TIFF: planar grayscale files with extra channels, and planar CMYK files, open and place

TIFFs that store each channel as its own plane (PlanarConfiguration 2)
did not open, place or relink when they were CMYK or grayscale with
extra channels: the image decoder refuses planar CMYK, and the readers
for CMYK inks and for extra samples returned nothing for planar files.

The two readers now read every plane through the tiff crate and put
each pixel's samples together. A planar CMYK TIFF keeps its ink
amounts and is stored as a CMYK TIFF with each pixel's inks together,
at the file's resolution. Grayscale TIFFs with an alpha channel or
other extra channels, and CMYK TIFFs with alpha, read as their chunky
versions do.

A TIFF whose header claims more strips or tiles than the tiff decoder
can count is refused as too large to draw. The decoder multiplies
those counts without a check, which panics in builds with overflow
checks.

Part of #1466.

Docs: docs/file-format-parity.md, docs/target-app-parity.md.

crates/doc/src/cmyk.rs

@@ -2,10 +2,12 @@
 //!
 //! Two encodings hold them: a four-component JPEG, whose samples are stored inverted with Adobe's
 //! marker (the convention JPEG readers and PDF writers take a CMYK JPEG to follow), and a CMYK
-//! TIFF (8 or 16 bits, chunky, ink amounts as they are). [`ImageBlob::cmyk_tiff`] writes the
-//! latter, Deflate-compressed. Every other image decodes to RGB(A) only.
+//! TIFF (8 or 16 bits, ink amounts as they are, each pixel's inks together or one plane per ink).
+//! [`ImageBlob::cmyk_tiff`] writes the latter, inks together, Deflate-compressed. Every other image
+//! decodes to RGB(A) only.
 
 use std::io::Cursor;
+use std::sync::Arc;
 
 use zune_jpeg::zune_core::bytestream::ZCursor;
 use zune_jpeg::zune_core::colorspace::ColorSpace;
@@ -54,25 +56,136 @@ fn is_tiff(bytes: &[u8]) -> bool {
     bytes.starts_with(b"II*\0") || bytes.starts_with(b"MM\0*")
 }
 
-/// The colour type of TIFF `bytes` and its decoder.
+/// The width and height of the first image of TIFF `bytes` when it has more strips or tiles than
+/// the `tiff` decoder can count: strips per plane times planes past `u32::MAX`, or tiles per plane
+/// times planes past `usize::MAX`. A file that stores one plane per channel (PlanarConfiguration 2)
+/// has a plane for each channel; other files have one. The decoder multiplies these counts without
+/// a check, which panics where overflow checks are on. Such an image, when it is at least a pixel
+/// wide, claims at least 2^32 samples.
+/// Where a tag repeats, the value giving the most strips or tiles counts. `None` for other images
+/// and for bytes that aren't a TIFF.
+pub fn oversized_tiff(bytes: &[u8]) -> Option<(u32, u32)> {
+    let le = bytes.starts_with(b"II*\0");
+    if !le && !bytes.starts_with(b"MM\0*") {
+        return None;
+    }
+    let u16_at = |at: usize| -> Option<u16> {
+        let b: [u8; 2] = bytes.get(at..at.checked_add(2)?)?.try_into().ok()?;
+        Some(if le { u16::from_le_bytes(b) } else { u16::from_be_bytes(b) })
+    };
+    let u32_at = |at: usize| -> Option<u32> {
+        let b: [u8; 4] = bytes.get(at..at.checked_add(4)?)?.try_into().ok()?;
+        Some(if le { u32::from_le_bytes(b) } else { u32::from_be_bytes(b) })
+    };
+    let ifd = usize::try_from(u32_at(4)?).ok()?;
+    // (tag, the entry's single BYTE, SHORT, LONG or IFD value, which sits in the entry, or its
+    // single LONG8 or IFD8 value that fits in 32 bits, which sits where the entry points)
+    let entry = |i: usize| -> Option<(u16, Option<u32>)> {
+        let e = ifd.checked_add(i.checked_mul(12)?.checked_add(2)?)?;
+        let (ty, count, at) = (u16_at(e.checked_add(2)?)?, u32_at(e.checked_add(4)?)?, e.checked_add(8)?);
+        let value = match (ty, count) {
+            (1, 1) => bytes.get(at).map(|&b| u32::from(b)),
+            (3, 1) => u16_at(at).map(u32::from),
+            (4 | 13, 1) => u32_at(at),
+            (16 | 18, 1) => {
+                let at = usize::try_from(u32_at(at)?).ok()?;
+                let (lo, hi) = (u32_at(at)?, u32_at(at.checked_add(4)?)?);
+                let wide = if le { u64::from(hi) << 32 | u64::from(lo) } else { u64::from(lo) << 32 | u64::from(hi) };
+                u32::try_from(wide).ok()
+            }
+            _ => None,
+        };
+        Some((u16_at(e)?, value))
+    };
+    let (mut width, mut height, mut planes, mut planar) = (0u32, 0u32, 1u32, false);
+    let (mut rows, mut tile_w, mut tile_h) = (None::<u32>, None::<u32>, None::<u32>);
+    let least = |was: Option<u32>, v: u32| Some(was.map_or(v, |w| w.min(v)));
+    for i in 0..usize::from(u16_at(ifd)?) {
+        let Some((tag, value)) = entry(i) else { break };
+        let Some(v) = value else { continue };
+        match tag {
+            256 => width = width.max(v),
+            257 => height = height.max(v),
+            277 => planes = planes.max(v),
+            278 => rows = least(rows, v),
+            284 => planar |= v == 2,
+            322 => tile_w = least(tile_w, v),
+            323 => tile_h = least(tile_h, v),
+            _ => {}
+        }
+    }
+    let planes = if planar { u128::from(planes) } else { 1 };
+    let tiles = match (tile_w, tile_h) {
+        (Some(tw @ 1..), Some(th @ 1..)) => u128::from(width.div_ceil(tw)) * u128::from(height.div_ceil(th)) * planes > usize::MAX as u128,
+        _ => false,
+    };
+    let rows = rows.unwrap_or(height);
+    let strips = rows > 0 && u128::from(height.saturating_sub(1) / rows + 1) * planes > u128::from(u32::MAX);
+    (tiles || strips).then_some((width, height))
+}
+
+/// The color type of TIFF `bytes` and its decoder; `None` for [`oversized_tiff`] images too.
 fn tiff(bytes: &[u8]) -> Option<(tiff::ColorType, tiff::decoder::Decoder<Cursor<&[u8]>>)> {
-    if !is_tiff(bytes) {
+    if !is_tiff(bytes) || oversized_tiff(bytes).is_some() {
         return None;
     }
     let mut d = tiff::decoder::Decoder::new(Cursor::new(bytes)).ok()?;
     Some((d.colortype().ok()?, d))
 }
 
