), "{text}");
+        assert!(harness.query_by_label_contains("Qqq Nonexistent Sans isn't installed").is_some());
+        // Closed, it stays closed for that document.
+        harness.get_by_label("Close").click();
+        harness.run_steps(2);
+        assert!(harness.state().toast.is_none());
+        harness.run_steps(2);
+        assert!(harness.state().toast.is_none());
+    }
+
     /// #17: Home created a new blank presentation instead of going to the start screen.
     #[test]
     fn home_shows_the_start_screen_over_the_open_presentation() {
@@ -938,4 +981,107 @@ mod tests {
         app.run("app.home", json!({})).unwrap();
         assert!(!app.home_open() && app.home.is_none(), "with nothing open the start screen shows anyway");
     }
+    fn canvas_harness() -> egui_kittest::Harness<'static, SlideApp> {
+        let mut harness = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_ui_state(
+            |ui, app: &mut SlideApp| {
+                app.logic(ui.ctx());
+                app.ui(ui);
+            },
+            SlideApp::new(Session::with_new(), Services::default()),
+        );
+        harness.run_steps(2);
+        let app = harness.state_mut();
+        // Zoomed out, the canvas shows plenty of pasteboard around the slide.
+        app.ui.zoom = Some(0.4);
+        app.session.prefs.snap_to_grid = false;
+        app.session.prefs.smart_guides = false;
+        harness
+    }
+
+    fn selected(app: &SlideApp) -> Vec<u64> {
+        app.session.active().unwrap().selection.shapes.iter().map(|i| i.0 as u64).collect()
+    }
+
+    fn shape_x(app: &SlideApp, id: u64) -> f64 {
+        let st = app.session.active().unwrap();
+        st.shape(deckcraft_model::ShapeId(id as u32)).and_then(|s| s.xfrm).unwrap().x
+    }
+
+    /// #270: PowerPoint's Normal view draws objects off the slide on the area around it, where
+    /// they can be selected and moved.
+    #[test]
+    fn off_slide_objects_show_on_the_pasteboard_and_can_be_selected_and_moved() {
+        let mut harness = canvas_harness();
+        let off =
+            harness.state_mut().session.execute("shape.insert", &json!({"preset": "rect", "rect": [1000.0, 100.0, 120.0, 80.0]})).unwrap()["id"]
+                .as_u64()
+                .unwrap();
+        harness.state_mut().session.execute("edit.select", &json!({"ids": []})).unwrap();
+        harness.run_steps(3);
+
+        let app = harness.state();
+        let (slide, region, k) = (app.slide_rect.unwrap(), app.canvas_region.unwrap(), app.canvas_scale);
+        // The texture reaches past the slide's right edge to the shape's, and no further left/up.
+        assert!(region.max.x >= slide.min.x + 1120.0 * k - 1.0, "{region:?} {slide:?}");
+        assert!((region.min.x - slide.min.x).abs() < 1.0 && (region.min.y - slide.min.y).abs() < 1.0, "{region:?} {slide:?}");
+        let centre = slide.min + egui::vec2(1060.0 * k, 140.0 * k);
+        assert!(app.canvas_rect.unwrap().contains(centre));
+
+        // Drawn at full strength on the pasteboard (when a GPU renderer is available here).
+        if let Ok(img) = harness.render() {
+            let px = |p: egui::Pos2| img.get_pixel(p.x as u32, p.y as u32).0;
+            let shape = px(centre);
+            let board = px(slide.min + egui::vec2(1060.0 * k, 400.0 * k));
+            let doc = &harness.state().session.active().unwrap().doc;
+            let accent = doc.masters[0].theme.colors.get(deckcraft_color::SchemeSlot::Accent1);
+            let close = |a: u8, b: u8| (a as i32 - b as i32).abs() <= 4;
+            assert!(close(shape[0], accent.r) && close(shape[1], accent.g) && close(shape[2], accent.b), "{shape:?} vs {accent:?}");
+            assert_ne!(shape, board);
+        }
+
+        // Click selects it.
+        harness.hover_at(centre);
+        harness.run_steps(1);
+        harness.drag_at(centre);
+        harness.run_steps(1);
+        harness.drop_at(centre);
+        harness.run_steps(2);
+        assert_eq!(selected(harness.state()), vec![off]);
+
+        // Drag moves it, further off the slide.
+        let to = centre + egui::vec2(40.0, 0.0);
+        harness.hover_at(centre);
+        harness.run_steps(1);
+        harness.drag_at(centre);
+        harness.run_steps(1);
+        for i in 1..=4 {
+            harness.hover_at(centre + egui::vec2(10.0 * i as f32, 0.0));
+            harness.run_steps(1);
+        }
+        harness.drop_at(to);
+        harness.run_steps(2);
+        let x = shape_x(harness.state(), off);
+        assert!((x - (1000.0 + 40.0 / k as f64)).abs() < 1.5, "{x}");
+        // The pasteboard followed it.
+        let (slide, region) = (harness.state().slide_rect.unwrap(), harness.state().canvas_region.unwrap());
+        assert!(region.max.x >= slide.min.x + (x as f32 + 120.0) * k - 1.0, "{region:?}");
+
+        // Idle frames don't render the canvas again.
+        let n = harness.state().textures.canvas_renders;
+        harness.run_steps(3);
+        assert_eq!(harness.state().textures.canvas_renders, n);
+    }
+
+    /// A slide with nothing off it renders just the slide, as before.
+    #[test]
+    fn the_canvas_renders_only_the_slide_when_nothing_is_off_it() {
+        let mut harness = canvas_harness();
+        harness.run_steps(3);
+        let app = harness.state();
+        let (slide, region) = (app.slide_rect.unwrap(), app.canvas_region.unwrap());
+        assert!((region.min - slide.min).length() < 0.5 && (region.max - slide.max).length() < 1.0, "{region:?} {slide:?}");
+        let n = app.textures.canvas_renders;
+        harness.run_steps(3);
+        assert_eq!(harness.state().textures.canvas_renders, n, "an unchanged slide isn't rendered again");
+    }
 }