+/// Does the TIFF `d` reads store one plane per channel (PlanarConfiguration 2)?
+fn planar(d: &mut tiff::decoder::Decoder<Cursor<&[u8]>>) -> bool {
+    d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1)
+}
+
+/// The samples of the `n` pixels of the TIFF `d` reads, `per` to a pixel (the number its color
+/// type has), pixel by pixel and 8 bits each (16-bit samples to their high byte), whether the file
+/// stores each pixel's samples together or one plane per channel. `None` when they don't decode to
+/// that many samples, which includes images whose planes together need more than the decoder's
+/// limit (256 MB of samples).
+fn read_samples(d: &mut tiff::decoder::Decoder<Cursor<&[u8]>>, n: usize, per: usize) -> Option<Vec<u8>> {
+    let mut buf = tiff::decoder::DecodingResult::U8(Vec::new());
+    let layout = d.read_image_to_buffer(&mut buf).ok()?;
+    let data = match buf {
+        tiff::decoder::DecodingResult::U8(v) => v,
+        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
+        _ => return None,
+    };
+    if Some(data.len()) != n.checked_mul(per) {
+        return None;
+    }
+    if layout.planes <= 1 {
+        return Some(data);
+    }
+    if layout.planes != per {
+        return None;
+    }
+    let planes: Vec<&[u8]> = data.chunks_exact(n).collect();
+    Some((0..n).flat_map(|i| planes.iter().map(move |p| p.get(i).copied().unwrap_or(0))).collect())
+}
+
 impl ImageBlob {
     /// A CMYK TIFF of ink amounts `inks` (Deflate-compressed); `None` when it can't be written.
     pub fn cmyk_tiff(inks: &Inks) -> Option<Self> {
-        use tiff::encoder::{Compression, TiffEncoder, colortype::CMYK8, compression::DeflateLevel};
+        Self::cmyk_tiff_at(inks, None)
+    }
+
+    /// [`ImageBlob::cmyk_tiff`], declaring the resolution `ppi` (horizontal, vertical pixels per
+    /// inch) when it is given and both are finite and above 0.
+    pub fn cmyk_tiff_at(inks: &Inks, ppi: Option<(f64, f64)>) -> Option<Self> {
+        use tiff::encoder::{Compression, Rational, TiffEncoder, colortype::CMYK8, compression::DeflateLevel};
+        use tiff::tags::{ResolutionUnit, Tag};
         let mut out = Cursor::new(Vec::new());
-        TiffEncoder::new(&mut out)
-            .ok()?
-            .with_compression(Compression::Deflate(DeflateLevel::Balanced))
-            .write_image::<CMYK8>(inks.width, inks.height, &inks.data)
-            .ok()?;
+        let mut enc = TiffEncoder::new(&mut out).ok()?.with_compression(Compression::Deflate(DeflateLevel::Balanced));
+        let mut img = enc.new_image::<CMYK8>(inks.width, inks.height).ok()?;
+        if let Some((x, y)) = ppi.filter(|(x, y)| [x, y].iter().all(|v| v.is_finite() && **v > 0.0)) {
+            // Ten-thousandths of a pixel per inch.
+            let r = |v: f64| Rational { n: (v * 10_000.0).round() as u32, d: 10_000 };
+            img.encoder().write_tag(Tag::XResolution, r(x)).ok()?;
+            img.encoder().write_tag(Tag::YResolution, r(y)).ok()?;
+            img.encoder().write_tag(Tag::ResolutionUnit, ResolutionUnit::Inch).ok()?;
+        }
+        img.write_data(&inks.data).ok()?;
         Some(Self::new("image/tiff", out.into_inner()))
     }
 
@@ -119,34 +232,42 @@ fn jpeg_inks(bytes: &[u8]) -> Option<Inks> {
     Inks::new(w, h, data)
 }
 
-/// The ink amounts of a chunky CMYK TIFF (16-bit samples to 8 bits).
+/// The ink amounts of a CMYK TIFF (16-bit samples to 8 bits), its inks stored together or one plane
+/// per ink.
 fn tiff_inks(bytes: &[u8]) -> Option<Inks> {
     let (kind, mut d) = tiff(bytes)?;
     let (w, h) = d.dimensions().ok()?;
-    // Planar samples (one plane per ink) would read as interleaved.
-    let planar = d.find_tag_unsigned::<u16>(tiff::tags::Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
-    if !matches!(kind, tiff::ColorType::CMYK(8 | 16)) || planar || pixels(w, h).is_none() {
+    if !matches!(kind, tiff::ColorType::CMYK(8 | 16)) {
         return None;
     }
-    let data = match d.read_image().ok()? {
-        tiff::decoder::DecodingResult::U8(v) => v,
-        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
-        _ => return None,
-    };
-    Inks::new(w, h, data)
+    let n = usize::try_from(pixels(w, h)?).ok()?;
+    Inks::new(w, h, read_samples(&mut d, n, 4)?)
+}
+
+/// CMYK TIFF `bytes` as Open and Place store them: as they are, or, when they store one plane per
+/// ink, which the image decoder doesn't read, their ink amounts written again by
+/// [`ImageBlob::cmyk_tiff_at`] with the resolution `ppi`. `None` for other images and for CMYK
+/// TIFFs whose inks [`ImageBlob::cmyk`] doesn't read.
+pub fn stored_cmyk_tiff(bytes: &[u8], ppi: Option<(f64, f64)>) -> Option<Vec<u8>> {
+    let inks = tiff_inks(bytes)?;
+    let (_, mut d) = tiff(bytes)?;
+    if !planar(&mut d) {
+        return Some(bytes.to_vec());
+    }
+    ImageBlob::cmyk_tiff_at(&inks, ppi).map(|b| Arc::unwrap_or_clone(b.bytes))
 }
 
 /// A TIFF whose pixels have samples after their colour, which the image decoder doesn't read at
 /// all, as RGBA pixels: CMYK with an alpha channel (5 samples), each colour converted by `rgb` (ink
 /// amounts 0..1 → sRGB 0..1; the inks can't be kept with the transparency, so they show as RGB),
 /// and grayscale with extra samples, of which the first is the alpha when the file says so (other
-/// channels are left out). Associated (premultiplied) alpha is divided back out. `None` for other
-/// images, planar ones and ones larger than [`MAX_CMYK_PIXELS`].
+/// channels are left out). Associated (premultiplied) alpha is divided back out. The samples may be
+/// stored together or one plane per channel. `None` for other images and ones larger than
+/// [`MAX_CMYK_PIXELS`].
 pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3]) -> Option<image::RgbaImage> {
     use tiff::tags::Tag;
     let (kind, mut d) = tiff(bytes)?;
     let (w, h) = d.dimensions().ok()?;
-    let planar = d.find_tag_unsigned::<u16>(Tag::PlanarConfiguration).ok().flatten().is_some_and(|p| p != 1);
     // 0: white is zero, 1: black is zero (the two grayscales).
     let photometric = d.find_tag_unsigned::<u16>(Tag::PhotometricInterpretation).ok().flatten();
     // ExtraSamples 1: associated alpha (premultiplied colour), 2: unassociated alpha, 0: not alpha.
@@ -159,18 +280,8 @@ pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3])
         }
         _ => return None,
     };
-    if planar {
-        return None;
-    }
     let n = usize::try_from(pixels(w, h)?).ok()?;
-    let data: Vec<u8> = match d.read_image().ok()? {
-        tiff::decoder::DecodingResult::U8(v) => v,
-        tiff::decoder::DecodingResult::U16(v) => v.iter().map(|s| (s >> 8) as u8).collect(),
-        _ => return None,
-    };
-    if Some(data.len()) != n.checked_mul(samples) {
-        return None;
-    }
+    let data = read_samples(&mut d, n, samples)?;
     let mut out = Vec::with_capacity(n * 4);
     for p in data.chunks_exact(samples) {
         let opacity = if alpha { p.get(colour).copied().unwrap_or(u8::MAX) } else { u8::MAX };
@@ -246,6 +357,64 @@ mod tests {
         assert_eq!(gray(0), [255, 255, 255, 255, 51, 51, 51, 255, 0, 0, 0, 255], "a channel that isn't alpha: opaque");
     }
 
+    /// A header claiming more tiles than can be counted: (2^32 − 1)² pixels in tiles of one pixel,
+    /// times 2 planes.
+    #[test]
+    fn tiffs_with_more_tiles_than_can_be_counted_are_oversized() {
+        let header = |planar: u32| {
+            let mut f = b"II*\0\x08\0\0\0".to_vec();
+            let entries = [(256u16, u32::MAX), (257, u32::MAX), (258, 8), (262, 1), (277, 2), (284, planar), (322, 1), (323, 1), (324, 0), (325, 0)];
+            f.extend(u16::try_from(entries.len()).unwrap().to_le_bytes());
+            for (tag, v) in entries {
+                f.extend([tag.to_le_bytes(), 4u16.to_le_bytes()].concat());
+                f.extend([1u32.to_le_bytes(), v.to_le_bytes()].concat());
+            }
+            f.extend([0; 4]);
+            f
+        };
+        assert_eq!(oversized_tiff(&header(2)), Some((u32::MAX, u32::MAX)));
+        assert_eq!(oversized_tiff(&header(1)), None, "one plane: (2^32 − 1)² tiles can be counted in 64 bits");
+        assert!(tiff(&header(2)).is_none(), "not decoded");
+    }
+
+    /// A header claiming more strips than can be counted: 2^31 + 1 rows, a strip each, times 2
+    /// planes. The decoder counts strips when the file has strip offsets, tile sizes or not, and
+    /// reads a LONG8 value from where the entry points.
+    #[test]
+    fn tiffs_with_more_strips_than_can_be_counted_are_oversized() {
+        // Each entry holds one value of type 3 (SHORT), 4 (LONG) or 16 (LONG8, after the directory).
+        let header = |entries: &[(u16, u16, u32)]| {
+            let after = 8 + 2 + 12 * entries.len() + 4;
+            let mut f = b"II*\0\x08\0\0\0".to_vec();
+            f.extend(u16::try_from(entries.len()).unwrap().to_le_bytes());
+            let mut wide = vec![];
+            for &(tag, ty, v) in entries {
+                f.extend([tag.to_le_bytes(), ty.to_le_bytes()].concat());
+                f.extend(1u32.to_le_bytes());
+                if ty == 16 {
+                    f.extend(u32::try_from(after + wide.len()).unwrap().to_le_bytes());
+                    wide.extend(u64::from(v).to_le_bytes());
+                } else {
+                    f.extend(v.to_le_bytes());
+                }
+            }
+            f.extend([0; 4]);
+            f.extend(wide);
+            f
+        };
+        let tall = 1u32 << 31 | 1;
+        let strips = [(256, 4, 1), (257, 4, tall), (258, 3, 8), (262, 3, 1), (273, 4, 0), (277, 3, 2), (278, 4, 1), (279, 4, 0), (284, 3, 2)];
+        assert_eq!(oversized_tiff(&header(&strips)), Some((1, tall)));
+        let tile_sizes = [&strips[..], &[(322, 4, u32::MAX), (323, 4, u32::MAX)]].concat();
+        assert_eq!(oversized_tiff(&header(&tile_sizes)), Some((1, tall)), "tile sizes without tile offsets");
+        let mut long8 = strips;
+        long8[1] = (257, 16, tall);
+        assert_eq!(oversized_tiff(&header(&long8)), Some((1, tall)), "ImageLength as a LONG8");
+        for h in [header(&tile_sizes), header(&long8)] {
+            assert!(tiff(&h).is_none(), "not decoded");
+        }
+    }
+
     fn inks() -> Inks {
         Inks::new(3, 2, vec![0, 40, 100, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 0, 0, 0, 0, 255, 12, 34, 56, 78]).unwrap()
     }