crates/ui-egui/src/textures.rs

@@ -1,11 +1,15 @@
 //! Rendered slides as GPU textures: the canvas slide and thumbnails, cached by the slide's and its
 //! master's `Arc` identity (an unchanged slide keeps its `Arc`, so it never re-renders).
+//!
+//! The canvas texture covers the slide plus whatever of the slide's drawing reaches off it and is
+//! in view (PowerPoint's Normal view shows off-slide objects; thumbnails clip to the slide).
 
 use std::collections::HashMap;
 use std::sync::Arc;
 
+use deckcraft_geom::Rect;
 use deckcraft_model::{Master, Presentation, ShapeId, Slide};
-use deckcraft_render::{Image, RenderOpts};
+use deckcraft_render::{Image, Region, RenderOpts};
 use egui::{ColorImage, TextureHandle, TextureOptions};
 
 #[derive(Clone, PartialEq)]
@@ -15,11 +19,15 @@ struct Key {
     size: (u32, u32),
     edit: bool,
     extra: u64,
+    /// The pasteboard region the slide's drawing calls for (canvas only).
+    want: Region,
 }
 
 struct Entry {
     key: Key,
     tex: TextureHandle,
+    /// The region the texture covers (at least `key.want`).
+    region: Region,
     // Keep the Arcs alive so their addresses can't be reused while cached.
     _slide: Arc<Slide>,
     _master: Option<Arc<Master>>,
@@ -29,6 +37,14 @@ struct Entry {
 #[derive(Default)]
 pub struct Textures {
     canvas: Option<Entry>,
+    /// How far the canvas slide's shapes reach (from their boxes), for the slide and master `Arc`s
+    /// held (kept alive so their addresses can't be reused).
+    estimate: Option<(Arc<Slide>, Option<Arc<Master>>, Rect)>,
+    /// How far the last canvas render of a slide (by index) actually drew: text spilling out of
+    /// its box shows there.
+    drawn: Option<(usize, Rect)>,
+    /// Canvas renders so far (tests, performance checks).
+    pub canvas_renders: u64,
     thumbs: HashMap<usize, Entry>,
     clock: u64,
     pub last_render_ms: f64,
@@ -55,41 +71,84 @@ fn master_of(p: &Presentation, slide: &Slide) -> Option<Arc<Master>> {
     p.masters.iter().find(|m| m.layout(slide.layout).is_some()).cloned()
 }
 
+fn same(a: &Option<Arc<Master>>, b: &Option<Arc<Master>>) -> bool {
+    match (a, b) {
+        (Some(a), Some(b)) => Arc::ptr_eq(a, b),
+        (None, None) => true,
+        _ => false,
+    }
+}
+
 fn threads() -> u16 {
     if cfg!(target_arch = "wasm32") { 0 } else { std::thread::available_parallelism().map(|n| n.get().min(8) as u16).unwrap_or(0) }
 }
 
 impl Textures {
-    /// The canvas texture for slide `index` at `size` pixels; `extra` changes with the GIF frames.
+    /// The canvas texture for slide `index`, the slide being `size` pixels, and the region it
+    /// covers: the slide, grown over the pasteboard to show what reaches off the slide within
+    /// `visible` (the canvas, in pixels from the slide's top-left corner). `extra` changes with the
+    /// GIF frames.
+    #[allow(clippy::too_many_arguments)]
     pub fn slide(
         &mut self,
         ctx: &egui::Context,
         p: &Presentation,
         index: usize,
         size: (u32, u32),
+        visible: Region,
         edit: bool,
         extra: u64,
         grayscale: bool,
         gif_times: &[(ShapeId, f64)],
-    ) -> Option<TextureHandle> {
+    ) -> Option<(TextureHandle, Region)> {
         let slide = p.slides.get(index)?.clone();
         let master = master_of(p, &slide);
+        let scale = size.0 as f64 / p.slide_size.width.max(1.0);
+        let estimate = match &self.estimate {
+            Some((s, m, r)) if Arc::ptr_eq(s, &slide) && same(m, &master) => *r,
+            _ => {
+                let r = deckcraft_render::slide_extent(p, index);
+                self.estimate = Some((slide.clone(), master.clone(), r));
+                r
+            }
+        };
+        let reach = match self.drawn {
+            Some((i, d)) if i == index => estimate.union(d),
+            _ => estimate,
+        };
+        let want = deckcraft_render::pasteboard_region(size, scale, reach, visible);
         let key = Key {
             slide: Arc::as_ptr(&slide) as usize,
             master: master.as_ref().map(|m| Arc::as_ptr(m) as usize).unwrap_or(0),
             size,
             edit,
             extra: extra ^ grayscale as u64,
+            want,
         };
         if let Some(e) = &self.canvas
             && e.key == key
         {
-            return Some(e.tex.clone());
+            return Some((e.tex.clone(), e.region));
         }
         let t0 = crate::now_ms();
-        let scale = size.0 as f64 / p.slide_size.width.max(1.0);
-        let opts = RenderOpts { scale, edit, gif_times, threads: threads(), size: Some(size), ..Default::default() };
-        let img = deckcraft_render::render_slide(p, index, &opts);
+        let render = |region: Region| {
+            let opts =
+                RenderOpts { scale, edit, gif_times, threads: threads(), offset: region.offset(), size: Some(region.size()), ..Default::default() };
+            deckcraft_render::render_slide_drawn(p, index, &opts)
+        };
+        let (mut img, drawn) = render(want);
+        self.canvas_renders += 1;
+        let mut region = want;
+        // Text spilling out of its box can reach further than the boxes said. Once drawn, the
+        // region it calls for is known (and is next frame's key): render again only if it shows
+        // more than this render covered.
+        let key = Key { want: deckcraft_render::pasteboard_region(size, scale, estimate.union(drawn), visible), ..key };
+        if !region.contains(&key.want) {
+            region = key.want;
+            img = render(region).0;
+            self.canvas_renders += 1;
+        }
+        self.drawn = Some((index, drawn));
         self.last_render_ms = crate::now_ms() - t0;
         let ci = to_color_image(&img, grayscale);
         let tex = match self.canvas.take() {
@@ -99,13 +158,15 @@ impl Textures {
             }
             None => ctx.load_texture("slide-canvas", ci, TextureOptions::LINEAR),
         };
-        self.canvas = Some(Entry { key, tex: tex.clone(), _slide: slide, _master: master, stamp: 0 });
-        Some(tex)
+        self.canvas = Some(Entry { key, tex: tex.clone(), region, _slide: slide, _master: master, stamp: 0 });
+        Some((tex, region))
     }
 
     /// Force the canvas to re-render next time (fonts loaded, theme changed in place…).
     pub fn invalidate(&mut self) {
         self.canvas = None;
+        self.estimate = None;
+        self.drawn = None;
         self.thumbs.clear();
     }
 