crates/engine/src/cmd/fileio/load.rs

@@ -447,18 +447,28 @@ pub(crate) use vectorcraft_doc::MAX_RASTER_ALLOC;
 /// decode, and for bytes that aren't an image.
 pub(crate) fn too_large_note(bytes: &[u8]) -> Option<String> {
     use image::ImageDecoder as _;
+    if let Some((w, h)) = vectorcraft_doc::cmyk::oversized_tiff(bytes) {
+        return Some(format!("an image of {w} × {h} pixels is too large to draw"));
+    }
     let d = image::ImageReader::new(Cursor::new(bytes)).with_guessed_format().ok()?.into_decoder().ok()?;
     let (w, h) = d.dimensions();
     (d.total_bytes() > MAX_RASTER_ALLOC).then(|| format!("an image of {w} × {h} pixels is too large to draw"))
 }
 
 /// Decode an image's header (and, for formats stored as PNG, its pixels). CMYK TIFFs are kept as
-/// they are, with their ink amounts ([`ImageBlob::cmyk`]); CMYK TIFFs with an alpha channel, which
-/// the decoder can't read, become RGBA in the active colour settings' CMYK, as do CMYK Photoshop
-/// documents, whose merged image is read ([`psdread`]). Grayscale TIFFs with an alpha channel or
-/// other extra channels, which the decoder can't read either, become RGBA too.
+/// they are, with their ink amounts ([`ImageBlob::cmyk`]), except that ones storing one plane per
+/// ink are written again with their inks together ([`vectorcraft_doc::cmyk::stored_cmyk_tiff`]);
+/// CMYK TIFFs with an alpha channel, which the decoder can't read, become RGBA in the active color
+/// settings' CMYK, as do CMYK Photoshop documents, whose merged image is read ([`psdread`]).
+/// Grayscale TIFFs with an alpha channel or other extra channels, which the decoder can't read
+/// either, become RGBA too, whether they store their channels together or one plane per channel.
+/// A TIFF with more strips or tiles than the decoder can count
+/// ([`vectorcraft_doc::cmyk::oversized_tiff`]) is refused as too large to draw.
 pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
     let ppi = super::ppi::resolution(bytes);
+    if let Some((w, h)) = vectorcraft_doc::cmyk::oversized_tiff(bytes) {
+        return Err(err(format!("an image of {w} × {h} pixels is too large to draw")));
+    }
     if psdread::is_psd(bytes) {
         let cms = vectorcraft_color::cms::active();
         return as_png(psdread::decode(bytes, MAX_RASTER_ALLOC, |c| cms.cmyk_to_srgb(c, false)).map_err(err)?, ppi);
@@ -469,10 +479,14 @@ pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
     reader.limits(limits);
     let kind = reader.format().ok_or_else(|| err("not an image VectorCraft reads (see document.formats)"))?;
     let f = image_format(kind).ok_or_else(|| err(format!("{kind:?} images can't be opened (see document.formats)")))?;
-    let cmyk = || ImageBlob::new(f.mime, bytes.to_vec()).cmyk().is_some();
-    if matches!(f.id, "png" | "jpg" | "gif" | "webp") || (f.id == "tiff" && cmyk()) {
+    let kept = match f.id {
+        "png" | "jpg" | "gif" | "webp" => Some(bytes.to_vec()),
+        "tiff" => vectorcraft_doc::cmyk::stored_cmyk_tiff(bytes, ppi),
+        _ => None,
+    };
+    if let Some(kept) = kept {
         let (width, height) = reader.into_dimensions().map_err(err)?;
-        return stored(bytes.to_vec(), f.mime, (width, height), ppi);
+        return stored(kept, f.mime, (width, height), ppi);
     }
     let extra_samples = || {
         let cms = vectorcraft_color::cms::active();

crates/engine/src/cmd/fileio/tests.rs

@@ -114,6 +114,100 @@ fn cmyk_tiffs_keep_their_inks_and_other_tiffs_become_png() {
     assert_eq!(rgb.blob.mime, "image/png");
 }
 