@@ -121,6 +182,7 @@ impl Textures {
             size: (width_px, h),
             edit: false,
             extra: 0,
+            want: Region::slide(width_px, h),
         };
         self.clock += 1;
         let clock = self.clock;
@@ -139,7 +201,8 @@ impl Textures {
         let img = deckcraft_render::render_slide(p, index, &RenderOpts { scale, size: Some((width_px, h)), threads: 0, ..Default::default() });
         let tex = ctx.load_texture(format!("thumb-{index}"), to_color_image(&img, false), TextureOptions::LINEAR);
         // Drop the old entry for this slide address; entries for slides that no longer exist age out.
-        self.thumbs.insert(key.slide, Entry { key, tex: tex.clone(), _slide: slide, _master: master, stamp: clock });
+        let region = key.want;
+        self.thumbs.insert(key.slide, Entry { key, tex: tex.clone(), region, _slide: slide, _master: master, stamp: clock });
         if self.thumbs.len() > 600 {
             let mut v: Vec<(usize, u64)> = self.thumbs.iter().map(|(k, e)| (*k, e.stamp)).collect();
             v.sort_by_key(|x| x.1);

crates/ui-egui/src/toast.rs

@@ -0,0 +1,94 @@
+//! Brief notices over the window's bottom edge: shown once, gone after a few seconds or when
+//! closed. Used to say a presentation's fonts aren't installed when it is first opened.
+
+use egui::{Align2, CornerRadius, Margin, Stroke, vec2};
+
+use crate::SlideApp;
+use crate::icons::{self, Icon};
+use crate::theme::{self, Tokens};
+
+/// How long a toast stays, in milliseconds.
+const SHOW_MS: f64 = 8000.0;
+
+pub struct Toast {
+    pub text: String,
+    pub at: f64,
+}
+
+/// The notice for fonts a presentation uses that aren't installed, or `None` when all are.
+pub fn missing_fonts_message(fonts: &[String]) -> Option<String> {
+    let names = match fonts {
+        [] => return None,
+        [a] => a.clone(),
+        [a, b] => format!("{a} and {b}"),
+        [a, b, c] => format!("{a}, {b} and {c}"),
+        [a, b, c, rest @ ..] => format!("{a}, {b}, {c} and {} more", rest.len()),
+    };
+    let (it, them) = if fonts.len() == 1 { ("isn't", "it") } else { ("aren't", "them") };
+    Some(format!("{names} {it} installed on this computer. Text that uses {them} is shown in a similar font."))
+}
+
+/// Toast the active presentation's missing fonts, once per opened document.
+pub fn note_missing_fonts(app: &mut SlideApp) {
+    let Some(d) = app.session.active() else { return };
+    if !app.fonts_noted.insert(d.uid) {
+        return;
+    }
+    if let Some(text) = missing_fonts_message(&d.missing_fonts) {
+        app.toast = Some(Toast { text, at: crate::now_ms() });
+    }
+}
+
+pub fn show(app: &mut SlideApp, ctx: &egui::Context) {
+    let Some(toast) = &app.toast else { return };
+    if crate::now_ms() - toast.at > SHOW_MS {
+        app.toast = None;
+        return;
+    }
+    let t = Tokens::get(ctx);
+    let text = toast.text.clone();
+    let mut close = false;
+    egui::Area::new(egui::Id::new("toast")).anchor(Align2::CENTER_BOTTOM, vec2(0.0, -44.0)).order(egui::Order::Foreground).show(ctx, |ui| {
+        egui::Frame::NONE
+            .fill(t.card)
+            .stroke(Stroke::new(1.0, t.card_border))
+            .corner_radius(CornerRadius::same(6))
+            .inner_margin(Margin::symmetric(14, 10))
+            .shadow(egui::epaint::Shadow { offset: [0, 2], blur: 8, spread: 0, color: t.shadow })
+            .show(ui, |ui| {
+                ui.set_max_width(520.0);
+                ui.horizontal(|ui| {
+                    ui.add(egui::Label::new(egui::RichText::new(&text).font(theme::font(13.0)).color(t.text)).wrap());
+                    let (r, resp) = ui.allocate_exact_size(vec2(20.0, 20.0), egui::Sense::click());
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Close"));
+                    if resp.hovered() {
+                        ui.painter().rect_filled(r, CornerRadius::same(4), t.hover);
+                    }
+                    icons::paint(ui.painter(), r.shrink(3.0), Icon::Close, t.text_dim, false);
+                    if resp.on_hover_text("Close").clicked() {
+                        close = true;
+                    }
+                });
+            });
+    });
+    if close {
+        app.toast = None;
+    } else {
+        ctx.request_repaint_after(std::time::Duration::from_millis(500));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_message_names_the_fonts() {
+        let f = |v: &[&str]| missing_fonts_message(&v.iter().map(|s| s.to_string()).collect::<Vec<_>>());
+        assert_eq!(f(&[]), None);
+        assert_eq!(f(&["Aptos"]).unwrap(), "Aptos isn't installed on this computer. Text that uses it is shown in a similar font.");
+        assert!(f(&["Aptos", "Sora"]).unwrap().starts_with("Aptos and Sora aren't installed"));
+        assert!(f(&["A", "B", "C"]).unwrap().starts_with("A, B and C aren't"));
+        assert!(f(&["A", "B", "C", "D", "E"]).unwrap().starts_with("A, B, C and 2 more aren't"));
+    }
+}