+/// A 3 × 2 TIFF at 150 ppi of `channels` (`extra`: their ExtraSamples values), 8 or 16 `bits` a
+/// sample, chunky or `planar`.
+fn hand_tiff(photometric: u16, bits: u16, extra: &[u16], planar: bool, channels: &[Vec<u16>]) -> Vec<u8> {
+    let t = vectorcraft_testkit::tiff::Tiff { width: 3, height: 2, photometric, bits, extra, planar, ppi: Some(150), channels };
+    vectorcraft_testkit::tiff::tiff(&t)
+}
+
+/// What Place keeps of TIFF `bytes`: the ink amounts, when it keeps them, and the pixels any image
+/// reader decodes from the stored image, as RGBA.
+fn kept(what: &str, bytes: &[u8]) -> (Option<Vec<u8>>, Vec<u8>) {
+    let r = raster_image(bytes).unwrap_or_else(|e| panic!("{what}: {e}"));
+    assert_eq!((r.width, r.height, r.ppi), (3, 2, Some((150.0, 150.0))), "{what}");
+    assert_eq!(super::ppi::resolution(&r.blob.bytes), Some((150.0, 150.0)), "{what}: the stored image keeps the resolution");
+    let rgba = image::load_from_memory(&r.blob.bytes).unwrap_or_else(|e| panic!("{what}: {e}")).to_rgba8().into_raw();
+    (r.blob.cmyk().map(|i| i.data), rgba)
+}
+
+/// TIFFs that store one plane per channel (PlanarConfiguration 2) read as their chunky versions do:
+/// grayscale and RGB with extra channels, and CMYK with and without them (#1466).
+#[test]
+fn planar_tiffs_read_as_their_chunky_versions() {
+    let ch = |v: [u16; 6]| v.to_vec();
+    let (gray, alpha, spot) = (ch([0, 51, 102, 153, 204, 255]), ch([255, 128, 0, 255, 64, 255]), ch([9, 8, 7, 6, 5, 4]));
+    let (r, g, b) = (ch([255, 0, 0, 10, 20, 30]), ch([0, 255, 0, 40, 50, 60]), ch([0, 0, 255, 70, 80, 90]));
+    let (c, m, y, k) = (ch([255, 0, 0, 0, 12, 200]), ch([0, 255, 0, 0, 34, 100]), ch([0, 0, 255, 0, 56, 50]), ch([0, 0, 0, 255, 78, 0]));
+    // Pixel by pixel, the samples of `px`.
+    let interleave = |px: &[&Vec<u16>]| -> Vec<u8> { (0..6).flat_map(|i| px.iter().map(move |v| v[i] as u8)).collect() };
+    let opaque = ch([255; 6]);
+    let inks = interleave(&[&c, &m, &y, &k]);
+    // (photometric, ExtraSamples, channels, the RGBA pixels when the color is gray or RGB, the inks when it is CMYK)
+    type Case = (u16, Vec<u16>, Vec<Vec<u16>>, Option<Vec<u8>>, Option<Vec<u8>>);
+    let cases: Vec<Case> = vec![
+        (1, vec![2], vec![gray.clone(), alpha.clone()], Some(interleave(&[&gray, &gray, &gray, &alpha])), None),
+        (1, vec![2, 0], vec![gray.clone(), alpha.clone(), spot.clone()], Some(interleave(&[&gray, &gray, &gray, &alpha])), None),
+        (2, vec![0], vec![r.clone(), g.clone(), b.clone(), spot.clone()], Some(interleave(&[&r, &g, &b, &opaque])), None),
+        (2, vec![2, 0], vec![r.clone(), g.clone(), b.clone(), alpha.clone(), spot.clone()], Some(interleave(&[&r, &g, &b, &alpha])), None),
+        (5, vec![], vec![c.clone(), m.clone(), y.clone(), k.clone()], None, Some(inks.clone())),
+        (5, vec![0], vec![c.clone(), m.clone(), y.clone(), k.clone(), spot.clone()], None, Some(inks.clone())),
+        (5, vec![2], vec![c.clone(), m.clone(), y.clone(), k.clone(), alpha.clone()], None, None),
+    ];
+    for (photometric, extra, channels, want_rgba, want_inks) in cases {
+        for bits in [8, 16] {
+            let wide: Vec<Vec<u16>> = channels.iter().map(|ch| ch.iter().map(|v| if bits == 16 { v * 257 } else { *v }).collect()).collect();
+            let what = format!("photometric {photometric}, extra samples {extra:?}, {bits} bits");
+            let chunky = kept(&format!("{what}, chunky"), &hand_tiff(photometric, bits, &extra, false, &wide));
+            let planar = kept(&format!("{what}, planar"), &hand_tiff(photometric, bits, &extra, true, &wide));
+            assert_eq!(planar.0, chunky.0, "{what}: planar keeps the inks chunky keeps");
+            assert_eq!(planar.0, want_inks, "{what}: the inks");
+            // A 16-bit chunky CMYK file is stored as it is, and a planar one is written again with
+            // its 8-bit inks: their RGB pixels may be a level apart.
+            let close = planar.1.len() == chunky.1.len() && planar.1.iter().zip(&chunky.1).all(|(a, b)| a.abs_diff(*b) <= 1);
+            assert!(close, "{what}: planar reads as chunky: {:?} against {:?}", planar.1, chunky.1);
+            if let Some(want) = &want_rgba {
+                assert_eq!(&planar.1, want, "{what}: the pixels");
+            }
+        }
+    }
+}
+
+/// A planar TIFF whose header claims more strips than the decoder can count (here 2^31 + 1 rows
+/// a strip each, times 5 planes) is refused as too large to draw, without a panic.
+#[test]
+fn planar_tiffs_with_more_strips_than_can_be_counted_are_too_large() {
+    let plane = |v: u16| vec![v; 6];
+    let mut file = hand_tiff(5, 8, &[0], true, &[plane(200), plane(40), plane(10), plane(0), plane(90)]);
+    // ImageLength (the directory's second entry, its value at offset 30) and RowsPerStrip (the
+    // eighth, at offset 102).
+    file[30..34].copy_from_slice(&(1u32 << 31 | 1).to_le_bytes());
+    file[102..106].copy_from_slice(&1u32.to_le_bytes());
+    let e = raster_image(&file).err().expect("refused");
+    assert!(e.to_string().contains("an image of 3 × 2147483649 pixels is too large to draw"), "{e}");
+    assert!(too_large_note(&file).is_some());
+    assert_eq!(vectorcraft_doc::cmyk::oversized_tiff(&file), Some((3, 1 << 31 | 1)));
+}
+
+/// A planar CMYK TIFF opens and places with its ink amounts, stored as a TIFF the image decoder
+/// reads (#1466).
+#[test]
+fn planar_cmyk_tiffs_open_and_place_with_their_inks() {
+    let inks = [vec![255u16, 0, 12, 0, 40, 9], vec![0, 255, 34, 0, 50, 8], vec![0, 0, 56, 0, 60, 7], vec![0, 0, 78, 255, 70, 6]];
+    let file = hand_tiff(5, 8, &[], true, &inks);
+    let want: Vec<u8> = (0..6).flat_map(|i| inks.iter().map(move |v| v[i] as u8)).collect();
+    assert!(image::load_from_memory(&file).is_err(), "the image decoder reads planar CMYK now");
+    let mut s = Session::new();
+    open(&mut s, "planar.tif", &file);
+    let blob = &s.doc().unwrap().doc.images[&image_of(&s).key];
+    assert_eq!(blob.cmyk().map(|i| i.data), Some(want.clone()), "Open keeps the inks");
+    let mut s = session(100.0, 100.0, 1);
+    s.execute("file.place", &json!({"name": "planar.tif", "dataBase64": vectorcraft_format::base64_encode(&file)})).unwrap();
+    let blob = &s.doc().unwrap().doc.images[&image_of(&s).key];
+    assert_eq!(blob.cmyk().map(|i| i.data), Some(want), "Place keeps the inks");
+    assert!(image::load_from_memory(&blob.bytes).is_ok(), "the image decoder reads the stored image");
+}
+
 #[test]
 fn content_beats_a_wrong_extension() {
     let png = image_bytes(2, 2, image::ImageFormat::Png);

crates/engine/tests/import_fuzz.rs

@@ -1303,6 +1303,17 @@ fn raster_samples() -> Vec<(&'static str, Vec<u8>)> {
         out.push((name, b));
     }
     out[0].1 = vectorcraft_engine::cmd::fileio::ppi::with_png_resolution(&out[0].1, (300.0, 150.0));
+    // TIFFs that store one plane per channel: CMYK with a channel after the inks, and gray with
+    // alpha, 16 bits a sample.
+    let plane = |v: u16| vec![v; 15];
+    let cmyk = [plane(200), plane(40), plane(10), plane(0), plane(90)];
+    let cmyk =
+        vectorcraft_testkit::tiff::Tiff { width: 5, height: 3, photometric: 5, bits: 8, extra: &[0], planar: true, ppi: Some(300), channels: &cmyk };
+    out.push(("planar-cmyk.tif", vectorcraft_testkit::tiff::tiff(&cmyk)));
+    let gray = [plane(30_000), plane(65_535)];
+    let gray =
+        vectorcraft_testkit::tiff::Tiff { width: 5, height: 3, photometric: 1, bits: 16, extra: &[2], planar: true, ppi: None, channels: &gray };
+    out.push(("planar-gray.tif", vectorcraft_testkit::tiff::tiff(&gray)));
     // A layered PSD with transparency (as VectorCraft exports it), and a PackBits PSB by hand.
     let mut s = rich_session();
     let r = s.execute("document.export", &json!({"format": "psd", "ppi": 2})).unwrap();
@@ -1325,7 +1336,7 @@ proptest! {
     /// Mutated image headers (resolution metadata, chunk and segment lengths) never crash reading
     /// their resolution or placing them.
     #[test]
-    fn mutated_images_place_without_panics(which in 0usize..6, cut in 0usize..4000, edits in prop::collection::vec((0usize..120, any::<u8>()), 0..12)) {
+    fn mutated_images_place_without_panics(which in 0usize..8, cut in 0usize..4000, edits in prop::collection::vec((0usize..120, any::<u8>()), 0..12)) {
         let (name, mut bytes) = raster_samples().swap_remove(which);
         for (at, b) in edits {
             if let Some(x) = bytes.get_mut(at) {

crates/testkit/src/lib.rs

@@ -12,6 +12,7 @@
 //! - [`pdf`]: hand-written PDF files (page boxes, colour spaces, encryption) for import tests.
 //! - [`ai`]: hand-written Illustrator editing data, and the EPS and `.ai` files that carry it.
 //! - [`ase`]: hand-written swatch exchange (`.ase`) files for swatch library tests.
+//! - [`tiff`]: hand-written TIFF files, chunky or planar, for image import tests.
 //! - [`fonts`]: font files made from the bundled fonts (a renamed family) for font tests.
 //!
 //! This crate may only be used as a dev-dependency (enforced by `cargo xtask layers`).
@@ -30,6 +31,7 @@ pub mod invariants;
 pub mod pdf;
 pub mod raster;
 pub mod strategies;
+pub mod tiff;
 
 pub use serde_json::{Value, json};
 pub use vectorcraft_engine::{Session, doc::NodeId};