docs/architecture.md

@@ -15,7 +15,7 @@ nothing below L6 uses egui, eframe, winit or rfd.
 
 | Layer | Crates | What they do |
 |---|---|---|
-| L0 | `geom`, `color`; standalone `bitstream`, `matroska`, `ogg`, `opus` | EMU/pt units, transforms, ~150 preset shape generators re-derived from ECMA-376, adjust handles, hit testing; RGB/HSL and DrawingML colour transforms; MKV/WebM and Ogg demuxers, the Opus decoder |
+| L0 | `geom`, `color`; standalone `bitstream`, `matroska`, `ogg`, `opus` | EMU/pt units, transforms, ~180 preset shape generators re-derived from ECMA-376, adjust handles, hit testing; RGB/HSL and DrawingML colour transforms; MKV/WebM and Ogg demuxers, the Opus decoder |
 | L1 | `model`, `fonts`; `h264`, `hevc`, `vp9`, `av1`, `isobmff` | Presentation, masters, layouts, slides, shapes, text, themes, tables, charts, transitions, animations, placeholder inheritance (`resolve`); font database (craft-fonts + system) with metric-compatible substitutes for Office fonts (Carlito for Calibri, Caladea for Cambria, Liberation for Arial/Times); video decoders and the MP4/MOV demuxer |
 | L2 | `text`, `anim`, `format`, `media` | Shaping (HarfRust), UAX #9 bidi, UAX #14 line breaking, autofit, caret hit testing; per-shape animation state over time, the show state machine, transition frame layouts, Morph matching; `.deckcraft` (zip + JSON + media) and outline text; media probing, decoding, mixer and clock |
 | L3 | `render`, `pptx` | `vello_cpu` raster of slides, masters and layouts (fills, outlines, effects, pictures, tables, charts, Morph frames); PPTX import/export from ECMA-376 |

docs/file-format-parity.md

@@ -38,7 +38,7 @@ PowerPoint opens and saves; Viewer = opens only).
 |---|---|---|---|
 | PNG, JPEG, GIF (animated), BMP, TIFF, WebP | yes | yes | `image` 0.25; animated GIFs play since #39 |
 | SVG | yes (with PNG fallback) | **no** | The PNG fallback shows; SVG files can't be inserted |
-| EMF / WMF | yes | **no** | Common in decks made on Windows: blank picture |
+| EMF / WMF | yes | partial | Drawn as vectors (paths, pens, bitmaps); text records inside are skipped |
 | HEIC | yes (macOS) | no | |
 | Audio: MP3, AAC/M4A, ALAC, WAV, AIFF, CAF, FLAC, Ogg Vorbis, Opus | yes (Ogg/Opus partly) | yes | Pure-Rust decoders in `crates/media`, `crates/opus` |
 | WMA | yes (Windows) | embedded, not playable | |
@@ -63,7 +63,7 @@ the round trip even though DeckCraft doesn't model it.
 | Themes: colour, font (Latin/EA/CS), effect schemes, background styles | yes | yes | Unknown theme parts kept |
 | Notes slides and notes master | yes | yes | No notes-master editing view |
 | Handout master | no | no | |
-| Shapes: preset geometry (~150 presets), custom geometry, groups, connectors | yes | yes | Presets re-derived in `crates/geom/src/preset.rs` |
+| Shapes: preset geometry (~180 presets), custom geometry, groups, connectors | yes | yes | Presets re-derived in `crates/geom/src/preset.rs` (and `preset/extra.rs`) |
 | Fills: solid, gradient, picture (stretch/tile/crop), pattern, group | yes | yes | |
 | Lines: dash, compound, caps, joins, arrowheads | yes | yes | |
 | Effects: shadow, glow, soft edges, reflection | yes | yes | |
@@ -93,7 +93,7 @@ the round trip even though DeckCraft doesn't model it.
    embedded fonts, every transition and animation) in a corpus repo, with import → render → export
    → re-import checks in CI and a PowerPoint reference render for each (owner runs PowerPoint).
 2. The round-trip losses above (#70, #74, #77).
-3. EMF/WMF and SVG rendering.
+3. SVG rendering, and text inside EMF/WMF.
 