crates/testkit/src/tiff.rs

@@ -0,0 +1,116 @@
+//! Hand-written TIFF files for import tests: little-endian, uncompressed, 8 or 16 bits a sample,
+//! with each pixel's samples stored together (chunky) or one plane per sample (planar,
+//! PlanarConfiguration 2) (TIFF 6.0, sections 2 and 8).
+
+/// One image: its channels in the order the file stores them, color first, extra samples after.
+#[derive(Clone, Debug, Default)]
+pub struct Tiff<'a> {
+    pub width: u32,
+    pub height: u32,
+    /// PhotometricInterpretation: 0 white is zero, 1 black is zero, 2 RGB, 5 separated (CMYK).
+    pub photometric: u16,
+    /// Bits a sample: 8 or 16.
+    pub bits: u16,
+    /// The ExtraSamples values, one for each channel after the color (0 not alpha, 1 associated
+    /// alpha, 2 unassociated alpha); none writes no ExtraSamples tag.
+    pub extra: &'a [u16],
+    /// One plane per channel (PlanarConfiguration 2) instead of each pixel's samples together.
+    pub planar: bool,
+    /// Pixels per inch, written as XResolution and YResolution with ResolutionUnit 2.
+    pub ppi: Option<u32>,
+    /// The channels: `width` × `height` samples each, row by row.
+    pub channels: &'a [Vec<u16>],
+}
+
+/// Pads `out` to an even length: TIFF offsets point at word boundaries.
+fn align(out: &mut Vec<u8>) {
+    if out.len() % 2 == 1 {
+        out.push(0);
+    }
+}
+
+/// A directory entry: its tag, field type, count and value bytes.
+type Entry = (u16, u16, usize, Vec<u8>);
+
+/// The TIFF file of `t`: the header, the directory at offset 8, the values longer than four
+/// bytes, then the image in one strip a plane.
+pub fn tiff(t: &Tiff) -> Vec<u8> {
+    let pixels = usize::try_from(t.width * t.height).unwrap();
+    assert!(t.channels.iter().all(|c| c.len() == pixels), "every channel has a sample a pixel");
+    assert!(matches!(t.bits, 8 | 16), "8 or 16 bits a sample");
+    let mut strips: Vec<Vec<u8>> = vec![];
+    let samples_of = |i: usize| t.channels.iter().map(move |c| c[i]);
+    let order: Vec<Vec<u16>> = if t.planar { t.channels.to_vec() } else { vec![(0..pixels).flat_map(samples_of).collect()] };
+    for values in order {
+        strips.push(match t.bits {
+            8 => values.iter().map(|&v| u8::try_from(v).unwrap()).collect(),
+            _ => values.iter().flat_map(|v| v.to_le_bytes()).collect(),
+        });
+    }
+    let samples = u16::try_from(t.channels.len()).unwrap();
+    let counts: Vec<u32> = strips.iter().map(|s| u32::try_from(s.len()).unwrap()).collect();
+    let entries = |offsets: &[u32]| -> Vec<Entry> {
+        let shorts = |tag, v: &[u16]| (tag, 3, v.len(), v.iter().flat_map(|x| x.to_le_bytes()).collect());
+        let longs = |tag, v: &[u32]| (tag, 4, v.len(), v.iter().flat_map(|x| x.to_le_bytes()).collect());
+        let rational = |tag, n: u32| (tag, 5, 1, [n.to_le_bytes(), 1u32.to_le_bytes()].concat());
+        // In ascending tag order.
+        let mut e = vec![
+            longs(256, &[t.width]),
+            longs(257, &[t.height]),
+            shorts(258, &vec![t.bits; usize::from(samples)]),
+            shorts(259, &[1]),
+            shorts(262, &[t.photometric]),
+            longs(273, offsets),
+            shorts(277, &[samples]),
+            longs(278, &[t.height]),
+            longs(279, &counts),
+        ];
+        if let Some(ppi) = t.ppi {
+            e.extend([rational(282, ppi), rational(283, ppi)]);
+        }
+        e.push(shorts(284, &[if t.planar { 2 } else { 1 }]));
+        if t.ppi.is_some() {
+            e.push(shorts(296, &[2]));
+        }
+        if !t.extra.is_empty() {
+            e.push(shorts(338, t.extra));
+        }
+        e
+    };
+    // The strips' offsets follow from the sizes of the rest, which don't depend on them.
+    let padded = |n: usize| n + n % 2;
+    let sized = entries(&vec![0; strips.len()]);
+    let ifd_len = 2 + 12 * sized.len() + 4;
+    let values_len: usize = sized.iter().filter(|e| e.3.len() > 4).map(|e| padded(e.3.len())).sum();
+    let mut at = 8 + ifd_len + values_len;
+    let mut offsets = vec![];
+    for s in &strips {
+        offsets.push(u32::try_from(at).unwrap());
+        at += padded(s.len());
+    }
+    let mut out = b"II*\0\x08\0\0\0".to_vec();
+    let entries = entries(&offsets);
+    out.extend(u16::try_from(entries.len()).unwrap().to_le_bytes());
+    let mut values = vec![];
+    for (tag, ty, count, bytes) in entries {
+        out.extend(tag.to_le_bytes());
+        out.extend(ty.to_le_bytes());
+        out.extend(u32::try_from(count).unwrap().to_le_bytes());
+        if bytes.len() <= 4 {
+            out.extend(&bytes);
+            out.extend(vec![0; 4 - bytes.len()]);
+        } else {
+            out.extend(u32::try_from(8 + ifd_len + values.len()).unwrap().to_le_bytes());
+            values.extend(bytes);
+            align(&mut values);
+        }
+    }
+    out.extend([0; 4]);
+    out.extend(values);
+    for s in strips {
+        out.extend(s);
+        align(&mut out);
+    }
+    assert_eq!(out.len(), at, "the strips sit where the directory says");
+    out
+}

docs/file-format-parity.md

@@ -101,6 +101,7 @@ the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPri
 | EMF / WMF | open, export | yes | yes | an oversized embedded PNG or JPEG is refused from its header, before any pixels are decoded (#1776) |
 | PSD | open, place, export | yes (merged image, every mode and depth) | yes (layered, max editability) | placing as layers (Photoshop Import Options) missing; the embedded ICC profile's tags are 4-byte aligned (#1584) |
 | PSB | open | yes (merged image) | no | |
+| PNG / JPEG / GIF / BMP / TIFF / Targa | open, export | yes (Targa: export only) | yes; TIFF is also selectable in Export for Screens and Asset Export with its existing options | Targa import missing; TIFF: grayscale with an alpha channel or other extra channels reads (#1466 in part), and so do files that store each channel as its own plane (PlanarConfiguration 2), CMYK ones with their ink amounts; CCITT Group 3 doesn't; the ICC profiles embedded in JPEG and TIFF have 4-byte aligned tags (#1584) |
 | PNG / JPEG / GIF / BMP / TIFF / Targa | open, export | yes (Targa: export only) | yes; TIFF is also selectable in Export for Screens and Asset Export with its existing options | Targa import missing; TIFF: grayscale with an alpha channel or other extra channels reads (#1466 in part), CCITT Group 3 and planar files with extra channels don't; the ICC profiles embedded in JPEG and TIFF have 4-byte aligned tags (#1584); PNG export marks its colours as sRGB (`embedIcc`, an `sRGB` chunk; no ICC profile is embedded, #2221) |
 | WebP | export (Export for Screens) | yes | yes (lossless only; lossy written lossless with a warning) | |
 | HEIC / HEIF | open, place | no | no | |

docs/target-app-parity.md

@@ -617,7 +617,8 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
     A PDF page whose `UserUnit` (PDF 1.6) is above 1 opens at its size in points, its numbers times the `UserUnit` (one above 75,000 counts as 75,000), and `document.pdfInfo` gives its size and boxes in points too. A `.ai` whose editing data has its artboards in the units of such a page opens from that data at the page's size, with its layers, and when the layers can't be read its pages still take the artboard layout of the data, scaled the same way (part of #1482).
     PDF export and `.ai` saves write a page with a side longer than 14,400 pt with a `UserUnit` (PDF 1.6), its longer side divided by 14,400 and rounded up to the next thousandth, so that no side is longer than 14,400 units (ISO 32000-1, Annex C.2); in PDF 1.3 to 1.5 files and PDF/X files such a page is written in points.
     Placed (linked) files in a `.ai`'s editing data come in as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (a file found next to the document or at its path is read as the document opens). A file with them no longer falls back to its PDF part, so its guides, sublayers and hidden objects open (#1264; `crates/eps/src/import/ai/tests.rs`, `crates/engine/src/tests_links.rs`). In a file opened that way, a gradient with stops in the middle runs its whole ramp across its shape and a gradient object no longer passes its fill to the next path (#1390); text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line, the frame made taller with a warning in the open result (#1392).
-  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export; grayscale TIFFs with an alpha channel or other extra channels place, relink and open, the alpha as the image's transparency (#1466 in part; CCITT Group 3 and planar files with extra channels are not read); PSD and PSB files open and place, linked or embedded, as their merged image in every colour mode and depth (#918). EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole). PDF export writes type as real, searchable text in embedded subset fonts by default, as Illustrator's PDF presets do (Convert Text to Outlines is an option; printer's marks stay shapes), so text-heavy PDFs stay small (#733). DXF export writes each fill as its outlines followed by its hatch, so laser and cutter software, which skips hatches, gets filled art and type too (#546).
+  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export; grayscale TIFFs with an alpha channel or other extra channels place, relink and open, the alpha as the image's transparency (#1466 in part; CCITT Group 3 files are not read); PSD and PSB files open and place, linked or embedded, as their merged image in every colour mode and depth (#918). EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole). PDF export writes type as real, searchable text in embedded subset fonts by default, as Illustrator's PDF presets do (Convert Text to Outlines is an option; printer's marks stay shapes), so text-heavy PDFs stay small (#733). DXF export writes each fill as its outlines followed by its hatch, so laser and cutter software, which skips hatches, gets filled art and type too (#546).
+  - TIFFs that store each channel as its own plane (PlanarConfiguration 2) place, relink and open as the same image stored pixel by pixel does, 8 and 16 bits: grayscale with an alpha channel or other extra channels, and CMYK with or without them. A planar CMYK TIFF keeps its ink amounts and is stored as a CMYK TIFF with each pixel's inks together, at the file's resolution. A TIFF whose header claims more strips or tiles than can be counted is refused as too large to draw (#1466 in part; `crates/engine/src/cmd/fileio/tests.rs`).
   - EPS and PostScript import keeps a CMYK image's ink amounts, as PDF import does: the samples of `image` and `colorimage` in a CMYK color space, and of a CMYK JPEG read through `DCTDecode`, come in as a CMYK TIFF, read through the image's Decode array, and the pixels a `MaskColor` or `ImageType 3` mask hides become a grayscale opacity mask (`crates/eps/src/import/tests_images.rs`). Such images came in as RGB PNGs.
   - DXF control-point SPLINE import honors its closed flag (#1299 follow-up after #1320 fixed export), including rational curves; open curves whose endpoints meet stay open. Own-fixture regressions cover controls/knots, fit-point fallback and all export versions (`crates/cad/src/import/tests.rs`, `crates/cad/src/tests.rs`); native save/read checked; CIRCLE/ARC fitting, CNC preset and VCarve QA remain pending.
   - Affinity documents in (AF.1–AF.4): `.af` (Affinity 3) and `.afdesign`/`.afphoto`/`.afpub` (Affinity 1 and 2, container versions 8–12) open and place as editable art: layers and sublayers, groups (pass-through or isolated), artboards (with their names and backgrounds) and Publisher pages side by side, curves with live corners, parametric shapes (rectangles with corner radii, ellipses, polygons, stars, pies, triangles, trapezoids), compound shapes, solid/linear/elliptical gradient fills and strokes (weight, dashes, alignment, scale-with-object), clipping by nesting, vector and pixel masks, artistic and frame text with fonts, sizes, tracking, leading and alignment, placed images (their original JPEG/PNG) and pixel layers (8/16-bit RGB, CMYK), opacity, visibility, locking and blend modes, at the document's resolution in points. Effects, adjustments, brushes and pressure profiles, transparency gradients, master pages, symbol instances (imported as their cached picture), special shapes (cloud, heart, cog…, imported as ellipses) and Affinity-only blend modes are named in the import warning. A file whose native data can't be read opens as its embedded preview with the reason, and that preview can't be placed. Save never writes back over the Affinity file and there is no Affinity export. AF.4 adds Affinity 3 artboard recognition and actual-outline clipping, source-backed JPEG/PNG raster tiles, Unicode text-run recovery, stored fallback/exact installed fonts, OpenType feature flags and compound-geometry limits. 51 public CC0/MIT/Apache-2.0 files (33 current `.af`), pinned and sha256-verified (`cargo xtask corpus --affinity`), test native retention and every-board native/SVG/PDF/PSD output for current files; selected files compare their saved thumbnails. No Affinity reopen or independent paired PSD oracle was available; [source audit and complex-font gaps](affinity-validation.md); [scope, provenance and limits](../crates/affinity/README.md).