 ## Revision history
 

docs/gaps.md

@@ -20,7 +20,7 @@ revision history.
 | 1 | PPTX never tested against a corpus of real decks | File format | B | 20–35 | [file-format-parity.md](file-format-parity.md) |
 | 2 | Data loss and crashes on common paths (#60, #40, #59) | Stability | B | 6–12 | this file |
 | 3 | PPTX round trip drops comment threads, media options, rewind (#70, #74, #77) | File format | B | 3–6 | [file-format-parity.md](file-format-parity.md) |
-| 4 | EMF/WMF and SVG pictures don't render | File format | B | 8–14 | [file-format-parity.md](file-format-parity.md) |
+| 4 | SVG pictures don't render (EMF/WMF do) | File format | B | 8–14 | [file-format-parity.md](file-format-parity.md) |
 | 5 | No localization: English only | Localization | B (infra + 5 languages) | 55–90 | [localization-parity.md](localization-parity.md) |
 | 6 | No printing | Feature | B | 5–8 | [file-format-parity.md](file-format-parity.md) |
 | 7 | Fonts: only Regular, Bold and Italic faces (#69) | Feature | B | 3–5 | [ui-parity.md](ui-parity.md) |
@@ -75,14 +75,14 @@ Detail in [file-format-parity.md](file-format-parity.md).
 - **Impact:** a deck opened and saved silently loses review state and show behaviour.
 - **Estimate:** 3–6 h. **Beta blocker.**
 
-### EMF/WMF and SVG pictures don't render
+### SVG pictures don't render
 - **Evidence:** `crates/render/src/images.rs` decodes through `image` 0.25 (PNG, JPEG, WebP, GIF,
-  TIFF, BMP); nothing reads EMF, WMF or SVG. Decks from Windows often hold EMF (pasted charts,
-  Visio, logos); PowerPoint's Insert Icons stores SVG with a PNG fallback.
-- **Impact:** blank pictures in real decks; SVG icons show only their raster fallback, and SVG files
-  can't be inserted.
-- **Estimate:** 8–14 h (an SVG renderer through `resvg`-style crates, an EMF/WMF record player for
-  the common records). **Beta blocker** for EMF.
+  TIFF, BMP), and EMF/WMF through `deckcraft-metafile` (ported from WordCraft: paths, fills, pens
+  and bitmaps; text records are skipped). Nothing reads SVG; PowerPoint's Insert Icons stores SVG
+  with a PNG fallback.
+- **Impact:** SVG icons show only their raster fallback, and SVG files can't be inserted. Text
+  drawn inside an EMF/WMF is missing.
+- **Estimate:** 4–8 h (an SVG renderer through `resvg`-style crates); EMF text records 2–4 h.
 
 ### Template, slide-show and macro variants are saved as plain `.pptx`
 - **Evidence:** `crates/pptx/src/write/mod.rs` always writes the

docs/roadmap.md

@@ -16,7 +16,7 @@ points and lead the beta plan.
 | Core workflow | Works end to end? | Evidence | Hours to full pass |
 |---|---|---|---|
 | Build a deck from scratch (theme, layouts, titles and bullets, shapes, pictures from file), save, close and reopen it | yes | Commands for all of it; `.deckcraft` and `.pptx` round-trip tests (`crates/pptx/tests/roundtrip.rs`, `crates/format`); AutoRecover. Close discards edits without asking (#60, PR #75); image *paste* fails on Windows/Linux (#53), though insert-from-file works | 1–3 |
-| Open a colleague's `.pptx`, edit it, save it back as `.pptx` that PowerPoint opens | partial (not blocking) | The reader is lenient and keeps unknown objects. Files open in PowerPoint without repair (checked 2026-10-06). But only generated decks have been tested; EMF/WMF pictures render blank; comment threads, media options and rewind are lost (#70, #74, #77) | 31–55 |
+| Open a colleague's `.pptx`, edit it, save it back as `.pptx` that PowerPoint opens | partial (not blocking) | The reader is lenient and keeps unknown objects. Files open in PowerPoint without repair (checked 2026-10-06). But only generated decks have been tested; text inside EMF/WMF pictures is missing; comment threads, media options and rewind are lost (#70, #74, #77) | 31–55 |
 | Present: full-screen show with transitions, animations, media, presenter view with notes, next slide and timer | yes | 48/48 transitions, 64 effects, triggers, builds, media playback, presenter window. Presenter view isn't placed on the second display automatically (drag it there) | 3–5 |
 | Add business content: tables, charts with their data, simple diagrams | partial (not blocking) | Tables with styles, merge/split, all D or P. Charts insert with the common types and edit data in the Chart Data dialog (P0 partial); SmartArt is basic (pre-drawn shapes) | 12–20 |
 | Share the deck: PDF of slides, notes or handouts; images | yes | `file.export` PDF with text layer, links, bookmarks, handouts 1–9; PNG/JPEG. Artwork is raster in the PDF; no direct print (print the PDF) | 10–16 |

docs/target-app-parity.md

@@ -212,7 +212,7 @@ Carried from the 2026-10-07 ROADMAP status and updated with what has landed sinc
   header/footer fields, embedded media, unlimited undo on shared slide snapshots.
 - **Themes:** 8 original themes with colour and font schemes, custom colours and fonts,
   backgrounds (solid, gradient, picture, pattern), slide size presets.
-- **Shapes:** ~150 preset geometries with adjustment handles, text boxes, pictures (crop,
+- **Shapes:** ~180 preset geometries with adjustment handles, text boxes, pictures (crop,
   corrections, animated GIFs that play and pause), tables with styles, charts (column, bar, line,
   area, pie, doughnut, scatter and more), basic SmartArt, groups, connectors glued to sites,
   freeform/curve/scribble, merge shapes, ink, action buttons, WordArt; flipped shapes keep their

docs/ui-parity.md

@@ -1,6 +1,6 @@
 # UI parity with PowerPoint
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (created; ribbon, menus, panes, dialogs and interaction compared with PowerPoint 16.113 observations in `plan/powerpoint/`) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-12 · **Change:** minor (off-slide objects in Normal view, #270) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 
 How DeckCraft looks and feels next to PowerPoint: the shell, the ribbon, menus, panes, dialogs,
 direct manipulation, keyboard and precision. Observations of PowerPoint are kept locally in
@@ -41,6 +41,7 @@ AGENTS.md §2). Dimension score: **~60% ready** (estimated), **30–50 h** to pa
 |---|---|---|
 | Selection handles, rotation handle, yellow adjustment handles | yes | yes |
 | Marquee, Shift/Cmd multi-select, Tab to cycle | yes | yes |
+| Objects off the slide: drawn on the area around it in Normal view (full strength, master graphics too), selectable and movable there; clipped in the show, exports and thumbnails | yes | yes (#270) |
 | Smart guides (edges, centres, equal spacing) | yes | yes |
 | Snap to grid, grid options, drawing guides | yes | gridlines, guides and snap to grid (engine setting); no Grid Options dialog or menu toggle |
 | Nudge (arrows), fine nudge (Option+arrows) | yes | yes |
@@ -87,4 +88,5 @@ imitate Microsoft's. No pixel comparison against PowerPoint screenshots has been
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-12 | minor | Off-slide objects drawn and editable around the slide in Normal view (#270) |
 | 2026-10-10 | major | Created: shell, panes and dialogs, direct manipulation, shortcuts and visual fidelity against PowerPoint 16.113 |

xtask/src/layers.rs

@@ -47,6 +47,8 @@ pub const TABLE: &[(&str, Class)] = &[
     ("isobmff", Class::Layer(1)),
     ("media", Class::Layer(2)),
     ("color", Class::Layer(0)),
+    // WMF/EMF reader (ported from WordCraft).
+    ("metafile", Class::Layer(0)),
     ("model", Class::Layer(1)),
     ("fonts", Class::Layer(1)),
     ("text", Class::Layer(2)),